Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

landlock: amend empty functions and comments #6305

Merged
merged 1 commit into from
Apr 11, 2024

Conversation

kmk3
Copy link
Collaborator

@kmk3 kmk3 commented Apr 10, 2024

Changes:

  • Always declare public landlock functions, regardless of
    HAVE_LANDLOCK
  • Make the other public landlock functions (besides ll_add_profile)
    also be empty when HAVE_LANDLOCK is not defined
  • Clarify related comments

This amends commit 8259f66 ("landlock fix for old kernel versions",
2024-04-06).

For clarity, landlock-common.inc is included by default.profile and the
issue that the aforementioned commit fixes is that if profile.c is built
without the part that parses landlock commands (that is, when
HAVE_LANDLOCK is not defined), using default.profile would cause
firejail to abort due to "invalid lines".

Note that the issue would only occur when firejail is built with an
older kernel (or with --disable-landlock), not when simply running on an
older kernel.

See also commit b02a7a3 ("landlock: remove empty functions",
2023-12-07).

Relates to #6078.

Changes:

* Always declare public landlock functions, regardless of
  `HAVE_LANDLOCK`
* Make the other public landlock functions (besides `ll_add_profile`)
  also be empty when `HAVE_LANDLOCK` is not defined
* Clarify related comments

This amends commit 8259f66 ("landlock fix for old kernel versions",
2024-04-06).

For clarity, landlock-common.inc is included by default.profile and the
issue that the aforementioned commit fixes is that if profile.c is built
without the part that parses landlock commands (that is, when
`HAVE_LANDLOCK` is not defined), using default.profile would cause
firejail to abort due to "invalid lines".

Note that the issue would only occur when firejail is built with an
older kernel (or with --disable-landlock), not when simply running on an
older kernel.

See also commit b02a7a3 ("landlock: remove empty functions",
2023-12-07).

Relates to netblue30#6078.
@netblue30
Copy link
Owner

Looks fine, merging in!

@netblue30 netblue30 merged commit 442a2f8 into netblue30:master Apr 11, 2024
13 checks passed
@kmk3 kmk3 deleted the landlock-amend-empty branch April 12, 2024 21:27
kmk3 added a commit that referenced this pull request Apr 25, 2024
kmk3 added a commit to kmk3/firejail that referenced this pull request Apr 29, 2024
landlock.h may not be available on the system (such as with older
versions of Linux API headers), so only try to include it if
`HAVE_LANDLOCK` is defined.

This fixes the following error from `build_debian_package` (which uses
`debian:buster`) on GitLab CI[1]:

    $ ./mkdeb.sh --enable-fatal-warnings
    [...]
    gcc [...] -c ../../src/firejail/landlock.c -o ../../src/firejail/landlock.o
    ../../src/firejail/landlock.c:22:10: fatal error: linux/landlock.h: No such file or directory
     #include <linux/landlock.h>
              ^~~~~~~~~~~~~~~~~~
    compilation terminated.

This amends commit a05ae97 ("landlock: amend empty functions and
comments", 2024-04-08) / PR netblue30#6305.

Relates to netblue30#6078.

[1] https://gitlab.com/Firejail/firejail_ci/-/jobs/6743161059
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Status: Done (on RELNOTES)
Development

Successfully merging this pull request may close these issues.

3 participants