diff options
| author | Jia Tan <jiat0218@gmail.com> | 2024-02-26 23:02:06 +0800 |
|---|---|---|
| committer | Lasse Collin <lasse.collin@tukaani.org> | 2024-02-28 18:31:04 +0200 |
| commit | a100f9111c8cc7f5b5f0e4a5e8af3de7161c7975 (patch) | |
| tree | b4eeeadacc883f3e2a60e06d8e9d960fe3ff8db8 /configure.ac | |
| parent | Tests: Add test_microlzma to .gitignore and CMakeLists.txt. (diff) | |
| download | xz-a100f9111c8cc7f5b5f0e4a5e8af3de7161c7975.tar.xz | |
Build: Fix Linux Landlock feature test in Autotools and CMake builds.
The previous Linux Landlock feature test assumed that having the
linux/landlock.h header file was enough. The new feature tests also
requires that prctl() and the required Landlock system calls are
supported.
Diffstat (limited to 'configure.ac')
| -rw-r--r-- | configure.ac | 27 |
1 files changed, 26 insertions, 1 deletions
diff --git a/configure.ac b/configure.ac index 3676cd03..446e26e2 100644 --- a/configure.ac +++ b/configure.ac @@ -1177,12 +1177,37 @@ AS_CASE([$enable_sandbox], ) AS_CASE([$enable_sandbox], [auto | landlock], [ - AC_CHECK_HEADERS([linux/landlock.h], [ + AC_MSG_CHECKING([if Linux Landlock is usable]) + + # A compile check is done here because some systems have + # linux/landlock.h, but do not have the syscalls defined + # in order to actually use Linux Landlock. + AC_COMPILE_IFELSE([AC_LANG_SOURCE([[ + #include <linux/landlock.h> + #include <sys/syscall.h> + #include <sys/prctl.h> + + void my_sandbox(void) + { + (void)prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); + (void)SYS_landlock_create_ruleset; + (void)SYS_landlock_restrict_self; + (void)LANDLOCK_CREATE_RULESET_VERSION; + return; + } + ]])], [ enable_sandbox=found AS_CASE([$CFLAGS], [*-fsanitize=*], [AC_MSG_ERROR([ CFLAGS contains '-fsanitize=' which is incompatible with the Landlock sandboxing. Use --disable-sandbox when using '-fsanitize'.])]) + + AC_DEFINE([HAVE_LINUX_LANDLOCK], [1], + [Define to 1 if Linux Landlock is supported. + See configure.ac for details.]) + AC_MSG_RESULT([yes]) + ], [ + AC_MSG_RESULT([no]) ]) ] ) |