--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
meshchatx/src/backend/landlock_sandbox.py dff83e198e78b84ec225e53ce3ab119f598b0a01 (dff83e19) Text, 15.45 KB
T8b949e# SPDX-License-Identifier: 0BSD
T8b949e"""Optional Landlock LSM filesystem sandbox for the backend (Linux only)."""
Tff7b72from T7ee787__future__ Tff7b72import Te6edf3annotations
Tff7b72import T7ee787ctypes
Tff7b72import T7ee787ctypesT7ee787.T7ee787util
Tff7b72import T7ee787logging
Tff7b72import T7ee787os
Tff7b72import T7ee787site
Tff7b72import T7ee787sys
Tff7b72import T7ee787tempfile
Te6edf3logger Tff7b72= Te6edf3loggingTff7b72.Td2a8ffgetLoggerTb4b4b4(Ta5d6ff"Ta5d6ffmeshchatx.landlockTa5d6ff"Tb4b4b4)
Te6edf3_LANDLOCK_ACCESS_FS_EXECUTE Tff7b72= T79c0ff1 Tff7b72<< T79c0ff0
Te6edf3_LANDLOCK_ACCESS_FS_WRITE_FILE Tff7b72= T79c0ff1 Tff7b72<< T79c0ff1
Te6edf3_LANDLOCK_ACCESS_FS_READ_FILE Tff7b72= T79c0ff1 Tff7b72<< T79c0ff2
Te6edf3_LANDLOCK_ACCESS_FS_READ_DIR Tff7b72= T79c0ff1 Tff7b72<< T79c0ff3
Te6edf3_LANDLOCK_ACCESS_FS_REMOVE_DIR Tff7b72= T79c0ff1 Tff7b72<< T79c0ff4
Te6edf3_LANDLOCK_ACCESS_FS_REMOVE_FILE Tff7b72= T79c0ff1 Tff7b72<< T79c0ff5
Te6edf3_LANDLOCK_ACCESS_FS_MAKE_CHAR Tff7b72= T79c0ff1 Tff7b72<< T79c0ff6
Te6edf3_LANDLOCK_ACCESS_FS_MAKE_DIR Tff7b72= T79c0ff1 Tff7b72<< T79c0ff7
Te6edf3_LANDLOCK_ACCESS_FS_MAKE_REG Tff7b72= T79c0ff1 Tff7b72<< T79c0ff8
Te6edf3_LANDLOCK_ACCESS_FS_MAKE_SOCK Tff7b72= T79c0ff1 Tff7b72<< T79c0ff9
Te6edf3_LANDLOCK_ACCESS_FS_MAKE_FIFO Tff7b72= T79c0ff1 Tff7b72<< T79c0ff10
Te6edf3_LANDLOCK_ACCESS_FS_MAKE_BLOCK Tff7b72= T79c0ff1 Tff7b72<< T79c0ff11
Te6edf3_LANDLOCK_ACCESS_FS_MAKE_SYM Tff7b72= T79c0ff1 Tff7b72<< T79c0ff12
Te6edf3_LANDLOCK_ACCESS_FS_REFER Tff7b72= T79c0ff1 Tff7b72<< T79c0ff13
Te6edf3_LANDLOCK_ACCESS_FS_TRUNCATE Tff7b72= T79c0ff1 Tff7b72<< T79c0ff14
Te6edf3_LANDLOCK_ACCESS_FS_IOCTL_DEV Tff7b72= T79c0ff1 Tff7b72<< T79c0ff15
Te6edf3_LANDLOCK_CREATE_RULESET_VERSION Tff7b72= T79c0ff1 Tff7b72<< T79c0ff0
Te6edf3_LANDLOCK_RULE_PATH_BENEATH Tff7b72= T79c0ff1
Te6edf3_PR_SET_NO_NEW_PRIVS Tff7b72= T79c0ff38
T8b949e# ABI v1 filesystem rights. Newer rights are added only when the running ABI
T8b949e# supports them, and only granted on paths that already need write or /dev.
Te6edf3_FS_ACCESS_ABI1 Tff7b72= Tb4b4b4(
Te6edf3_LANDLOCK_ACCESS_FS_EXECUTE
Tff7b72| Te6edf3_LANDLOCK_ACCESS_FS_WRITE_FILE
Tff7b72| Te6edf3_LANDLOCK_ACCESS_FS_READ_FILE
Tff7b72| Te6edf3_LANDLOCK_ACCESS_FS_READ_DIR
Tff7b72| Te6edf3_LANDLOCK_ACCESS_FS_REMOVE_DIR
Tff7b72| Te6edf3_LANDLOCK_ACCESS_FS_REMOVE_FILE
Tff7b72| Te6edf3_LANDLOCK_ACCESS_FS_MAKE_CHAR
Tff7b72| Te6edf3_LANDLOCK_ACCESS_FS_MAKE_DIR
Tff7b72| Te6edf3_LANDLOCK_ACCESS_FS_MAKE_REG
Tff7b72| Te6edf3_LANDLOCK_ACCESS_FS_MAKE_SOCK
Tff7b72| Te6edf3_LANDLOCK_ACCESS_FS_MAKE_FIFO
Tff7b72| Te6edf3_LANDLOCK_ACCESS_FS_MAKE_BLOCK
Tff7b72| Te6edf3_LANDLOCK_ACCESS_FS_MAKE_SYM
Tb4b4b4)
Te6edf3_READ_ACCESS_BASE Tff7b72= Tb4b4b4(
Te6edf3_LANDLOCK_ACCESS_FS_READ_FILE
Tff7b72| Te6edf3_LANDLOCK_ACCESS_FS_READ_DIR
Tff7b72| Te6edf3_LANDLOCK_ACCESS_FS_EXECUTE
Tb4b4b4)
Te6edf3_RW_ACCESS_BASE Tff7b72= Te6edf3_READ_ACCESS_BASE Tff7b72| Tb4b4b4(
Te6edf3_LANDLOCK_ACCESS_FS_WRITE_FILE
Tff7b72| Te6edf3_LANDLOCK_ACCESS_FS_REMOVE_DIR
Tff7b72| Te6edf3_LANDLOCK_ACCESS_FS_REMOVE_FILE
Tff7b72| Te6edf3_LANDLOCK_ACCESS_FS_MAKE_CHAR
Tff7b72| Te6edf3_LANDLOCK_ACCESS_FS_MAKE_DIR
Tff7b72| Te6edf3_LANDLOCK_ACCESS_FS_MAKE_REG
Tff7b72| Te6edf3_LANDLOCK_ACCESS_FS_MAKE_SOCK
Tff7b72| Te6edf3_LANDLOCK_ACCESS_FS_MAKE_FIFO
Tff7b72| Te6edf3_LANDLOCK_ACCESS_FS_MAKE_BLOCK
Tff7b72| Te6edf3_LANDLOCK_ACCESS_FS_MAKE_SYM
