landlock 0.2.1.0 → 0.2.1.1
raw patch · 6 files changed
+181/−103 lines, 6 filesdep ~basePVP ok
version bump matches the API change (PVP)
Dependency ranges changed: base
API changes (from Hackage documentation)
Files
- CHANGELOG.md +4/−0
- internal/System/Landlock/Flags.hs +69/−32
- internal/System/Landlock/OpenPath.hs +26/−16
- internal/System/Landlock/Rules.hs +7/−5
- landlock.cabal +10/−9
- src/System/Landlock.hs +65/−41
CHANGELOG.md view
@@ -1,5 +1,9 @@ # Revision history for landlock +## 0.2.1.1 -- 2023-02-28++* Extend API documentation with links to man-pages.+ ## 0.2.1.0 -- 2023-02-22 * Use vendored `linux/landlock.h` instead of system-provided header during
internal/System/Landlock/Flags.hs view
@@ -83,38 +83,63 @@ -- - 'AccessFsRefer' -- -- __Warning:__ It is currently not possible to restrict some file-related--- actions acessible through these syscall families: @chdir@,--- @stat@, @flock@, @chmod@, @chown@, @setxattr@, @utime@, @ioctl@, @fcntl@,--- @access@. Future Landlock evolutions will enable to restrict them.+-- actions acessible through these syscall families:+-- [@chdir@](https://man.archlinux.org/man/chdir.2),+-- [@stat@](https://man.archlinux.org/man/stat.2),+-- [@flock@](https://man.archlinux.org/man/flock.2),+-- [@chmod@](https://man.archlinux.org/man/chmod.2),+-- [@chown@](https://man.archlinux.org/man/chown.2),+-- [@setxattr@](https://man.archlinux.org/man/setxattr.2),+-- [@utime@](https://man.archlinux.org/man/utime.2),+-- [@ioctl@](https://man.archlinux.org/man/ioctl.2),+-- [@fcntl@](https://man.archlinux.org/man/fcntl.2),+-- [@access@](https://man.archlinux.org/man/access.2).+-- Future Landlock evolutions will enable to restrict them. data AccessFsFlag- = -- | Execute a file.+ = -- | Execute a file+ -- ([@LANDLOCK_ACCESS_FS_EXECUTE@](https://man.archlinux.org/man/landlock.7.en#LANDLOCK_ACCESS_FS_EXECUTE)). AccessFsExecute- | -- | Open a file with write access.+ | -- | Open a file with write access+ -- ([@LANDLOCK_ACCESS_FS_WRITE_FILE@](https://man.archlinux.org/man/landlock.7.en#LANDLOCK_ACCESS_FS_WRITE_FILE)).+ --+ -- Note that you might additionally need the @LANDLOCK_ACCESS_FS_TRUNCATE@+ -- right in order to overwrite files with+ -- [@open@](https://man.archlinux.org/man/open.2) using+ -- [@O_TRUNC@](https://man.archlinux.org/man/open.2#O_TRUNC) or+ -- [@creat@](https://man.archlinux.org/man/creat.2). AccessFsWriteFile- | -- | Open a file with read access. Note that- -- you might additionally need the @LANDLOCK_ACCESS_FS_TRUNCATE@ right in order- -- to overwrite files with @open@ using @O_TRUNC@ or- -- @creat@.+ | -- | Open a file with read access+ -- ([@LANDLOCK_ACCESS_FS_READ_FILE@](https://man.archlinux.org/man/landlock.7.en#LANDLOCK_ACCESS_FS_READ_FILE)). AccessFsReadFile- | -- | Open a directory or list its content.+ | -- | Open a directory or list its content+ -- ([@LANDLOCK_ACCESS_FS_READ_DIR@](https://man.archlinux.org/man/landlock.7.en#LANDLOCK_ACCESS_FS_READ_DIR)). AccessFsReadDir | -- | Remove an empty directory or rename one+ -- ([@LANDLOCK_ACCESS_FS_REMOVE_DIR@](https://man.archlinux.org/man/landlock.7.en#LANDLOCK_ACCESS_FS_REMOVE_DIR)). AccessFsRemoveDir- | -- | Unlink (or rename) a file.