1: ; syd.el --- Emacs Lisp binding for the syd(2) API -*- lexical-binding: t -*-
2:
3: ; Syd: rock-solid application kernel
4: ;
5: ; Copyright (c) 2023, 2024, 2025, 2026 Ali Polatel <alip@chesswob.org>
6: ;
7: ; Author: Ali Polatel <alip@chesswob.org>
8: ; SPDX-License-Identifier: GPL-3.0
9:
10: ; Commentary:
11:
12: ; This is the Emacs Lisp implementation of the virtual syd(2) stat
13: ; interface. A sandboxed process configures and queries the Syd
14: ; application kernel by issuing stat(2) calls on magic paths under
15: ; /dev/syd. Syd answers each with a character-special device. Every
16: ; public function here builds such a magic path and validates the
17: ; response with `syd--stat'.
18:
19: ; Code:
20:
21: ; Define lock states as keywords
22: (defconst syd-lock-off :lock-off
23: "The sandbox lock is off, allowing all sandbox commands.")
24:
25: (defconst syd-lock-exec :lock-exec
26: "Sandbox commands are allowed only from the syd exec child (the default).")
27:
28: (defconst syd-lock-drop :lock-drop
29: "Sandbox commands are allowed only to drop privileges.")
30:
31: (defconst syd-lock-read :lock-read
32: "Sandbox commands are allowed only to read sandbox state.")
33:
34: (defconst syd-lock-on :lock-on
35: "The sandbox lock is on, disallowing all sandbox commands.")
36:
37: ; Define sandbox actions as keywords
38: (defconst syd-action-allow :action-allow
39: "Allow system call.")
40:
41: (defconst syd-action-warn :action-warn
42: "Allow system call and warn.")
43:
44: (defconst syd-action-filter :action-filter
45: "Deny system call silently.")
46:
47: (defconst syd-action-deny :action-deny
48: "Deny system call and warn.")
49:
50: (defconst syd-action-panic :action-panic
51: "Deny system call, warn and panic the current Syd thread.")
52:
53: (defconst syd-action-stop :action-stop
54: "Deny system call, warn and stop offending process.")
55:
56: (defconst syd-action-abort :action-abort
57: "Deny system call, warn and abort offending process.")
58:
59: (defconst syd-action-kill :action-kill
60: "Deny system call, warn and kill offending process.")
61:
62: (defconst syd-action-exit :action-exit
63: "Warn, and exit Syd immediately with deny errno as exit value.")
64:
65: (defun syd-info ()
66: "Read the state of the syd sandbox from /dev/syd and return it as an alist.
67: If the `json' module is not available, returns nil."
68: (if (require 'json nil t)
69: (condition-case nil
70: (with-temp-buffer
71: (insert-file-contents "/dev/syd" nil nil (* 16 1024 1024))
72: (with-no-warnings
73: (let ((json-object-type 'alist)
74: (json-array-type 'list)
75: (json-key-type 'symbol)
76: (json-false nil)
77: (json-null nil))
78: (json-read))))
79: (file-error
80: (message "Error reading /dev/syd.")
81: nil)
82: (json-error
83: (message "JSON decoding error.")
84: nil))
85: (progn
86: (message "JSON module not available.")
87: nil)))
88:
89: (defun syd-api ()
90: "Perform a syd API check."
91: (cond
92: ((syd--stat "/dev/syd/3") 3) ; API number on success
93: ((syd--stat "/dev/sydbox/1") 1))) ; On error, return nil
94:
95: (defun syd-check ()
96: "Check if '/dev/syd' is a character device."
97: (syd--stat "/dev/syd"))
98:
99: (defun syd-have-force ()
100: "Return non-nil if Syd was built with force sandboxing support."
101: (alist-get 'have_force (syd-info)))
102:
103: (defun syd-landlock-abi ()
104: "Return the landlock(7) ABI version detected by Syd.
105: The version is 0 if Landlock is unsupported, and nil when it cannot
106: be determined."
107: (alist-get 'landlock_abi (syd-info)))
108:
109: (defun syd-panic ()
110: "Cause syd to exit immediately with code 127."
111: (syd--stat "/dev/syd/panic"))
112:
113: (defun syd-ghost ()
114: "Initiate Ghost mode."
115: (syd--stat "/dev/syd/ghost"))
116:
117: (defun syd-load (fd)
118: "Cause syd to read configuration from the given file descriptor FD."
119: (let ((path (concat "/dev/syd/load/" (number-to-string fd))))
120: (syd--stat path)))
121:
122: (defun syd-lock (state)
123: "Set the sandbox lock to STATE.
124: STATE is one of the keywords `:lock-off', `:lock-exec', `:lock-drop',
125: `:lock-read' or `:lock-on'.
126: Return t on success, nil on failure."
127: (cond
128: ((eq state syd-lock-off) (syd--stat "/dev/syd/lock:off"))
129: ((eq state syd-lock-exec) (syd--stat "/dev/syd/lock:exec"))
130: ((eq state syd-lock-drop) (syd--stat "/dev/syd/lock:drop"))
131: ((eq state syd-lock-read) (syd--stat "/dev/syd/lock:read"))
132: ((eq state syd-lock-on) (syd--stat "/dev/syd/lock:on"))
133: (t nil))) ; Invalid state
134:
135: (defun syd-enabled-fs ()
136: "Check whether Filesystem sandboxing is enabled."
137: (syd--stat "/dev/syd/sandbox/fs?"))
138:
139: (defun syd-enable-fs ()
140: "Enable Filesystem sandboxing."
141: (syd--stat "/dev/syd/sandbox/fs:on"))
142:
143: (defun syd-disable-fs ()
144: "Disable Filesystem sandboxing."
145: (syd--stat "/dev/syd/sandbox/fs:off"))
146:
147: (defun syd-enabled-walk ()
148: "Check whether Walk sandboxing is enabled."
149: (syd--stat "/dev/syd/sandbox/walk?"))
150:
151: (defun syd-enable-walk ()
152: "Enable Walk sandboxing."
153: (syd--stat "/dev/syd/sandbox/walk:on"))
154:
155: (defun syd-disable-walk ()
156: "Disable Walk sandboxing."
157: (syd--stat "/dev/syd/sandbox/walk:off"))
158:
159: (defun syd-enabled-list ()
160: "Check whether List sandboxing is enabled."
161: (syd--stat "/dev/syd/sandbox/list?"))
162:
163: (defun syd-enable-list ()
164: "Enable List sandboxing."
165: (syd--stat "/dev/syd/sandbox/list:on"))
166:
167: (defun syd-disable-list ()
168: "Disable List sandboxing."
169: (syd--stat "/dev/syd/sandbox/list:off"))
170:
171: (defun syd-enabled-stat ()
172: "Check whether Stat sandboxing is enabled."
173: (syd--stat "/dev/syd/sandbox/stat?"))
174:
175: (defun syd-enable-stat ()
176: "Enable Stat sandboxing."
177: (syd--stat "/dev/syd/sandbox/stat:on"))
178:
179: (defun syd-disable-stat ()
180: "Disable Stat sandboxing."
181: (syd--stat "/dev/syd/sandbox/stat:off"))
182:
183: (defun syd-enabled-read ()
184: "Check whether Read sandboxing is enabled."
185: (syd--stat "/dev/syd/sandbox/read?"))
186:
187: (defun syd-enable-read ()
188: "Enable Read sandboxing."
189: (syd--stat "/dev/syd/sandbox/read:on"))
190:
191: (defun syd-disable-read ()
192: "Disable Read sandboxing."
193: (syd--stat "/dev/syd/sandbox/read:off"))
194:
195: (defun syd-enabled-write ()
196: "Check whether Write sandboxing is enabled."
197: (syd--stat "/dev/syd/sandbox/write?"))
198:
199: (defun syd-enable-write ()
200: "Enable Write sandboxing."
201: (syd--stat "/dev/syd/sandbox/write:on"))
202:
203: (defun syd-disable-write ()
204: "Disable Write sandboxing."
205: (syd--stat "/dev/syd/sandbox/write:off"))
206:
207: (defun syd-enabled-exec ()
208: "Check whether Exec sandboxing is enabled."
209: (syd--stat "/dev/syd/sandbox/exec?"))
210:
211: (defun syd-enable-exec ()
212: "Enable Exec sandboxing."
213: (syd--stat "/dev/syd/sandbox/exec:on"))
214:
215: (defun syd-disable-exec ()
216: "Disable Exec sandboxing."
217: (syd--stat "/dev/syd/sandbox/exec:off"))
218:
219: (defun syd-enabled-ioctl ()
220: "Check whether Ioctl sandboxing is enabled."
221: (syd--stat "/dev/syd/sandbox/ioctl?"))
222:
223: (defun syd-enable-ioctl ()
224: "Enable Ioctl sandboxing."
225: (syd--stat "/dev/syd/sandbox/ioctl:on"))
226:
227: (defun syd-disable-ioctl ()
228: "Disable Ioctl sandboxing."
229: (syd--stat "/dev/syd/sandbox/ioctl:off"))
230:
231: (defun syd-enabled-create ()
232: "Check whether create sandboxing is enabled."
233: (syd--stat "/dev/syd/sandbox/create?"))
234:
235: (defun syd-enable-create ()
236: "Enable create sandboxing."
237: (syd--stat "/dev/syd/sandbox/create:on"))
238:
239: (defun syd-disable-create ()
240: "Disable create sandboxing."
241: (syd--stat "/dev/syd/sandbox/create:off"))
242:
243: (defun syd-enabled-delete ()
244: "Check whether delete sandboxing is enabled."
245: (syd--stat "/dev/syd/sandbox/delete?"))
246:
247: (defun syd-enable-delete ()
248: "Enable delete sandboxing."
249: (syd--stat "/dev/syd/sandbox/delete:on"))
250:
251: (defun syd-disable-delete ()
252: "Disable delete sandboxing."
253: (syd--stat "/dev/syd/sandbox/delete:off"))
254:
255: (defun syd-enabled-rename ()
256: "Check whether rename sandboxing is enabled."
257: (syd--stat "/dev/syd/sandbox/rename?"))
258:
259: (defun syd-enable-rename ()
260: "Enable rename sandboxing."
261: (syd--stat "/dev/syd/sandbox/rename:on"))
262:
263: (defun syd-disable-rename ()
264: "Disable rename sandboxing."
265: (syd--stat "/dev/syd/sandbox/rename:off"))
266:
267: (defun syd-enabled-readlink ()
268: "Check whether readlink sandboxing is enabled."
269: (syd--stat "/dev/syd/sandbox/readlink?"))
270:
271: (defun syd-enable-readlink ()
272: "Enable readlink sandboxing."
273: (syd--stat "/dev/syd/sandbox/readlink:on"))
274:
275: (defun syd-disable-readlink ()
276: "Disable readlink sandboxing."
277: (syd--stat "/dev/syd/sandbox/readlink:off"))
278:
279: (defun syd-enabled-symlink ()
280: "Check whether symlink sandboxing is enabled."
281: (syd--stat "/dev/syd/sandbox/symlink?"))
282:
283: (defun syd-enable-symlink ()
284: "Enable symlink sandboxing."
285: (syd--stat "/dev/syd/sandbox/symlink:on"))
286:
287: (defun syd-disable-symlink ()
288: "Disable symlink sandboxing."
289: (syd--stat "/dev/syd/sandbox/symlink:off"))
290:
291: (defun syd-enabled-truncate ()
292: "Check whether Truncate sandboxing is enabled."
293: (syd--stat "/dev/syd/sandbox/truncate?"))
294:
295: (defun syd-enable-truncate ()
296: "Enable Truncate sandboxing."
297: (syd--stat "/dev/syd/sandbox/truncate:on"))
298:
299: (defun syd-disable-truncate ()
300: "Disable Truncate sandboxing."
301: (syd--stat "/dev/syd/sandbox/truncate:off"))
302:
303: (defun syd-enabled-chdir ()
304: "Check whether chdir sandboxing is enabled."
305: (syd--stat "/dev/syd/sandbox/chdir?"))
306:
307: (defun syd-enable-chdir ()
308: "Enable chdir sandboxing."
309: (syd--stat "/dev/syd/sandbox/chdir:on"))
310:
311: (defun syd-disable-chdir ()
312: "Disable chdir sandboxing."
313: (syd--stat "/dev/syd/sandbox/chdir:off"))
314:
315: (defun syd-enabled-readdir ()
316: "Check whether readdir sandboxing is enabled."
317: (syd--stat "/dev/syd/sandbox/readdir?"))
318:
319: (defun syd-enable-readdir ()
320: "Enable readdir sandboxing."
321: (syd--stat "/dev/syd/sandbox/readdir:on"))
322:
323: (defun syd-disable-readdir ()
324: "Disable readdir sandboxing."
325: (syd--stat "/dev/syd/sandbox/readdir:off"))
326:
327: (defun syd-enabled-mkdir ()
328: "Check whether mkdir sandboxing is enabled."
329: (syd--stat "/dev/syd/sandbox/mkdir?"))
330:
331: (defun syd-enable-mkdir ()
332: "Enable mkdir sandboxing."
333: (syd--stat "/dev/syd/sandbox/mkdir:on"))
334:
335: (defun syd-disable-mkdir ()
336: "Disable mkdir sandboxing."
337: (syd--stat "/dev/syd/sandbox/mkdir:off"))
338:
339: (defun syd-enabled-rmdir ()
340: "Check whether rmdir sandboxing is enabled."
341: (syd--stat "/dev/syd/sandbox/rmdir?"))
342:
343: (defun syd-enable-rmdir ()
344: "Enable rmdir sandboxing."
345: (syd--stat "/dev/syd/sandbox/rmdir:on"))
346:
347: (defun syd-disable-rmdir ()
348: "Disable rmdir sandboxing."
349: (syd--stat "/dev/syd/sandbox/rmdir:off"))
350:
351: (defun syd-enabled-chown ()
352: "Check whether chown sandboxing is enabled."
353: (syd--stat "/dev/syd/sandbox/chown?"))
354:
355: (defun syd-enable-chown ()
356: "Enable chown sandboxing."
