add some sandboxing code

1 files changed, 110 insertions, 2 deletions

diff --git a/snag/src/build_db.c b/snag/src/build_db.c
index 83bf6d9..54a20cd 100644
--- a/snag/src/build_db.c
+++ b/snag/src/build_db.c
@@ -15,10 +15,115 @@
 #include <sys/stat.h>
 #include <errno.h>
 
+#include "sandboxing.h"
+
 #define API_MESSAGE_NONE      0
 #define API_MESSAGE_FINISHED  1
 #define API_MESSAGE_TEST      2
 
+bool set_child_sandbox(const package_build_t* build) {
+    struct landlock_ruleset_attr ruleset_attr = {
+        .handled_access_fs =
+            LANDLOCK_ACCESS_FS_EXECUTE |
+            LANDLOCK_ACCESS_FS_WRITE_FILE |
+            LANDLOCK_ACCESS_FS_READ_FILE |
+            LANDLOCK_ACCESS_FS_READ_DIR |
+            LANDLOCK_ACCESS_FS_REMOVE_DIR |
+            LANDLOCK_ACCESS_FS_REMOVE_FILE |
+            LANDLOCK_ACCESS_FS_MAKE_CHAR |
+            LANDLOCK_ACCESS_FS_MAKE_DIR |
+            LANDLOCK_ACCESS_FS_MAKE_REG |
+            LANDLOCK_ACCESS_FS_MAKE_SOCK |
+            LANDLOCK_ACCESS_FS_MAKE_FIFO |
+            LANDLOCK_ACCESS_FS_MAKE_BLOCK |
+            LANDLOCK_ACCESS_FS_MAKE_SYM |
+            LANDLOCK_ACCESS_FS_REFER |
+            LANDLOCK_ACCESS_FS_TRUNCATE |
+            LANDLOCK_ACCESS_FS_IOCTL_DEV |
+            LANDLOCK_ACCESS_FS_RESOLVE_UNIX,
+        .handled_access_net =
+            LANDLOCK_ACCESS_NET_BIND_TCP |
+            LANDLOCK_ACCESS_NET_CONNECT_TCP,
+        .scoped =
+            LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET |
+            LANDLOCK_SCOPE_SIGNAL,
+    };
+
+    int landlock_fd = create_new_landlock_ruleset(&ruleset_attr);
+    if (landlock_fd < 0) {
+        return false;
+    }
+
+    struct landlock_path_beneath_attr path_beneath = {
+        .allowed_access =
+            LANDLOCK_ACCESS_FS_EXECUTE |
+            LANDLOCK_ACCESS_FS_WRITE_FILE |
+            LANDLOCK_ACCESS_FS_READ_FILE |
+            LANDLOCK_ACCESS_FS_READ_DIR |
+            LANDLOCK_ACCESS_FS_REMOVE_DIR |
+            LANDLOCK_ACCESS_FS_REMOVE_FILE |
+            LANDLOCK_ACCESS_FS_MAKE_CHAR |
+            LANDLOCK_ACCESS_FS_MAKE_DIR |
+            LANDLOCK_ACCESS_FS_MAKE_REG |
+            LANDLOCK_ACCESS_FS_MAKE_SOCK |
+            LANDLOCK_ACCESS_FS_MAKE_FIFO |
+            LANDLOCK_ACCESS_FS_MAKE_BLOCK |
+            LANDLOCK_ACCESS_FS_MAKE_SYM |
+            LANDLOCK_ACCESS_FS_REFER |
+            LANDLOCK_ACCESS_FS_TRUNCATE |
+            LANDLOCK_ACCESS_FS_IOCTL_DEV |
+            LANDLOCK_ACCESS_FS_RESOLVE_UNIX,
+    };
+    if (!landlock_add_path_rule(landlock_fd, &ruleset_attr, build->source_directory, &path_beneath)) {
+        return false;
+    }
+    path_beneath.allowed_access = LANDLOCK_ACCESS_FS_EXECUTE | LANDLOCK_ACCESS_FS_READ_FILE;
+    if (!landlock_add_path_rule(landlock_fd, &ruleset_attr, cfg.build_package_script, &path_beneath)) {
+        return false;
+    }
+    if (!landlock_add_path_rule(landlock_fd, &ruleset_attr, build->package->script_path, &path_beneath)) {
+        return false;
+    }
+    path_beneath.allowed_access =
+        LANDLOCK_ACCESS_FS_EXECUTE |
+        LANDLOCK_ACCESS_FS_READ_FILE |
+        LANDLOCK_ACCESS_FS_READ_DIR;
+    if (!landlock_add_path_rule(landlock_fd, &ruleset_attr, "/bin", &path_beneath)) {
+        return false;
+    }
+    if (!landlock_add_path_rule(landlock_fd, &ruleset_attr, "/usr/bin", &path_beneath)) {
+        return false;
+    }
+    if (!landlock_add_path_rule(landlock_fd, &ruleset_attr, "/lib64", &path_beneath)) {
+        return false;
+    }
+    if (!landlock_add_path_rule(landlock_fd, &ruleset_attr, "/lib", &path_beneath)) {
+        return false;
+    }
+    // this is just specific to my system - (rjb)
+    if (!landlock_add_path_rule(landlock_fd, &ruleset_attr, "/opt/gnome/lib64/libglib-2.0.so.0", &path_beneath)) {
+        return false;
+    }
+    path_beneath.allowed_access =
+        LANDLOCK_ACCESS_FS_READ_FILE |
+        LANDLOCK_ACCESS_FS_WRITE_FILE |
+        LANDLOCK_ACCESS_FS_MAKE_FIFO |
+        LANDLOCK_ACCESS_FS_READ_DIR;
+    if (!landlock_add_path_rule(landlock_fd, &ruleset_attr, "/tmp", &path_beneath)) {
+        return false;
+    }
+    path_beneath.allowed_access =
+        LANDLOCK_ACCESS_FS_READ_FILE |
+        LANDLOCK_ACCESS_FS_READ_DIR;
+    if (!landlock_add_path_rule(landlock_fd, &ruleset_attr, "/usr", &path_beneath)) {
+        return false;
+    }
+
+    landlock_enforce(landlock_fd);
+
+    return true;
+}
+
 bool package_setup_build(const package_info_t* info, package_build_t* build) {
 
 	// get timestamp string
@@ -78,14 +183,17 @@ void build_run(const package_build_t* build) {
         // close unused api pipes
         close(api_from_sh[0]);
         close(api_to_sh[1]);
-        char buf1[1024];
+        char buf1[12];
         snprintf(buf1, sizeof(buf1), "%d", api_from_sh[1]);
-        char buf2[1024];
+        char buf2[12];
         snprintf(buf2, sizeof(buf2), "%d", api_to_sh[0]);
 		// exec into install script
 		chdir(build->source_directory);
+        set_child_sandbox(build);
         char* argv[] = { cfg.build_package_script, buf1, buf2, build->package->script_path, NULL };
         execv(cfg.build_package_script, argv);
+        int finished = API_MESSAGE_FINISHED;
+        write(api_from_sh[1], &finished, sizeof(finished));
 		// what are you still doing here?
 		die("CHILD - execve to %s failed: %s", cfg.build_package_script, strerror(errno));
     } else {