+ | -- | Unlink (or rename) a file+ -- ([@LANDLOCK_ACCESS_FS_REMOVE_FILE@](https://man.archlinux.org/man/landlock.7.en#LANDLOCK_ACCESS_FS_REMOVE_FILE)). AccessFsRemoveFile- | -- | Create (or rename or link) a character device.+ | -- | Create (or rename or link) a character device+ -- ([@LANDLOCK_ACCESS_FS_MAKE_CHAR@](https://man.archlinux.org/man/landlock.7.en#LANDLOCK_ACCESS_FS_MAKE_CHAR)). AccessFsMakeChar- | -- | Create (or rename) a directory.+ | -- | Create (or rename) a directory+ -- ([@LANDLOCK_ACCESS_FS_MAKE_DIR@](https://man.archlinux.org/man/landlock.7.en#LANDLOCK_ACCESS_FS_MAKE_DIR)). AccessFsMakeDir- | -- | Create (or rename or link) a regular file.+ | -- | Create (or rename or link) a regular file+ -- ([@LANDLOCK_ACCESS_FS_MAKE_REG@](https://man.archlinux.org/man/landlock.7.en#LANDLOCK_ACCESS_FS_MAKE_REG)). AccessFsMakeReg- | -- | Create (or rename or link) a UNIX domain socket.+ | -- | Create (or rename or link) a UNIX domain socket+ -- ([@LANDLOCK_ACCESS_FS_MAKE_SOCK@](https://man.archlinux.org/man/landlock.7.en#LANDLOCK_ACCESS_FS_MAKE_SOCK)). AccessFsMakeSock- | -- | Create (or rename or link) a named pipe.+ | -- | Create (or rename or link) a named pipe+ -- ([@LANDLOCK_ACCESS_FS_MAKE_FIFO@](https://man.archlinux.org/man/landlock.7.en#LANDLOCK_ACCESS_FS_MAKE_FIFO)). AccessFsMakeFifo- | -- | Create (or rename or link) a block device.+ | -- | Create (or rename or link) a block device+ -- ([@LANDLOCK_ACCESS_FS_MAKE_BLOCK@](https://man.archlinux.org/man/landlock.7.en#LANDLOCK_ACCESS_FS_MAKE_BLOCK)). AccessFsMakeBlock- | -- | Create (or rename or link) a symbolic link.+ | -- | Create (or rename or link) a symbolic link+ -- ([@LANDLOCK_ACCESS_FS_MAKE_SYM@](https://man.archlinux.org/man/landlock.7.en#LANDLOCK_ACCESS_FS_MAKE_SYM)). AccessFsMakeSym | -- | Link or rename a file from or to a different -- directory (i.e. reparent a file hierarchy). This access right is@@ -125,22 +150,34 @@ -- access right. When linking or renaming a file, the destination directory -- hierarchy must also always have the same or a superset of restrictions of -- the source hierarchy. If it is not the case, or if the domain doesn't- -- handle this access right, such actions are denied by default with @errno@- -- set to @EXDEV@. Linking also requires a @LANDLOCK_ACCESS_FS_MAKE_*@ access- -- right on the destination directory, and renaming also requires a+ -- handle this access right, such actions are denied by default with+ -- [@errno@](https://man.archlinux.org/man/errno.3)+ -- set to [@EXDEV@](https://man.archlinux.org/man/errno.3#EXDEV). Linking+ -- also requires a @LANDLOCK_ACCESS_FS_MAKE_*@ access right on the+ -- destination directory, and renaming also requires a -- @LANDLOCK_ACCESS_FS_REMOVE_*@ access right on the source's (file or- -- directory) parent. Otherwise, such actions are denied with @errno@ set to- -- @EACCES@. The @EACCES@ @errno@ prevails over @EXDEV@ to let user space- -- efficiently deal with an unrecoverable error.