357: (syd--stat "/dev/syd/sandbox/chown:on"))
358:
359: (defun syd-disable-chown ()
360: "Disable chown sandboxing."
361: (syd--stat "/dev/syd/sandbox/chown:off"))
362:
363: (defun syd-enabled-chgrp ()
364: "Check whether chgrp sandboxing is enabled."
365: (syd--stat "/dev/syd/sandbox/chgrp?"))
366:
367: (defun syd-enable-chgrp ()
368: "Enable chgrp sandboxing."
369: (syd--stat "/dev/syd/sandbox/chgrp:on"))
370:
371: (defun syd-disable-chgrp ()
372: "Disable chgrp sandboxing."
373: (syd--stat "/dev/syd/sandbox/chgrp:off"))
374:
375: (defun syd-enabled-chmod ()
376: "Check whether chmod sandboxing is enabled."
377: (syd--stat "/dev/syd/sandbox/chmod?"))
378:
379: (defun syd-enable-chmod ()
380: "Enable chmod sandboxing."
381: (syd--stat "/dev/syd/sandbox/chmod:on"))
382:
383: (defun syd-disable-chmod ()
384: "Disable chmod sandboxing."
385: (syd--stat "/dev/syd/sandbox/chmod:off"))
386:
387: (defun syd-enabled-chattr ()
388: "Check whether chattr sandboxing is enabled."
389: (syd--stat "/dev/syd/sandbox/chattr?"))
390:
391: (defun syd-enable-chattr ()
392: "Enable chattr sandboxing."
393: (syd--stat "/dev/syd/sandbox/chattr:on"))
394:
395: (defun syd-disable-chattr ()
396: "Disable chattr sandboxing."
397: (syd--stat "/dev/syd/sandbox/chattr:off"))
398:
399: (defun syd-enabled-chroot ()
400: "Check whether chroot sandboxing is enabled."
401: (syd--stat "/dev/syd/sandbox/chroot?"))
402:
403: (defun syd-enable-chroot ()
404: "Enable chroot sandboxing."
405: (syd--stat "/dev/syd/sandbox/chroot:on"))
406:
407: (defun syd-disable-chroot ()
408: "Disable chroot sandboxing."
409: (syd--stat "/dev/syd/sandbox/chroot:off"))
410:
411: (defun syd-enabled-notify ()
412: "Check whether notify sandboxing is enabled."
413: (syd--stat "/dev/syd/sandbox/notify?"))
414:
415: (defun syd-enable-notify ()
416: "Enable notify sandboxing."
417: (syd--stat "/dev/syd/sandbox/notify:on"))
418:
419: (defun syd-disable-notify ()
420: "Disable notify sandboxing."
421: (syd--stat "/dev/syd/sandbox/notify:off"))
422:
423: (defun syd-enabled-utime ()
424: "Check whether utime sandboxing is enabled."
425: (syd--stat "/dev/syd/sandbox/utime?"))
426:
427: (defun syd-enable-utime ()
428: "Enable utime sandboxing."
429: (syd--stat "/dev/syd/sandbox/utime:on"))
430:
431: (defun syd-disable-utime ()
432: "Disable utime sandboxing."
433: (syd--stat "/dev/syd/sandbox/utime:off"))
434:
435: (defun syd-enabled-mkbdev ()
436: "Check whether mkbdev sandboxing is enabled."
437: (syd--stat "/dev/syd/sandbox/mkbdev?"))
438:
439: (defun syd-enable-mkbdev ()
440: "Enable mkbdev sandboxing."
441: (syd--stat "/dev/syd/sandbox/mkbdev:on"))
442:
443: (defun syd-disable-mkbdev ()
444: "Disable mkbdev sandboxing."
445: (syd--stat "/dev/syd/sandbox/mkbdev:off"))
446:
447: (defun syd-enabled-mkcdev ()
448: "Check whether mkcdev sandboxing is enabled."
449: (syd--stat "/dev/syd/sandbox/mkcdev?"))
450:
451: (defun syd-enable-mkcdev ()
452: "Enable mkcdev sandboxing."
453: (syd--stat "/dev/syd/sandbox/mkcdev:on"))
454:
455: (defun syd-disable-mkcdev ()
456: "Disable mkcdev sandboxing."
457: (syd--stat "/dev/syd/sandbox/mkcdev:off"))
458:
459: (defun syd-enabled-mkfifo ()
460: "Check whether mkfifo sandboxing is enabled."
461: (syd--stat "/dev/syd/sandbox/mkfifo?"))
462:
463: (defun syd-enable-mkfifo ()
464: "Enable mkfifo sandboxing."
465: (syd--stat "/dev/syd/sandbox/mkfifo:on"))
466:
467: (defun syd-disable-mkfifo ()
468: "Disable mkfifo sandboxing."
469: (syd--stat "/dev/syd/sandbox/mkfifo:off"))
470:
471: (defun syd-enabled-mktemp ()
472: "Check whether mktemp sandboxing is enabled."
473: (syd--stat "/dev/syd/sandbox/mktemp?"))
474:
475: (defun syd-enable-mktemp ()
476: "Enable mktemp sandboxing."
477: (syd--stat "/dev/syd/sandbox/mktemp:on"))
478:
479: (defun syd-disable-mktemp ()
480: "Disable mktemp sandboxing."
481: (syd--stat "/dev/syd/sandbox/mktemp:off"))
482:
483: (defun syd-enabled-net ()
484: "Check whether Network sandboxing is enabled."
485: (syd--stat "/dev/syd/sandbox/net?"))
486:
487: (defun syd-enable-net ()
488: "Enable Network sandboxing."
489: (syd--stat "/dev/syd/sandbox/net:on"))
490:
491: (defun syd-disable-net ()
492: "Disable Network sandboxing."
493: (syd--stat "/dev/syd/sandbox/net:off"))
494:
495: (defun syd-enabled-sendfd ()
496: "Check whether sendfd sandboxing is enabled."
497: (syd--stat "/dev/syd/sandbox/sendfd?"))
498:
499: (defun syd-enable-sendfd ()
500: "Enable sendfd sandboxing."
501: (syd--stat "/dev/syd/sandbox/sendfd:on"))
502:
503: (defun syd-disable-sendfd ()
504: "Disable sendfd sandboxing."
505: (syd--stat "/dev/syd/sandbox/sendfd:off"))
506:
507: (defun syd-enabled-recvfd ()
508: "Check whether recvfd sandboxing is enabled."
509: (syd--stat "/dev/syd/sandbox/recvfd?"))
510:
511: (defun syd-enable-recvfd ()
512: "Enable recvfd sandboxing."
513: (syd--stat "/dev/syd/sandbox/recvfd:on"))
514:
515: (defun syd-disable-recvfd ()
516: "Disable recvfd sandboxing."
517: (syd--stat "/dev/syd/sandbox/recvfd:off"))
518:
519: (defun syd-enabled-lock ()
520: "Check whether lock sandboxing is enabled."
521: (syd--stat "/dev/syd/sandbox/lock?"))
522:
523: (defun syd-enabled-proxy ()
524: "Check whether proxy sandboxing is enabled."
525: (syd--stat "/dev/syd/sandbox/proxy?"))
526:
527: (defun syd-enabled-mem ()
528: "Check whether memory sandboxing is enabled."
529: (syd--stat "/dev/syd/sandbox/mem?"))
530:
531: (defun syd-disable-mem ()
532: "Disable memory sandboxing."
533: (syd--stat "/dev/syd/sandbox/mem:off"))
534:
535: (defun syd-enabled-pid ()
536: "Check whether PID sandboxing is enabled."
537: (syd--stat "/dev/syd/sandbox/pid?"))
538:
539: (defun syd-enable-pid ()
540: "Enable PID sandboxing."
541: (syd--stat "/dev/syd/sandbox/pid:on"))
542:
543: (defun syd-disable-pid ()
544: "Disable PID sandboxing."
545: (syd--stat "/dev/syd/sandbox/pid:off"))
546:
547: (defun syd-enabled-force ()
548: "Check whether force sandboxing is enabled."
549: (syd--stat "/dev/syd/sandbox/force?"))
550:
551: (defun syd-disable-force ()
552: "Disable force sandboxing."
553: (syd--stat "/dev/syd/sandbox/force:off"))
554:
555: (defun syd-enabled-tpe ()
556: "Check whether TPE sandboxing is enabled."
557: (syd--stat "/dev/syd/sandbox/tpe?"))
558:
559: (defun syd-enable-tpe ()
560: "Enable TPE sandboxing."
561: (syd--stat "/dev/syd/sandbox/tpe:on"))
562:
563: (defun syd-disable-tpe ()
564: "Disable TPE sandboxing."
565: (syd--stat "/dev/syd/sandbox/tpe:off"))
566:
567: (defun syd-default-fs (action)
568: "Set default action for Filesystem sandboxing.
569: ACTION is a constant representing the sandboxing action."
570: (let ((action (cond
571: ((eq action :action-allow) "allow")
572: ((eq action :action-warn) "warn")
573: ((eq action :action-filter) "filter")
574: ((eq action :action-deny) "deny")
575: ((eq action :action-panic) "panic")
576: ((eq action :action-stop) "stop")
577: ((eq action :action-abort) "abort")
578: ((eq action :action-kill) "kill")
579: ((eq action :action-exit) "exit"))))
580: (when action
581: (let ((cmd (format "/dev/syd/default/fs:%s" action)))
582: (syd--stat cmd)))))
583:
584: (defun syd-default-walk (action)
585: "Set default action for Walk sandboxing.
586: ACTION is a constant representing the sandboxing action."
587: (let ((action (cond
588: ((eq action :action-allow) "allow")
589: ((eq action :action-warn) "warn")
590: ((eq action :action-filter) "filter")
591: ((eq action :action-deny) "deny")
592: ((eq action :action-panic) "panic")
593: ((eq action :action-stop) "stop")
594: ((eq action :action-abort) "abort")
595: ((eq action :action-kill) "kill")
596: ((eq action :action-exit) "exit"))))
597: (when action
598: (let ((cmd (format "/dev/syd/default/walk:%s" action)))
599: (syd--stat cmd)))))
600:
601: (defun syd-default-list (action)
602: "Set default action for List sandboxing.
603: ACTION is a constant representing the sandboxing action."
604: (let ((action (cond
605: ((eq action :action-allow) "allow")
606: ((eq action :action-warn) "warn")
607: ((eq action :action-filter) "filter")
608: ((eq action :action-deny) "deny")
609: ((eq action :action-panic) "panic")
610: ((eq action :action-stop) "stop")
611: ((eq action :action-abort) "abort")
612: ((eq action :action-kill) "kill")
613: ((eq action :action-exit) "exit"))))
614: (when action
615: (let ((cmd (format "/dev/syd/default/list:%s" action)))
616: (syd--stat cmd)))))
617:
618: (defun syd-default-stat (action)
619: "Set default action for Stat sandboxing.
620: ACTION is a constant representing the sandboxing action."
621: (let ((action (cond
622: ((eq action :action-allow) "allow")
623: ((eq action :action-warn) "warn")
624: ((eq action :action-filter) "filter")
625: ((eq action :action-deny) "deny")
626: ((eq action :action-panic) "panic")
627: ((eq action :action-stop) "stop")
628: ((eq action :action-abort) "abort")
629: ((eq action :action-kill) "kill")
630: ((eq action :action-exit) "exit"))))
631: (when action
632: (let ((cmd (format "/dev/syd/default/stat:%s" action)))
633: (syd--stat cmd)))))
634:
635: (defun syd-default-read (action)
636: "Set default action for Read sandboxing.
637: ACTION is a constant representing the sandboxing action."
638: (let ((action (cond
639: ((eq action :action-allow) "allow")
640: ((eq action :action-warn) "warn")
641: ((eq action :action-filter) "filter")
642: ((eq action :action-deny) "deny")
643: ((eq action :action-panic) "panic")
644: ((eq action :action-stop) "stop")
645: ((eq action :action-abort) "abort")
646: ((eq action :action-kill) "kill")
647: ((eq action :action-exit) "exit"))))
648: (when action
649: (let ((cmd (format "/dev/syd/default/read:%s" action)))
650: (syd--stat cmd)))))
651:
652: (defun syd-default-write (action)
653: "Set default action for Write sandboxing.
654: ACTION is a constant representing the sandboxing action."
655: (let ((action (cond
656: ((eq action :action-allow) "allow")
657: ((eq action :action-warn) "warn")
658: ((eq action :action-filter) "filter")
659: ((eq action :action-deny) "deny")
660: ((eq action :action-panic) "panic")
661: ((eq action :action-stop) "stop")
662: ((eq action :action-abort) "abort")
663: ((eq action :action-kill) "kill")
664: ((eq action :action-exit) "exit"))))
665: (when action
666: (let ((cmd (format "/dev/syd/default/write:%s" action)))
667: (syd--stat cmd)))))
668:
669: (defun syd-default-exec (action)
670: "Set default action for Exec sandboxing.
671: ACTION is a constant representing the sandboxing action."
672: (let ((action (cond
673: ((eq action :action-allow) "allow")
674: ((eq action :action-warn) "warn")
675: ((eq action :action-filter) "filter")
676: ((eq action :action-deny) "deny")
677: ((eq action :action-panic) "panic")
678: ((eq action :action-stop) "stop")
679: ((eq action :action-abort) "abort")
680: ((eq action :action-kill) "kill")
681: ((eq action :action-exit) "exit"))))
682: (when action
683: (let ((cmd (format "/dev/syd/default/exec:%s" action)))
684: (syd--stat cmd)))))
685:
686: (defun syd-default-ioctl (action)
687: "Set default action for Ioctl sandboxing.
688: ACTION is a constant representing the sandboxing action."
689: (let ((action (cond
690: ((eq action :action-allow) "allow")
691: ((eq action :action-warn) "warn")
692: ((eq action :action-filter) "filter")
693: ((eq action :action-deny) "deny")
694: ((eq action :action-panic) "panic")
695: ((eq action :action-stop) "stop")
696: ((eq action :action-abort) "abort")
697: ((eq action :action-kill) "kill")
698: ((eq action :action-exit) "exit"))))
699: (when action
700: (let ((cmd (format "/dev/syd/default/ioctl:%s" action)))
701: (syd--stat cmd)))))
702:
703: (defun syd-default-create (action)
704: "Set default action for Create sandboxing.
