From patchwork Sat Oct 19 15:15:32 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Matthieu Buffet X-Patchwork-Id: 13842768 Received: from mx1.buffet.re (mx1.buffet.re [51.83.41.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E9CA08472; Sat, 19 Oct 2024 15:14:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=51.83.41.69 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729350894; cv=none; b=f4AMn4WNKX5tHqkMjv8jz6w0n3VvTB7MSh3OoGtxF5dUlz7sglGl5WcTE4AmD4+x++m4acDTCjpcUwYZfRf5HIHmjxK009dBB90JZWCbcOe7I0HriUv7BJ1yS9C37VWGxGDJvOHMqIJAjB9uuXvlkO16UvgxIbbVP8J34aoTwB0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729350894; c=relaxed/simple; bh=EbOaNfV96LGnKaVuzgC8ZReAzEf1xeV3TJnMvRw0RKw=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=op7zY/+kCBi6n8l1WlHOUn/pzQL7BwiOzJ2mkmsCvN8594sQTh13TN0svfwC8KLJHUBYrsSSkM3RQl0sMKNuLGURWHuw7un+a/cJvMr0I9bz3ee4jb5pali6DLqjTwPQPgBmgSlzHGqbUo9XmZD4aB2vrRh/nTaEZjLT4h5U4fA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=buffet.re; spf=pass smtp.mailfrom=buffet.re; dkim=pass (2048-bit key) header.d=buffet.re header.i=@buffet.re header.b=D22pavtT; arc=none smtp.client-ip=51.83.41.69 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=buffet.re Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=buffet.re Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=buffet.re header.i=@buffet.re header.b="D22pavtT" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=buffet.re; s=mx1; t=1729350882; bh=EbOaNfV96LGnKaVuzgC8ZReAzEf1xeV3TJnMvRw0RKw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=D22pavtT67F9YQpapMTd18eKhpaRqHIF1ckPStjcxsB2cti+274q8bY7CMmMjnUhE Gufm3NbEkZ6R4T7aYiHx/wrDGgPn4ZsZdlIexXRzijSXvS9iu/daOHOw1zMVLb/6Im SYBCHOOh+3T7rPlZcekOEmuzkYlv5Kuz5Q3twHF0EmR5t003GD2sdOrjrv8LL2j5Xb 6aa60tCMk91S02I7xEVCfU/uVsdE4Q7GdGWbYiv5aPjOsb026OQt0yPbCYF/Qhn/UV 0OARaJHRn6J0cF26gaOa2magAgZTbcWxQyKZfMXDzrWEI+rTqeG2lPLMIeJSge6XPY NG6dEn3IL0Icg== Received: from localhost.localdomain (unknown [10.0.1.3]) by mx1.buffet.re (Postfix) with ESMTPA id 1F21E123074; Sat, 19 Oct 2024 17:14:42 +0200 (CEST) From: Matthieu Buffet To: =?utf-8?q?Micka=C3=ABl_Sala=C3=BCn?= Cc: =?utf-8?q?G=C3=BCnther_Noack?= , Konstantin Meskhidze , Ivanov Mikhail , linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, Matthieu Buffet , Tahera Fahimi Subject: [PATCH v3 1/3] samples/landlock: Fix port parsing in sandboxer Date: Sat, 19 Oct 2024 17:15:32 +0200 Message-Id: <20241019151534.1400605-2-matthieu@buffet.re> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20241019151534.1400605-1-matthieu@buffet.re> References: <20241019151534.1400605-1-matthieu@buffet.re> Precedence: bulk X-Mailing-List: linux-security-module@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 If you want to specify that no port can be bind()ed, you would think (looking quickly at both help message and code) that setting LL_TCP_BIND="" would do it. However the code splits on ":" then applies atoi(), which does not allow checking for errors. Passing an empty string returns 0, which is interpreted as "allow bind(0)", which means bind to any ephemeral port. This bug occurs whenever passing an empty string or when leaving a trailing/leading colon, making it impossible to completely deny bind(). To reproduce: export LL_FS_RO="/" LL_FS_RW="" LL_TCP_BIND="" ./sandboxer strace -e bind nc -n -vvv -l -p 0 Executing the sandboxed command... bind(3, {sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("0.0.0.0")}, 