Tb4b4b4)
Te6edf3_SYSCALL_NUMBERS Tff7b72= Tb4b4b4{
Ta5d6ff"Ta5d6ffx86_64Ta5d6ff"Tb4b4b4: Tb4b4b4(T79c0ff444Tb4b4b4, T79c0ff445Tb4b4b4, T79c0ff446Tb4b4b4)Tb4b4b4,
Ta5d6ff"Ta5d6ffaarch64Ta5d6ff"Tb4b4b4: Tb4b4b4(T79c0ff444Tb4b4b4, T79c0ff445Tb4b4b4, T79c0ff446Tb4b4b4)Tb4b4b4,
Ta5d6ff"Ta5d6ffarmTa5d6ff"Tb4b4b4: Tb4b4b4(T79c0ff383Tb4b4b4, T79c0ff384Tb4b4b4, T79c0ff385Tb4b4b4)Tb4b4b4,
Ta5d6ff"Ta5d6ffriscv64Ta5d6ff"Tb4b4b4: Tb4b4b4(T79c0ff444Tb4b4b4, T79c0ff445Tb4b4b4, T79c0ff446Tb4b4b4)Tb4b4b4,
Tb4b4b4}
Tff7b72class T56d364_LandlockRulesetAttrTb4b4b4(Te6edf3ctypesTff7b72.Td2a8ffStructureTb4b4b4)Tb4b4b4:
Te6edf3_fields_ Tff7b72= Tb4b4b4[
Tb4b4b4(Ta5d6ff"Ta5d6ffhandled_access_fsTa5d6ff"Tb4b4b4, Te6edf3ctypesTff7b72.Td2a8ffc_uint64Tb4b4b4)Tb4b4b4,
Tb4b4b4(Ta5d6ff"Ta5d6ffhandled_access_netTa5d6ff"Tb4b4b4, Te6edf3ctypesTff7b72.Td2a8ffc_uint64Tb4b4b4)Tb4b4b4,
Tb4b4b4(Ta5d6ff"Ta5d6ffscopedTa5d6ff"Tb4b4b4, Te6edf3ctypesTff7b72.Td2a8ffc_uint64Tb4b4b4)Tb4b4b4,
Tb4b4b4]
Tff7b72class T56d364_LandlockPathBeneathAttrTb4b4b4(Te6edf3ctypesTff7b72.Td2a8ffStructureTb4b4b4)Tb4b4b4:
Te6edf3_fields_ Tff7b72= Tb4b4b4[
Tb4b4b4(Ta5d6ff"Ta5d6ffallowed_accessTa5d6ff"Tb4b4b4, Te6edf3ctypesTff7b72.Td2a8ffc_uint64Tb4b4b4)Tb4b4b4,
Tb4b4b4(Ta5d6ff"Ta5d6ffparent_fdTa5d6ff"Tb4b4b4, Te6edf3ctypesTff7b72.Td2a8ffc_int32Tb4b4b4)Tb4b4b4,
Tb4b4b4]
Te6edf3_pack_ Tff7b72= T79c0ff1
Te6edf3_layout_ Tff7b72= Ta5d6ff"Ta5d6ffmsTa5d6ff"
Tff7b72def Td2a8ff_parse_kernel_versionTb4b4b4(Te6edf3releaseTb4b4b4: Tffa657strTb4b4b4) Tff7b72-Tff7b72> Tffa657tupleTb4b4b4[Tffa657intTb4b4b4, Tffa657intTb4b4b4, Tffa657intTb4b4b4]Tb4b4b4:
Te6edf3base Tff7b72= Tb4b4b4(Te6edf3release Tff7b72or Ta5d6ff"Ta5d6ff"Tb4b4b4)Tff7b72.Td2a8ffsplitTb4b4b4(Ta5d6ff"Ta5d6ff-Ta5d6ff"Tb4b4b4, T79c0ff1Tb4b4b4)Tb4b4b4[T79c0ff0Tb4b4b4]
Te6edf3parts Tff7b72= Te6edf3baseTff7b72.Td2a8ffsplitTb4b4b4(Ta5d6ff"Ta5d6ff.Ta5d6ff"Tb4b4b4)
Te6edf3numsTb4b4b4: Tffa657listTb4b4b4[Tffa657intTb4b4b4] Tff7b72= Tb4b4b4[Tb4b4b4]
Tff7b72for Te6edf3part Tff7b72in Te6edf3partsTb4b4b4[Tb4b4b4:T79c0ff3Tb4b4b4]Tb4b4b4:
Te6edf3digits Tff7b72= Ta5d6ff"Ta5d6ff"
Tff7b72for Te6edf3ch Tff7b72in Te6edf3partTb4b4b4:
Tff7b72if Te6edf3chTff7b72.Td2a8ffisdigitTb4b4b4(Tb4b4b4)Tb4b4b4:
Te6edf3digits Tff7b72+Tff7b72= Te6edf3ch
Tff7b72elseTb4b4b4:
Tff7b72break
Te6edf3numsTff7b72.Td2a8ffappendTb4b4b4(Tffa657intTb4b4b4(Te6edf3digitsTb4b4b4) Tff7b72if Te6edf3digits Tff7b72else T79c0ff0Tb4b4b4)
Tff7b72while Tffa657lenTb4b4b4(Te6edf3numsTb4b4b4) Tff7b72< T79c0ff3Tb4b4b4:
Te6edf3numsTff7b72.Td2a8ffappendTb4b4b4(T79c0ff0Tb4b4b4)
Tff7b72return Te6edf3numsTb4b4b4[T79c0ff0Tb4b4b4]Tb4b4b4, Te6edf3numsTb4b4b4[T79c0ff1Tb4b4b4]Tb4b4b4, Te6edf3numsTb4b4b4[T79c0ff2Tb4b4b4]
Tff7b72def Td2a8ff_kernel_version_meets_minimumTb4b4b4(Te6edf3min_majorTb4b4b4: Tffa657int Tff7b72= T79c0ff5Tb4b4b4, Te6edf3min_minorTb4b4b4: Tffa657int Tff7b72= T79c0ff13Tb4b4b4) Tff7b72-Tff7b72> Tffa657boolTb4b4b4:
Tff7b72tryTb4b4b4:
Te6edf3majorTb4b4b4, Te6edf3minorTb4b4b4, Te6edf3_patch Tff7b72= Te6edf3_parse_kernel_versionTb4b4b4(Te6edf3osTff7b72.Td2a8ffunameTb4b4b4(Tb4b4b4)Tff7b72.Td2a8ffreleaseTb4b4b4)
Tff7b72except Tb4b4b4(Tf85149AttributeErrorTb4b4b4, Tf85149OSErrorTb4b4b4, Tf85149ValueErrorTb4b4b4)Tb4b4b4:
Tff7b72return Tff7b72False
Tff7b72if Te6edf3major Tff7b72> Te6edf3min_majorTb4b4b4:
Tff7b72return Tff7b72True
Tff7b72if Te6edf3major Tff7b72== Te6edf3min_majorTb4b4b4:
Tff7b72return Te6edf3minor Tff7b72>Tff7b72= Te6edf3min_minor
Tff7b72return Tff7b72False
Tff7b72def Td2a8ff_landlock_env_overrideTb4b4b4(Tb4b4b4) Tff7b72-Tff7b72> Tffa657bool Tff7b72| Tff7b72NoneTb4b4b4:
Te6edf3raw Tff7b72= Te6edf3osTff7b72.Td2a8ffenvironTff7b72.Td2a8ffgetTb4b4b4(Ta5d6ff"Ta5d6ffMESHCHAT_LANDLOCKTa5d6ff"Tb4b4b4)
Tff7b72if Te6edf3raw Tff7b72is Tff7b72NoneTb4b4b4:
Tff7b72return Tff7b72None
Te6edf3val Tff7b72= Te6edf3rawTff7b72.Td2a8ffstripTb4b4b4(Tb4b4b4)Tff7b72.Td2a8fflowerTb4b4b4(Tb4b4b4)
Tff7b72if Te6edf3val Tff7b72in Tb4b4b4(Ta5d6ff"Ta5d6fffalseTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ff0Ta5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffnoTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffoffTa5d6ff"Tb4b4b4)Tb4b4b4:
Tff7b72return Tff7b72False
Tff7b72if Te6edf3val Tff7b72in Tb4b4b4(Ta5d6ff"Ta5d6fftrueTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ff1Ta5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffyesTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffonTa5d6ff"Tb4b4b4)Tb4b4b4:
Tff7b72return Tff7b72True
Tff7b72return Tff7b72None
Te6edf3_landlock_support_cachedTb4b4b4: Tffa657bool Tff7b72| Tff7b72None Tff7b72= Tff7b72None
Te6edf3_landlock_abi_cachedTb4b4b4: Tffa657int Tff7b72| Tff7b72None Tff7b72= Tff7b72None
Tff7b72def Td2a8ff_syscall_numbersTb4b4b4(Tb4b4b4)Tb4b4b4:
Te6edf3machine Tff7b72= Te6edf3osTff7b72.Td2a8ffunameTb4b4b4(Tb4b4b4)Tff7b72.Td2a8ffmachineTff7b72.Td2a8fflowerTb4b4b4(Tb4b4b4)
Tff7b72if Te6edf3machine Tff7b72in Te6edf3_SYSCALL_NUMBERSTb4b4b4:
Tff7b72return Te6edf3_SYSCALL_NUMBERSTb4b4b4[Te6edf3machineTb4b4b4]
Tff7b72return Te6edf3_SYSCALL_NUMBERSTff7b72.Td2a8ffgetTb4b4b4(Ta5d6ff"Ta5d6ffx86_64Ta5d6ff"Tb4b4b4)
Tff7b72def Td2a8ff_libcTb4b4b4(Tb4b4b4)Tb4b4b4:
Te6edf3name Tff7b72= Te6edf3ctypesTff7b72.Td2a8ffutilTff7b72.Td2a8fffind_libraryTb4b4b4(Ta5d6ff"Ta5d6ffcTa5d6ff"Tb4b4b4)
Tff7b72tryTb4b4b4:
Tff7b72if Te6edf3nameTb4b4b4:
Te6edf3libc Tff7b72= Te6edf3ctypesTff7b72.Td2a8ffCDLLTb4b4b4(Te6edf3nameTb4b4b4, Te6edf3use_errnoTff7b72=Tff7b72TrueTb4b4b4)
Tff7b72elseTb4b4b4:
T8b949e# On some systems (like Alpine/musl) find_library("c") fails.
T8b949e# Loading None gives us access to symbols already in the process.
Te6edf3libc Tff7b72= Te6edf3ctypesTff7b72.Td2a8ffCDLLTb4b4b4(Tff7b72NoneTb4b4b4, Te6edf3use_errnoTff7b72=Tff7b72TrueTb4b4b4)
Tff7b72except Tf85149OSErrorTb4b4b4:
Tff7b72return Tff7b72None
Tff7b72if Tff7b72not Tffa657hasattrTb4b4b4(Te6edf3libcTb4b4b4, Ta5d6ff"Ta5d6ffsyscallTa5d6ff"Tb4b4b4)Tb4b4b4:
Tff7b72return Tff7b72None
Te6edf3libcTff7b72.Td2a8ffsyscallTff7b72.Td2a8ffrestype Tff7b72= Te6edf3ctypesTff7b72.Td2a8ffc_long
Tff7b72return Te6edf3libc
Tff7b72def Td2a8ff_syscallTb4b4b4(Te6edf3libcTb4b4b4, Te6edf3nrTb4b4b4: Tffa657intTb4b4b4, Tff7b72*Te6edf3argsTb4b4b4)Tb4b4b4:
Te6edf3rc Tff7b72= Te6edf3libcTff7b72.Td2a8ffsyscallTb4b4b4(Te6edf3nrTb4b4b4, Tff7b72*Te6edf3argsTb4b4b4)
Tff7b72if Te6edf3rc Tff7b72< T79c0ff0Tb4b4b4:
Te6edf3err Tff7b72= Te6edf3ctypesTff7b72.Td2a8ffget_errnoTb4b4b4(Tb4b4b4)
Te6edf3msg Tff7b72= Ta5d6fffTa5d6ff"Ta5d6fflandlock syscall Tffd700{Te6edf3nrTffd700}Ta5d6ff failed: errno Tffd700{Te6edf3errTffd700}Ta5d6ff"
Tff7b72raise Tf85149OSErrorTb4b4b4(Te6edf3errTb4b4b4, Te6edf3osTff7b72.Td2a8ffstrerrorTb4b4b4(Te6edf3errTb4b4b4)Tb4b4b4, Te6edf3msgTb4b4b4)
Tff7b72return Te6edf3rc
Tff7b72def Td2a8ff_handled_access_fs_for_abiTb4b4b4(Te6edf3abiTb4b4b4: Tffa657intTb4b4b4) Tff7b72-Tff7b72> Tffa657intTb4b4b4:
T8b949e"""Return handled FS rights for a best-effort sandbox on this ABI.
Intentionally omits network port rules and IPC scoping so mesh traffic,
Unix sockets, and signals keep working. Omits RESOLVE_UNIX for the same
reason. Rights we do handle are also granted on RW roots (including /dev).