+ -- directory) parent. Otherwise, such actions are denied with+ -- [@errno@](https://man.archlinux.org/man/errno.3) set to+ -- [@EACCES@](https://man.archlinux.org/man/errno.3#EACCES).+ -- The [@EACCES@](https://man.archlinux.org/man/errno.3#EACCES)+ -- [@errno@](https://man.archlinux.org/man/errno.3) prevails over+ -- [@EXDEV@](https://man.archlinux.org/man/errno.3#EXDEV) to let user+ -- space efficiently deal with an unrecoverable error. AccessFsRefer- | -- | Truncate a file with @truncate@,- -- @ftruncate@, @creat@, or @open@ with- -- @O_TRUNC@. Whether an opened file can be truncated with- -- @ftruncate@ is determined during @open@, in the- -- same way as read and write permissions are checked during- -- @open@ using @LANDLOCK_ACCESS_FS_READ_FILE@ and- -- @LANDLOCK_ACCESS_FS_WRITE_FILE@. This access right is available since the- -- third version of the Landlock ABI.+ | -- | Truncate a file with+ -- [@truncate@](https://man.archlinux.org/man/truncate.2),+ -- [@ftruncate@](https://man.archlinux.org/man/ftruncate.2),+ -- [@creat@](https://man.archlinux.org/man/creat.2), or+ -- [@open@](https://man.archlinux.org/man/open.2) with+ -- [@O_TRUNC@](https://man.archlinux.org/man/open.2#O_TRUNC). Whether an+ -- opened file can be truncated with+ -- [@ftruncate@](https://man.archlinux.org/man/ftruncate.2) is determined+ -- during @open@, in the same way as read and write permissions are checked+ -- during [@open@](https://man.archlinux.org/man/open.2) using+ -- [@LANDLOCK_ACCESS_FS_READ_FILE@](https://man.archlinux.org/man/landlock.7.en#LANDLOCK_ACCESS_FS_READ_FILE)+ -- and+ -- [@LANDLOCK_ACCESS_FS_WRITE_FILE@](https://man.archlinux.org/man/landlock.7.en#LANDLOCK_ACCESS_FS_WRITE_FILE).+ -- This access right is available since the third version of the Landlock ABI. AccessFsTruncate -- Note: when adding new flags, this likely means a new ABI version is -- available. Hence, add this to 'System.Landlock.Version' (and export it
internal/System/Landlock/OpenPath.hs view
@@ -41,13 +41,14 @@ throwErrnoPathIfMinus1Retry "openat" pathname $ fromIntegral <$> _openat (fromIntegral dirfd) pathnamep flags --- | Extra flags used by 'withOpenPathAt' in the call to @openat@.+-- | Extra flags used by 'withOpenPathAt' in the call to+-- [@openat@](https://man.archlinux.org/man/openat.2). data OpenPathFlags = OpenPathFlags- { -- | Set @O_DIRECTORY@.+ { -- | Set [@O_DIRECTORY@](https://man.archlinux.org/man/openat.2#O_DIRECTORY). directory :: Bool,- -- | Set @O_NOFOLLOW@.+ -- | Set [@O_NOFOLLOW@](https://man.archlinux.org/man/openat.2#O_NOFOLLOW). nofollow :: Bool,- -- | Set @O_CLOEXEC@.+ -- | Set [@O_CLOEXEC@](https://man.archlinux.org/man/openat.2#O_CLOEXEC). cloexec :: Bool } deriving (Show, Eq)@@ -65,14 +66,16 @@ cloexec = True } --- | Perform an action with a path @open@ed using @O_PATH@.