705: ACTION is a constant representing the sandboxing action."
706: (let ((action (cond
707: ((eq action :action-allow) "allow")
708: ((eq action :action-warn) "warn")
709: ((eq action :action-filter) "filter")
710: ((eq action :action-deny) "deny")
711: ((eq action :action-panic) "panic")
712: ((eq action :action-stop) "stop")
713: ((eq action :action-abort) "abort")
714: ((eq action :action-kill) "kill")
715: ((eq action :action-exit) "exit"))))
716: (when action
717: (let ((cmd (format "/dev/syd/default/create:%s" action)))
718: (syd--stat cmd)))))
719:
720: (defun syd-default-delete (action)
721: "Set default action for Delete sandboxing.
722: ACTION is a constant representing the sandboxing action."
723: (let ((action (cond
724: ((eq action :action-allow) "allow")
725: ((eq action :action-warn) "warn")
726: ((eq action :action-filter) "filter")
727: ((eq action :action-deny) "deny")
728: ((eq action :action-panic) "panic")
729: ((eq action :action-stop) "stop")
730: ((eq action :action-abort) "abort")
731: ((eq action :action-kill) "kill")
732: ((eq action :action-exit) "exit"))))
733: (when action
734: (let ((cmd (format "/dev/syd/default/delete:%s" action)))
735: (syd--stat cmd)))))
736:
737: (defun syd-default-rename (action)
738: "Set default action for rename sandboxing.
739: ACTION is a constant representing the sandboxing action."
740: (let ((action (cond
741: ((eq action :action-allow) "allow")
742: ((eq action :action-warn) "warn")
743: ((eq action :action-filter) "filter")
744: ((eq action :action-deny) "deny")
745: ((eq action :action-panic) "panic")
746: ((eq action :action-stop) "stop")
747: ((eq action :action-abort) "abort")
748: ((eq action :action-kill) "kill")
749: ((eq action :action-exit) "exit"))))
750: (when action
751: (let ((cmd (format "/dev/syd/default/rename:%s" action)))
752: (syd--stat cmd)))))
753:
754: (defun syd-default-readlink (action)
755: "Set default action for readlink sandboxing.
756: ACTION is a constant representing the sandboxing action."
757: (let ((action (cond
758: ((eq action :action-allow) "allow")
759: ((eq action :action-warn) "warn")
760: ((eq action :action-filter) "filter")
761: ((eq action :action-deny) "deny")
762: ((eq action :action-panic) "panic")
763: ((eq action :action-stop) "stop")
764: ((eq action :action-abort) "abort")
765: ((eq action :action-kill) "kill")
766: ((eq action :action-exit) "exit"))))
767: (when action
768: (let ((cmd (format "/dev/syd/default/readlink:%s" action)))
769: (syd--stat cmd)))))
770:
771: (defun syd-default-symlink (action)
772: "Set default action for symlink sandboxing.
773: ACTION is a constant representing the sandboxing action."
774: (let ((action (cond
775: ((eq action :action-allow) "allow")
776: ((eq action :action-warn) "warn")
777: ((eq action :action-filter) "filter")
778: ((eq action :action-deny) "deny")
779: ((eq action :action-panic) "panic")
780: ((eq action :action-stop) "stop")
781: ((eq action :action-abort) "abort")
782: ((eq action :action-kill) "kill")
783: ((eq action :action-exit) "exit"))))
784: (when action
785: (let ((cmd (format "/dev/syd/default/symlink:%s" action)))
786: (syd--stat cmd)))))
787:
788: (defun syd-default-truncate (action)
789: "Set default action for Truncate sandboxing.
790: ACTION is a constant representing the sandboxing action."
791: (let ((action (cond
792: ((eq action :action-allow) "allow")
793: ((eq action :action-warn) "warn")
794: ((eq action :action-filter) "filter")
795: ((eq action :action-deny) "deny")
796: ((eq action :action-panic) "panic")
797: ((eq action :action-stop) "stop")
798: ((eq action :action-abort) "abort")
799: ((eq action :action-kill) "kill")
800: ((eq action :action-exit) "exit"))))
801: (when action
802: (let ((cmd (format "/dev/syd/default/truncate:%s" action)))
803: (syd--stat cmd)))))
804:
805: (defun syd-default-chdir (action)
806: "Set default action for chdir sandboxing.
807: ACTION is a constant representing the sandboxing action."
808: (let ((action (cond
809: ((eq action :action-allow) "allow")
810: ((eq action :action-warn) "warn")
811: ((eq action :action-filter) "filter")
812: ((eq action :action-deny) "deny")
813: ((eq action :action-panic) "panic")
814: ((eq action :action-stop) "stop")
815: ((eq action :action-abort) "abort")
816: ((eq action :action-kill) "kill")
817: ((eq action :action-exit) "exit"))))
818: (when action
819: (let ((cmd (format "/dev/syd/default/chdir:%s" action)))
820: (syd--stat cmd)))))
821:
822: (defun syd-default-readdir (action)
823: "Set default action for readdir sandboxing.
824: ACTION is a constant representing the sandboxing action."
825: (let ((action (cond
826: ((eq action :action-allow) "allow")
827: ((eq action :action-warn) "warn")
828: ((eq action :action-filter) "filter")
829: ((eq action :action-deny) "deny")
830: ((eq action :action-panic) "panic")
831: ((eq action :action-stop) "stop")
832: ((eq action :action-abort) "abort")
833: ((eq action :action-kill) "kill")
834: ((eq action :action-exit) "exit"))))
835: (when action
836: (let ((cmd (format "/dev/syd/default/readdir:%s" action)))
837: (syd--stat cmd)))))
838:
839: (defun syd-default-mkdir (action)
840: "Set default action for mkdir sandboxing.
841: ACTION is a constant representing the sandboxing action."
842: (let ((action (cond
843: ((eq action :action-allow) "allow")
844: ((eq action :action-warn) "warn")
845: ((eq action :action-filter) "filter")
846: ((eq action :action-deny) "deny")
847: ((eq action :action-panic) "panic")
848: ((eq action :action-stop) "stop")
849: ((eq action :action-abort) "abort")
850: ((eq action :action-kill) "kill")
851: ((eq action :action-exit) "exit"))))
852: (when action
853: (let ((cmd (format "/dev/syd/default/mkdir:%s" action)))
854: (syd--stat cmd)))))
855:
856: (defun syd-default-rmdir (action)
857: "Set default action for rmdir sandboxing.
858: ACTION is a constant representing the sandboxing action."
859: (let ((action (cond
860: ((eq action :action-allow) "allow")
861: ((eq action :action-warn) "warn")
862: ((eq action :action-filter) "filter")
863: ((eq action :action-deny) "deny")
864: ((eq action :action-panic) "panic")
865: ((eq action :action-stop) "stop")
866: ((eq action :action-abort) "abort")
867: ((eq action :action-kill) "kill")
868: ((eq action :action-exit) "exit"))))
869: (when action
870: (let ((cmd (format "/dev/syd/default/rmdir:%s" action)))
871: (syd--stat cmd)))))
872:
873: (defun syd-default-chown (action)
874: "Set default action for Chown sandboxing.
875: ACTION is a constant representing the sandboxing action."
876: (let ((action (cond
877: ((eq action :action-allow) "allow")
878: ((eq action :action-warn) "warn")
879: ((eq action :action-filter) "filter")
880: ((eq action :action-deny) "deny")
881: ((eq action :action-panic) "panic")
882: ((eq action :action-stop) "stop")
883: ((eq action :action-abort) "abort")
884: ((eq action :action-kill) "kill")
885: ((eq action :action-exit) "exit"))))
886: (when action
887: (let ((cmd (format "/dev/syd/default/chown:%s" action)))
888: (syd--stat cmd)))))
889:
890: (defun syd-default-chgrp (action)
891: "Set default action for Chgrp sandboxing.
892: ACTION is a constant representing the sandboxing action."
893: (let ((action (cond
894: ((eq action :action-allow) "allow")
895: ((eq action :action-warn) "warn")
896: ((eq action :action-filter) "filter")
897: ((eq action :action-deny) "deny")
898: ((eq action :action-panic) "panic")
899: ((eq action :action-stop) "stop")
900: ((eq action :action-abort) "abort")
901: ((eq action :action-kill) "kill")
902: ((eq action :action-exit) "exit"))))
903: (when action
904: (let ((cmd (format "/dev/syd/default/chgrp:%s" action)))
905: (syd--stat cmd)))))
906:
907: (defun syd-default-chmod (action)
908: "Set default action for chmod sandboxing.
909: ACTION is a constant representing the sandboxing action."
910: (let ((action (cond
911: ((eq action :action-allow) "allow")
912: ((eq action :action-warn) "warn")
913: ((eq action :action-filter) "filter")
914: ((eq action :action-deny) "deny")
915: ((eq action :action-panic) "panic")
916: ((eq action :action-stop) "stop")
917: ((eq action :action-abort) "abort")
918: ((eq action :action-kill) "kill")
919: ((eq action :action-exit) "exit"))))
920: (when action
921: (let ((cmd (format "/dev/syd/default/chmod:%s" action)))
922: (syd--stat cmd)))))
923:
924: (defun syd-default-chattr (action)
925: "Set default action for chattr sandboxing.
926: ACTION is a constant representing the sandboxing action."
927: (let ((action (cond
928: ((eq action :action-allow) "allow")
929: ((eq action :action-warn) "warn")
930: ((eq action :action-filter) "filter")
931: ((eq action :action-deny) "deny")
932: ((eq action :action-panic) "panic")
933: ((eq action :action-stop) "stop")
934: ((eq action :action-abort) "abort")
935: ((eq action :action-kill) "kill")
936: ((eq action :action-exit) "exit"))))
937: (when action
938: (let ((cmd (format "/dev/syd/default/chattr:%s" action)))
939: (syd--stat cmd)))))
940:
941: (defun syd-default-chroot (action)
942: "Set default action for chroot sandboxing.
943: ACTION is a constant representing the sandboxing action."
944: (let ((action (cond
945: ((eq action :action-allow) "allow")
946: ((eq action :action-warn) "warn")
947: ((eq action :action-filter) "filter")
948: ((eq action :action-deny) "deny")
949: ((eq action :action-panic) "panic")
950: ((eq action :action-stop) "stop")
951: ((eq action :action-abort) "abort")
952: ((eq action :action-kill) "kill")
953: ((eq action :action-exit) "exit"))))
954: (when action
955: (let ((cmd (format "/dev/syd/default/chroot:%s" action)))
956: (syd--stat cmd)))))
957:
958: (defun syd-default-notify (action)
959: "Set default action for notify sandboxing.
960: ACTION is a constant representing the sandboxing action."
961: (let ((action (cond
962: ((eq action :action-allow) "allow")
963: ((eq action :action-warn) "warn")
964: ((eq action :action-filter) "filter")
965: ((eq action :action-deny) "deny")
966: ((eq action :action-panic) "panic")
967: ((eq action :action-stop) "stop")
968: ((eq action :action-abort) "abort")
969: ((eq action :action-kill) "kill")
970: ((eq action :action-exit) "exit"))))
971: (when action
972: (let ((cmd (format "/dev/syd/default/notify:%s" action)))
973: (syd--stat cmd)))))
974:
975: (defun syd-default-utime (action)
976: "Set default action for utime sandboxing.
977: ACTION is a constant representing the sandboxing action."
978: (let ((action (cond
979: ((eq action :action-allow) "allow")
980: ((eq action :action-warn) "warn")
981: ((eq action :action-filter) "filter")
982: ((eq action :action-deny) "deny")
983: ((eq action :action-panic) "panic")
984: ((eq action :action-stop) "stop")
985: ((eq action :action-abort) "abort")
986: ((eq action :action-kill) "kill")
987: ((eq action :action-exit) "exit"))))
988: (when action
989: (let ((cmd (format "/dev/syd/default/utime:%s" action)))
990: (syd--stat cmd)))))
991:
992: (defun syd-default-mkbdev (action)
993: "Set default action for mkbdev sandboxing.
994: ACTION is a constant representing the sandboxing action."
995: (let ((action (cond
996: ((eq action :action-allow) "allow")
997: ((eq action :action-warn) "warn")
998: ((eq action :action-filter) "filter")
999: ((eq action :action-deny) "deny")
1000: ((eq action :action-panic) "panic")
1001: ((eq action :action-stop) "stop")
1002: ((eq action :action-abort) "abort")
1003: ((eq action :action-kill) "kill")
1004: ((eq action :action-exit) "exit"))))
1005: (when action
1006: (let ((cmd (format "/dev/syd/default/mkbdev:%s" action)))
1007: (syd--stat cmd)))))
1008:
1009: (defun syd-default-mkcdev (action)
1010: "Set default action for mkcdev sandboxing.
1011: ACTION is a constant representing the sandboxing action."
1012: (let ((action (cond
1013: ((eq action :action-allow) "allow")
1014: ((eq action :action-warn) "warn")
1015: ((eq action :action-filter) "filter")
1016: ((eq action :action-deny) "deny")
1017: ((eq action :action-panic) "panic")
1018: ((eq action :action-stop) "stop")
1019: ((eq action :action-abort) "abort")
1020: ((eq action :action-kill) "kill")
1021: ((eq action :action-exit) "exit"))))
1022: (when action
1023: (let ((cmd (format "/dev/syd/default/mkcdev:%s" action)))
1024: (syd--stat cmd)))))
1025:
1026: (defun syd-default-mkfifo (action)
1027: "Set default action for mkfifo sandboxing.
1028: ACTION is a constant representing the sandboxing action."
