From e80569f5dabfb91d073ee474f0194f69a12702e8 Mon Sep 17 00:00:00 2001
From: Chih-Hsuan Yen <645432-yan12125@users.noreply.gitlab.com>
Date: Sun, 15 Sep 2024 11:49:53 +0800
Subject: [PATCH] Correctly configure landlock for older ABIs

For example, with landlock ABI < 3, LANDLOCK_ACCESS_FS_TRUNCATE is not
set in ruleset_attr.handled_access_fs, so it should not be set in
path_beneath.allowed_access either. Otherwise, landlock_add_rule fails
with -EINVAL, and pacman complains:

> error: restricting filesystem access failed because the landlock rule for the temporary download directory could not be added!

The change is tested on Debian Bookworm kernel
linux-image-6.1.0-25-cloud-amd64 6.1.106-3.
---
 lib/libalpm/sandbox_fs.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/libalpm/sandbox_fs.c b/lib/libalpm/sandbox_fs.c
index c97f355e..94bbb104 100644
--- a/lib/libalpm/sandbox_fs.c
+++ b/lib/libalpm/sandbox_fs.c
@@ -150,6 +150,9 @@ bool _alpm_sandbox_fs_restrict_writes_to(alpm_handle_t *handle, const char *path
 	path_beneath.parent_fd = open(path, O_PATH | O_CLOEXEC | O_DIRECTORY);
 	path_beneath.allowed_access = _LANDLOCK_ACCESS_FS_READ | _LANDLOCK_ACCESS_FS_WRITE | _LANDLOCK_ACCESS_FS_TRUNCATE;
 
+	/* make sure allowed_access is a subset of handled_access_fs, which may change for older landlock ABI */
+	path_beneath.allowed_access &= ruleset_attr.handled_access_fs;
+
 	if(landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH, &path_beneath, 0) == 0) {
 		if(landlock_restrict_self(ruleset_fd, 0)) {
 			_alpm_log(handle, ALPM_LOG_ERROR, _("restricting filesystem access failed because the landlock ruleset could not be applied!\n"));