+-- | Perform an action with a path opened using+-- [@O_PATH@](https://man.archlinux.org/man/openat.2#O_PATH). ----- The file descriptor provided to the action will be @close@d when the--- function returns.+-- The file descriptor provided to the action will be+-- [@close@](https://man.archlinux.org/man/close.2)d when the function returns. ----- This internally calls @openat@ with @AT_FDCWD@ and the @O_PATH@ and--- @O_RDONLY@ flags set, next to any flags specified in the 'OpenPathFlags'--- argument.+-- This internally calls [@openat@](https://man.archlinux.org/man/openat.2) with+-- @AT_FDCWD@ and the [@O_PATH@](https://man.archlinux.org/man/openat.2#O_PATH)+-- and [@O_RDONLY@](https://man.archlinux.org/man/open.2#File_access_mode) flags+-- set, next to any flags specified in the 'OpenPathFlags' argument. withOpenPath :: (MonadIO m, MonadMask m) => -- | Path to open.@@ -85,18 +88,25 @@ m a withOpenPath = withOpenPathAt (fromIntegral aT_FDCWD) --- | Perform an action with a path @openat@ed using @O_PATH@.+-- | Perform an action with a path+-- [@openat@](https://man.archlinux.org/man/openat.2)ed using+-- [@O_PATH@](https://man.archlinux.org/man/openat.2#O_PATH). ----- Like 'withOpenPath', exposing the @openat@ @dirfd@ argument.+-- Like 'withOpenPath', exposing the+-- [@openat@](https://man.archlinux.org/man/openat.2#O_PATH) @dirfd@ argument. ----- The file descriptor provided to the action will be @close@d when the+-- The file descriptor provided to the action will be+-- [@close@](https://man.archlinux.org/man/close.2)d when the -- function returns. ----- This internally calls @openat@ with the @O_PATH@ and @O_RDONLY@ flags set,--- next to any flags specified in the 'OpenPathFlags' argument.+-- This internally calls+-- [@openat@](https://man.archlinux.org/man/openat.2) with the+-- [@O_PATH@](https://man.archlinux.org/man/openat.2#O_PATH) and+-- [@O_RDONLY@](https://man.archlinux.org/man/openat.2#File_access_mode) flags+-- set, next to any flags specified in the 'OpenPathFlags' argument. withOpenPathAt :: (MonadIO m, MonadMask m) =>- -- | @dirfd@ argument to @openat@.+ -- | @dirfd@ argument to [@openat@](https://man.archlinux.org/man/openat.2). Fd -> -- | Path to open. FilePath ->
internal/System/Landlock/Rules.hs view
@@ -69,12 +69,14 @@ -- | Construct a path hierarchy rule definition. ----- This corresponds to a rule of type @LANDLOCK_RULE_PATH_BENEATH@, with--- attributes defined in a @struct landlock_path_beneath_attr@.+-- This corresponds to a rule of type+-- [@LANDLOCK_RULE_PATH_BENEATH@](https://man.archlinux.org/man/landlock_add_rule.2.en#LANDLOCK_RULE_PATH_BENEATH),+-- with attributes defined in a @struct landlock_path_beneath_attr@. pathBeneath ::- -- | File descriptor, preferably opened with @O_PATH@, which- -- identifies the parent directory of a file hierarchy, or- -- just a file.+ -- | File descriptor, preferably opened with+ -- [@O_PATH@](https://man.archlinux.org/man/open.2#O_PATH), which+ -- identifies the parent directory of a file hierarchy, or+ -- just a file. Fd -> -- | Allowed actions for this file hierarchy -- (cf. 'AccessFsFlag').
