From 6465d94eb6e71f57986c25ba88fe3c0e39195a21 Mon Sep 17 00:00:00 2001
From: Peter Seiderer <ps.report@gmx.net>
Date: Mon, 8 Jul 2024 11:05:47 +0200
Subject: [PATCH v1] Add support for landlock_create_ruleset (444),
 landlock_add_rule (445) and landlock_restrict_self (446) syscalls

- add support for landlock_create_ruleset (444) syscall
- add support for landlock_add_rule (445) syscall
- add support for landlock_restrict_self (446) syscall

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
---
 coregrind/m_syswrap/priv_syswrap-linux.h  |  5 ++++
 coregrind/m_syswrap/syswrap-amd64-linux.c |  4 +++
 coregrind/m_syswrap/syswrap-arm64-linux.c |  4 +++
 coregrind/m_syswrap/syswrap-linux.c       | 25 ++++++++++++++++
 coregrind/m_syswrap/syswrap-x86-linux.c   |  4 +++
 include/Makefile.am                       |  3 +-
 include/pub_tool_vki.h                    |  1 +
 include/vki/vki-linux-landlock.h          | 35 +++++++++++++++++++++++
 include/vki/vki-scnums-shared-linux.h     |  4 +++
 9 files changed, 84 insertions(+), 1 deletion(-)
 create mode 100644 include/vki/vki-linux-landlock.h

diff --git a/coregrind/m_syswrap/priv_syswrap-linux.h b/coregrind/m_syswrap/priv_syswrap-linux.h
index d50cdcc98..221439a0e 100644
--- a/coregrind/m_syswrap/priv_syswrap-linux.h
+++ b/coregrind/m_syswrap/priv_syswrap-linux.h
@@ -328,6 +328,11 @@ DECL_TEMPLATE(linux, sys_pidfd_open);
 DECL_TEMPLATE(linux, sys_close_range);
 DECL_TEMPLATE(linux, sys_openat2);
 
+// Linux-specific (new in Linux 5.13)
+DECL_TEMPLATE(linux, sys_landlock_create_ruleset)
+DECL_TEMPLATE(linux, sys_landlock_add_rule)
+DECL_TEMPLATE(linux, sys_landlock_restrict_self)
+
 // Linux-specific (new in Linux 5.14)
 DECL_TEMPLATE(linux, sys_memfd_secret);
 
diff --git a/coregrind/m_syswrap/syswrap-amd64-linux.c b/coregrind/m_syswrap/syswrap-amd64-linux.c
index 86a47d9c2..3170ff857 100644
--- a/coregrind/m_syswrap/syswrap-amd64-linux.c
+++ b/coregrind/m_syswrap/syswrap-amd64-linux.c
@@ -887,6 +887,10 @@ static SyscallTableEntry syscall_table[] = {
 
    LINXY(__NR_epoll_pwait2,      sys_epoll_pwait2),      // 441
 
+   LINX_(__NR_landlock_create_ruleset, sys_landlock_create_ruleset), // 444
+   LINX_(__NR_landlock_add_rule,       sys_landlock_add_rule),       // 445
+   LINX_(__NR_landlock_restrict_self,  sys_landlock_restrict_self),  // 446
+
    LINXY(__NR_memfd_secret,      sys_memfd_secret),      // 447
 
    LINX_(__NR_fchmodat2,         sys_fchmodat2),         // 452
diff --git a/coregrind/m_syswrap/syswrap-arm64-linux.c b/coregrind/m_syswrap/syswrap-arm64-linux.c
index ccc548484..5774a3baf 100644
--- a/coregrind/m_syswrap/syswrap-arm64-linux.c
+++ b/coregrind/m_syswrap/syswrap-arm64-linux.c
@@ -840,6 +840,10 @@ static SyscallTableEntry syscall_main_table[] = {
 
    LINXY(__NR_epoll_pwait2,      sys_epoll_pwait2),      // 441
 
+   LINX_(__NR_landlock_create_ruleset, sys_landlock_create_ruleset), // 444
+   LINX_(__NR_landlock_add_rule,       sys_landlock_add_rule),       // 445
+   LINX_(__NR_landlock_restrict_self,  sys_landlock_restrict_self),  // 446
+
    LINXY(__NR_memfd_secret,      sys_memfd_secret),      // 447
 
    LINX_(__NR_fchmodat2,         sys_fchmodat2),         // 452
diff --git a/coregrind/m_syswrap/syswrap-linux.c b/coregrind/m_syswrap/syswrap-linux.c
index 9f3c51c17..0ed07c063 100644
--- a/coregrind/m_syswrap/syswrap-linux.c
+++ b/coregrind/m_syswrap/syswrap-linux.c
@@ -4163,6 +4163,31 @@ POST(sys_memfd_create)
    }
 }
 