"""
Tff7b72if Te6edf3abi Tff7b72< T79c0ff1Tb4b4b4:
Tff7b72return T79c0ff0
Te6edf3handled Tff7b72= Te6edf3_FS_ACCESS_ABI1
Tff7b72if Te6edf3abi Tff7b72>Tff7b72= T79c0ff2Tb4b4b4:
Te6edf3handled Tff7b72|Tff7b72= Te6edf3_LANDLOCK_ACCESS_FS_REFER
Tff7b72if Te6edf3abi Tff7b72>Tff7b72= T79c0ff3Tb4b4b4:
Te6edf3handled Tff7b72|Tff7b72= Te6edf3_LANDLOCK_ACCESS_FS_TRUNCATE
Tff7b72if Te6edf3abi Tff7b72>Tff7b72= T79c0ff5Tb4b4b4:
Te6edf3handled Tff7b72|Tff7b72= Te6edf3_LANDLOCK_ACCESS_FS_IOCTL_DEV
Tff7b72return Te6edf3handled
Tff7b72def Td2a8ff_ruleset_attr_sizeTb4b4b4(Te6edf3abiTb4b4b4: Tffa657intTb4b4b4) Tff7b72-Tff7b72> Tffa657intTb4b4b4:
T8b949e"""Bytes of landlock_ruleset_attr the running ABI understands."""
Tff7b72if Te6edf3abi Tff7b72>Tff7b72= T79c0ff6Tb4b4b4:
Tff7b72return Te6edf3ctypesTff7b72.Td2a8ffsizeofTb4b4b4(Te6edf3_LandlockRulesetAttrTb4b4b4)
Tff7b72if Te6edf3abi Tff7b72>Tff7b72= T79c0ff4Tb4b4b4:
Tff7b72return Te6edf3ctypesTff7b72.Td2a8ffsizeofTb4b4b4(Te6edf3ctypesTff7b72.Td2a8ffc_uint64Tb4b4b4) Tff7b72* T79c0ff2
Tff7b72return Te6edf3ctypesTff7b72.Td2a8ffsizeofTb4b4b4(Te6edf3ctypesTff7b72.Td2a8ffc_uint64Tb4b4b4)
Tff7b72def Td2a8ff_read_access_for_handledTb4b4b4(Te6edf3handledTb4b4b4: Tffa657intTb4b4b4) Tff7b72-Tff7b72> Tffa657intTb4b4b4:
Tff7b72return Te6edf3_READ_ACCESS_BASE Tff7b72& Te6edf3handled
Tff7b72def Td2a8ff_rw_access_for_handledTb4b4b4(Te6edf3handledTb4b4b4: Tffa657intTb4b4b4) Tff7b72-Tff7b72> Tffa657intTb4b4b4:
Te6edf3access Tff7b72= Te6edf3_RW_ACCESS_BASE
Tff7b72if Te6edf3handled Tff7b72& Te6edf3_LANDLOCK_ACCESS_FS_REFERTb4b4b4:
Te6edf3access Tff7b72|Tff7b72= Te6edf3_LANDLOCK_ACCESS_FS_REFER
Tff7b72if Te6edf3handled Tff7b72& Te6edf3_LANDLOCK_ACCESS_FS_TRUNCATETb4b4b4:
Te6edf3access Tff7b72|Tff7b72= Te6edf3_LANDLOCK_ACCESS_FS_TRUNCATE
Tff7b72if Te6edf3handled Tff7b72& Te6edf3_LANDLOCK_ACCESS_FS_IOCTL_DEVTb4b4b4:
Te6edf3access Tff7b72|Tff7b72= Te6edf3_LANDLOCK_ACCESS_FS_IOCTL_DEV
Tff7b72return Te6edf3access Tff7b72& Te6edf3handled
Tff7b72def Td2a8ff_probe_landlock_abiTb4b4b4(Tb4b4b4) Tff7b72-Tff7b72> Tffa657intTb4b4b4:
T8b949e"""Return the Landlock ABI version, or 0 when unavailable."""
Tff7b72global Te6edf3_landlock_abi_cached
Tff7b72if Te6edf3_landlock_abi_cached Tff7b72is Tff7b72not Tff7b72NoneTb4b4b4:
Tff7b72return Te6edf3_landlock_abi_cached
Te6edf3libc Tff7b72= Te6edf3_libcTb4b4b4(Tb4b4b4)
Te6edf3nums Tff7b72= Te6edf3_syscall_numbersTb4b4b4(Tb4b4b4)
Tff7b72if Te6edf3libc Tff7b72is Tff7b72None Tff7b72or Te6edf3nums Tff7b72is Tff7b72NoneTb4b4b4:
Te6edf3_landlock_abi_cached Tff7b72= T79c0ff0
Tff7b72return T79c0ff0
Te6edf3create_nrTb4b4b4, Te6edf3_Tb4b4b4, Te6edf3_ Tff7b72= Te6edf3nums
Tff7b72tryTb4b4b4:
Te6edf3abi Tff7b72= Tffa657intTb4b4b4(Te6edf3_syscallTb4b4b4(Te6edf3libcTb4b4b4, Te6edf3create_nrTb4b4b4, T79c0ff0Tb4b4b4, T79c0ff0Tb4b4b4, Te6edf3_LANDLOCK_CREATE_RULESET_VERSIONTb4b4b4)Tb4b4b4)
Tff7b72except Tf85149OSErrorTb4b4b4:
Te6edf3_landlock_abi_cached Tff7b72= T79c0ff0
Tff7b72return T79c0ff0
Tff7b72if Te6edf3abi Tff7b72< T79c0ff1Tb4b4b4:
Te6edf3_landlock_abi_cached Tff7b72= T79c0ff0
Tff7b72return T79c0ff0
Te6edf3_landlock_abi_cached Tff7b72= Te6edf3abi
Tff7b72return Te6edf3abi
Tff7b72def Td2a8ff_probe_landlock_create_rulesetTb4b4b4(Tb4b4b4) Tff7b72-Tff7b72> Tffa657boolTb4b4b4:
Tff7b72return Te6edf3_probe_landlock_abiTb4b4b4(Tb4b4b4) Tff7b72>Tff7b72= T79c0ff1
Tff7b72def Td2a8ff_is_androidTb4b4b4(Tb4b4b4) Tff7b72-Tff7b72> Tffa657boolTb4b4b4:
T8b949e"""Return True when running under Android/Chaquopy.
Android kernels may expose Landlock, but the app seccomp filter blocks
the syscalls and raises SIGSYS. Landlock must never be enabled there.
"""
Tff7b72return Tffa657hasattrTb4b4b4(Te6edf3sysTb4b4b4, Ta5d6ff"Ta5d6ffgetandroidapilevelTa5d6ff"Tb4b4b4)
Tff7b72def Td2a8fflandlock_abi_versionTb4b4b4(Tb4b4b4) Tff7b72-Tff7b72> Tffa657intTb4b4b4:
T8b949e"""Return the probed Landlock ABI version, or 0 if unsupported."""