1029: (let ((action (cond
1030: ((eq action :action-allow) "allow")
1031: ((eq action :action-warn) "warn")
1032: ((eq action :action-filter) "filter")
1033: ((eq action :action-deny) "deny")
1034: ((eq action :action-panic) "panic")
1035: ((eq action :action-stop) "stop")
1036: ((eq action :action-abort) "abort")
1037: ((eq action :action-kill) "kill")
1038: ((eq action :action-exit) "exit"))))
1039: (when action
1040: (let ((cmd (format "/dev/syd/default/mkfifo:%s" action)))
1041: (syd--stat cmd)))))
1042:
1043: (defun syd-default-mktemp (action)
1044: "Set default action for mktemp sandboxing.
1045: ACTION is a constant representing the sandboxing action."
1046: (let ((action (cond
1047: ((eq action :action-allow) "allow")
1048: ((eq action :action-warn) "warn")
1049: ((eq action :action-filter) "filter")
1050: ((eq action :action-deny) "deny")
1051: ((eq action :action-panic) "panic")
1052: ((eq action :action-stop) "stop")
1053: ((eq action :action-abort) "abort")
1054: ((eq action :action-kill) "kill")
1055: ((eq action :action-exit) "exit"))))
1056: (when action
1057: (let ((cmd (format "/dev/syd/default/mktemp:%s" action)))
1058: (syd--stat cmd)))))
1059:
1060: (defun syd-default-net (action)
1061: "Set default action for Network sandboxing.
1062: ACTION is a constant representing the sandboxing action."
1063: (let ((action (cond
1064: ((eq action :action-allow) "allow")
1065: ((eq action :action-warn) "warn")
1066: ((eq action :action-filter) "filter")
1067: ((eq action :action-deny) "deny")
1068: ((eq action :action-panic) "panic")
1069: ((eq action :action-stop) "stop")
1070: ((eq action :action-abort) "abort")
1071: ((eq action :action-kill) "kill")
1072: ((eq action :action-exit) "exit"))))
1073: (when action
1074: (let ((cmd (format "/dev/syd/default/net:%s" action)))
1075: (syd--stat cmd)))))
1076:
1077: (defun syd-default-net-bind (action)
1078: "Set default action for Bind sandboxing.
1079: ACTION is a constant representing the sandboxing action."
1080: (let ((action (cond
1081: ((eq action :action-allow) "allow")
1082: ((eq action :action-warn) "warn")
1083: ((eq action :action-filter) "filter")
1084: ((eq action :action-deny) "deny")
1085: ((eq action :action-panic) "panic")
1086: ((eq action :action-stop) "stop")
1087: ((eq action :action-abort) "abort")
1088: ((eq action :action-kill) "kill")
1089: ((eq action :action-exit) "exit"))))
1090: (when action
1091: (let ((cmd (format "/dev/syd/default/net/bind:%s" action)))
1092: (syd--stat cmd)))))
1093:
1094: (defun syd-default-net-connect (action)
1095: "Set default action for Connect sandboxing.
1096: ACTION is a constant representing the sandboxing action."
1097: (let ((action (cond
1098: ((eq action :action-allow) "allow")
1099: ((eq action :action-warn) "warn")
1100: ((eq action :action-filter) "filter")
1101: ((eq action :action-deny) "deny")
1102: ((eq action :action-panic) "panic")
1103: ((eq action :action-stop) "stop")
1104: ((eq action :action-abort) "abort")
1105: ((eq action :action-kill) "kill")
1106: ((eq action :action-exit) "exit"))))
1107: (when action
1108: (let ((cmd (format "/dev/syd/default/net/connect:%s" action)))
1109: (syd--stat cmd)))))
1110:
1111: (defun syd-default-sendfd (action)
1112: "Set default action for SendFd sandboxing.
1113: ACTION is a constant representing the sandboxing action."
1114: (let ((action (cond
1115: ((eq action :action-allow) "allow")
1116: ((eq action :action-warn) "warn")
1117: ((eq action :action-filter) "filter")
1118: ((eq action :action-deny) "deny")
1119: ((eq action :action-panic) "panic")
1120: ((eq action :action-stop) "stop")
1121: ((eq action :action-abort) "abort")
1122: ((eq action :action-kill) "kill")
1123: ((eq action :action-exit) "exit"))))
1124: (when action
1125: (let ((cmd (format "/dev/syd/default/sendfd:%s" action)))
1126: (syd--stat cmd)))))
1127:
1128: (defun syd-default-recvfd (action)
1129: "Set default action for RecvFd sandboxing.
1130: ACTION is a constant representing the sandboxing action."
1131: (let ((action (cond
1132: ((eq action :action-allow) "allow")
1133: ((eq action :action-warn) "warn")
1134: ((eq action :action-filter) "filter")
1135: ((eq action :action-deny) "deny")
1136: ((eq action :action-panic) "panic")
1137: ((eq action :action-stop) "stop")
1138: ((eq action :action-abort) "abort")
1139: ((eq action :action-kill) "kill")
1140: ((eq action :action-exit) "exit"))))
1141: (when action
1142: (let ((cmd (format "/dev/syd/default/recvfd:%s" action)))
1143: (syd--stat cmd)))))
1144:
1145: ; TODO: syd-default-block!
1146:
1147: (defun syd-default-mem (action)
1148: "Set default action for Memory sandboxing.
1149: ACTION is a constant representing the sandboxing action."
1150: (let ((action (cond
1151: ((eq action :action-allow) "allow")
1152: ((eq action :action-warn) "warn")
1153: ((eq action :action-filter) "filter")
1154: ((eq action :action-deny) "deny")
1155: ((eq action :action-panic) "panic")
1156: ((eq action :action-stop) "stop")
1157: ((eq action :action-abort) "abort")
1158: ((eq action :action-kill) "kill")
1159: ((eq action :action-exit) "exit"))))
1160: (when action
1161: (let ((cmd (format "/dev/syd/default/mem:%s" action)))
1162: (syd--stat cmd)))))
1163:
1164: (defun syd-default-pid (action)
1165: "Set default action for PID sandboxing.
1166: ACTION is a constant representing the sandboxing action."
1167: (let ((action (cond
1168: ((eq action :action-allow) "allow")
1169: ((eq action :action-warn) "warn")
1170: ((eq action :action-filter) "filter")
1171: ((eq action :action-deny) "deny")
1172: ((eq action :action-panic) "panic")
1173: ((eq action :action-stop) "stop")
1174: ((eq action :action-abort) "abort")
1175: ((eq action :action-kill) "kill")
1176: ((eq action :action-exit) "exit"))))
1177: (when action
1178: (let ((cmd (format "/dev/syd/default/pid:%s" action)))
1179: (syd--stat cmd)))))
1180:
1181: (defun syd-default-force (action)
1182: "Set default action for Force sandboxing.
1183: ACTION is a constant representing the sandboxing action."
1184: (let ((action (cond
1185: ((eq action :action-allow) "allow")
1186: ((eq action :action-warn) "warn")
1187: ((eq action :action-filter) "filter")
1188: ((eq action :action-deny) "deny")
1189: ((eq action :action-panic) "panic")
1190: ((eq action :action-stop) "stop")
1191: ((eq action :action-abort) "abort")
1192: ((eq action :action-kill) "kill")
1193: ((eq action :action-exit) "exit"))))
1194: (when action
1195: (let ((cmd (format "/dev/syd/default/force:%s" action)))
1196: (syd--stat cmd)))))
1197:
1198: (defun syd-default-segvguard (action)
1199: "Set default action for SegvGuard.
1200: ACTION is a constant representing the sandboxing action."
1201: (let ((action (cond
1202: ((eq action :action-allow) "allow")
1203: ((eq action :action-warn) "warn")
1204: ((eq action :action-filter) "filter")
1205: ((eq action :action-deny) "deny")
1206: ((eq action :action-panic) "panic")
1207: ((eq action :action-stop) "stop")
1208: ((eq action :action-abort) "abort")
1209: ((eq action :action-kill) "kill")
1210: ((eq action :action-exit) "exit"))))
1211: (when action
1212: (let ((cmd (format "/dev/syd/default/segvguard:%s" action)))
1213: (syd--stat cmd)))))
1214:
1215: (defun syd-default-tpe (action)
1216: "Set default action for TPE sandboxing.
1217: ACTION is a constant representing the sandboxing action."
1218: (let ((action (cond
1219: ((eq action :action-allow) "allow")
1220: ((eq action :action-warn) "warn")
1221: ((eq action :action-filter) "filter")
1222: ((eq action :action-deny) "deny")
1223: ((eq action :action-panic) "panic")
1224: ((eq action :action-stop) "stop")
1225: ((eq action :action-abort) "abort")
1226: ((eq action :action-kill) "kill")
1227: ((eq action :action-exit) "exit"))))
1228: (when action
1229: (let ((cmd (format "/dev/syd/default/tpe:%s" action)))
1230: (syd--stat cmd)))))
1231:
1232: (defun syd-ioctl-deny (request)
1233: "Add a request to the _ioctl_(2) denylist.
1234: REQUEST is the _ioctl_(2) request number to add to the denylist."
1235: (unless (numberp request)
1236: (error "Request must be a number"))
1237: (let ((path (format "/dev/syd/deny/ioctl+%d" request)))
1238: (syd--stat path)))
1239:
1240: (defun syd-fs-add (action glob)
1241: "Add to the given actionlist of Filesystem sandboxing.
1242: ACTION is a constant representing the sandboxing action.
1243: GLOB is a string representing the glob pattern."
1244: (let ((action (cond
1245: ((eq action :action-allow) "allow")
1246: ((eq action :action-warn) "warn")
1247: ((eq action :action-filter) "filter")
1248: ((eq action :action-deny) "deny")
1249: ((eq action :action-panic) "panic")
1250: ((eq action :action-stop) "stop")
1251: ((eq action :action-abort) "abort")
1252: ((eq action :action-kill) "kill")
1253: ((eq action :action-exit) "exit"))))
1254: (when action
1255: (let ((cmd (format "%s/fs" action)))
1256: (syd--stat (syd--rule cmd glob ?+))))))
1257:
1258: (defun syd-fs-del (action glob)
1259: "Remove the first matching Filesystem sandboxing actionlist entry.
1260: ACTION is a constant representing the sandboxing action.
1261: GLOB is a string representing the glob pattern."
1262: (let ((action (cond
1263: ((eq action :action-allow) "allow")
1264: ((eq action :action-warn) "warn")
1265: ((eq action :action-filter) "filter")
1266: ((eq action :action-deny) "deny")
1267: ((eq action :action-panic) "panic")
1268: ((eq action :action-stop) "stop")
1269: ((eq action :action-abort) "abort")
1270: ((eq action :action-kill) "kill")
1271: ((eq action :action-exit) "exit"))))
1272: (when action
1273: (let ((cmd (format "%s/fs" action)))
1274: (syd--stat (syd--rule cmd glob ?-))))))
1275:
1276: (defun syd-fs-rem (action glob)
1277: "Remove all matching Filesystem sandboxing actionlist entries.
1278: ACTION is a constant representing the sandboxing action.
1279: GLOB is a string representing the glob pattern."
1280: (let ((action (cond
1281: ((eq action :action-allow) "allow")
1282: ((eq action :action-warn) "warn")
1283: ((eq action :action-filter) "filter")
1284: ((eq action :action-deny) "deny")
1285: ((eq action :action-panic) "panic")
1286: ((eq action :action-stop) "stop")
1287: ((eq action :action-abort) "abort")
1288: ((eq action :action-kill) "kill")
1289: ((eq action :action-exit) "exit"))))
1290: (when action
1291: (let ((cmd (format "%s/fs" action)))
1292: (syd--stat (syd--rule cmd glob ?^))))))
1293:
1294: (defun syd-walk-add (action glob)
1295: "Add to the given actionlist of walk sandboxing.
1296: ACTION is a constant representing the sandboxing action.
1297: GLOB is a string representing the glob pattern."
1298: (let ((action (cond
1299: ((eq action :action-allow) "allow")
1300: ((eq action :action-warn) "warn")
1301: ((eq action :action-filter) "filter")
1302: ((eq action :action-deny) "deny")
1303: ((eq action :action-panic) "panic")
1304: ((eq action :action-stop) "stop")
1305: ((eq action :action-abort) "abort")
1306: ((eq action :action-kill) "kill")
1307: ((eq action :action-exit) "exit"))))
1308: (when action
1309: (let ((cmd (format "%s/walk" action)))
1310: (syd--stat (syd--rule cmd glob ?+))))))
1311:
1312: (defun syd-walk-del (action glob)
1313: "Remove the first matching walk sandboxing actionlist entry.
1314: ACTION is a constant representing the sandboxing action.
1315: GLOB is a string representing the glob pattern."
1316: (let ((action (cond
1317: ((eq action :action-allow) "allow")
1318: ((eq action :action-warn) "warn")
1319: ((eq action :action-filter) "filter")
1320: ((eq action :action-deny) "deny")
1321: ((eq action :action-panic) "panic")
1322: ((eq action :action-stop) "stop")
1323: ((eq action :action-abort) "abort")
1324: ((eq action :action-kill) "kill")
1325: ((eq action :action-exit) "exit"))))
1326: (when action
1327: (let ((cmd (format "%s/walk" action)))
1328: (syd--stat (syd--rule cmd glob ?-))))))
1329:
1330: (defun syd-walk-rem (action glob)
1331: "Remove all matching walk sandboxing actionlist entries.
1332: ACTION is a constant representing the sandboxing action.
1333: GLOB is a string representing the glob pattern."
1334: (let ((action (cond
1335: ((eq action :action-allow) "allow")
1336: ((eq action :action-warn) "warn")
1337: ((eq action :action-filter) "filter")
1338: ((eq action :action-deny) "deny")
1339: ((eq action :action-panic) "panic")
1340: ((eq action :action-stop) "stop")
1341: ((eq action :action-abort) "abort")
1342: ((eq action :action-kill) "kill")
1343: ((eq action :action-exit) "exit"))))
1344: (when action
1345: (let ((cmd (format "%s/walk" action)))
1346: (syd--stat (syd--rule cmd glob ?^))))))
1347:
1348: (defun syd-list-add (action glob)
1349: "Add to the given actionlist of list sandboxing.
1350: ACTION is a constant representing the sandboxing action.
1351: GLOB is a string representing the glob pattern."
