{"header":{"message":"elpe: sandbox evaluation of untrusted build.ml (seccomp: no net/exec; landlock: writes confined to CWD, no $HOME reads) armed before Dynlink","description":null,"timestamp":"2026-08-04T17:48:17.767418622Z","authors":[{}]},"hash":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC","authors":[{"login":"pmeunier","key":"AAAAC3NzaC1lZDI1NTE5AAAAILagOJFgwaMNhBWQINinKOXmqS4Gh5NgxgriXwdOoINJ"}],"deps":{"hashes":[["P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC","elpe: sandbox evaluation of untrusted build.ml (seccomp: no net/exec; landlock: writes confined to CWD, no $HOME reads) armed before Dynlink"],["AA",null],["UWQB743KR36X6A6JVNK3VH6KMEFUHOUT6ZS2Y2SWIJR55JSF5WQAC","First working shell (with ocaml code)"],["ODUDDQRY373JMDR6W2BHUWSKEU6TEICQMNZIAIFKJPNUA5UN3C4QC","Adding the OCaml interface"],["R7J4254ZZREVMWXXDUM772GPLZSCZSIJKOLEAI33WUF2CPS3X6WQC","Reorganisation of the frontend"],["P27ILID2JNRMIXJNW47AWFYDU37BXQETA63W742HWVWGAXEET4QQC","Frontend: starting the connection before linking"],["LIMIMBOUN3DCIKKTHOK4TAXAWQXNVQXBTMNZYN22DJX4L4FZQH4AC","Bootstrapping the Rust part"],["6BIP2OPVOFSOHOFNNRARTKNZFRZH7IDZOAJEPW33KKFGMSDIALYQC","Allowing default shell, and renaming it to shell.ml"],["WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC","elpe frontend: SBOM (SPDX 2.3 / CycloneDX 1.5) from lockfile; Darwin/Homebrew source & Mach-O target + lock; mccs solver wiring"],["WIG24AV2QMNDOIJXAE3FTPD7F2TQLRLZLSO7AG7ZEIWA2PD6RRPQC","image: derive /etc system users+groups from shipped sysusers.d (§7.2 iso-boot), replacing the hand-written table"]],"deps":["UWQB743KR36X6A6JVNK3VH6KMEFUHOUT6ZS2Y2SWIJR55JSF5WQAC","ODUDDQRY373JMDR6W2BHUWSKEU6TEICQMNZIAIFKJPNUA5UN3C4QC","R7J4254ZZREVMWXXDUM772GPLZSCZSIJKOLEAI33WUF2CPS3X6WQC","P27ILID2JNRMIXJNW47AWFYDU37BXQETA63W742HWVWGAXEET4QQC","LIMIMBOUN3DCIKKTHOK4TAXAWQXNVQXBTMNZYN22DJX4L4FZQH4AC","6BIP2OPVOFSOHOFNNRARTKNZFRZH7IDZOAJEPW33KKFGMSDIALYQC","WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC","WIG24AV2QMNDOIJXAE3FTPD7F2TQLRLZLSO7AG7ZEIWA2PD6RRPQC"],"known":[]},"hunks":[{"FileAdd":{"meta":{"basename":"sandbox.ml","metadata":0},"context":[{"change":2,"pos":55449}],"contents":[{"Add":{"text":"(* In-process sandbox armed just before Dynlink-loading untrusted user code.","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:112"}},{"Add":{"text":" See sandbox_stubs.c for the mechanism (seccomp + landlock). Enforcement is","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:191"}},{"Add":{"text":" below OCaml, so it holds regardless of what the bytecode does (Obj.magic","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:267"}},{"Add":{"text":" included) and works for a native frontend too. *)","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:320"}},{"Add":{"text":"","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:321"}},{"Add":{"text":"external arm_c : string -> int = \"elpe_sandbox_arm\"","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:373"}},{"Add":{"text":"","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:374"}},{"Add":{"text":"type outcome =","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:389"}},{"Add":{"text":" | Armed","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:399"}},{"Add":{"text":" | Unsupported (** kernel/platform lacks landlock or seccomp *)","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:465"}},{"Add":{"text":"","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:466"}},{"Add":{"text":"exception Failed of string","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:493"}},{"Add":{"text":"","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:494"}},{"Add":{"text":"(* [arm root] locks the process to: no new network egress, no exec, writes","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:569"}},{"Add":{"text":" confined to [root], reads confined to [root] + system prefixes (not $HOME).","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:648"}},{"Add":{"text":" Raises [Failed] if the sandbox is available but could not be installed —","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:726"}},{"Add":{"text":" callers must fail closed rather than run untrusted code unsandboxed. *)","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:801"}},{"Add":{"text":"let arm root =","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:816"}},{"Add":{"text":" match arm_c root with","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:840"}},{"Add":{"text":" | 0 -> Armed","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:855"}},{"Add":{"text":" | -1 -> Unsupported","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:877"}},{"Add":{"text":" | -2 -> raise (Failed \"landlock ruleset could not be installed\")","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:944"}},{"Add":{"text":" | -3 -> raise (Failed \"seccomp filter could not be installed\")","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:1009"}},{"Add":{"text":" | n -> raise (Failed (Printf.sprintf \"unknown sandbox error %d\" n))","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:1079"}},{"Add":{"text":"","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:1080"}},{"Add":{"text":"let arm_cwd () = arm (Sys.getcwd ())","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:1117"}}]}},{"FileAdd":{"meta":{"basename":"sandbox_stubs.c","metadata":0},"context":[{"change":2,"pos":55449}],"contents":[{"Add":{"text":"/* In-process sandbox for Elpe evaluation.","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:1202"}},{"Add":{"text":" *","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:1205"}},{"Add":{"text":" * Elpe compiles a user-written build.ml/lock.ml to bytecode and Dynlink-loads","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:1284"}},{"Add":{"text":" * it into the frontend process. That process holds a gRPC connection to the","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:1362"}},{"Add":{"text":" * (trusted) Rust backend and reads the project tree; nothing else is a","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:1434"}},{"Add":{"text":" * legitimate effect during evaluation. [elpe_sandbox_arm] locks the current","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:1512"}},{"Add":{"text":" * process down to exactly that surface right before the untrusted code runs:","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:1590"}},{"Add":{"text":" *","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:1593"}},{"Add":{"text":" * - seccomp denies socket/connect/bind (all new network egress) and","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:1664"}},{"Add":{"text":" * execve/execveat/ptrace (exec + debugging). The already-open backend","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:1740"}},{"Add":{"text":" * socket keeps working: only *creating* new sockets and *connecting* is","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:1817"}},{"Add":{"text":" * denied, and the GC/Lwt-on-existing-fd path needs none of these. Denied","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:1896"}},{"Add":{"text":" * calls return EPERM (surfaced as an OCaml Unix_error) rather than killing","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:1976"}},{"Add":{"text":" * the process, so a hostile definition fails cleanly instead of crashing.","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:2055"}},{"Add":{"text":" *","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:2058"}},{"Add":{"text":" * - landlock confines writes to the project root (argument [root]) while","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:2134"}},{"Add":{"text":" * allowing reads of system prefixes (/nix, /usr, /etc, ...). $HOME and","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:2211"}},{"Add":{"text":" * /root are deliberately absent from the read set, so secrets there are","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:2288"}},{"Add":{"text":" * unreadable even though network egress is already blocked.","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:2353"}},{"Add":{"text":" *","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:2356"}},{"Add":{"text":" * Returns 0 on success, a negative errno-ish code on failure. Callers treat a","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:2436"}},{"Add":{"text":" * nonzero result as fatal (fail closed): if we cannot arm the sandbox we must","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:2515"}},{"Add":{"text":" * not run untrusted code. On non-Linux the function is a no-op returning a","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:2592"}},{"Add":{"text":" * distinct sentinel so the OCaml side can decide what \"unsandboxed\" means.","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:2668"}},{"Add":{"text":" */","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:2672"}},{"Add":{"text":"","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:2673"}},{"Add":{"text":"#include ","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:2700"}},{"Add":{"text":"#include ","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:2725"}},{"Add":{"text":"#include ","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:2749"}},{"Add":{"text":"","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:2750"}},{"Add":{"text":"#define ELPE_SANDBOX_OK 0","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:2787"}},{"Add":{"text":"#define ELPE_SANDBOX_UNSUPPORTED (-1)","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:2825"}},{"Add":{"text":"#define ELPE_SANDBOX_LANDLOCK (-2)","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:2863"}},{"Add":{"text":"#define