landlock.cabal view
@@ -1,7 +1,7 @@ cabal-version: 2.2 build-type: Simple name: landlock-version: 0.2.1.0+version: 0.2.1.1 synopsis: Haskell bindings for the Linux Landlock API description: This library exposes Haskell bindings for the Linux kernel Landlock API.@@ -37,7 +37,8 @@ cbits/hs-landlock.h cbits/linux/landlock.h -tested-with: GHC ==8.10.7 || ==9.0.2 || ==9.2.4 || ==9.4.2+tested-with:+ GHC ==8.10.7 || ==9.0.2 || ==9.2.4 || ==9.4.2 || ==9.6.1 source-repository head type: git@@ -76,7 +77,7 @@ import: common-settings exposed-modules: System.Landlock build-depends:- , base >=4.14.2.0 && <4.17 || ^>=4.17+ , base >=4.14.2.0 && <4.18 , exceptions ^>=0.10.4 , landlock-internal , unix >=2.7.2.2 && <2.8 || ^>=2.8@@ -99,7 +100,7 @@ include-dirs: cbits c-sources: cbits/hs-landlock.c build-depends:- , base >=4.14.2.0 && <4.17 || ^>=4.17+ , base >=4.14.2.0 && <4.18 , exceptions ^>=0.10.4 , psx ^>=0.1 , unix >=2.7.2.2 && <2.8 || ^>=2.8@@ -128,7 +129,7 @@ autogen-modules: Paths_landlock hs-source-dirs: bin build-depends:- , base >=4.14.2.0 && <4.17 || ^>=4.17+ , base >=4.14.2.0 && <4.18 , exceptions ^>=0.10.4 , landlock , optparse-applicative >=0.16.1.0 && <0.17 || ^>=0.17@@ -142,7 +143,7 @@ other-modules: ThreadedScenario build-depends: , async ^>=2.2.3- , base >=4.14.2.0 && <4.17 || ^>=4.17+ , base >=4.14.2.0 && <4.18 , filepath ^>=1.4.2.1 , landlock , landlock-internal@@ -168,7 +169,7 @@ other-modules: ThreadedScenario build-depends: , async ^>=2.2.3- , base >=4.14.2.0 && <4.17 || ^>=4.17+ , base >=4.14.2.0 && <4.18 , landlock , tasty ^>=1.4.1 , tasty-hunit ^>=0.10.0.3@@ -183,7 +184,7 @@ other-modules: ReadmeUtils hs-source-dirs: . test build-depends:- , base >=4.14.2.0 && <4.17 || ^>=4.17+ , base >=4.14.2.0 && <4.18 , directory ^>=1.3.6.0 , filepath ^>=1.4.2.1 , landlock@@ -203,7 +204,7 @@ hs-source-dirs: test main-is: landlocked-test.hs build-depends:- , base >=4.14.2.0 && <4.17 || ^>=4.17+ , base >=4.14.2.0 && <4.18 , filepath ^>=1.4.2.1 , process ^>=1.6.9.0 , tasty ^>=1.4.1
src/System/Landlock.hs view
@@ -21,13 +21,12 @@ -- behaviors in user space applications. Landlock empowers any process, -- including unprivileged ones, to securely restrict themselves. ----- For more information, see the [Landlock homepage](https://landlock.io/) and its--- [kernel documentation](https://docs.kernel.org/userspace-api/landlock.html).+-- For more information, see the [Landlock homepage](https://landlock.io/), its+-- [kernel documentation](https://docs.kernel.org/userspace-api/landlock.html)+-- and its [manual page](https://man.archlinux.org/man/landlock.7.en). module System.Landlock ( -- * Core API - --- -- | Use 'landlock' to sandbox a process. -- $example landlock,@@ -35,8 +34,6 @@ -- ** Filesystem Access Flags - --- -- | Filesystem access flags to sandbox filesystem access. AccessFsFlag (..), accessFsFlags,@@ -44,23 +41,17 @@ -- * Sandboxing Rules - --- -- | Sandboxing rules to apply. Rule, pathBeneath, -- * Utility Functions - --- -- | Various utility functions. isSupported, -- ** Landlock ABI Version - --- -- | Retrieve and handle the kernel's Landlock ABI version. abiVersion, Version,@@ -71,11 +62,10 @@ -- ** Opening paths using @O_PATH@ - --- -- | When creating a 'pathBeneath' rule, a file descriptor to a directory- -- or file is needed. These can be safely @open@ed using the @O_PATH@ flag- -- using the following functions.