1352: (let ((action (cond
1353: ((eq action :action-allow) "allow")
1354: ((eq action :action-warn) "warn")
1355: ((eq action :action-filter) "filter")
1356: ((eq action :action-deny) "deny")
1357: ((eq action :action-panic) "panic")
1358: ((eq action :action-stop) "stop")
1359: ((eq action :action-abort) "abort")
1360: ((eq action :action-kill) "kill")
1361: ((eq action :action-exit) "exit"))))
1362: (when action
1363: (let ((cmd (format "%s/list" action)))
1364: (syd--stat (syd--rule cmd glob ?+))))))
1365:
1366: (defun syd-list-del (action glob)
1367: "Remove the first matching list sandboxing actionlist entry.
1368: ACTION is a constant representing the sandboxing action.
1369: GLOB is a string representing the glob pattern."
1370: (let ((action (cond
1371: ((eq action :action-allow) "allow")
1372: ((eq action :action-warn) "warn")
1373: ((eq action :action-filter) "filter")
1374: ((eq action :action-deny) "deny")
1375: ((eq action :action-panic) "panic")
1376: ((eq action :action-stop) "stop")
1377: ((eq action :action-abort) "abort")
1378: ((eq action :action-kill) "kill")
1379: ((eq action :action-exit) "exit"))))
1380: (when action
1381: (let ((cmd (format "%s/list" action)))
1382: (syd--stat (syd--rule cmd glob ?-))))))
1383:
1384: (defun syd-list-rem (action glob)
1385: "Remove all matching list sandboxing actionlist entries.
1386: ACTION is a constant representing the sandboxing action.
1387: GLOB is a string representing the glob pattern."
1388: (let ((action (cond
1389: ((eq action :action-allow) "allow")
1390: ((eq action :action-warn) "warn")
1391: ((eq action :action-filter) "filter")
1392: ((eq action :action-deny) "deny")
1393: ((eq action :action-panic) "panic")
1394: ((eq action :action-stop) "stop")
1395: ((eq action :action-abort) "abort")
1396: ((eq action :action-kill) "kill")
1397: ((eq action :action-exit) "exit"))))
1398: (when action
1399: (let ((cmd (format "%s/list" action)))
1400: (syd--stat (syd--rule cmd glob ?^))))))
1401:
1402: (defun syd-stat-add (action glob)
1403: "Add to the given actionlist of stat sandboxing.
1404: ACTION is a constant representing the sandboxing action.
1405: GLOB is a string representing the glob pattern."
1406: (let ((action (cond
1407: ((eq action :action-allow) "allow")
1408: ((eq action :action-warn) "warn")
1409: ((eq action :action-filter) "filter")
1410: ((eq action :action-deny) "deny")
1411: ((eq action :action-panic) "panic")
1412: ((eq action :action-stop) "stop")
1413: ((eq action :action-abort) "abort")
1414: ((eq action :action-kill) "kill")
1415: ((eq action :action-exit) "exit"))))
1416: (when action
1417: (let ((cmd (format "%s/stat" action)))
1418: (syd--stat (syd--rule cmd glob ?+))))))
1419:
1420: (defun syd-stat-del (action glob)
1421: "Remove the first matching stat sandboxing actionlist entry.
1422: ACTION is a constant representing the sandboxing action.
1423: GLOB is a string representing the glob pattern."
1424: (let ((action (cond
1425: ((eq action :action-allow) "allow")
1426: ((eq action :action-warn) "warn")
1427: ((eq action :action-filter) "filter")
1428: ((eq action :action-deny) "deny")
1429: ((eq action :action-panic) "panic")
1430: ((eq action :action-stop) "stop")
1431: ((eq action :action-abort) "abort")
1432: ((eq action :action-kill) "kill")
1433: ((eq action :action-exit) "exit"))))
1434: (when action
1435: (let ((cmd (format "%s/stat" action)))
1436: (syd--stat (syd--rule cmd glob ?-))))))
1437:
1438: (defun syd-stat-rem (action glob)
1439: "Remove all matching stat sandboxing actionlist entries.
1440: ACTION is a constant representing the sandboxing action.
1441: GLOB is a string representing the glob pattern."
1442: (let ((action (cond
1443: ((eq action :action-allow) "allow")
1444: ((eq action :action-warn) "warn")
1445: ((eq action :action-filter) "filter")
1446: ((eq action :action-deny) "deny")
1447: ((eq action :action-panic) "panic")
1448: ((eq action :action-stop) "stop")
1449: ((eq action :action-abort) "abort")
1450: ((eq action :action-kill) "kill")
1451: ((eq action :action-exit) "exit"))))
1452: (when action
1453: (let ((cmd (format "%s/stat" action)))
1454: (syd--stat (syd--rule cmd glob ?^))))))
1455:
1456: (defun syd-read-add (action glob)
1457: "Add to the given actionlist of read sandboxing.
1458: ACTION is a constant representing the sandboxing action.
1459: GLOB is a string representing the glob pattern."
1460: (let ((action (cond
1461: ((eq action :action-allow) "allow")
1462: ((eq action :action-warn) "warn")
1463: ((eq action :action-filter) "filter")
1464: ((eq action :action-deny) "deny")
1465: ((eq action :action-panic) "panic")
1466: ((eq action :action-stop) "stop")
1467: ((eq action :action-abort) "abort")
1468: ((eq action :action-kill) "kill")
1469: ((eq action :action-exit) "exit"))))
1470: (when action
1471: (let ((cmd (format "%s/read" action)))
1472: (syd--stat (syd--rule cmd glob ?+))))))
1473:
1474: (defun syd-read-del (action glob)
1475: "Remove the first matching read sandboxing actionlist entry.
1476: ACTION is a constant representing the sandboxing action.
1477: GLOB is a string representing the glob pattern."
1478: (let ((action (cond
1479: ((eq action :action-allow) "allow")
1480: ((eq action :action-warn) "warn")
1481: ((eq action :action-filter) "filter")
1482: ((eq action :action-deny) "deny")
1483: ((eq action :action-panic) "panic")
1484: ((eq action :action-stop) "stop")
1485: ((eq action :action-abort) "abort")
1486: ((eq action :action-kill) "kill")
1487: ((eq action :action-exit) "exit"))))
1488: (when action
1489: (let ((cmd (format "%s/read" action)))
1490: (syd--stat (syd--rule cmd glob ?-))))))
1491:
1492: (defun syd-read-rem (action glob)
1493: "Remove all matching read sandboxing actionlist entries.
1494: ACTION is a constant representing the sandboxing action.
1495: GLOB is a string representing the glob pattern."
1496: (let ((action (cond
1497: ((eq action :action-allow) "allow")
1498: ((eq action :action-warn) "warn")
1499: ((eq action :action-filter) "filter")
1500: ((eq action :action-deny) "deny")
1501: ((eq action :action-panic) "panic")
1502: ((eq action :action-stop) "stop")
1503: ((eq action :action-abort) "abort")
1504: ((eq action :action-kill) "kill")
1505: ((eq action :action-exit) "exit"))))
1506: (when action
1507: (let ((cmd (format "%s/read" action)))
1508: (syd--stat (syd--rule cmd glob ?^))))))
1509:
1510: (defun syd-write-add (action glob)
1511: "Add to the given actionlist of write sandboxing.
1512: ACTION is a constant representing the sandboxing action.
1513: GLOB is a string representing the glob pattern."
1514: (let ((action (cond
1515: ((eq action :action-allow) "allow")
1516: ((eq action :action-warn) "warn")
1517: ((eq action :action-filter) "filter")
1518: ((eq action :action-deny) "deny")
1519: ((eq action :action-panic) "panic")
1520: ((eq action :action-stop) "stop")
1521: ((eq action :action-abort) "abort")
1522: ((eq action :action-kill) "kill")
1523: ((eq action :action-exit) "exit"))))
1524: (when action
1525: (let ((cmd (format "%s/write" action)))
1526: (syd--stat (syd--rule cmd glob ?+))))))
1527:
1528: (defun syd-write-del (action glob)
1529: "Remove the first matching write sandboxing actionlist entry.
1530: ACTION is a constant representing the sandboxing action.
1531: GLOB is a string representing the glob pattern."
1532: (let ((action (cond
1533: ((eq action :action-allow) "allow")
1534: ((eq action :action-warn) "warn")
1535: ((eq action :action-filter) "filter")
1536: ((eq action :action-deny) "deny")
1537: ((eq action :action-panic) "panic")
1538: ((eq action :action-stop) "stop")
1539: ((eq action :action-abort) "abort")
1540: ((eq action :action-kill) "kill")
1541: ((eq action :action-exit) "exit"))))
1542: (when action
1543: (let ((cmd (format "%s/write" action)))
1544: (syd--stat (syd--rule cmd glob ?-))))))
1545:
1546: (defun syd-write-rem (action glob)
1547: "Remove all matching write sandboxing actionlist entries.
1548: ACTION is a constant representing the sandboxing action.
1549: GLOB is a string representing the glob pattern."
1550: (let ((action (cond
1551: ((eq action :action-allow) "allow")
1552: ((eq action :action-warn) "warn")
1553: ((eq action :action-filter) "filter")
1554: ((eq action :action-deny) "deny")
1555: ((eq action :action-panic) "panic")
1556: ((eq action :action-stop) "stop")
1557: ((eq action :action-abort) "abort")
1558: ((eq action :action-kill) "kill")
1559: ((eq action :action-exit) "exit"))))
1560: (when action
1561: (let ((cmd (format "%s/write" action)))
1562: (syd--stat (syd--rule cmd glob ?^))))))
1563:
1564: (defun syd-exec-add (action glob)
1565: "Add to the given actionlist of exec sandboxing.
1566: ACTION is a constant representing the sandboxing action.
1567: GLOB is a string representing the glob pattern."
1568: (let ((action (cond
1569: ((eq action :action-allow) "allow")
1570: ((eq action :action-warn) "warn")
1571: ((eq action :action-filter) "filter")
1572: ((eq action :action-deny) "deny")
1573: ((eq action :action-panic) "panic")
1574: ((eq action :action-stop) "stop")
1575: ((eq action :action-abort) "abort")
1576: ((eq action :action-kill) "kill")
1577: ((eq action :action-exit) "exit"))))
1578: (when action
1579: (let ((cmd (format "%s/exec" action)))
1580: (syd--stat (syd--rule cmd glob ?+))))))
1581:
1582: (defun syd-exec-del (action glob)
1583: "Remove the first matching exec sandboxing actionlist entry.
1584: ACTION is a constant representing the sandboxing action.
1585: GLOB is a string representing the glob pattern."
1586: (let ((action (cond
1587: ((eq action :action-allow) "allow")
1588: ((eq action :action-warn) "warn")
1589: ((eq action :action-filter) "filter")
1590: ((eq action :action-deny) "deny")
1591: ((eq action :action-panic) "panic")
1592: ((eq action :action-stop) "stop")
1593: ((eq action :action-abort) "abort")
1594: ((eq action :action-kill) "kill")
1595: ((eq action :action-exit) "exit"))))
1596: (when action
1597: (let ((cmd (format "%s/exec" action)))
1598: (syd--stat (syd--rule cmd glob ?-))))))
1599:
1600: (defun syd-exec-rem (action glob)
1601: "Remove all matching exec sandboxing actionlist entries.
1602: ACTION is a constant representing the sandboxing action.
1603: GLOB is a string representing the glob pattern."
1604: (let ((action (cond
1605: ((eq action :action-allow) "allow")
1606: ((eq action :action-warn) "warn")
1607: ((eq action :action-filter) "filter")
1608: ((eq action :action-deny) "deny")
1609: ((eq action :action-panic) "panic")
1610: ((eq action :action-stop) "stop")
1611: ((eq action :action-abort) "abort")
1612: ((eq action :action-kill) "kill")
1613: ((eq action :action-exit) "exit"))))
1614: (when action
1615: (let ((cmd (format "%s/exec" action)))
1616: (syd--stat (syd--rule cmd glob ?^))))))
1617:
1618: (defun syd-ioctl-add (action glob)
1619: "Add to the given actionlist of ioctl sandboxing.
1620: ACTION is a constant representing the sandboxing action.
1621: GLOB is a string representing the glob pattern."
1622: (let ((action (cond
1623: ((eq action :action-allow) "allow")
1624: ((eq action :action-warn) "warn")
1625: ((eq action :action-filter) "filter")
1626: ((eq action :action-deny) "deny")
1627: ((eq action :action-panic) "panic")
1628: ((eq action :action-stop) "stop")
1629: ((eq action :action-abort) "abort")
1630: ((eq action :action-kill) "kill")
1631: ((eq action :action-exit) "exit"))))
1632: (when action
1633: (let ((cmd (format "%s/ioctl" action)))
1634: (syd--stat (syd--rule cmd glob ?+))))))
1635:
1636: (defun syd-ioctl-del (action glob)
1637: "Remove the first matching ioctl sandboxing actionlist entry.
1638: ACTION is a constant representing the sandboxing action.
1639: GLOB is a string representing the glob pattern."
1640: (let ((action (cond
1641: ((eq action :action-allow) "allow")
1642: ((eq action :action-warn) "warn")
1643: ((eq action :action-filter) "filter")
1644: ((eq action :action-deny) "deny")
1645: ((eq action :action-panic) "panic")
1646: ((eq action :action-stop) "stop")
1647: ((eq action :action-abort) "abort")
1648: ((eq action :action-kill) "kill")
1649: ((eq action :action-exit) "exit"))))
1650: (when action
1651: (let ((cmd (format "%s/ioctl" action)))
1652: (syd--stat (syd--rule cmd glob ?-))))))
1653:
1654: (defun syd-ioctl-rem (action glob)
1655: "Remove all matching ioctl sandboxing actionlist entries.
1656: ACTION is a constant representing the sandboxing action.
1657: GLOB is a string representing the glob pattern."
1658: (let ((action (cond
1659: ((eq action :action-allow) "allow")
1660: ((eq action :action-warn) "warn")
1661: ((eq action :action-filter) "filter")
1662: ((eq action :action-deny) "deny")
1663: ((eq action :action-panic) "panic")
1664: ((eq action :action-stop) "stop")
1665: ((eq action :action-abort) "abort")
1666: ((eq action :action-kill) "kill")
1667: ((eq action :action-exit) "exit"))))
1668: (when action
1669: (let ((cmd (format "%s/ioctl" action)))
1670: (syd--stat (syd--rule cmd glob ?^))))))
1671:
1672: (defun syd-create-add (action glob)
1673: "Add to the given actionlist of create sandboxing.