ELPE_SANDBOX_SECCOMP (-3)","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:2901"}},{"Add":{"text":"","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:2902"}},{"Add":{"text":"#if defined(__linux__)","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:2925"}},{"Add":{"text":"","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:2926"}},{"Add":{"text":"#include ","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:2945"}},{"Add":{"text":"#include ","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:2964"}},{"Add":{"text":"#include ","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:2984"}},{"Add":{"text":"#include ","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:3004"}},{"Add":{"text":"#include ","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:3024"}},{"Add":{"text":"#include ","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:3044"}},{"Add":{"text":"#include ","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:3067"}},{"Add":{"text":"#include ","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:3092"}},{"Add":{"text":"","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:3093"}},{"Add":{"text":"#include ","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:3118"}},{"Add":{"text":"#include ","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:3144"}},{"Add":{"text":"#include ","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:3171"}},{"Add":{"text":"#include ","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:3199"}},{"Add":{"text":"","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:3200"}},{"Add":{"text":"/* landlock syscall numbers were assigned identically across the arches we","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:3275"}},{"Add":{"text":" * support; define them defensively in case the build headers predate them. */","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:3354"}},{"Add":{"text":"#ifndef __NR_landlock_create_ruleset","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:3391"}},{"Add":{"text":"#define __NR_landlock_create_ruleset 444","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:3432"}},{"Add":{"text":"#endif","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:3439"}},{"Add":{"text":"#ifndef __NR_landlock_add_rule","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:3470"}},{"Add":{"text":"#define __NR_landlock_add_rule 445","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:3505"}},{"Add":{"text":"#endif","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:3512"}},{"Add":{"text":"#ifndef __NR_landlock_restrict_self","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:3548"}},{"Add":{"text":"#define __NR_landlock_restrict_self 446","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:3588"}},{"Add":{"text":"#endif","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:3595"}},{"Add":{"text":"","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:3596"}},{"Add":{"text":"#if defined(__x86_64__)","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:3620"}},{"Add":{"text":"#define ELPE_AUDIT_ARCH AUDIT_ARCH_X86_64","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:3662"}},{"Add":{"text":"#elif defined(__aarch64__)","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:3689"}},{"Add":{"text":"#define ELPE_AUDIT_ARCH AUDIT_ARCH_AARCH64","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:3732"}},{"Add":{"text":"#else","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:3738"}},{"Add":{"text":"#define ELPE_AUDIT_ARCH 0","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:3764"}},{"Add":{"text":"#endif","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:3771"}},{"Add":{"text":"","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:3772"}},{"Add":{"text":"/* --- landlock ---------------------------------------------------------- */","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:3850"}},{"Add":{"text":"","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:3851"}},{"Add":{"text":"/* Read-only prefixes: everything the OCaml runtime, glibc and vendored deps","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:3928"}},{"Add":{"text":" * may need to read, minus /home and /root (secrets). A prefix that does not","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:4005"}},{"Add":{"text":" * exist is silently skipped. */","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:4038"}},{"Add":{"text":"static const char *const ro_prefixes[] = {","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:4081"}},{"Add":{"text":" \"/nix\", \"/usr\", \"/etc\", \"/lib\", \"/lib64\", \"/bin\", \"/sbin\",","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:4144"}},{"Add":{"text":" \"/opt\", \"/proc\", \"/sys\", \"/dev\", \"/run\", \"/var\", \"/tmp\",","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:4205"}},{"Add":{"text":"};","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:4208"}},{"Add":{"text":"","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:4209"}},{"Add":{"text":"static