16) = 0 Listening on 0.0.0.0 37629 Use strtoull(3) instead, which allows error checking. Check that the entire string has been parsed correctly without overflows/underflows, but not that the __u64 (the type of struct landlock_net_port_attr.port) is a valid __u16 port: that is already done by the kernel. Fixes: 5e990dcef12e ("samples/landlock: Support TCP restrictions") Signed-off-by: Matthieu Buffet --- samples/landlock/sandboxer.c | 32 ++++++++++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-) diff --git a/samples/landlock/sandboxer.c b/samples/landlock/sandboxer.c index f847e832ba14..4cbef9d2f15b 100644 --- a/samples/landlock/sandboxer.c +++ b/samples/landlock/sandboxer.c @@ -60,6 +60,25 @@ static inline int landlock_restrict_self(const int ruleset_fd, #define ENV_SCOPED_NAME "LL_SCOPED" #define ENV_DELIMITER ":" +static int str2num(const char *numstr, __u64 *num_dst) +{ + char *endptr = NULL; + int err = 0; + __u64 num; + + errno = 0; + num = strtoull(numstr, &endptr, 10); + if (errno != 0) + err = errno; + /* Was the string empty, or not entirely parsed successfully? */ + else if ((*numstr == '\0') || (*endptr != '\0')) + err = EINVAL; + else + *num_dst = num; + + return err; +} + static int parse_path(char *env_path, const char ***const path_list) { int i, num_paths = 0; @@ -160,7 +179,6 @@ static int populate_ruleset_net(const char *const env_var, const int ruleset_fd, char *env_port_name, *env_port_name_next, *strport; struct landlock_net_port_attr net_port = { .allowed_access = allowed_access, - .port = 0, }; env_port_name = getenv(env_var); @@ -171,7 +189,17 @@ static int populate_ruleset_net(const char *const env_var, const int ruleset_fd, env_port_name_next = env_port_name; while ((strport = strsep(&env_port_name_next, ENV_DELIMITER))) { - net_port.port = atoi(strport); + __u64 port; + + if (strcmp(strport, "") == 0) + continue; + + if (str2num(strport, &port)) { + fprintf(stderr, "Failed to parse port at \"%s\"\n", + strport); + goto out_free_name; + } + net_port.port = port; if (landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &net_port, 0)) { fprintf(stderr, From patchwork Sat Oct 19 15:15:33 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Matthieu Buffet X-Patchwork-Id: 13842769 Received: from mx1.buffet.re (mx1.buffet.re [51.83.41.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 063E910E4; Sat, 19 Oct 2024 15:15:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=51.83.41.69 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729350943; cv=none; b=YokBiSPjBe8MZtAKFOWJTm/UhPcm12VzHo+vKg8ssRw31U0WaH9PUhj3zlEkpWmTH86qzw/Rp4pCw9Zwaub45AsVR3YvhQe6MvSMbHslcFn4Pv1abKFmAs3YLc+WzNyIr8gCD2AgnrUjzgpr2o5DAqYtPCDSL+dKRoagtBiA76U= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729350943; c=relaxed/simple; bh=4p0yi6hQrklynyNTJu66D+95UFCO+N8SlLzW+Fppcg0=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=R0r/tIunFHTTkB9OAmiCTqOYuB61MnIoYj0IW9BIdXcBsASURiUzOvXXEy5XzVRUOGY2w3CAj5UCCiCAJpgnb5RnuMWhJIQlHNYWrTjshch+tbvnyvfqatPF+eorT0eqG1lK9BQ8r3Cy4Z27z95tVr7qJgtim7qf/cNMA8EXGsk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=buffet.re; spf=pass smtp.mailfrom=buffet.re; dkim=pass (2048-bit key) header.d=buffet.re header.i=@buffet.re header.b=VTuhLc0F; arc=none smtp.client-ip=51.83.41.69 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=buffet.re Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=buffet.re Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=buffet.re