+PRE(sys_landlock_create_ruleset)
+{
+   PRINT("sys_landlock_create_ruleset ( %#" FMT_REGWORD "x, %lu, %lu )",
+         ARG1, ARG2, ARG3);
+   PRE_REG_READ3(long, "landlock_create_ruleset",
+                 const struct vki_landlock_ruleset_attr*, attr,
+                 vki_size_t, size, vki_uint32_t, flags);
+}
+
+PRE(sys_landlock_add_rule)
+{
+   PRINT("sys_landlock_add_rule ( %ld, %lu, %#" FMT_REGWORD "x, %lu )",
+         SARG1, ARG2, ARG3, ARG4);
+   PRE_REG_READ4(long, "landlock_add_rule",
+                 int, ruleset_fd, enum vki_landlock_rule_type, rule_type,
+                 const void*, rule_attr, vki_uint32_t, flags);
+}
+
+PRE(sys_landlock_restrict_self)
+{
+   PRINT("sys_landlock_restrict_self ( %ld, %lu )", SARG1, ARG2);
+   PRE_REG_READ2(long, "landlock_create_ruleset",
+                 int, ruleset_fd, vki_uint32_t, flags);
+}
+
 PRE(sys_memfd_secret)
 {
    PRINT("sys_memfd_secret ( %#" FMT_REGWORD "x )", ARG1);
diff --git a/coregrind/m_syswrap/syswrap-x86-linux.c b/coregrind/m_syswrap/syswrap-x86-linux.c
index ea930bafe..aad8ba7de 100644
--- a/coregrind/m_syswrap/syswrap-x86-linux.c
+++ b/coregrind/m_syswrap/syswrap-x86-linux.c
@@ -1656,6 +1656,10 @@ static SyscallTableEntry syscall_table[] = {
 
    LINXY(__NR_epoll_pwait2,      sys_epoll_pwait2),     // 441
 
+   LINX_(__NR_landlock_create_ruleset, sys_landlock_create_ruleset), // 444
+   LINX_(__NR_landlock_add_rule,       sys_landlock_add_rule),       // 445
+   LINX_(__NR_landlock_restrict_self,  sys_landlock_restrict_self),  // 446
+
    LINXY(__NR_memfd_secret,      sys_memfd_secret),      // 447
 
    LINX_(__NR_fchmodat2,         sys_fchmodat2),         // 452
diff --git a/include/Makefile.am b/include/Makefile.am
index 8012d7374..5d5162a46 100644
--- a/include/Makefile.am
+++ b/include/Makefile.am
@@ -107,4 +107,5 @@ nobase_pkginclude_HEADERS = \
 	vki/vki-xen-xsm.h		\
 	vki/vki-xen-x86.h		\
 	vki/vki-linux-drm.h		\
-	vki/vki-linux-io_uring.h
+	vki/vki-linux-io_uring.h	\
+	vki/vki-linux-landlock.h
diff --git a/include/pub_tool_vki.h b/include/pub_tool_vki.h
index 24f99cc09..7b6e71e11 100644
--- a/include/pub_tool_vki.h
+++ b/include/pub_tool_vki.h
@@ -47,6 +47,7 @@
 #  include "vki/vki-linux.h"
 #  include "vki/vki-linux-drm.h"
 #  include "vki/vki-linux-io_uring.h"
+#  include "vki/vki-linux-landlock.h"
 #elif defined(VGO_darwin)
 #  include "vki/vki-darwin.h"
 #elif defined(VGO_solaris)
diff --git a/include/vki/vki-linux-landlock.h b/include/vki/vki-linux-landlock.h
new file mode 100644
index 000000000..ab027e622
--- /dev/null
+++ b/include/vki/vki-linux-landlock.h
@@ -0,0 +1,35 @@
+/*
+   This file is part of Valgrind, a dynamic binary instrumentation framework.
+
+   Copyright (C) 2024 Peter Seiderer <ps.report@gmx.net>
+
+   This program is free software; you can redistribute it and/or
+   modify it under the terms of the GNU General Public License as
+   published by the Free Software Foundation; either version 2 of the
+   License, or (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, see <http://www.gnu.org/licenses/>.
+
+   The GNU General Public License is contained in the file COPYING.
+*/
+#ifndef __VKI_LANDLOCK_H
+#define __VKI_LANDLOCK_H
+
+// Derived from linux-6.9.7/include/uapi/linux/landlock.h
+struct vki_landlock_ruleset_attr {
+	__vki_u64 handled_access_fs;
+	__vki_u64 handled_access_net;
+};
+
+enum vki_landlock_rule_type {
+	VKI_LANDLOCK_RULE_PATH_BENEATH = 1,
+	VKI_LANDLOCK_RULE_NET_PORT,
+};
+
+#endif
diff --git a/include/vki/vki-scnums-shared-linux.h b/include/vki/vki-scnums-shared-linux.h
index 068a2cd12..20346ca71 100644
--- a/include/vki/vki-scnums-shared-linux.h
+++ b/include/vki/vki-scnums-shared-linux.h
@@ -48,6 +48,10 @@
 
 #define __NR_epoll_pwait2		441
 
+#define __NR_landlock_create_ruleset	444
+#define __NR_landlock_add_rule		445
+#define __NR_landlock_restrict_self	446
+
 #define __NR_memfd_secret		447
 
 #define __NR_fchmodat2		452
-- 
2.45.2