int landlock_add_path(int ruleset_fd, const char *path,","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:4272"}},{"Add":{"text":" uint64_t allowed) {","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:4321"}},{"Add":{"text":" int fd = open(path, O_PATH | O_CLOEXEC | O_DIRECTORY);","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:4380"}},{"Add":{"text":" if (fd < 0)","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:4396"}},{"Add":{"text":" return -1; /* absent prefix: caller decides whether to care */","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:4467"}},{"Add":{"text":" struct landlock_path_beneath_attr pb = {","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:4512"}},{"Add":{"text":" .allowed_access = allowed,","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:4547"}},{"Add":{"text":" .parent_fd = fd,","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:4572"}},{"Add":{"text":" };","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:4579"}},{"Add":{"text":" int rc = syscall(__NR_landlock_add_rule, ruleset_fd,","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:4636"}},{"Add":{"text":" LANDLOCK_RULE_PATH_BENEATH, &pb, 0);","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:4694"}},{"Add":{"text":" close(fd);","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:4709"}},{"Add":{"text":" return rc;","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:4724"}},{"Add":{"text":"}","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:4726"}},{"Add":{"text":"","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:4727"}},{"Add":{"text":"static int arm_landlock(const char *root) {","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:4771"}},{"Add":{"text":" int abi = syscall(__NR_landlock_create_ruleset, NULL, 0,","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:4832"}},{"Add":{"text":" LANDLOCK_CREATE_RULESET_VERSION);","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:4888"}},{"Add":{"text":" if (abi < 1)","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:4905"}},{"Add":{"text":" return ELPE_SANDBOX_LANDLOCK; /* landlock unavailable */","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:4970"}},{"Add":{"text":"","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:4971"}},{"Add":{"text":" /* Full write-capable right set, masked down to what this ABI knows. */","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:5047"}},{"Add":{"text":" uint64_t rw = LANDLOCK_ACCESS_FS_EXECUTE | LANDLOCK_ACCESS_FS_WRITE_FILE |","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:5126"}},{"Add":{"text":" LANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_READ_DIR |","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:5205"}},{"Add":{"text":" LANDLOCK_ACCESS_FS_REMOVE_DIR | LANDLOCK_ACCESS_FS_REMOVE_FILE |","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:5288"}},{"Add":{"text":" LANDLOCK_ACCESS_FS_MAKE_CHAR | LANDLOCK_ACCESS_FS_MAKE_DIR |","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:5367"}},{"Add":{"text":" LANDLOCK_ACCESS_FS_MAKE_REG | LANDLOCK_ACCESS_FS_MAKE_SOCK |","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:5446"}},{"Add":{"text":" LANDLOCK_ACCESS_FS_MAKE_FIFO | LANDLOCK_ACCESS_FS_MAKE_BLOCK |","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:5527"}},{"Add":{"text":" LANDLOCK_ACCESS_FS_MAKE_SYM;","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:5574"}},{"Add":{"text":"#ifdef LANDLOCK_ACCESS_FS_REFER","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:5606"}},{"Add":{"text":" if (abi >= 2) rw |= LANDLOCK_ACCESS_FS_REFER;","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:5656"}},{"Add":{"text":"#endif","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:5663"}},{"Add":{"text":"#ifdef LANDLOCK_ACCESS_FS_TRUNCATE","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:5698"}},{"Add":{"text":" if (abi >= 3) rw |= LANDLOCK_ACCESS_FS_TRUNCATE;","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:5751"}},{"Add":{"text":"#endif","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:5758"}},{"Add":{"text":"#ifdef LANDLOCK_ACCESS_FS_IOCTL_DEV","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:5794"}},{"Add":{"text":" if (abi >= 5) rw |= LANDLOCK_ACCESS_FS_IOCTL_DEV;","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:5848"}},{"Add":{"text":"#endif","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:5855"}},{"Add":{"text":" /* Read-only subset: reads + execute (mmap of vendored .so etc.), no","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:5928"}},{"Add":{"text":" * write/create/remove. */","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:5959"}},{"Add":{"text":" uint64_t