header.i=@buffet.re header.b="VTuhLc0F" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=buffet.re; s=mx1; t=1729350934; bh=4p0yi6hQrklynyNTJu66D+95UFCO+N8SlLzW+Fppcg0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VTuhLc0FF8VlhjZuG18YyRl70fRf2BMM6YPMrAUp4BKJ7VSk1CTIrwRlbpf3BQC48 vfMo6ed5US/+E2yTO7fR+WmYbglISNyfZYLF53Wz/pz0wtRZcv09shuqE02PQesQ9x C+jfBw/NWMPTi+Sj1rq6svlShQSgv7ZERcU3B3H8537Hl3V//WlJAN9cyIxjpORMaA nX1czajwNx9bkvYeaFtKDHQuoSFf1GpXVS1PTCOp744Ra8OU0Qdw5U94IQjCtK2YLV ekIb2uu+wud4mB/7wb6QhJ3FQJ+G0iF+P+3c7INGKEIemVuXZv5aFrfhBaD4DEL22S 7u3hSMYkah8EA== Received: from localhost.localdomain (unknown [10.0.1.3]) by mx1.buffet.re (Postfix) with ESMTPA id 08279123074; Sat, 19 Oct 2024 17:15:34 +0200 (CEST) From: Matthieu Buffet To: =?utf-8?q?Micka=C3=ABl_Sala=C3=BCn?= Cc: =?utf-8?q?G=C3=BCnther_Noack?= , Konstantin Meskhidze , Ivanov Mikhail , linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, Matthieu Buffet , Tahera Fahimi Subject: [PATCH v3 2/3] samples/landlock: Refactor help message Date: Sat, 19 Oct 2024 17:15:33 +0200 Message-Id: <20241019151534.1400605-3-matthieu@buffet.re> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20241019151534.1400605-1-matthieu@buffet.re> References: <20241019151534.1400605-1-matthieu@buffet.re> Precedence: bulk X-Mailing-List: linux-security-module@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Help message is getting larger with each new supported feature (scopes, and soon UDP). Also the large number of calls to fprintf with environment variables make it hard to read. Refactor it away into a single simpler constant format string. Signed-off-by: Matthieu Buffet --- samples/landlock/sandboxer.c | 79 +++++++++++++++++------------------- 1 file changed, 38 insertions(+), 41 deletions(-) diff --git a/samples/landlock/sandboxer.c b/samples/landlock/sandboxer.c index 4cbef9d2f15b..38fc6ebd7222 100644 --- a/samples/landlock/sandboxer.c +++ b/samples/landlock/sandboxer.c @@ -290,6 +290,43 @@ static bool check_ruleset_scope(const char *const env_var, #define LANDLOCK_ABI_LAST 6 +#define XSTR(s) #s +#define STR(s) XSTR(s) + +/* clang-format off */ + +static const char help[] = + "usage: " + ENV_FS_RO_NAME "=\"...\" " + ENV_FS_RW_NAME "=\"...\" " + ENV_TCP_BIND_NAME "=\"...\" " + ENV_TCP_CONNECT_NAME "=\"...\" " + ENV_SCOPED_NAME "=\"...\" %1$s [args]...\n" + "\n" + "Execute a command in a restricted environment.\n" + "\n" + "Environment variables containing paths and ports each separated by a colon:\n" + "* " ENV_FS_RO_NAME ": list of paths allowed to be used in a read-only way\n" + "* " ENV_FS_RW_NAME ": list of paths allowed to be used in a read-write way\n" + "\n" + "Environment variables containing ports are optional and could be skipped.\n" + "* " ENV_TCP_BIND_NAME ": list of ports allowed to bind (server)\n" + "* " ENV_TCP_CONNECT_NAME ": list of ports allowed to connect (client)\n" + "* " ENV_SCOPED_NAME ": list of scoped IPCs\n" + "\n" + "Example:\n" + ENV_FS_RO_NAME "=\"${PATH}:/lib:/usr:/proc:/etc:/dev/urandom\" " + ENV_FS_RW_NAME "=\"/dev/null:/dev/full:/dev/zero:/dev/pts:/tmp\" " + ENV_TCP_BIND_NAME "=\"9418\" " + ENV_TCP_CONNECT_NAME "=\"80:443\" " + ENV_SCOPED_NAME "=\"a:s\" " + "%1$s bash -i\n" + "\n" + "This sandboxer can use Landlock features up to ABI version " + STR(LANDLOCK_ABI_LAST) ".