When using make oldconfig with a previous configuration already
including the CONFIG_LSM variable, no question is asked to update its
content.
Update the Kconfig help and add hints to the sample to help user
understand the required configuration.
This also cut long strings to fit in 100 columns.
Cc: James Morris <jmorris@xxxxxxxxx>
Cc: Jann Horn <jannh@xxxxxxxxxx>
Cc: Serge E. Hallyn <serge@xxxxxxxxxx>
Signed-off-by: Mickaël Salaün <mic@xxxxxxxxxxx>
---
samples/landlock/sandboxer.c | 21 +++++++++++++++++++--
security/landlock/Kconfig | 4 +++-
2 files changed, 22 insertions(+), 3 deletions(-)
diff --git a/samples/landlock/sandboxer.c b/samples/landlock/sandboxer.c
index ee5ec1203cb7..127fb063c23a 100644
--- a/samples/landlock/sandboxer.c
+++ b/samples/landlock/sandboxer.c
@@ -169,7 +169,8 @@ int main(const int argc, char *const argv[], char *const *const envp)
fprintf(stderr, "usage: %s=\"...\" %s=\"...\" %s <cmd> [args]...\n\n",
ENV_FS_RO_NAME, ENV_FS_RW_NAME, argv[0]);
fprintf(stderr, "Launch a command in a restricted environment.\n\n");
- fprintf(stderr, "Environment variables containing paths, each separated by a colon:\n");
+ fprintf(stderr, "Environment variables containing paths, "
+ "each separated by a colon:\n");
fprintf(stderr, "* %s: list of paths allowed to be used in a read-only way.\n",
ENV_FS_RO_NAME);
fprintf(stderr, "* %s: list of paths allowed to be used in a read-write way.\n",
@@ -185,6 +186,21 @@ int main(const int argc, char *const argv[], char *const *const envp)
ruleset_fd = landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
if (ruleset_fd < 0) {
perror("Failed to create a ruleset");
+ switch (errno) {
+ case ENOSYS:
+ fprintf(stderr, "Hint: Landlock is not supported by the current kernel. "
+ "To support it, build the kernel with "
+ "CONFIG_SECURITY_LANDLOCK=y and prepend "
+ "\"landlock,\" to the content of CONFIG_LSM.\n");
+ break;
+ case EOPNOTSUPP:
+ fprintf(stderr, "Hint: Landlock is currently disabled. "
+ "It can be enabled in the kernel configuration by "
+ "prepending \"landlock,\" to the content of CONFIG_LSM, "
+ "or at boot time by setting the same content to the "
+ "\"lsm\" kernel parameter.\n");
+ break;
+ }
return 1;
}
if (populate_ruleset(ENV_FS_RO_NAME, ruleset_fd,
@@ -210,7 +226,8 @@ int main(const int argc, char *const argv[], char *const *const envp)
execvpe(cmd_path, cmd_argv, envp);
fprintf(stderr, "Failed to execute \"%s\": %s\n", cmd_path,
strerror(errno));
- fprintf(stderr, "Hint: access to the binary, the interpreter or shared libraries may be denied.\n");
+ fprintf(stderr, "Hint: access to the binary, the interpreter or "
+ "shared libraries may be denied.\n");
return 1;
err_close_ruleset:
diff --git a/security/landlock/Kconfig b/security/landlock/Kconfig
index cbf88bb7fd97..43e5b0bb0706 100644
--- a/security/landlock/Kconfig
+++ b/security/landlock/Kconfig
@@ -16,4 +16,6 @@ config SECURITY_LANDLOCK
See Documentation/userspace-api/landlock.rst for further information.
- If you are unsure how to answer this question, answer N.
+ If you are unsure how to answer this question, answer N. Otherwise, you
+ should also prepend "landlock," to the content of CONFIG_LSM to enable
+ Landlock at boot time.
--
2.29.2