ro = rw & (LANDLOCK_ACCESS_FS_READ_FILE |","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:6014"}},{"Add":{"text":" LANDLOCK_ACCESS_FS_READ_DIR |","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:6068"}},{"Add":{"text":" LANDLOCK_ACCESS_FS_EXECUTE);","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:6121"}},{"Add":{"text":"","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:6122"}},{"Add":{"text":" struct landlock_ruleset_attr attr = {.handled_access_fs = rw};","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:6189"}},{"Add":{"text":" int ruleset_fd = syscall(__NR_landlock_create_ruleset, &attr, sizeof(attr), 0);","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:6273"}},{"Add":{"text":" if (ruleset_fd < 0)","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:6297"}},{"Add":{"text":" return ELPE_SANDBOX_LANDLOCK;","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:6335"}},{"Add":{"text":"","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:6336"}},{"Add":{"text":" int rc = ELPE_SANDBOX_OK;","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:6366"}},{"Add":{"text":" /* Project root: full read/write. Must succeed. */","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:6421"}},{"Add":{"text":" if (landlock_add_path(ruleset_fd, root, rw) != 0)","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:6475"}},{"Add":{"text":" rc = ELPE_SANDBOX_LANDLOCK;","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:6511"}},{"Add":{"text":" /* System prefixes: read-only, best-effort (skip the missing ones). */","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:6586"}},{"Add":{"text":" for (size_t i = 0; rc == ELPE_SANDBOX_OK &&","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:6634"}},{"Add":{"text":" i < sizeof(ro_prefixes) / sizeof(ro_prefixes[0]);","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:6707"}},{"Add":{"text":" i++)","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:6721"}},{"Add":{"text":" landlock_add_path(ruleset_fd, ro_prefixes[i], ro);","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:6780"}},{"Add":{"text":"","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:6781"}},{"Add":{"text":" if (rc == ELPE_SANDBOX_OK &&","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:6814"}},{"Add":{"text":" syscall(__NR_landlock_restrict_self, ruleset_fd, 0) != 0)","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:6880"}},{"Add":{"text":" rc = ELPE_SANDBOX_LANDLOCK;","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:6916"}},{"Add":{"text":" close(ruleset_fd);","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:6939"}},{"Add":{"text":" return rc;","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:6954"}},{"Add":{"text":"}","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:6956"}},{"Add":{"text":"","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:6957"}},{"Add":{"text":"/* --- seccomp ----------------------------------------------------------- */","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:7035"}},{"Add":{"text":"","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:7036"}},{"Add":{"text":"static int arm_seccomp(void) {","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:7067"}},{"Add":{"text":" if (ELPE_AUDIT_ARCH == 0)","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:7097"}},{"Add":{"text":" return ELPE_SANDBOX_SECCOMP; /* unknown arch: refuse rather than fake it */","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:7181"}},{"Add":{"text":"","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:7182"}},{"Add":{"text":"#define DENY(nr) \\","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:7256"}},{"Add":{"text":" BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, (nr), 0, 1), \\","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:7330"}},{"Add":{"text":" BPF_STMT(BPF_RET | BPF_K, \\","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:7404"}},{"Add":{"text":" SECCOMP_RET_ERRNO | (EPERM & SECCOMP_RET_DATA))","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:7469"}},{"Add":{"text":"","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:7470"}},{"Add":{"text":" struct sock_filter filter[] = {","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:7506"}},{"Add":{"text":" /* Guard on arch: a foreign personality skips straight to ALLOW so we","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:7584"}},{"Add":{"text":" * never misinterpret its syscall numbers. */","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:7638"}},{"Add":{"text":" BPF_STMT(BPF_LD | BPF_W | BPF_ABS,","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:7681"}},{"Add":{"text":" offsetof(struct