Add directory access allowlist build flag for unveil/Landlock git binary usually links against system libraries. However the paths of system libraries varys by operating system / distribution. This flag is intended to used by system admin (build from source) and distributor. I did not test unveil, so whether OpenBSD user needs to reach for this flag is unknown.

Changes

3 changed files (+25/-1)

• README.md
  • @@ -32,6 +32,10 @@ Go compiler generates `legit` executable file at the repository root directory.
    You can also run legit without installing by `go run .`. + legit uses unveil(2) on OpenBSD and Landlock LSM on Linux. + If you find unexpected filesystem permission error, add the _directory_ to `main.additionalAccessDirs` ldflag. + That flag takes comma-separated list of directories, and unveil/Landlock allows a readonly access to that paths. + ### Nix Add this repository as a Flake input and use `nixosModules.default` or `homeManagerModules.default`.
• default.nix
  • @@ -24,6 +24,11 @@ buildGoModule {
    vendorHash = "sha256-SWMJVv7QQt4gHaPjb5Q5m20jzFMPHqa+McI26EYg6Ak="; + ldflags = [ + # git binary from nixpkgs links against libs under "/nix/store/.../lib" + "-X main.additionalAccessDirs=/nix/store" + ]; + # Test scripts invoke system "git" command. nativeBuildInputs = [ git ];
• main.go
  • @@ -8,12 +8,15 @@ import (
    "net/http" "os" "os/exec" + "strings" "github.com/pocka/legit/config" "github.com/pocka/legit/embed" "github.com/pocka/legit/routes" ) + var additionalAccessDirs string + func main() { var cfg string var host string
  • @@ -54,7 +57,7 @@ func main() {
    log.Fatal(err) } - fsAllowList := make([]filesystemAccess, 2, 5) + fsAllowList := make([]filesystemAccess, 2, 10) fsAllowList[0] = filesystemAccess{ path: c.Repo.ScanPath, isDir: true,
  • @@ -96,6 +99,18 @@ func main() {
    }) } + if additionalAccessDirs != "" { + for path := range strings.SplitSeq(additionalAccessDirs, ",") { + path := strings.Trim(path, " ") + + fsAllowList = append(fsAllowList, filesystemAccess{ + path: path, + isDir: true, + read: true, + }) + } + } + if err := restrictFileAccessTo(fsAllowList...); err != nil { log.Fatalf("Unable to restrict filesystem access: %s", err) }