Tff7b72if Te6edf3sysTff7b72.Td2a8ffplatform Tff7b72!= Ta5d6ff"Ta5d6fflinuxTa5d6ff" Tff7b72or Te6edf3_is_androidTb4b4b4(Tb4b4b4)Tb4b4b4:
Tff7b72return T79c0ff0
Tff7b72if Tff7b72not Te6edf3_kernel_version_meets_minimumTb4b4b4(Tb4b4b4)Tb4b4b4:
Tff7b72return T79c0ff0
Tff7b72return Te6edf3_probe_landlock_abiTb4b4b4(Tb4b4b4)
Tff7b72def Td2a8fflandlock_kernel_supportedTb4b4b4(Tb4b4b4) Tff7b72-Tff7b72> Tffa657boolTb4b4b4:
Tff7b72global Te6edf3_landlock_support_cached
Tff7b72if Te6edf3_landlock_support_cached Tff7b72is Tff7b72not Tff7b72NoneTb4b4b4:
Tff7b72return Te6edf3_landlock_support_cached
Tff7b72if Te6edf3sysTff7b72.Td2a8ffplatform Tff7b72!= Ta5d6ff"Ta5d6fflinuxTa5d6ff"Tb4b4b4:
Te6edf3_landlock_support_cached Tff7b72= Tff7b72False
Tff7b72return Tff7b72False
Tff7b72if Te6edf3_is_androidTb4b4b4(Tb4b4b4)Tb4b4b4:
T8b949e# Android seccomp blocks Landlock syscalls with SIGSYS.
Te6edf3_landlock_support_cached Tff7b72= Tff7b72False
Tff7b72return Tff7b72False
Tff7b72if Tff7b72not Te6edf3_kernel_version_meets_minimumTb4b4b4(Tb4b4b4)Tb4b4b4:
Te6edf3_landlock_support_cached Tff7b72= Tff7b72False
Tff7b72return Tff7b72False
Te6edf3_landlock_support_cached Tff7b72= Te6edf3_probe_landlock_create_rulesetTb4b4b4(Tb4b4b4)
Tff7b72return Te6edf3_landlock_support_cached
Tff7b72def Td2a8fflandlock_requestedTb4b4b4(Tb4b4b4) Tff7b72-Tff7b72> Tffa657boolTb4b4b4:
Tff7b72if Te6edf3sysTff7b72.Td2a8ffplatform Tff7b72!= Ta5d6ff"Ta5d6fflinuxTa5d6ff"Tb4b4b4:
Tff7b72return Tff7b72False
Te6edf3override Tff7b72= Te6edf3_landlock_env_overrideTb4b4b4(Tb4b4b4)
Tff7b72if Te6edf3override Tff7b72is Tff7b72FalseTb4b4b4:
Tff7b72return Tff7b72False
Tff7b72if Te6edf3override Tff7b72is Tff7b72TrueTb4b4b4:
Tff7b72return Tff7b72True
Tff7b72return Te6edf3landlock_kernel_supportedTb4b4b4(Tb4b4b4)
Tff7b72def Td2a8fflandlock_auto_enabledTb4b4b4(Tb4b4b4) Tff7b72-Tff7b72> Tffa657boolTb4b4b4:
Tff7b72return Te6edf3landlock_requestedTb4b4b4(Tb4b4b4) Tff7b72and Te6edf3_landlock_env_overrideTb4b4b4(Tb4b4b4) Tff7b72is Tff7b72None
Tff7b72def Td2a8fflandlock_disabled_by_envTb4b4b4(Tb4b4b4) Tff7b72-Tff7b72> Tffa657boolTb4b4b4:
Tff7b72return Te6edf3_landlock_env_overrideTb4b4b4(Tb4b4b4) Tff7b72is Tff7b72False
Tff7b72def Td2a8ff_set_no_new_privsTb4b4b4(Te6edf3libcTb4b4b4) Tff7b72-Tff7b72> Tff7b72NoneTb4b4b4:
Te6edf3rc Tff7b72= Te6edf3libcTff7b72.Td2a8ffprctlTb4b4b4(Te6edf3_PR_SET_NO_NEW_PRIVSTb4b4b4, T79c0ff1Tb4b4b4, T79c0ff0Tb4b4b4, T79c0ff0Tb4b4b4, T79c0ff0Tb4b4b4)
Tff7b72if Te6edf3rc Tff7b72!= T79c0ff0Tb4b4b4:
Te6edf3err Tff7b72= Te6edf3ctypesTff7b72.Td2a8ffget_errnoTb4b4b4(Tb4b4b4)
Te6edf3msg Tff7b72= Ta5d6fffTa5d6ff"Ta5d6ffprctl(PR_SET_NO_NEW_PRIVS) failed: errno Tffd700{Te6edf3errTffd700}Ta5d6ff"
Tff7b72raise Tf85149OSErrorTb4b4b4(Te6edf3msgTb4b4b4)
Tff7b72def Td2a8ff_existing_dirTb4b4b4(Te6edf3pathTb4b4b4: Tffa657str Tff7b72| Tff7b72NoneTb4b4b4) Tff7b72-Tff7b72> Tffa657str Tff7b72| Tff7b72NoneTb4b4b4:
Tff7b72if Tff7b72not Te6edf3pathTb4b4b4:
Tff7b72return Tff7b72None
Te6edf3resolved Tff7b72= Te6edf3osTff7b72.Td2a8ffpathTff7b72.Td2a8ffabspathTb4b4b4(Te6edf3osTff7b72.Td2a8ffpathTff7b72.Td2a8ffexpanduserTb4b4b4(Te6edf3pathTb4b4b4)Tb4b4b4)
Tff7b72if Te6edf3osTff7b72.Td2a8ffpathTff7b72.Td2a8ffisdirTb4b4b4(Te6edf3resolvedTb4b4b4)Tb4b4b4:
Tff7b72return Te6edf3resolved
Te6edf3parent Tff7b72= Te6edf3osTff7b72.Td2a8ffpathTff7b72.Td2a8ffdirnameTb4b4b4(Te6edf3resolvedTb4b4b4)
Tff7b72if Te6edf3parent Tff7b72and Te6edf3osTff7b72.Td2a8ffpathTff7b72.Td2a8ffisdirTb4b4b4(Te6edf3parentTb4b4b4)Tb4b4b4:
Tff7b72return Te6edf3parent
Tff7b72return Tff7b72None
Tff7b72def Td2a8ff_collect_read_rootsTb4b4b4(Tb4b4b4) Tff7b72-Tff7b72> Tffa657listTb4b4b4[Tffa657strTb4b4b4]Tb4b4b4:
Te6edf3roots Tff7b72= Tb4b4b4{
Ta5d6ff"Ta5d6ff/usrTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ff/libTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ff/lib64Ta5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ff/etcTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ff/binTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ff/sbinTa5d6ff"Tb4b4b4,
T8b949e# RNS get_interface_stats() uses psutil for rss, and psutil reads /proc/self.