seccomp_data, arch)),","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:7736"}},{"Add":{"text":" BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, ELPE_AUDIT_ARCH, 1, 0),","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:7804"}},{"Add":{"text":" BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:7858"}},{"Add":{"text":"","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:7859"}},{"Add":{"text":" BPF_STMT(BPF_LD | BPF_W | BPF_ABS,","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:7902"}},{"Add":{"text":" offsetof(struct seccomp_data, nr)),","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:7955"}},{"Add":{"text":" DENY(__NR_socket),","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:7982"}},{"Add":{"text":" DENY(__NR_connect),","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:8010"}},{"Add":{"text":" DENY(__NR_bind),","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:8035"}},{"Add":{"text":" DENY(__NR_execve),","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:8062"}},{"Add":{"text":" DENY(__NR_execveat),","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:8091"}},{"Add":{"text":" DENY(__NR_ptrace),","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:8118"}},{"Add":{"text":" BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:8172"}},{"Add":{"text":" };","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:8179"}},{"Add":{"text":"#undef DENY","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:8191"}},{"Add":{"text":"","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:8192"}},{"Add":{"text":" struct sock_fprog prog = {","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:8223"}},{"Add":{"text":" .len = (unsigned short)(sizeof(filter) / sizeof(filter[0])),","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:8292"}},{"Add":{"text":" .filter = filter,","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:8318"}},{"Add":{"text":" };","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:8325"}},{"Add":{"text":" if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0) != 0)","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:8395"}},{"Add":{"text":" return ELPE_SANDBOX_SECCOMP;","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:8432"}},{"Add":{"text":" return ELPE_SANDBOX_OK;","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:8460"}},{"Add":{"text":"}","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:8462"}},{"Add":{"text":"","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:8463"}},{"Add":{"text":"CAMLprim value elpe_sandbox_arm(value root) {","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:8509"}},{"Add":{"text":" CAMLparam1(root);","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:8531"}},{"Add":{"text":" const char *r = String_val(root);","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:8569"}},{"Add":{"text":"","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:8570"}},{"Add":{"text":" /* NO_NEW_PRIVS is a prerequisite for both an unprivileged landlock","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:8642"}},{"Add":{"text":" * restrict_self and a seccomp filter. */","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:8688"}},{"Add":{"text":" if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) != 0)","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:8741"}},{"Add":{"text":" CAMLreturn(Val_int(ELPE_SANDBOX_UNSUPPORTED));","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:8796"}},{"Add":{"text":"","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:8797"}},{"Add":{"text":" int rc = arm_landlock(r);","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:8827"}},{"Add":{"text":" if (rc == ELPE_SANDBOX_OK)","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:8858"}},{"Add":{"text":" rc = arm_seccomp();","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:8886"}},{"Add":{"text":" CAMLreturn(Val_int(rc));","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:8915"}},{"Add":{"text":"}","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:8917"}},{"Add":{"text":"","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:8918"}},{"Add":{"text":"#else /* !