+ -- or file is needed. These can be safely opened using the+ -- [@O_PATH@](https://man.archlinux.org/man/openat.2#O_PATH) flag using the+ -- following functions. withOpenPath, withOpenPathAt, OpenPathFlags (..),@@ -105,7 +95,12 @@ restrictSelfFlagToBit, toBits, )-import System.Landlock.OpenPath (OpenPathFlags (..), defaultOpenPathFlags, withOpenPath, withOpenPathAt)+import System.Landlock.OpenPath+ ( OpenPathFlags (..),+ defaultOpenPathFlags,+ withOpenPath,+ withOpenPathAt,+ ) import System.Landlock.Rules (Rule, pathBeneath, ruleType) import System.Landlock.Syscalls ( LandlockRulesetAttr (..),@@ -122,6 +117,12 @@ -- | Retrieve the Landlock ABI version of the running system. --+-- This invokes+-- [@landlock_create_ruleset@](https://man.archlinux.org/man/landlock_create_ruleset.2.en)+-- with the+-- [@LANDLOCK_CREATE_RULESET_VERSION@](https://man.archlinux.org/man/landlock_create_ruleset.2.en#LANDLOCK_CREATE_RULESET_VERSION)+-- option.+-- -- __Warning:__ calling this on a system without Landlock support, or with -- Landlock disabled, will result in an exception. abiVersion :: IO Version@@ -130,26 +131,31 @@ flags = toBits createRulesetFlagToBit [CreateRulesetVersion] -- | Check whether Landlock is supported and enabled on the running system.+--+-- This calls 'abiVersion', catching relevant exceptions to return 'False' when+-- applicable. isSupported :: IO Bool isSupported = handleJust unsupportedOperation (\() -> return False) $ do void abiVersion return True where- unsupportedOperation exc = if isUnsupportedOperationError exc then Just () else Nothing- isUnsupportedOperationError = isUnsupportedOperationErrorType . ioeGetErrorType+ unsupportedOperation exc =+ if isUnsupportedOperationError exc then Just () else Nothing+ isUnsupportedOperationError =+ isUnsupportedOperationErrorType . ioeGetErrorType isUnsupportedOperationErrorType = (== UnsupportedOperation) -- | Ruleset attributes. -- -- This represents a @struct landlock_ruleset_attr@ as passed to--- @landlock_create_ruleset@.+-- [@landlock_create_ruleset@](https://man.archlinux.org/man/landlock_create_ruleset.2.en). {- HLINT ignore "Use newtype instead of data" -} data RulesetAttr = RulesetAttr { -- | Actions (cf. 'AccessFsFlag') that ought to -- be handled by a ruleset and should be -- forbidden if no rule explicitly allow them.- -- This is needed forbackward compatibility+ -- This is needed for backward compatibility -- reasons. rulesetAttrHandledAccessFs :: [AccessFsFlag] }@@ -160,10 +166,14 @@ deriving (Show, Eq) createRuleset :: RulesetAttr -> [CreateRulesetFlag] -> IO LandlockFd-createRuleset attr flags = with attr' $ \attrp -> wrap <$> landlock_create_ruleset attrp (fromIntegral $ sizeOf attr') flags'+createRuleset attr flags = with attr' $ \attrp ->+ wrap <$> landlock_create_ruleset attrp (fromIntegral $ sizeOf attr') flags' where wrap = LandlockFd . fromIntegral- attr' = LandlockRulesetAttr {landlockRulesetAttrHandledAccessFs = handledAccessFs}+ attr' =+ LandlockRulesetAttr+ { landlockRulesetAttrHandledAccessFs = handledAccessFs+ } handledAccessFs = toBits accessFsFlagToBit (rulesetAttrHandledAccessFs attr) flags' = toBits createRulesetFlagToBit flags @@ -179,38 +189,48 @@ -- instance (see 'addRule'). -- -- Once this returns, the Landlock sandbox will be in effect (see--- @landlock_restrict_self@), and no privileged processes can be spawned--- (@prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)@ has been invoked).