Ta5d6ff"Ta5d6ff/procTa5d6ff"Tb4b4b4,
Tb4b4b4}
Tff7b72for Te6edf3path Tff7b72in Te6edf3sysTff7b72.Td2a8ffpathTb4b4b4:
Te6edf3existing Tff7b72= Te6edf3_existing_dirTb4b4b4(Te6edf3pathTb4b4b4)
Tff7b72if Te6edf3existingTb4b4b4:
Te6edf3rootsTff7b72.Td2a8ffaddTb4b4b4(Te6edf3existingTb4b4b4)
Tff7b72for Te6edf3path Tff7b72in Te6edf3siteTff7b72.Td2a8ffgetsitepackagesTb4b4b4(Tb4b4b4)Tb4b4b4:
Te6edf3existing Tff7b72= Te6edf3_existing_dirTb4b4b4(Te6edf3pathTb4b4b4)
Tff7b72if Te6edf3existingTb4b4b4:
Te6edf3rootsTff7b72.Td2a8ffaddTb4b4b4(Te6edf3existingTb4b4b4)
Te6edf3user_site Tff7b72= Te6edf3siteTff7b72.Td2a8ffgetusersitepackagesTb4b4b4(Tb4b4b4)
Te6edf3existing Tff7b72= Te6edf3_existing_dirTb4b4b4(Te6edf3user_siteTb4b4b4)
Tff7b72if Te6edf3existingTb4b4b4:
Te6edf3rootsTff7b72.Td2a8ffaddTb4b4b4(Te6edf3existingTb4b4b4)
T8b949e# Allow execve of the running interpreter (uv-managed CPython lives outside
T8b949e# /usr, and bots, self-check, or rnsh re-spawn sys.executable under Landlock).
Tff7b72for Te6edf3candidate Tff7b72in Tb4b4b4(Te6edf3sysTff7b72.Td2a8ffexecutableTb4b4b4, Te6edf3osTff7b72.Td2a8ffpathTff7b72.Td2a8ffrealpathTb4b4b4(Te6edf3sysTff7b72.Td2a8ffexecutableTb4b4b4)Tb4b4b4)Tb4b4b4:
Tff7b72if Tff7b72not Te6edf3candidateTb4b4b4:
Tff7b72continue
Te6edf3exe_dir Tff7b72= Te6edf3_existing_dirTb4b4b4(Te6edf3osTff7b72.Td2a8ffpathTff7b72.Td2a8ffdirnameTb4b4b4(Te6edf3candidateTb4b4b4)Tb4b4b4)
Tff7b72if Te6edf3exe_dirTb4b4b4:
Te6edf3rootsTff7b72.Td2a8ffaddTb4b4b4(Te6edf3exe_dirTb4b4b4)
T8b949e# Venv layouts put pyvenv.cfg next to bin/, not under it. Allowing only
T8b949e# …/bin leaves child interpreters unable to read pyvenv.cfg (EACCES).
Te6edf3venv_root Tff7b72= Te6edf3osTff7b72.Td2a8ffpathTff7b72.Td2a8ffdirnameTb4b4b4(Te6edf3exe_dirTb4b4b4) Tff7b72if Te6edf3exe_dir Tff7b72else Tff7b72None
Tff7b72if Te6edf3venv_root Tff7b72and Te6edf3osTff7b72.Td2a8ffpathTff7b72.Td2a8ffisfileTb4b4b4(Te6edf3osTff7b72.Td2a8ffpathTff7b72.Td2a8ffjoinTb4b4b4(Te6edf3venv_rootTb4b4b4, Ta5d6ff"Ta5d6ffpyvenv.cfgTa5d6ff"Tb4b4b4)Tb4b4b4)Tb4b4b4:
Te6edf3existing_venv Tff7b72= Te6edf3_existing_dirTb4b4b4(Te6edf3venv_rootTb4b4b4)
Tff7b72if Te6edf3existing_venvTb4b4b4:
Te6edf3rootsTff7b72.Td2a8ffaddTb4b4b4(Te6edf3existing_venvTb4b4b4)
T8b949e# Prefer the install prefix (…/cpython-…/) so bin + lib are covered.
Tff7b72for Te6edf3prefix_candidate Tff7b72in Tb4b4b4(
Tffa657getattrTb4b4b4(Te6edf3sysTb4b4b4, Ta5d6ff"Ta5d6ffbase_prefixTa5d6ff"Tb4b4b4, Tff7b72NoneTb4b4b4)Tb4b4b4,
Te6edf3sysTff7b72.Td2a8ffprefixTb4b4b4,
Te6edf3osTff7b72.Td2a8ffenvironTff7b72.Td2a8ffgetTb4b4b4(Ta5d6ff"Ta5d6ffVIRTUAL_ENVTa5d6ff"Tb4b4b4)Tb4b4b4,
Tb4b4b4)Tb4b4b4:
Te6edf3prefix Tff7b72= Te6edf3_existing_dirTb4b4b4(Te6edf3prefix_candidateTb4b4b4)
Tff7b72if Te6edf3prefixTb4b4b4:
Te6edf3rootsTff7b72.Td2a8ffaddTb4b4b4(Te6edf3prefixTb4b4b4)
Tff7b72return Tffa657sortedTb4b4b4(Te6edf3rootsTb4b4b4)
Tff7b72def Td2a8ff_collect_rw_rootsTb4b4b4(
Te6edf3storage_dirTb4b4b4: Tffa657str Tff7b72| Tff7b72NoneTb4b4b4,
Te6edf3reticulum_config_dirTb4b4b4: Tffa657str Tff7b72| Tff7b72NoneTb4b4b4,
Te6edf3log_dirTb4b4b4: Tffa657str Tff7b72| Tff7b72NoneTb4b4b4,
Tb4b4b4) Tff7b72-Tff7b72> Tffa657listTb4b4b4[Tffa657strTb4b4b4]Tb4b4b4:
Te6edf3pathsTb4b4b4: Tffa657listTb4b4b4[Tffa657strTb4b4b4] Tff7b72= Tb4b4b4[Tb4b4b4]
Tff7b72for Te6edf3candidate Tff7b72in Tb4b4b4(
Te6edf3storage_dirTb4b4b4,
Te6edf3reticulum_config_dirTb4b4b4,
Te6edf3log_dirTb4b4b4,
Te6edf3tempfileTff7b72.Td2a8ffgettempdirTb4b4b4(Tb4b4b4)Tb4b4b4,
Ta5d6ff"Ta5d6ff/dev/shmTa5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ff/runTa5d6ff"Tb4b4b4,
Tb4b4b4)Tb4b4b4:
Te6edf3existing Tff7b72= Te6edf3_existing_dirTb4b4b4(Te6edf3candidateTb4b4b4)
Tff7b72if Te6edf3existing Tff7b72and Te6edf3existing Tff7b72not Tff7b72in Te6edf3pathsTb4b4b4:
Te6edf3pathsTff7b72.Td2a8ffappendTb4b4b4(Te6edf3existingTb4b4b4)
Tff7b72if Te6edf3osTff7b72.Td2a8ffpathTff7b72.Td2a8ffisdirTb4b4b4(Ta5d6ff"Ta5d6ff/devTa5d6ff"Tb4b4b4)Tb4b4b4:
Te6edf3pathsTff7b72.Td2a8ffappendTb4b4b4(Ta5d6ff"Ta5d6ff/devTa5d6ff"Tb4b4b4)
Tff7b72return Te6edf3paths
Tff7b72def Td2a8ff_file_access_from_dir_accessTb4b4b4(Te6edf3accessTb4b4b4: Tffa657intTb4b4b4, Te6edf3handledTb4b4b4: Tffa657intTb4b4b4) Tff7b72-Tff7b72> Tffa657intTb4b4b4:
T8b949e"""Map a directory access mask to rights valid on a non-directory path."""
