inside 0.1.0

sandboxer for processes
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137

use landlock::{
    ABI, Access, AccessFs, AccessNet, AddRulesError, BitFlags, CreateRulesetError,
    HandleAccessesError, NetPort, PathBeneath, PathFd, Ruleset, RulesetAttr, RulesetCreated,
    RulesetCreatedAttr, RulesetError, path_beneath_rules,
};

use crate::{FilePermissions, NetworkPermissions};

pub struct InsideRuleset {
    abi: ABI,
    ruleset: RulesetCreated,
}

impl InsideRuleset {
    pub fn try_new(abi: ABI) -> Result<Self, NewInsideRulesetError> {
        match Ruleset::default().handle_access(AccessFs::from_all(abi)) {
            Ok(ruleset) => match ruleset.handle_access(AccessNet::from_all(abi)) {
                Ok(ruleset) => match ruleset.create() {
                    Ok(ruleset) => Ok(InsideRuleset { abi, ruleset }),
                    Err(RulesetError::CreateRuleset(e)) => Err(e.into()),
                    Err(_) => unreachable!(),
                },
                Err(RulesetError::HandleAccesses(e)) => Err(e.into()),
                Err(_) => unreachable!(),
            },
            Err(RulesetError::HandleAccesses(e)) => Err(e.into()),
            Err(_) => unreachable!(),
        }
    }
    pub fn allow_file(
        mut self,
        path: AllowPath,
        permissions: FilePermissions,
    ) -> Result<Self, AddRulesError> {
        let access_fs = if let Some(access_fs) = self.access_fs(permissions) {
            access_fs
        } else {
            return Ok(self);
        };
        let ruleset = self
            .ruleset
            .add_rule(PathBeneath::new(path.0, access_fs))
            .map_err(|e| match e {
                RulesetError::AddRules(e) => e,
                _ => unreachable!(),
            })?;
        self.ruleset = ruleset;
        Ok(self)
    }
    pub fn allow_files<T: AsRef<std::path::Path>>(
        mut self,
        paths: impl Iterator<Item = T>,
        permissions: FilePermissions,
    ) -> Result<Self, AddRulesError> {
        let access_fs = if let Some(access_fs) = self.access_fs(permissions) {
            access_fs
        } else {
            return Ok(self);
        };
        self.ruleset = self
            .ruleset
            .add_rules(path_beneath_rules(paths, access_fs))
            .map_err(|e| match e {
                RulesetError::AddRules(e) => e,
                _ => unreachable!(),
            })?;
        Ok(self)
    }
    pub fn allow_port(
        mut self,
        port: u16,
        network_permissions: NetworkPermissions,
    ) -> Result<Self, AddRulesError> {
        let access_net = if let Some(network_permissions) = self.access_net(network_permissions) {
            network_permissions
        } else {
            return Ok(self);
        };
        self.ruleset = self
            .ruleset
            .add_rule(NetPort::new(port, access_net))
            .map_err(|e| match e {
                RulesetError::AddRules(e) => e,
                _ => unreachable!(),
            })?;
        Ok(self)
    }
    pub fn restrict(self) -> Result<landlock::RestrictionStatus, RulesetError> {
        self.ruleset.restrict_self()
    }
    fn access_fs(&self, file_permissions: FilePermissions) -> Option<BitFlags<AccessFs, u64>> {
        let access_fs = match file_permissions {
            FilePermissions::NONE => {
                return None;
            }
            FilePermissions::READ => AccessFs::from_read(self.abi),
            FilePermissions::WRITE => AccessFs::from_write(self.abi),
            FilePermissions::EXECUTE => AccessFs::Execute.into(),
            FilePermissions::READ_WRITE => AccessFs::from_all(self.abi),
            FilePermissions::READ_EXECUTE => AccessFs::from_read(self.abi) | AccessFs::Execute,
            FilePermissions::WRITE_EXECUTE => AccessFs::from_write(self.abi) | AccessFs::Execute,
            FilePermissions::ALL => AccessFs::from_all(self.abi) | AccessFs::Execute,
            _ => unreachable!(),
        };
        Some(access_fs)
    }
    fn access_net(
        &self,
        network_permissions: NetworkPermissions,
    ) -> Option<BitFlags<AccessNet, u64>> {
        let access_net = match network_permissions {
            NetworkPermissions::NONE => return None,
            NetworkPermissions::CONNECT_TCP => AccessNet::ConnectTcp.into(),
            NetworkPermissions::BIND_TCP => AccessNet::BindTcp.into(),
            NetworkPermissions::ALL => AccessNet::from_all(self.abi),
            _ => unreachable!(),
        };
        Some(access_net)
    }
}

#[derive(thiserror::Error, Debug)]
pub enum NewInsideRulesetError {
    #[error(transparent)]
    HandleAccess(#[from] HandleAccessesError),
    #[error(transparent)]
    CreateRuleset(#[from] CreateRulesetError),
}

#[derive(Debug)]
pub struct AllowPath(PathFd);
impl AllowPath {
    pub fn try_new(path: impl AsRef<std::path::Path>) -> Result<Self, landlock::PathFdError> {
        let path = PathFd::new(path)?;
        Ok(AllowPath(path))
    }
}