Contributors: 3
Author Tokens Token Proportion Commits Commit Proportion
Tahera Fahimi 287 95.67% 1 33.33%
Konstantin Meskhidze 12 4.00% 1 33.33%
Mickaël Salaün 1 0.33% 1 33.33%
Total 300 3 
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152
/* SPDX-License-Identifier: GPL-2.0 */
/*
 * Landlock variants for three processes with various domains.
 *
 * Copyright © 2024 Tahera Fahimi <fahimitahera@gmail.com>
 */

enum sandbox_type {
	NO_SANDBOX,
	SCOPE_SANDBOX,
	/* Any other type of sandboxing domain */
	OTHER_SANDBOX,
};

/* clang-format on */
FIXTURE_VARIANT(scoped_vs_unscoped)
{
	const int domain_all;
	const int domain_parent;
	const int domain_children;
	const int domain_child;
	const int domain_grand_child;
};

/*
 * .-----------------.
 * |         ####### |  P3 -> P2 : allow
 * |   P1----# P2  # |  P3 -> P1 : deny
 * |         #  |  # |
 * |         # P3  # |
 * |         ####### |
 * '-----------------'
 */
/* clang-format off */
FIXTURE_VARIANT_ADD(scoped_vs_unscoped, deny_scoped) {
	.domain_all = OTHER_SANDBOX,
	.domain_parent = NO_SANDBOX,
	.domain_children = SCOPE_SANDBOX,
	.domain_child = NO_SANDBOX,
	.domain_grand_child = NO_SANDBOX,
	/* clang-format on */
};

/*
 * ###################
 * #         ####### #  P3 -> P2 : allow
 * #   P1----# P2  # #  P3 -> P1 : deny
 * #         #  |  # #
 * #         # P3  # #
 * #         ####### #
 * ###################
 */
/* clang-format off */
FIXTURE_VARIANT_ADD(scoped_vs_unscoped, all_scoped) {
	.domain_all = SCOPE_SANDBOX,
	.domain_parent = NO_SANDBOX,
	.domain_children = SCOPE_SANDBOX,
	.domain_child = NO_SANDBOX,
	.domain_grand_child = NO_SANDBOX,
	/* clang-format on */
};

/*
 * .-----------------.
 * |         .-----. |  P3 -> P2 : allow
 * |   P1----| P2  | |  P3 -> P1 : allow
 * |         |     | |
 * |         | P3  | |
 * |         '-----' |
 * '-----------------'
 */
/* clang-format off */
FIXTURE_VARIANT_ADD(scoped_vs_unscoped, allow_with_other_domain) {
	.domain_all = OTHER_SANDBOX,
	.domain_parent = NO_SANDBOX,
	.domain_children = OTHER_SANDBOX,
	.domain_child = NO_SANDBOX,
	.domain_grand_child = NO_SANDBOX,
	/* clang-format on */
};

/*
 *  .----.    ######   P3 -> P2 : allow
 *  | P1 |----# P2 #   P3 -> P1 : allow
 *  '----'    ######
 *              |
 *              P3
 */
/* clang-format off */
FIXTURE_VARIANT_ADD(scoped_vs_unscoped, allow_with_one_domain) {
	.domain_all = NO_SANDBOX,
	.domain_parent = OTHER_SANDBOX,
	.domain_children = NO_SANDBOX,
	.domain_child = SCOPE_SANDBOX,
	.domain_grand_child = NO_SANDBOX,
	/* clang-format on */
};

/*
 *  ######    .-----.   P3 -> P2 : allow
 *  # P1 #----| P2  |   P3 -> P1 : allow
 *  ######    '-----'
 *              |
 *              P3
 */
/* clang-format off */
FIXTURE_VARIANT_ADD(scoped_vs_unscoped, allow_with_grand_parent_scoped) {
	.domain_all = NO_SANDBOX,
	.domain_parent = SCOPE_SANDBOX,
	.domain_children = NO_SANDBOX,
	.domain_child = OTHER_SANDBOX,
	.domain_grand_child = NO_SANDBOX,
	/* clang-format on */
};

/*
 *  ######    ######   P3 -> P2 : allow
 *  # P1 #----# P2 #   P3 -> P1 : allow
 *  ######    ######
 *               |
 *             .----.
 *             | P3 |
 *             '----'
 */
/* clang-format off */
FIXTURE_VARIANT_ADD(scoped_vs_unscoped, allow_with_parents_domain) {
	.domain_all = NO_SANDBOX,
	.domain_parent = SCOPE_SANDBOX,
	.domain_children = NO_SANDBOX,
	.domain_child = SCOPE_SANDBOX,
	.domain_grand_child = NO_SANDBOX,
	/* clang-format on */
};

/*
 *  ######		P3 -> P2 : deny
 *  # P1 #----P2	P3 -> P1 : deny
 *  ######     |
 *	       |
 *	     ######
 *           # P3 #
 *           ######
 */
/* clang-format off */
FIXTURE_VARIANT_ADD(scoped_vs_unscoped, deny_with_self_and_grandparent_domain) {
	.domain_all = NO_SANDBOX,
	.domain_parent = SCOPE_SANDBOX,
	.domain_children = NO_SANDBOX,
	.domain_child = NO_SANDBOX,
	.domain_grand_child = SCOPE_SANDBOX,
	/* clang-format on */
};