Te6edf3file_bits Tff7b72= Te6edf3_LANDLOCK_ACCESS_FS_READ_FILE Tff7b72| Te6edf3_LANDLOCK_ACCESS_FS_WRITE_FILE
Tff7b72if Te6edf3access Tff7b72& Te6edf3_LANDLOCK_ACCESS_FS_EXECUTETb4b4b4:
Te6edf3file_bits Tff7b72|Tff7b72= Te6edf3_LANDLOCK_ACCESS_FS_EXECUTE
Tff7b72if Te6edf3access Tff7b72& Te6edf3_LANDLOCK_ACCESS_FS_TRUNCATETb4b4b4:
Te6edf3file_bits Tff7b72|Tff7b72= Te6edf3_LANDLOCK_ACCESS_FS_TRUNCATE
Tff7b72if Te6edf3access Tff7b72& Te6edf3_LANDLOCK_ACCESS_FS_IOCTL_DEVTb4b4b4:
Te6edf3file_bits Tff7b72|Tff7b72= Te6edf3_LANDLOCK_ACCESS_FS_IOCTL_DEV
Tff7b72return Te6edf3file_bits Tff7b72& Te6edf3access Tff7b72& Te6edf3handled
Tff7b72def Td2a8ff_add_path_beneath_ruleTb4b4b4(
Te6edf3libcTb4b4b4,
Te6edf3add_rule_nrTb4b4b4: Tffa657intTb4b4b4,
Te6edf3ruleset_fdTb4b4b4: Tffa657intTb4b4b4,
Te6edf3pathTb4b4b4: Tffa657strTb4b4b4,
Te6edf3accessTb4b4b4: Tffa657intTb4b4b4,
Te6edf3handledTb4b4b4: Tffa657intTb4b4b4,
Tb4b4b4) Tff7b72-Tff7b72> Tff7b72NoneTb4b4b4:
Tff7b72if Tff7b72not Te6edf3path Tff7b72or Tff7b72not Te6edf3osTff7b72.Td2a8ffpathTff7b72.Td2a8ffexistsTb4b4b4(Te6edf3pathTb4b4b4)Tb4b4b4:
Tff7b72return
Tff7b72if Tff7b72not Te6edf3osTff7b72.Td2a8ffpathTff7b72.Td2a8ffisdirTb4b4b4(Te6edf3pathTb4b4b4)Tb4b4b4:
Te6edf3effective_access Tff7b72= Te6edf3_file_access_from_dir_accessTb4b4b4(Te6edf3accessTb4b4b4, Te6edf3handledTb4b4b4)
Tff7b72elseTb4b4b4:
Te6edf3effective_access Tff7b72= Te6edf3access Tff7b72& Te6edf3handled
Tff7b72if Te6edf3effective_access Tff7b72== T79c0ff0Tb4b4b4:
Tff7b72return
Te6edf3open_flags Tff7b72= Te6edf3osTff7b72.Td2a8ffO_PATH Tff7b72| Te6edf3osTff7b72.Td2a8ffO_CLOEXEC Tff7b72| Te6edf3osTff7b72.Td2a8ffO_RDONLY
Tff7b72tryTb4b4b4:
Te6edf3fd Tff7b72= Te6edf3osTff7b72.Td2a8ffopenTb4b4b4(Te6edf3pathTb4b4b4, Te6edf3open_flagsTb4b4b4)
Tff7b72except Tf85149OSErrorTb4b4b4:
Tff7b72return
Tff7b72tryTb4b4b4:
Te6edf3attr Tff7b72= Te6edf3_LandlockPathBeneathAttrTb4b4b4(Te6edf3allowed_accessTff7b72=Te6edf3effective_accessTb4b4b4, Te6edf3parent_fdTff7b72=Te6edf3fdTb4b4b4)
Te6edf3_syscallTb4b4b4(
Te6edf3libcTb4b4b4,
Te6edf3add_rule_nrTb4b4b4,
Te6edf3ruleset_fdTb4b4b4,
Te6edf3_LANDLOCK_RULE_PATH_BENEATHTb4b4b4,
Te6edf3ctypesTff7b72.Td2a8ffbyrefTb4b4b4(Te6edf3attrTb4b4b4)Tb4b4b4,
T79c0ff0Tb4b4b4,
Tb4b4b4)
Tff7b72finallyTb4b4b4:
Te6edf3osTff7b72.Td2a8ffcloseTb4b4b4(Te6edf3fdTb4b4b4)
Tff7b72def Td2a8ffapply_landlock_sandboxTb4b4b4(
Tff7b72*Tb4b4b4,
Te6edf3storage_dirTb4b4b4: Tffa657str Tff7b72| Tff7b72None Tff7b72= Tff7b72NoneTb4b4b4,
Te6edf3reticulum_config_dirTb4b4b4: Tffa657str Tff7b72| Tff7b72None Tff7b72= Tff7b72NoneTb4b4b4,
Te6edf3public_dirTb4b4b4: Tffa657str Tff7b72| Tff7b72None Tff7b72= Tff7b72NoneTb4b4b4,
Te6edf3log_dirTb4b4b4: Tffa657str Tff7b72| Tff7b72None Tff7b72= Tff7b72NoneTb4b4b4,
Tb4b4b4) Tff7b72-Tff7b72> Tffa657boolTb4b4b4:
T8b949e"""Apply Landlock rules. Returns True when the sandbox is active."""