1674: ACTION is a constant representing the sandboxing action.
1675: GLOB is a string representing the glob pattern."
1676: (let ((action (cond
1677: ((eq action :action-allow) "allow")
1678: ((eq action :action-warn) "warn")
1679: ((eq action :action-filter) "filter")
1680: ((eq action :action-deny) "deny")
1681: ((eq action :action-panic) "panic")
1682: ((eq action :action-stop) "stop")
1683: ((eq action :action-abort) "abort")
1684: ((eq action :action-kill) "kill")
1685: ((eq action :action-exit) "exit"))))
1686: (when action
1687: (let ((cmd (format "%s/create" action)))
1688: (syd--stat (syd--rule cmd glob ?+))))))
1689:
1690: (defun syd-create-del (action glob)
1691: "Remove the first matching create sandboxing actionlist entry.
1692: ACTION is a constant representing the sandboxing action.
1693: GLOB is a string representing the glob pattern."
1694: (let ((action (cond
1695: ((eq action :action-allow) "allow")
1696: ((eq action :action-warn) "warn")
1697: ((eq action :action-filter) "filter")
1698: ((eq action :action-deny) "deny")
1699: ((eq action :action-panic) "panic")
1700: ((eq action :action-stop) "stop")
1701: ((eq action :action-abort) "abort")
1702: ((eq action :action-kill) "kill")
1703: ((eq action :action-exit) "exit"))))
1704: (when action
1705: (let ((cmd (format "%s/create" action)))
1706: (syd--stat (syd--rule cmd glob ?-))))))
1707:
1708: (defun syd-create-rem (action glob)
1709: "Remove all matching create sandboxing actionlist entries.
1710: ACTION is a constant representing the sandboxing action.
1711: GLOB is a string representing the glob pattern."
1712: (let ((action (cond
1713: ((eq action :action-allow) "allow")
1714: ((eq action :action-warn) "warn")
1715: ((eq action :action-filter) "filter")
1716: ((eq action :action-deny) "deny")
1717: ((eq action :action-panic) "panic")
1718: ((eq action :action-stop) "stop")
1719: ((eq action :action-abort) "abort")
1720: ((eq action :action-kill) "kill")
1721: ((eq action :action-exit) "exit"))))
1722: (when action
1723: (let ((cmd (format "%s/create" action)))
1724: (syd--stat (syd--rule cmd glob ?^))))))
1725:
1726: (defun syd-delete-add (action glob)
1727: "Add to the given actionlist of delete sandboxing.
1728: ACTION is a constant representing the sandboxing action.
1729: GLOB is a string representing the glob pattern."
1730: (let ((action (cond
1731: ((eq action :action-allow) "allow")
1732: ((eq action :action-warn) "warn")
1733: ((eq action :action-filter) "filter")
1734: ((eq action :action-deny) "deny")
1735: ((eq action :action-panic) "panic")
1736: ((eq action :action-stop) "stop")
1737: ((eq action :action-abort) "abort")
1738: ((eq action :action-kill) "kill")
1739: ((eq action :action-exit) "exit"))))
1740: (when action
1741: (let ((cmd (format "%s/delete" action)))
1742: (syd--stat (syd--rule cmd glob ?+))))))
1743:
1744: (defun syd-delete-del (action glob)
1745: "Remove the first matching delete sandboxing actionlist entry.
1746: ACTION is a constant representing the sandboxing action.
1747: GLOB is a string representing the glob pattern."
1748: (let ((action (cond
1749: ((eq action :action-allow) "allow")
1750: ((eq action :action-warn) "warn")
1751: ((eq action :action-filter) "filter")
1752: ((eq action :action-deny) "deny")
1753: ((eq action :action-panic) "panic")
1754: ((eq action :action-stop) "stop")
1755: ((eq action :action-abort) "abort")
1756: ((eq action :action-kill) "kill")
1757: ((eq action :action-exit) "exit"))))
1758: (when action
1759: (let ((cmd (format "%s/delete" action)))
1760: (syd--stat (syd--rule cmd glob ?-))))))
1761:
1762: (defun syd-delete-rem (action glob)
1763: "Remove all matching delete sandboxing actionlist entries.
1764: ACTION is a constant representing the sandboxing action.
1765: GLOB is a string representing the glob pattern."
1766: (let ((action (cond
1767: ((eq action :action-allow) "allow")
1768: ((eq action :action-warn) "warn")
1769: ((eq action :action-filter) "filter")
1770: ((eq action :action-deny) "deny")
1771: ((eq action :action-panic) "panic")
1772: ((eq action :action-stop) "stop")
1773: ((eq action :action-abort) "abort")
1774: ((eq action :action-kill) "kill")
1775: ((eq action :action-exit) "exit"))))
1776: (when action
1777: (let ((cmd (format "%s/delete" action)))
1778: (syd--stat (syd--rule cmd glob ?^))))))
1779:
1780: (defun syd-rename-add (action glob)
1781: "Add to the given actionlist of rename sandboxing.
1782: ACTION is a constant representing the sandboxing action.
1783: GLOB is a string representing the glob pattern."
1784: (let ((action (cond
1785: ((eq action :action-allow) "allow")
1786: ((eq action :action-warn) "warn")
1787: ((eq action :action-filter) "filter")
1788: ((eq action :action-deny) "deny")
1789: ((eq action :action-panic) "panic")
1790: ((eq action :action-stop) "stop")
1791: ((eq action :action-abort) "abort")
1792: ((eq action :action-kill) "kill")
1793: ((eq action :action-exit) "exit"))))
1794: (when action
1795: (let ((cmd (format "%s/rename" action)))
1796: (syd--stat (syd--rule cmd glob ?+))))))
1797:
1798: (defun syd-rename-del (action glob)
1799: "Remove the first matching rename sandboxing actionlist entry.
1800: ACTION is a constant representing the sandboxing action.
1801: GLOB is a string representing the glob pattern."
1802: (let ((action (cond
1803: ((eq action :action-allow) "allow")
1804: ((eq action :action-warn) "warn")
1805: ((eq action :action-filter) "filter")
1806: ((eq action :action-deny) "deny")
1807: ((eq action :action-panic) "panic")
1808: ((eq action :action-stop) "stop")
1809: ((eq action :action-abort) "abort")
1810: ((eq action :action-kill) "kill")
1811: ((eq action :action-exit) "exit"))))
1812: (when action
1813: (let ((cmd (format "%s/rename" action)))
1814: (syd--stat (syd--rule cmd glob ?-))))))
1815:
1816: (defun syd-rename-rem (action glob)
1817: "Remove all matching rename sandboxing actionlist entries.
1818: ACTION is a constant representing the sandboxing action.
1819: GLOB is a string representing the glob pattern."
1820: (let ((action (cond
1821: ((eq action :action-allow) "allow")
1822: ((eq action :action-warn) "warn")
1823: ((eq action :action-filter) "filter")
1824: ((eq action :action-deny) "deny")
1825: ((eq action :action-panic) "panic")
1826: ((eq action :action-stop) "stop")
1827: ((eq action :action-abort) "abort")
1828: ((eq action :action-kill) "kill")
1829: ((eq action :action-exit) "exit"))))
1830: (when action
1831: (let ((cmd (format "%s/rename" action)))
1832: (syd--stat (syd--rule cmd glob ?^))))))
1833:
1834: (defun syd-readlink-add (action glob)
1835: "Add to the given actionlist of readlink sandboxing.
1836: ACTION is a constant representing the sandboxing action.
1837: GLOB is a string representing the glob pattern."
1838: (let ((action (cond
1839: ((eq action :action-allow) "allow")
1840: ((eq action :action-warn) "warn")
1841: ((eq action :action-filter) "filter")
1842: ((eq action :action-deny) "deny")
1843: ((eq action :action-panic) "panic")
1844: ((eq action :action-stop) "stop")
1845: ((eq action :action-abort) "abort")
1846: ((eq action :action-kill) "kill")
1847: ((eq action :action-exit) "exit"))))
1848: (when action
1849: (let ((cmd (format "%s/readlink" action)))
1850: (syd--stat (syd--rule cmd glob ?+))))))
1851:
1852: (defun syd-readlink-del (action glob)
1853: "Remove the first matching readlink sandboxing actionlist entry.
1854: ACTION is a constant representing the sandboxing action.
1855: GLOB is a string representing the glob pattern."
1856: (let ((action (cond
1857: ((eq action :action-allow) "allow")
1858: ((eq action :action-warn) "warn")
1859: ((eq action :action-filter) "filter")
1860: ((eq action :action-deny) "deny")
1861: ((eq action :action-panic) "panic")
1862: ((eq action :action-stop) "stop")
1863: ((eq action :action-abort) "abort")
1864: ((eq action :action-kill) "kill")
1865: ((eq action :action-exit) "exit"))))
1866: (when action
1867: (let ((cmd (format "%s/readlink" action)))
1868: (syd--stat (syd--rule cmd glob ?-))))))
1869:
1870: (defun syd-readlink-rem (action glob)
1871: "Remove all matching readlink sandboxing actionlist entries.
1872: ACTION is a constant representing the sandboxing action.
1873: GLOB is a string representing the glob pattern."
1874: (let ((action (cond
1875: ((eq action :action-allow) "allow")
1876: ((eq action :action-warn) "warn")
1877: ((eq action :action-filter) "filter")
1878: ((eq action :action-deny) "deny")
1879: ((eq action :action-panic) "panic")
1880: ((eq action :action-stop) "stop")
1881: ((eq action :action-abort) "abort")
1882: ((eq action :action-kill) "kill")
1883: ((eq action :action-exit) "exit"))))
1884: (when action
1885: (let ((cmd (format "%s/readlink" action)))
1886: (syd--stat (syd--rule cmd glob ?^))))))
1887:
1888: (defun syd-symlink-add (action glob)
1889: "Add to the given actionlist of symlink sandboxing.
1890: ACTION is a constant representing the sandboxing action.
1891: GLOB is a string representing the glob pattern."
1892: (let ((action (cond
1893: ((eq action :action-allow) "allow")
1894: ((eq action :action-warn) "warn")
1895: ((eq action :action-filter) "filter")
1896: ((eq action :action-deny) "deny")
1897: ((eq action :action-panic) "panic")
1898: ((eq action :action-stop) "stop")
1899: ((eq action :action-abort) "abort")
1900: ((eq action :action-kill) "kill")
1901: ((eq action :action-exit) "exit"))))
1902: (when action
1903: (let ((cmd (format "%s/symlink" action)))
1904: (syd--stat (syd--rule cmd glob ?+))))))
1905:
1906: (defun syd-symlink-del (action glob)
1907: "Remove the first matching symlink sandboxing actionlist entry.
1908: ACTION is a constant representing the sandboxing action.
1909: GLOB is a string representing the glob pattern."
1910: (let ((action (cond
1911: ((eq action :action-allow) "allow")
1912: ((eq action :action-warn) "warn")
1913: ((eq action :action-filter) "filter")
1914: ((eq action :action-deny) "deny")
1915: ((eq action :action-panic) "panic")
1916: ((eq action :action-stop) "stop")
1917: ((eq action :action-abort) "abort")
1918: ((eq action :action-kill) "kill")
1919: ((eq action :action-exit) "exit"))))
1920: (when action
1921: (let ((cmd (format "%s/symlink" action)))
1922: (syd--stat (syd--rule cmd glob ?-))))))
1923:
1924: (defun syd-symlink-rem (action glob)
1925: "Remove all matching symlink sandboxing actionlist entries.
1926: ACTION is a constant representing the sandboxing action.
1927: GLOB is a string representing the glob pattern."
1928: (let ((action (cond
1929: ((eq action :action-allow) "allow")
1930: ((eq action :action-warn) "warn")
1931: ((eq action :action-filter) "filter")
1932: ((eq action :action-deny) "deny")
1933: ((eq action :action-panic) "panic")
1934: ((eq action :action-stop) "stop")
1935: ((eq action :action-abort) "abort")
1936: ((eq action :action-kill) "kill")
1937: ((eq action :action-exit) "exit"))))
1938: (when action
1939: (let ((cmd (format "%s/symlink" action)))
1940: (syd--stat (syd--rule cmd glob ?^))))))
1941:
1942: (defun syd-truncate-add (action glob)
1943: "Add to the given actionlist of truncate sandboxing.
1944: ACTION is a constant representing the sandboxing action.
1945: GLOB is a string representing the glob pattern."
1946: (let ((action (cond
1947: ((eq action :action-allow) "allow")
1948: ((eq action :action-warn) "warn")
1949: ((eq action :action-filter) "filter")
1950: ((eq action :action-deny) "deny")
1951: ((eq action :action-panic) "panic")
1952: ((eq action :action-stop) "stop")
1953: ((eq action :action-abort) "abort")
1954: ((eq action :action-kill) "kill")
1955: ((eq action :action-exit) "exit"))))
1956: (when action
1957: (let ((cmd (format "%s/truncate" action)))
1958: (syd--stat (syd--rule cmd glob ?+))))))
1959:
1960: (defun syd-truncate-del (action glob)
1961: "Remove the first matching truncate sandboxing actionlist entry.
1962: ACTION is a constant representing the sandboxing action.
1963: GLOB is a string representing the glob pattern."
1964: (let ((action (cond
1965: ((eq action :action-allow) "allow")
1966: ((eq action :action-warn) "warn")
1967: ((eq action :action-filter) "filter")
1968: ((eq action :action-deny) "deny")
1969: ((eq action :action-panic) "panic")
1970: ((eq action :action-stop) "stop")
1971: ((eq action :action-abort) "abort")
1972: ((eq action :action-kill) "kill")
1973: ((eq action :action-exit) "exit"))))
1974: (when action
1975: (let ((cmd (format "%s/truncate" action)))
1976: (syd--stat (syd--rule cmd glob ?-))))))
1977:
1978: (defun syd-truncate-rem (action glob)
1979: "Remove all matching truncate sandboxing actionlist entries.