\n"; + +/* clang-format on */ + int main(const int argc, char *const argv[], char *const *const envp) { const char *cmd_path; @@ -308,47 +345,7 @@ int main(const int argc, char *const argv[], char *const *const envp) }; if (argc < 2) { - fprintf(stderr, - "usage: %s=\"...\" %s=\"...\" %s=\"...\" %s=\"...\" %s=\"...\" %s " - " [args]...\n\n", - ENV_FS_RO_NAME, ENV_FS_RW_NAME, ENV_TCP_BIND_NAME, - ENV_TCP_CONNECT_NAME, ENV_SCOPED_NAME, argv[0]); - fprintf(stderr, - "Execute a command in a restricted environment.\n\n"); - fprintf(stderr, - "Environment variables containing paths and ports " - "each separated by a colon:\n"); - fprintf(stderr, - "* %s: list of paths allowed to be used in a read-only way.\n", - ENV_FS_RO_NAME); - fprintf(stderr, - "* %s: list of paths allowed to be used in a read-write way.\n\n", - ENV_FS_RW_NAME); - fprintf(stderr, - "Environment variables containing ports are optional " - "and could be skipped.\n"); - fprintf(stderr, - "* %s: list of ports allowed to bind (server).\n", - ENV_TCP_BIND_NAME); - fprintf(stderr, - "* %s: list of ports allowed to connect (client).\n", - ENV_TCP_CONNECT_NAME); - fprintf(stderr, "* %s: list of scoped IPCs.\n", - ENV_SCOPED_NAME); - fprintf(stderr, - "\nexample:\n" - "%s=\"${PATH}:/lib:/usr:/proc:/etc:/dev/urandom\" " - "%s=\"/dev/null:/dev/full:/dev/zero:/dev/pts:/tmp\" " - "%s=\"9418\" " - "%s=\"80:443\" " - "%s=\"a:s\" " - "%s bash -i\n\n", - ENV_FS_RO_NAME, ENV_FS_RW_NAME, ENV_TCP_BIND_NAME, - ENV_TCP_CONNECT_NAME, ENV_SCOPED_NAME, argv[0]); - fprintf(stderr, - "This sandboxer can use Landlock features " - "up to ABI version %d.\n", - LANDLOCK_ABI_LAST); + fprintf(stderr, help, argv[0]); return 1; } From patchwork Sat Oct 19 15:15:34 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Matthieu Buffet X-Patchwork-Id: 13842770 Received: from mx1.buffet.re (mx1.buffet.re [51.83.41.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A19212A1DC; Sat, 19 Oct 2024 15:16:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=51.83.41.69 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729350981; cv=none; b=Y0mHdqEBleqkbcsvWQAGKQpopN09DVEbrS0I28dFfO66u7cfwhk9dFfecm5RArBTuOvj7k3YzEwwxtj0jH0BN2OsAcc+b1vyzMeTaKOuPBFW5PDDX6bn4mXF+SYWvl2KCBqfS6pEGt+vR1cJmWQb0Xx2AUBgdSGJioCJTf9jVa8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729350981; c=relaxed/simple; bh=pb5BOcbIw+1C1GTdxWqkBm/vZQtpW4RtR+DB6pQVSpw=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=oI4TB5Dm96g0pffWqf9PI0gWkka6LnHFKfcB9iQIvIqGkjsTvnnIZKqAneIrD0GWZJMTcMPb5vNB/CqYG07WC7yqNnHgP+g44HR8GmF73VBdoDVBYTHwheEBCXbJL8OWSUKA3pUBiPxWn/xkPVl4MTLRwpWrIvA26o7iEcBIh6w= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=buffet.re; spf=pass smtp.mailfrom=buffet.re; dkim=pass (2048-bit key) header.d=buffet.re header.i=@buffet.re header.b=CP/nvToJ; arc=none smtp.client-ip=51.83.41.69 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=buffet.re Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=buffet.re Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=buffet.re header.i=@buffet.re header.b="CP/nvToJ" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=buffet.re; s=mx1; t=1729350972; bh=pb5BOcbIw+1C1GTdxWqkBm/vZQtpW4RtR+DB6pQVSpw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CP/nvToJ/wCqnnvAbjydjgKVpPMeYVBCPXYbygwdPLKD5KX/l+b8fH3lBhdVBs1TR rX3yGOeiRLsxzJJywoB/+lKaskYmLogL1eNxlahoL5GDasUzTGqqj8pvUSmh5ZjRm4 QGuXN5wW8O8M5JA1RCD3JvVrsNsFj11CNpFkIEhWdNllDNJt5at5H6NmSOuNC4FnSU SESVj4VyVqcRkGWBxV+8CHB2NsVYbx9FuSmc5WY/JXi8R5fqrEnEzjTmhef9Y8pZZ4 UYbR5E4/yvRm6nEGCIFfrpjBRfOUkr8wIzx/xt2rm5OlRZFx9dPLBN0nmWUnPotL8U jqe0EFze04GqQ== Received: from localhost.localdomain (unknown [10.0.1.3]) by mx1.buffet.re (Postfix) with ESMTPA id B7112123074; Sat, 19 Oct 2024 17:16:12 +0200 (CEST) From: Matthieu Buffet To: =?utf-8?q?Micka=C3=ABl_Sala=C3=BCn?