Tff7b72if Tff7b72not Te6edf3landlock_requestedTb4b4b4(Tb4b4b4)Tb4b4b4:
Tff7b72return Tff7b72False
Te6edf3libc Tff7b72= Te6edf3_libcTb4b4b4(Tb4b4b4)
Te6edf3nums Tff7b72= Te6edf3_syscall_numbersTb4b4b4(Tb4b4b4)
Tff7b72if Te6edf3libc Tff7b72is Tff7b72None Tff7b72or Te6edf3nums Tff7b72is Tff7b72NoneTb4b4b4:
Te6edf3loggerTff7b72.Td2a8ffwarningTb4b4b4(Ta5d6ff"Ta5d6ffLandlock requested but libc or syscall numbers are unavailableTa5d6ff"Tb4b4b4)
Tff7b72return Tff7b72False
Te6edf3create_nrTb4b4b4, Te6edf3add_rule_nrTb4b4b4, Te6edf3restrict_nr Tff7b72= Te6edf3nums
Tff7b72tryTb4b4b4:
Te6edf3_set_no_new_privsTb4b4b4(Te6edf3libcTb4b4b4)
Tff7b72except Tf85149OSError Tff7b72as Te6edf3excTb4b4b4:
Te6edf3loggerTff7b72.Td2a8ffwarningTb4b4b4(Ta5d6ff"Ta5d6ffLandlock disabled: Tffd700%sTa5d6ff"Tb4b4b4, Te6edf3excTb4b4b4)
Tff7b72return Tff7b72False
Te6edf3abi Tff7b72= Te6edf3_probe_landlock_abiTb4b4b4(Tb4b4b4)
Tff7b72if Te6edf3abi Tff7b72< T79c0ff1Tb4b4b4:
Te6edf3loggerTff7b72.Td2a8ffwarningTb4b4b4(Ta5d6ff"Ta5d6ffLandlock disabled: ABI probe failedTa5d6ff"Tb4b4b4)
Tff7b72return Tff7b72False
Te6edf3handled Tff7b72= Te6edf3_handled_access_fs_for_abiTb4b4b4(Te6edf3abiTb4b4b4)
Te6edf3read_access Tff7b72= Te6edf3_read_access_for_handledTb4b4b4(Te6edf3handledTb4b4b4)
Te6edf3rw_access Tff7b72= Te6edf3_rw_access_for_handledTb4b4b4(Te6edf3handledTb4b4b4)
Te6edf3attr Tff7b72= Te6edf3_LandlockRulesetAttrTb4b4b4(Te6edf3handled_access_fsTff7b72=Te6edf3handledTb4b4b4)
Tff7b72tryTb4b4b4:
Te6edf3ruleset_fd Tff7b72= Te6edf3_syscallTb4b4b4(
Te6edf3libcTb4b4b4,
Te6edf3create_nrTb4b4b4,
Te6edf3ctypesTff7b72.Td2a8ffbyrefTb4b4b4(Te6edf3attrTb4b4b4)Tb4b4b4,
Te6edf3_ruleset_attr_sizeTb4b4b4(Te6edf3abiTb4b4b4)Tb4b4b4,
T79c0ff0Tb4b4b4,
Tb4b4b4)
Tff7b72except Tf85149OSError Tff7b72as Te6edf3excTb4b4b4:
Te6edf3loggerTff7b72.Td2a8ffwarningTb4b4b4(Ta5d6ff"Ta5d6ffLandlock disabled: Tffd700%sTa5d6ff"Tb4b4b4, Te6edf3excTb4b4b4)
Tff7b72return Tff7b72False
Tff7b72tryTb4b4b4:
Tff7b72for Te6edf3root Tff7b72in Te6edf3_collect_read_rootsTb4b4b4(Tb4b4b4)Tb4b4b4:
Te6edf3_add_path_beneath_ruleTb4b4b4(
Te6edf3libcTb4b4b4, Te6edf3add_rule_nrTb4b4b4, Te6edf3ruleset_fdTb4b4b4, Te6edf3rootTb4b4b4, Te6edf3read_accessTb4b4b4, Te6edf3handled
Tb4b4b4)
Te6edf3rw_roots Tff7b72= Te6edf3_collect_rw_rootsTb4b4b4(Te6edf3storage_dirTb4b4b4, Te6edf3reticulum_config_dirTb4b4b4, Te6edf3log_dirTb4b4b4)
Te6edf3public_existing Tff7b72= Te6edf3_existing_dirTb4b4b4(Te6edf3public_dirTb4b4b4)
Tff7b72if Te6edf3public_existing Tff7b72and Te6edf3public_existing Tff7b72not Tff7b72in Te6edf3rw_rootsTb4b4b4:
Te6edf3rw_rootsTff7b72.Td2a8ffappendTb4b4b4(Te6edf3public_existingTb4b4b4)
Tff7b72for Te6edf3root Tff7b72in Te6edf3rw_rootsTb4b4b4:
Te6edf3_add_path_beneath_ruleTb4b4b4(
Te6edf3libcTb4b4b4, Te6edf3add_rule_nrTb4b4b4, Te6edf3ruleset_fdTb4b4b4, Te6edf3rootTb4b4b4, Te6edf3rw_accessTb4b4b4, Te6edf3handled
Tb4b4b4)
Te6edf3_syscallTb4b4b4(Te6edf3libcTb4b4b4, Te6edf3restrict_nrTb4b4b4, Te6edf3ruleset_fdTb4b4b4, T79c0ff0Tb4b4b4)
Tff7b72except Tf85149OSError Tff7b72as Te6edf3excTb4b4b4:
Te6edf3loggerTff7b72.Td2a8ffwarningTb4b4b4(Ta5d6ff"Ta5d6ffLandlock disabled while adding rules: Tffd700%sTa5d6ff"Tb4b4b4, Te6edf3excTb4b4b4)
Tff7b72tryTb4b4b4:
Te6edf3osTff7b72.Td2a8ffcloseTb4b4b4(Te6edf3ruleset_fdTb4b4b4)
Tff7b72except Tf85149OSErrorTb4b4b4:
Tff7b72pass
Tff7b72return Tff7b72False
Tff7b72tryTb4b4b4:
Te6edf3osTff7b72.Td2a8ffcloseTb4b4b4(Te6edf3ruleset_fdTb4b4b4)
Tff7b72except Tf85149OSErrorTb4b4b4:
Tff7b72pass
Tff7b72if Te6edf3landlock_auto_enabledTb4b4b4(Tb4b4b4)Tb4b4b4:
Te6edf3loggerTff7b72.Td2a8ffinfoTb4b4b4(
Ta5d6ff"Ta5d6ffLandlock filesystem sandbox enabled (auto-detected on Linux, ABI Tffd700%sTa5d6ff)Ta5d6ff"Tb4b4b4,
Te6edf3abiTb4b4b4,
Tb4b4b4)
Tff7b72elseTb4b4b4:
Te6edf3loggerTff7b72.Td2a8ffinfoTb4b4b4(Ta5d6ff"Ta5d6ffLandlock filesystem sandbox enabled (ABI Tffd700%sTa5d6ff)Ta5d6ff"Tb4b4b4, Te6edf3abiTb4b4b4)
Tff7b72return Tff7b72True
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────