uutils/shadow
0
0
Fork 0
mirror of https://github.com/uutils/shadow.git synced 2026-06-10 16:14:57 -07:00
Code Issues Packages Projects Releases Wiki Activity

review: address all 6 Copilot review comments

Browse Source
This commit is contained in:
Pierre Warnier
2026-04-03 12:30:52 +02:00
parent 7fbea1f102
commit b4130cfcf0
3 changed files with 11 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/shadow-core/src/hardening.rs
+7 -6
View File
@@ -62,7 +62,7 @@ pub fn sanitized_env() -> Vec<(String, String)> {
/// Best-effort: silently does nothing on kernels without Landlock support. /// Best-effort: silently does nothing on kernels without Landlock support.
/// `rw_paths` get read+write access, `ro_paths` get read-only access, /// `rw_paths` get read+write access, `ro_paths` get read-only access,
/// `exec_paths` get execute access. Everything else is denied. /// `exec_paths` get execute access. Everything else is denied.
#[cfg(feature = "landlock")] #[cfg(all(feature = "landlock", target_os = "linux"))]
pub fn apply_landlock( pub fn apply_landlock(
writable: &[&std::path::Path], writable: &[&std::path::Path],
readable: &[&std::path::Path], readable: &[&std::path::Path],
@@ -72,6 +72,9 @@ pub fn apply_landlock(
ABI, Access, AccessFs, Ruleset, RulesetAttr, RulesetCreatedAttr, path_beneath_rules, ABI, Access, AccessFs, Ruleset, RulesetAttr, RulesetCreatedAttr, path_beneath_rules,
}; };
// V5 is the maximum ABI we request; Ruleset's default CompatLevel
// (BestEffort) automatically downgrades to whatever the running
// kernel actually supports, so this is safe on older kernels.
let abi = ABI::V5; let abi = ABI::V5;
let all_access = AccessFs::from_all(abi); let all_access = AccessFs::from_all(abi);
let read_access = AccessFs::from_read(abi); let read_access = AccessFs::from_read(abi);
@@ -85,14 +88,12 @@ pub fn apply_landlock(
.and_then(|rs| rs.add_rules(path_beneath_rules(exec_paths, exec_access))) .and_then(|rs| rs.add_rules(path_beneath_rules(exec_paths, exec_access)))
.and_then(landlock::RulesetCreated::restrict_self); .and_then(landlock::RulesetCreated::restrict_self);
// Best-effort: log but don't fail // Best-effort: silently ignore errors (unsupported kernel, etc.)
if let Err(e) = result { let _ = result;
eprintln!("landlock: {e}");
}
} }
/// No-op on non-Linux or when the `landlock` feature is disabled. /// No-op on non-Linux or when the `landlock` feature is disabled.
#[cfg(not(feature = "landlock"))] #[cfg(not(all(feature = "landlock", target_os = "linux")))]
pub fn apply_landlock( pub fn apply_landlock(
_writable: &[&std::path::Path], _writable: &[&std::path::Path],
_readable: &[&std::path::Path], _readable: &[&std::path::Path],
src/uu/passwd/src/passwd.rs
+2 -1
View File
@@ -117,7 +117,8 @@ impl UError for PasswdError {
/// Restrict filesystem access using landlock (Linux 5.13+). /// Restrict filesystem access using landlock (Linux 5.13+).
/// ///
/// Best-effort Landlock sandboxing for passwd. /// Best-effort Landlock sandboxing for passwd. Silently does nothing on
/// kernels without Landlock support or when the feature is disabled.
/// ///
/// Restricts filesystem access to only what passwd needs: /// Restricts filesystem access to only what passwd needs:
/// read+write `/etc/` (passwd/shadow files) and `/dev/` (tty for prompts), /// read+write `/etc/` (passwd/shadow files) and `/dev/` (tty for prompts),
util/generate-completions.sh
+2 -7
View File
@@ -16,13 +16,8 @@ OUTPUT_DIR="${2:-}"
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
PROJECT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)" PROJECT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
# Build the completions binary
cargo build --manifest-path "$PROJECT_DIR/Cargo.toml" --features completions --bin shadow-rs-completions
BINARY="$PROJECT_DIR/target/debug/shadow-rs-completions"
if [ -n "$OUTPUT_DIR" ]; then if [ -n "$OUTPUT_DIR" ]; then
"$BINARY" --all --shell "$SHELL_TYPE" --dir "$OUTPUT_DIR" cargo run --manifest-path "$PROJECT_DIR/Cargo.toml" --features completions --bin shadow-rs-completions -- --all --shell "$SHELL_TYPE" --dir "$OUTPUT_DIR"
else else
"$BINARY" --all --shell "$SHELL_TYPE" cargo run --manifest-path "$PROJECT_DIR/Cargo.toml" --features completions --bin shadow-rs-completions -- --all --shell "$SHELL_TYPE"
fi fi