+-- [@landlock_restrict_self@](https://man.archlinux.org/man/landlock_restrict_self.2.en)),+-- and no privileged processes can be spawned+-- (@[prctl](https://man.archlinux.org/man/prctl.2)([PR_SET_NO_NEW_PRIVS](https://man.archlinux.org/man/prctl.2#PR_SET_NO_NEW_PRIVS), 1, 0, 0, 0)@+-- has been invoked). -- -- __Warning:__ calling this on a system without Landlock support, or with -- Landlock disabled, will result in an exception. landlock :: (MonadMask m, MonadIO m) =>- -- | Ruleset attribute passed to @landlock_create_ruleset@.+ -- | Ruleset attribute passed to+ -- [@landlock_create_ruleset@](https://man.archlinux.org/man/landlock_create_ruleset.2.en). RulesetAttr ->- -- | Flags passed to @landlock_create_ruleset@. Since no flags but- -- 'CreateRulesetVersion' (@LANDLOCK_CREATE_RULESET_VERSION@) are- -- defined, and this flag must not be used when creating an actual- -- ruleset, this should be an empty list.+ -- | Flags passed to+ -- [@landlock_create_ruleset@](https://man.archlinux.org/man/landlock_create_ruleset.2.en).+ -- Since no flags but 'CreateRulesetVersion'+ -- ([@LANDLOCK_CREATE_RULESET_VERSION@](https://man.archlinux.org/man/landlock_create_ruleset.2.en#LANDLOCK_CREATE_RULESET_VERSION))+ -- are defined, and this flag must not be used when creating an actual+ -- ruleset, this should be an empty list. [CreateRulesetFlag] ->- -- | Flags passed to @landlock_restrict_self@. Since no flags are- -- defined, this should be an empty list.+ -- | Flags passed to+ -- [@landlock_restrict_self@](https://man.archlinux.org/man/landlock_restrict_self.2.en).+ -- Since no flags are defined, this should be an empty list. [RestrictSelfFlag] -> -- | Action that will be called before the Landlock sandbox is -- enforced. The provided function can be used to register- -- sandboxing rules (internally using @landlock_add_rule@),+ -- sandboxing rules (internally using+ -- [@landlock_add_rule@](https://man.archlinux.org/man/landlock_add_rule.2.en)), -- given a 'Rule' and a set of 'AddRuleFlag's. However, since no -- flags are currently defined, this should be an empty list.- ((Storable (Rule r) => Rule r -> [AddRuleFlag] -> m ()) -> m a) ->+ (((Storable (Rule r)) => Rule r -> [AddRuleFlag] -> m ()) -> m a) -> -- | Result of the given action. m a landlock attr createRulesetFlags restrictSelfFlags act =- bracket (liftIO $ createRuleset attr createRulesetFlags) (liftIO . closeFd . unLandlockFd) $ \fd -> do- res <- act (addRule fd)- liftIO $ do- throwIfNonZero "prtcl" $ prctl pR_SET_NO_NEW_PRIVS 1 0 0 0- restrictSelf fd restrictSelfFlags- return res+ bracket+ (liftIO $ createRuleset attr createRulesetFlags)+ (liftIO . closeFd . unLandlockFd)+ $ \fd -> do+ res <- act (addRule fd)+ liftIO $ do+ throwIfNonZero "prtcl" $ prctl pR_SET_NO_NEW_PRIVS 1 0 0 0+ restrictSelf fd restrictSelfFlags+ return res -- | Register a new 'Rule' with a Landlock instance. addRule ::@@ -225,7 +245,11 @@ m () addRule fd rule flags = liftIO $ with rule $ \ruleAttrp ->- landlock_add_rule (fromIntegral $ unLandlockFd fd) (ruleType rule) ruleAttrp flags'+ landlock_add_rule+ (fromIntegral $ unLandlockFd fd)+ (ruleType rule)+ ruleAttrp+ flags' where flags' = toBits addRuleFlagToBit flags