= Cc: =?utf-8?q?G=C3=BCnther_Noack?= , Konstantin Meskhidze , Ivanov Mikhail , linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, Matthieu Buffet , Tahera Fahimi Subject: [PATCH v3 3/3] samples/landlock: Clarify option parsing behaviour Date: Sat, 19 Oct 2024 17:15:34 +0200 Message-Id: <20241019151534.1400605-4-matthieu@buffet.re> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20241019151534.1400605-1-matthieu@buffet.re> References: <20241019151534.1400605-1-matthieu@buffet.re> Precedence: bulk X-Mailing-List: linux-security-module@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Clarify the distinction between filesystem variables (mandatory) and all others (optional). For optional variables, explain the difference between unset variables (no access check performed) and empty variables (nothing allowed for lists of allowed paths/ports, or no effect for lists of scopes). List LL_SCOPED values understood and their effect. Signed-off-by: Matthieu Buffet --- samples/landlock/sandboxer.c | 29 +++++++++++++++-------------- 1 file changed, 15 insertions(+), 14 deletions(-) diff --git a/samples/landlock/sandboxer.c b/samples/landlock/sandboxer.c index 38fc6ebd7222..96b451cf0531 100644 --- a/samples/landlock/sandboxer.c +++ b/samples/landlock/sandboxer.c @@ -296,23 +296,24 @@ static bool check_ruleset_scope(const char *const env_var, /* clang-format off */ static const char help[] = - "usage: " - ENV_FS_RO_NAME "=\"...\" " - ENV_FS_RW_NAME "=\"...\" " - ENV_TCP_BIND_NAME "=\"...\" " - ENV_TCP_CONNECT_NAME "=\"...\" " - ENV_SCOPED_NAME "=\"...\" %1$s [args]...\n" + "usage: " ENV_FS_RO_NAME "=\"...\" " ENV_FS_RW_NAME "=\"...\" " + "[other environment variables] %1$s [args]...\n" "\n" - "Execute a command in a restricted environment.\n" + "Execute the given command in a restricted environment.\n" + "Multi-valued settings (lists of ports, paths, scopes) are colon-delimited.\n" "\n" - "Environment variables containing paths and ports each separated by a colon:\n" - "* " ENV_FS_RO_NAME ": list of paths allowed to be used in a read-only way\n" - "* " ENV_FS_RW_NAME ": list of paths allowed to be used in a read-write way\n" + "Mandatory settings:\n" + "* " ENV_FS_RO_NAME ": paths allowed to be used in a read-only way\n" + "* " ENV_FS_RW_NAME ": paths allowed to be used in a read-write way\n" "\n" - "Environment variables containing ports are optional and could be skipped.\n" - "* " ENV_TCP_BIND_NAME ": list of ports allowed to bind (server)\n" - "* " ENV_TCP_CONNECT_NAME ": list of ports allowed to connect (client)\n" - "* " ENV_SCOPED_NAME ": list of scoped IPCs\n" + "Optional settings (when not set, their associated access check " + "is always allowed, which is different from an empty string which " + "means an empty list)\n" + "* " ENV_TCP_BIND_NAME ": ports allowed to bind (server)\n" + "* " ENV_TCP_CONNECT_NAME ": ports allowed to connect (client)\n" + "* " ENV_SCOPED_NAME ": actions denied on the outside of the landlock domain\n" + " - \"a\" to restrict opening abstract unix sockets\n" + " - \"s\" to restrict sending signals\n" "\n" "Example:\n" ENV_FS_RO_NAME "=\"${PATH}:/lib:/usr:/proc:/etc:/dev/urandom\" "