1980: ACTION is a constant representing the sandboxing action.
1981: GLOB is a string representing the glob pattern."
1982: (let ((action (cond
1983: ((eq action :action-allow) "allow")
1984: ((eq action :action-warn) "warn")
1985: ((eq action :action-filter) "filter")
1986: ((eq action :action-deny) "deny")
1987: ((eq action :action-panic) "panic")
1988: ((eq action :action-stop) "stop")
1989: ((eq action :action-abort) "abort")
1990: ((eq action :action-kill) "kill")
1991: ((eq action :action-exit) "exit"))))
1992: (when action
1993: (let ((cmd (format "%s/truncate" action)))
1994: (syd--stat (syd--rule cmd glob ?^))))))
1995:
1996: (defun syd-chdir-add (action glob)
1997: "Add to the given actionlist of chdir sandboxing.
1998: ACTION is a constant representing the sandboxing action.
1999: GLOB is a string representing the glob pattern."
2000: (let ((action (cond
2001: ((eq action :action-allow) "allow")
2002: ((eq action :action-warn) "warn")
2003: ((eq action :action-filter) "filter")
2004: ((eq action :action-deny) "deny")
2005: ((eq action :action-panic) "panic")
2006: ((eq action :action-stop) "stop")
2007: ((eq action :action-abort) "abort")
2008: ((eq action :action-kill) "kill")
2009: ((eq action :action-exit) "exit"))))
2010: (when action
2011: (let ((cmd (format "%s/chdir" action)))
2012: (syd--stat (syd--rule cmd glob ?+))))))
2013:
2014: (defun syd-chdir-del (action glob)
2015: "Remove the first matching chdir sandboxing actionlist entry.
2016: ACTION is a constant representing the sandboxing action.
2017: GLOB is a string representing the glob pattern."
2018: (let ((action (cond
2019: ((eq action :action-allow) "allow")
2020: ((eq action :action-warn) "warn")
2021: ((eq action :action-filter) "filter")
2022: ((eq action :action-deny) "deny")
2023: ((eq action :action-panic) "panic")
2024: ((eq action :action-stop) "stop")
2025: ((eq action :action-abort) "abort")
2026: ((eq action :action-kill) "kill")
2027: ((eq action :action-exit) "exit"))))
2028: (when action
2029: (let ((cmd (format "%s/chdir" action)))
2030: (syd--stat (syd--rule cmd glob ?-))))))
2031:
2032: (defun syd-chdir-rem (action glob)
2033: "Remove all matching chdir sandboxing actionlist entries.
2034: ACTION is a constant representing the sandboxing action.
2035: GLOB is a string representing the glob pattern."
2036: (let ((action (cond
2037: ((eq action :action-allow) "allow")
2038: ((eq action :action-warn) "warn")
2039: ((eq action :action-filter) "filter")
2040: ((eq action :action-deny) "deny")
2041: ((eq action :action-panic) "panic")
2042: ((eq action :action-stop) "stop")
2043: ((eq action :action-abort) "abort")
2044: ((eq action :action-kill) "kill")
2045: ((eq action :action-exit) "exit"))))
2046: (when action
2047: (let ((cmd (format "%s/chdir" action)))
2048: (syd--stat (syd--rule cmd glob ?^))))))
2049:
2050: (defun syd-readdir-add (action glob)
2051: "Add to the given actionlist of readdir sandboxing.
2052: ACTION is a constant representing the sandboxing action.
2053: GLOB is a string representing the glob pattern."
2054: (let ((action (cond
2055: ((eq action :action-allow) "allow")
2056: ((eq action :action-warn) "warn")
2057: ((eq action :action-filter) "filter")
2058: ((eq action :action-deny) "deny")
2059: ((eq action :action-panic) "panic")
2060: ((eq action :action-stop) "stop")
2061: ((eq action :action-abort) "abort")
2062: ((eq action :action-kill) "kill")
2063: ((eq action :action-exit) "exit"))))
2064: (when action
2065: (let ((cmd (format "%s/readdir" action)))
2066: (syd--stat (syd--rule cmd glob ?+))))))
2067:
2068: (defun syd-readdir-del (action glob)
2069: "Remove the first matching readdir sandboxing actionlist entry.
2070: ACTION is a constant representing the sandboxing action.
2071: GLOB is a string representing the glob pattern."
2072: (let ((action (cond
2073: ((eq action :action-allow) "allow")
2074: ((eq action :action-warn) "warn")
2075: ((eq action :action-filter) "filter")
2076: ((eq action :action-deny) "deny")
2077: ((eq action :action-panic) "panic")
2078: ((eq action :action-stop) "stop")
2079: ((eq action :action-abort) "abort")
2080: ((eq action :action-kill) "kill")
2081: ((eq action :action-exit) "exit"))))
2082: (when action
2083: (let ((cmd (format "%s/readdir" action)))
2084: (syd--stat (syd--rule cmd glob ?-))))))
2085:
2086: (defun syd-readdir-rem (action glob)
2087: "Remove all matching readdir sandboxing actionlist entries.
2088: ACTION is a constant representing the sandboxing action.
2089: GLOB is a string representing the glob pattern."
2090: (let ((action (cond
2091: ((eq action :action-allow) "allow")
2092: ((eq action :action-warn) "warn")
2093: ((eq action :action-filter) "filter")
2094: ((eq action :action-deny) "deny")
2095: ((eq action :action-panic) "panic")
2096: ((eq action :action-stop) "stop")
2097: ((eq action :action-abort) "abort")
2098: ((eq action :action-kill) "kill")
2099: ((eq action :action-exit) "exit"))))
2100: (when action
2101: (let ((cmd (format "%s/readdir" action)))
2102: (syd--stat (syd--rule cmd glob ?^))))))
2103:
2104: (defun syd-mkdir-add (action glob)
2105: "Add to the given actionlist of mkdir sandboxing.
2106: ACTION is a constant representing the sandboxing action.
2107: GLOB is a string representing the glob pattern."
2108: (let ((action (cond
2109: ((eq action :action-allow) "allow")
2110: ((eq action :action-warn) "warn")
2111: ((eq action :action-filter) "filter")
2112: ((eq action :action-deny) "deny")
2113: ((eq action :action-panic) "panic")
2114: ((eq action :action-stop) "stop")
2115: ((eq action :action-abort) "abort")
2116: ((eq action :action-kill) "kill")
2117: ((eq action :action-exit) "exit"))))
2118: (when action
2119: (let ((cmd (format "%s/mkdir" action)))
2120: (syd--stat (syd--rule cmd glob ?+))))))
2121:
2122: (defun syd-mkdir-del (action glob)
2123: "Remove the first matching mkdir sandboxing actionlist entry.
2124: ACTION is a constant representing the sandboxing action.
2125: GLOB is a string representing the glob pattern."
2126: (let ((action (cond
2127: ((eq action :action-allow) "allow")
2128: ((eq action :action-warn) "warn")
2129: ((eq action :action-filter) "filter")
2130: ((eq action :action-deny) "deny")
2131: ((eq action :action-panic) "panic")
2132: ((eq action :action-stop) "stop")
2133: ((eq action :action-abort) "abort")
2134: ((eq action :action-kill) "kill")
2135: ((eq action :action-exit) "exit"))))
2136: (when action
2137: (let ((cmd (format "%s/mkdir" action)))
2138: (syd--stat (syd--rule cmd glob ?-))))))
2139:
2140: (defun syd-mkdir-rem (action glob)
2141: "Remove all matching mkdir sandboxing actionlist entries.
2142: ACTION is a constant representing the sandboxing action.
2143: GLOB is a string representing the glob pattern."
2144: (let ((action (cond
2145: ((eq action :action-allow) "allow")
2146: ((eq action :action-warn) "warn")
2147: ((eq action :action-filter) "filter")
2148: ((eq action :action-deny) "deny")
2149: ((eq action :action-panic) "panic")
2150: ((eq action :action-stop) "stop")
2151: ((eq action :action-abort) "abort")
2152: ((eq action :action-kill) "kill")
2153: ((eq action :action-exit) "exit"))))
2154: (when action
2155: (let ((cmd (format "%s/mkdir" action)))
2156: (syd--stat (syd--rule cmd glob ?^))))))
2157:
2158: (defun syd-rmdir-add (action glob)
2159: "Add to the given actionlist of rmdir sandboxing.
2160: ACTION is a constant representing the sandboxing action.
2161: GLOB is a string representing the glob pattern."
2162: (let ((action (cond
2163: ((eq action :action-allow) "allow")
2164: ((eq action :action-warn) "warn")
2165: ((eq action :action-filter) "filter")
2166: ((eq action :action-deny) "deny")
2167: ((eq action :action-panic) "panic")
2168: ((eq action :action-stop) "stop")
2169: ((eq action :action-abort) "abort")
2170: ((eq action :action-kill) "kill")
2171: ((eq action :action-exit) "exit"))))
2172: (when action
2173: (let ((cmd (format "%s/rmdir" action)))
2174: (syd--stat (syd--rule cmd glob ?+))))))
2175:
2176: (defun syd-rmdir-del (action glob)
2177: "Remove the first matching rmdir sandboxing actionlist entry.
2178: ACTION is a constant representing the sandboxing action.
2179: GLOB is a string representing the glob pattern."
2180: (let ((action (cond
2181: ((eq action :action-allow) "allow")
2182: ((eq action :action-warn) "warn")
2183: ((eq action :action-filter) "filter")
2184: ((eq action :action-deny) "deny")
2185: ((eq action :action-panic) "panic")
2186: ((eq action :action-stop) "stop")
2187: ((eq action :action-abort) "abort")
2188: ((eq action :action-kill) "kill")
2189: ((eq action :action-exit) "exit"))))
2190: (when action
2191: (let ((cmd (format "%s/rmdir" action)))
2192: (syd--stat (syd--rule cmd glob ?-))))))
2193:
2194: (defun syd-rmdir-rem (action glob)
2195: "Remove all matching rmdir sandboxing actionlist entries.
2196: ACTION is a constant representing the sandboxing action.
2197: GLOB is a string representing the glob pattern."
2198: (let ((action (cond
2199: ((eq action :action-allow) "allow")
2200: ((eq action :action-warn) "warn")
2201: ((eq action :action-filter) "filter")
2202: ((eq action :action-deny) "deny")
2203: ((eq action :action-panic) "panic")
2204: ((eq action :action-stop) "stop")
2205: ((eq action :action-abort) "abort")
2206: ((eq action :action-kill) "kill")
2207: ((eq action :action-exit) "exit"))))
2208: (when action
2209: (let ((cmd (format "%s/rmdir" action)))
2210: (syd--stat (syd--rule cmd glob ?^))))))
2211:
2212: (defun syd-chown-add (action glob)
2213: "Add to the given actionlist of chown sandboxing.
2214: ACTION is a constant representing the sandboxing action.
2215: GLOB is a string representing the glob pattern."
2216: (let ((action (cond
2217: ((eq action :action-allow) "allow")
2218: ((eq action :action-warn) "warn")
2219: ((eq action :action-filter) "filter")
2220: ((eq action :action-deny) "deny")
2221: ((eq action :action-panic) "panic")
2222: ((eq action :action-stop) "stop")
2223: ((eq action :action-abort) "abort")
2224: ((eq action :action-kill) "kill")
2225: ((eq action :action-exit) "exit"))))
2226: (when action
2227: (let ((cmd (format "%s/chown" action)))
2228: (syd--stat (syd--rule cmd glob ?+))))))
2229:
2230: (defun syd-chown-del (action glob)
2231: "Remove the first matching chown sandboxing actionlist entry.
2232: ACTION is a constant representing the sandboxing action.
2233: GLOB is a string representing the glob pattern."
2234: (let ((action (cond
2235: ((eq action :action-allow) "allow")
2236: ((eq action :action-warn) "warn")
2237: ((eq action :action-filter) "filter")
2238: ((eq action :action-deny) "deny")
2239: ((eq action :action-panic) "panic")
2240: ((eq action :action-stop) "stop")
2241: ((eq action :action-abort) "abort")
2242: ((eq action :action-kill) "kill")
2243: ((eq action :action-exit) "exit"))))
2244: (when action
2245: (let ((cmd (format "%s/chown" action)))
2246: (syd--stat (syd--rule cmd glob ?-))))))
2247:
2248: (defun syd-chown-rem (action glob)
2249: "Remove all matching chown sandboxing actionlist entries.
2250: ACTION is a constant representing the sandboxing action.
2251: GLOB is a string representing the glob pattern."
2252: (let ((action (cond
2253: ((eq action :action-allow) "allow")
2254: ((eq action :action-warn) "warn")
2255: ((eq action :action-filter) "filter")
2256: ((eq action :action-deny) "deny")
2257: ((eq action :action-panic) "panic")
2258: ((eq action :action-stop) "stop")
2259: ((eq action :action-abort) "abort")
2260: ((eq action :action-kill) "kill")
2261: ((eq action :action-exit) "exit"))))
2262: (when action
2263: (let ((cmd (format "%s/chown" action)))
2264: (syd--stat (syd--rule cmd glob ?^))))))
2265:
2266: (defun syd-chgrp-add (action glob)
2267: "Add to the given actionlist of chgrp sandboxing.
2268: ACTION is a constant representing the sandboxing action.
2269: GLOB is a string representing the glob pattern."
2270: (let ((action (cond
2271: ((eq action :action-allow) "allow")
2272: ((eq action :action-warn) "warn")
2273: ((eq action :action-filter) "filter")
2274: ((eq action :action-deny) "deny")
2275: ((eq action :action-panic) "panic")
2276: ((eq action :action-stop) "stop")
2277: ((eq action :action-abort) "abort")
2278: ((eq action :action-kill) "kill")
2279: ((eq action :action-exit) "exit"))))
2280: (when action
2281: (let ((cmd (format "%s/chgrp" action)))
2282: (syd--stat (syd--rule cmd glob ?+))))))
2283:
2284: (defun syd-chgrp-del (action glob)
2285: "Remove the first matching chgrp sandboxing actionlist entry.