__linux__ */","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:8941"}},{"Add":{"text":"","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:8942"}},{"Add":{"text":"CAMLprim value elpe_sandbox_arm(value root) {","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:8988"}},{"Add":{"text":" CAMLparam1(root);","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:9010"}},{"Add":{"text":" (void)root;","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:9026"}},{"Add":{"text":" CAMLreturn(Val_int(ELPE_SANDBOX_UNSUPPORTED));","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:9077"}},{"Add":{"text":"}","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:9079"}},{"Add":{"text":"","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:9080"}},{"Add":{"text":"#endif","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:9087"}}]}},{"Edit":{"inode":{"change":2,"pos":62377},"path":"elpe/lib/dune","line":6,"atom":{"NewVertex":{"up_context":[{"change":6,"pos":36353}],"down_context":[{"change":8,"pos":651642}],"flag":"BLOCK","start":9089,"end":9140,"inode":{"change":2,"pos":62377}}},"contents":[{"Add":{"text":"(foreign_stubs (language c) (names sandbox_stubs))","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:9139"}}]}},{"Edit":{"inode":{"change":2,"pos":56160},"path":"elpe/lib/elpe.ml","line":55,"atom":{"NewVertex":{"up_context":[{"change":9,"pos":12446}],"down_context":[{"change":4,"pos":127}],"flag":"BLOCK","start":9141,"end":9188,"inode":{"change":2,"pos":56160}}},"contents":[{"Add":{"text":"end","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:9144"}},{"Add":{"text":"","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:9145"}},{"Add":{"text":"module Sandbox = struct","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:9169"}},{"Add":{"text":" include Sandbox","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:9187"}}]}},{"Replacement":{"inode":{"change":2,"pos":63278},"path":"elpe/bin/elpe_bin.ml","line":92,"ins":{"up_context":[{"change":2,"pos":63636}],"down_context":[{"change":2,"pos":63661}],"flag":"BLOCK","start":9189,"end":9233,"inode":{"change":2,"pos":63278}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":2,"pos":63636},"to":{"change":3,"start":74890,"end":74916},"introduced_by":3}],"inode":{"change":2,"pos":63278}},"ins_contents":[{"Add":{"text":"let compile ?(sandbox = true) input_files =","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:9232"}}],"del_contents":[{"Del":{"text":"let compile input_files =","pos":"ODUDDQRY373JMDR6W2BHUWSKEU6TEICQMNZIAIFKJPNUA5UN3C4QC:74915"}}]}},{"Edit":{"inode":{"change":2,"pos":63278},"path":"elpe/bin/elpe_bin.ml","line":132,"atom":{"NewVertex":{"up_context":[{"change":2,"pos":64350}],"down_context":[{"change":5,"pos":975}],"flag":"BLOCK","start":9234,"end":9883,"inode":{"change":2,"pos":63278}}},"contents":[{"Add":{"text":" (* Arm the sandbox after the backend channel is up and the [.cmo] path is","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:9309"}},{"Add":{"text":" resolved, but before any untrusted code runs. [Dynlink.loadfile] only","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:9385"}},{"Add":{"text":" reads the object (allowed under CWD); everything the DSL does afterwards","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:9463"}},{"Add":{"text":" (backend RPCs on the existing socket, project reads, lock/SBOM writes in","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:9541"}},{"Add":{"text":" CWD) stays inside the policy. [shell] opts out because it execs bash. *)","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:9620"}},{"Add":{"text":" (if sandbox then","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:9639"}},{"Add":{"text":" match Elpe.Sandbox.arm_cwd () with","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:9679"}},{"Add":{"text":" | Elpe.Sandbox.Armed -> ()","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:9711"}},{"Add":{"text":" | Elpe.Sandbox.Unsupported ->","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:9746"}},{"Add":{"text":" Printf.eprintf","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:9770"}},{"Add":{"text":" \"elpe: warning: evaluation sandbox unavailable on this host; \\","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:9844"}},{"Add":{"text":" running unconfined\\n%!\");","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:9882"}}]}},{"Replacement":{"inode":{"change":2,"pos":63278},"path":"elpe/bin/elpe_bin.ml","line":154,"ins":{"up_context":[{"change":5,"pos":1032}],"down_context":[{"change":5,"pos":1109}],"flag":"BLOCK","start":9884,"end":10012,"inode":{"change":2,"pos":63278}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":1032},"to":{"change":7,"start":56,"end":133},"introduced_by":7}],"inode":{"change":2,"pos":63278}},"ins_contents":[{"Add":{"text":" (let* _ =","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:9902"}},{"Add":{"text":" compile ~sandbox:false","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:9937"}},{"Add":{"text":" (if files = [] then [ \"shell.ml\" ] else files)","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:9998"}},{"Add":{"text":" in","pos":"P4TPHNAPRVTLWLGIV3UZU2TNQ22YUEC4ZYKJ4IEL4FUL6GFSGTQQC:10011"}}],"del_contents":[{"Del":{"text":" (let* _ = compile (if files = [] then [ \"shell.ml\" ] else files) in","pos":"6BIP2OPVOFSOHOFNNRARTKNZFRZH7IDZOAJEPW33KKFGMSDIALYQC:132"}}]}}],"owner":"pmeunier","repo":"elpe","token":"lxyu1+7RSU99ZNq9LydARIJagY0I8qs6nN4maC9Vtgk=","login":null}

…

Dependencies

Change contents

Review