2286: ACTION is a constant representing the sandboxing action.
2287: GLOB is a string representing the glob pattern."
2288: (let ((action (cond
2289: ((eq action :action-allow) "allow")
2290: ((eq action :action-warn) "warn")
2291: ((eq action :action-filter) "filter")
2292: ((eq action :action-deny) "deny")
2293: ((eq action :action-panic) "panic")
2294: ((eq action :action-stop) "stop")
2295: ((eq action :action-abort) "abort")
2296: ((eq action :action-kill) "kill")
2297: ((eq action :action-exit) "exit"))))
2298: (when action
2299: (let ((cmd (format "%s/chgrp" action)))
2300: (syd--stat (syd--rule cmd glob ?-))))))
2301:
2302: (defun syd-chgrp-rem (action glob)
2303: "Remove all matching chgrp sandboxing actionlist entries.
2304: ACTION is a constant representing the sandboxing action.
2305: GLOB is a string representing the glob pattern."
2306: (let ((action (cond
2307: ((eq action :action-allow) "allow")
2308: ((eq action :action-warn) "warn")
2309: ((eq action :action-filter) "filter")
2310: ((eq action :action-deny) "deny")
2311: ((eq action :action-panic) "panic")
2312: ((eq action :action-stop) "stop")
2313: ((eq action :action-abort) "abort")
2314: ((eq action :action-kill) "kill")
2315: ((eq action :action-exit) "exit"))))
2316: (when action
2317: (let ((cmd (format "%s/chgrp" action)))
2318: (syd--stat (syd--rule cmd glob ?^))))))
2319:
2320: (defun syd-chmod-add (action glob)
2321: "Add to the given actionlist of chmod sandboxing.
2322: ACTION is a constant representing the sandboxing action.
2323: GLOB is a string representing the glob pattern."
2324: (let ((action (cond
2325: ((eq action :action-allow) "allow")
2326: ((eq action :action-warn) "warn")
2327: ((eq action :action-filter) "filter")
2328: ((eq action :action-deny) "deny")
2329: ((eq action :action-panic) "panic")
2330: ((eq action :action-stop) "stop")
2331: ((eq action :action-abort) "abort")
2332: ((eq action :action-kill) "kill")
2333: ((eq action :action-exit) "exit"))))
2334: (when action
2335: (let ((cmd (format "%s/chmod" action)))
2336: (syd--stat (syd--rule cmd glob ?+))))))
2337:
2338: (defun syd-chmod-del (action glob)
2339: "Remove the first matching chmod sandboxing actionlist entry.
2340: ACTION is a constant representing the sandboxing action.
2341: GLOB is a string representing the glob pattern."
2342: (let ((action (cond
2343: ((eq action :action-allow) "allow")
2344: ((eq action :action-warn) "warn")
2345: ((eq action :action-filter) "filter")
2346: ((eq action :action-deny) "deny")
2347: ((eq action :action-panic) "panic")
2348: ((eq action :action-stop) "stop")
2349: ((eq action :action-abort) "abort")
2350: ((eq action :action-kill) "kill")
2351: ((eq action :action-exit) "exit"))))
2352: (when action
2353: (let ((cmd (format "%s/chmod" action)))
2354: (syd--stat (syd--rule cmd glob ?-))))))
2355:
2356: (defun syd-chmod-rem (action glob)
2357: "Remove all matching chmod sandboxing actionlist entries.
2358: ACTION is a constant representing the sandboxing action.
2359: GLOB is a string representing the glob pattern."
2360: (let ((action (cond
2361: ((eq action :action-allow) "allow")
2362: ((eq action :action-warn) "warn")
2363: ((eq action :action-filter) "filter")
2364: ((eq action :action-deny) "deny")
2365: ((eq action :action-panic) "panic")
2366: ((eq action :action-stop) "stop")
2367: ((eq action :action-abort) "abort")
2368: ((eq action :action-kill) "kill")
2369: ((eq action :action-exit) "exit"))))
2370: (when action
2371: (let ((cmd (format "%s/chmod" action)))
2372: (syd--stat (syd--rule cmd glob ?^))))))
2373:
2374: (defun syd-chattr-add (action glob)
2375: "Add to the given actionlist of chattr sandboxing.
2376: ACTION is a constant representing the sandboxing action.
2377: GLOB is a string representing the glob pattern."
2378: (let ((action (cond
2379: ((eq action :action-allow) "allow")
2380: ((eq action :action-warn) "warn")
2381: ((eq action :action-filter) "filter")
2382: ((eq action :action-deny) "deny")
2383: ((eq action :action-panic) "panic")
2384: ((eq action :action-stop) "stop")
2385: ((eq action :action-abort) "abort")
2386: ((eq action :action-kill) "kill")
2387: ((eq action :action-exit) "exit"))))
2388: (when action
2389: (let ((cmd (format "%s/chattr" action)))
2390: (syd--stat (syd--rule cmd glob ?+))))))
2391:
2392: (defun syd-chattr-del (action glob)
2393: "Remove the first matching chattr sandboxing actionlist entry.
2394: ACTION is a constant representing the sandboxing action.
2395: GLOB is a string representing the glob pattern."
2396: (let ((action (cond
2397: ((eq action :action-allow) "allow")
2398: ((eq action :action-warn) "warn")
2399: ((eq action :action-filter) "filter")
2400: ((eq action :action-deny) "deny")
2401: ((eq action :action-panic) "panic")
2402: ((eq action :action-stop) "stop")
2403: ((eq action :action-abort) "abort")
2404: ((eq action :action-kill) "kill")
2405: ((eq action :action-exit) "exit"))))
2406: (when action
2407: (let ((cmd (format "%s/chattr" action)))
2408: (syd--stat (syd--rule cmd glob ?-))))))
2409:
2410: (defun syd-chattr-rem (action glob)
2411: "Remove all matching chattr sandboxing actionlist entries.
2412: ACTION is a constant representing the sandboxing action.
2413: GLOB is a string representing the glob pattern."
2414: (let ((action (cond
2415: ((eq action :action-allow) "allow")
2416: ((eq action :action-warn) "warn")
2417: ((eq action :action-filter) "filter")
2418: ((eq action :action-deny) "deny")
2419: ((eq action :action-panic) "panic")
2420: ((eq action :action-stop) "stop")
2421: ((eq action :action-abort) "abort")
2422: ((eq action :action-kill) "kill")
2423: ((eq action :action-exit) "exit"))))
2424: (when action
2425: (let ((cmd (format "%s/chattr" action)))
2426: (syd--stat (syd--rule cmd glob ?^))))))
2427:
2428: (defun syd-chroot-add (action glob)
2429: "Add to the given actionlist of chroot sandboxing.
2430: ACTION is a constant representing the sandboxing action.
2431: GLOB is a string representing the glob pattern."
2432: (let ((action (cond
2433: ((eq action :action-allow) "allow")
2434: ((eq action :action-warn) "warn")
2435: ((eq action :action-filter) "filter")
2436: ((eq action :action-deny) "deny")
2437: ((eq action :action-panic) "panic")
2438: ((eq action :action-stop) "stop")
2439: ((eq action :action-abort) "abort")
2440: ((eq action :action-kill) "kill")
2441: ((eq action :action-exit) "exit"))))
2442: (when action
2443: (let ((cmd (format "%s/chroot" action)))
2444: (syd--stat (syd--rule cmd glob ?+))))))
2445:
2446: (defun syd-chroot-del (action glob)
2447: "Remove the first matching chroot sandboxing actionlist entry.
2448: ACTION is a constant representing the sandboxing action.
2449: GLOB is a string representing the glob pattern."
2450: (let ((action (cond
2451: ((eq action :action-allow) "allow")
2452: ((eq action :action-warn) "warn")
2453: ((eq action :action-filter) "filter")
2454: ((eq action :action-deny) "deny")
2455: ((eq action :action-panic) "panic")
2456: ((eq action :action-stop) "stop")
2457: ((eq action :action-abort) "abort")
2458: ((eq action :action-kill) "kill")
2459: ((eq action :action-exit) "exit"))))
2460: (when action
2461: (let ((cmd (format "%s/chroot" action)))
2462: (syd--stat (syd--rule cmd glob ?-))))))
2463:
2464: (defun syd-chroot-rem (action glob)
2465: "Remove all matching chroot sandboxing actionlist entries.
2466: ACTION is a constant representing the sandboxing action.
2467: GLOB is a string representing the glob pattern."
2468: (let ((action (cond
2469: ((eq action :action-allow) "allow")
2470: ((eq action :action-warn) "warn")
2471: ((eq action :action-filter) "filter")
2472: ((eq action :action-deny) "deny")
2473: ((eq action :action-panic) "panic")
2474: ((eq action :action-stop) "stop")
2475: ((eq action :action-abort) "abort")
2476: ((eq action :action-kill) "kill")
2477: ((eq action :action-exit) "exit"))))
2478: (when action
2479: (let ((cmd (format "%s/chroot" action)))
2480: (syd--stat (syd--rule cmd glob ?^))))))
2481:
2482: (defun syd-notify-add (action glob)
2483: "Add to the given actionlist of notify sandboxing.
2484: ACTION is a constant representing the sandboxing action.
2485: GLOB is a string representing the glob pattern."
2486: (let ((action (cond
2487: ((eq action :action-allow) "allow")
2488: ((eq action :action-warn) "warn")
2489: ((eq action :action-filter) "filter")
2490: ((eq action :action-deny) "deny")
2491: ((eq action :action-panic) "panic")
2492: ((eq action :action-stop) "stop")
2493: ((eq action :action-abort) "abort")
2494: ((eq action :action-kill) "kill")
2495: ((eq action :action-exit) "exit"))))
2496: (when action
2497: (let ((cmd (format "%s/notify" action)))
2498: (syd--stat (syd--rule cmd glob ?+))))))
2499:
2500: (defun syd-notify-del (action glob)
2501: "Remove the first matching notify sandboxing actionlist entry.
2502: ACTION is a constant representing the sandboxing action.
2503: GLOB is a string representing the glob pattern."
2504: (let ((action (cond
2505: ((eq action :action-allow) "allow")
2506: ((eq action :action-warn) "warn")
2507: ((eq action :action-filter) "filter")
2508: ((eq action :action-deny) "deny")
2509: ((eq action :action-panic) "panic")
2510: ((eq action :action-stop) "stop")
2511: ((eq action :action-abort) "abort")
2512: ((eq action :action-kill) "kill")
2513: ((eq action :action-exit) "exit"))))
2514: (when action
2515: (let ((cmd (format "%s/notify" action)))
2516: (syd--stat (syd--rule cmd glob ?-))))))
2517:
2518: (defun syd-notify-rem (action glob)
2519: "Remove all matching notify sandboxing actionlist entries.
2520: ACTION is a constant representing the sandboxing action.
2521: GLOB is a string representing the glob pattern."
2522: (let ((action (cond
2523: ((eq action :action-allow) "allow")
2524: ((eq action :action-warn) "warn")
2525: ((eq action :action-filter) "filter")
2526: ((eq action :action-deny) "deny")
2527: ((eq action :action-panic) "panic")
2528: ((eq action :action-stop) "stop")
2529: ((eq action :action-abort) "abort")
2530: ((eq action :action-kill) "kill")
2531: ((eq action :action-exit) "exit"))))
2532: (when action
2533: (let ((cmd (format "%s/notify" action)))
2534: (syd--stat (syd--rule cmd glob ?^))))))
2535:
2536: (defun syd-utime-add (action glob)
2537: "Add to the given actionlist of utime sandboxing.
2538: ACTION is a constant representing the sandboxing action.
2539: GLOB is a string representing the glob pattern."
2540: (let ((action (cond
2541: ((eq action :action-allow) "allow")
2542: ((eq action :action-warn) "warn")
2543: ((eq action :action-filter) "filter")
2544: ((eq action :action-deny) "deny")
2545: ((eq action :action-panic) "panic")
2546: ((eq action :action-stop) "stop")
2547: ((eq action :action-abort) "abort")
2548: ((eq action :action-kill) "kill")
2549: ((eq action :action-exit) "exit"))))
2550: (when action
2551: (let ((cmd (format "%s/utime" action)))
2552: (syd--stat (syd--rule cmd glob ?+))))))
2553:
2554: (defun syd-utime-del (action glob)
2555: "Remove the first matching utime sandboxing actionlist entry.
2556: ACTION is a constant representing the sandboxing action.
2557: GLOB is a string representing the glob pattern."
2558: (let ((action (cond
2559: ((eq action :action-allow) "allow")
2560: ((eq action :action-warn) "warn")
2561: ((eq action :action-filter) "filter")
2562: ((eq action :action-deny) "deny")
2563: ((eq action :action-panic) "panic")
2564: ((eq action :action-stop) "stop")
2565: ((eq action :action-abort) "abort")
2566: ((eq action :action-kill) "kill")
2567: ((eq action :action-exit) "exit"))))
2568: (when action
2569: (let ((cmd (format "%s/utime" action)))
2570: (syd--stat (syd--rule cmd glob ?-))))))
2571:
2572: (defun syd-utime-rem (action glob)
2573: "Remove all matching utime sandboxing actionlist entries.
2574: ACTION is a constant representing the sandboxing action.
2575: GLOB is a string representing the glob pattern."
2576: (let ((action (cond
2577: ((eq action :action-allow) "allow")
2578: ((eq action :action-warn) "warn")
2579: ((eq action :action-filter) "filter")
2580: ((eq action :action-deny) "deny")
2581: ((eq action :action-panic) "panic")
2582: ((eq action :action-stop) "stop")
2583: ((eq action :action-abort) "abort")
2584: ((eq action :action-kill) "kill")
2585: ((eq action :action-exit) "exit"))))
2586: (when action
2587: (let ((cmd (format "%s/utime" action)))
2588: (syd--stat (syd--rule cmd glob ?^))))))
2589:
2590: (defun syd-mkbdev-add (action glob)
2591: "Add to the given actionlist of mkbdev sandboxing.
2592: ACTION is a constant representing the sandboxing action.
2593: GLOB is a string representing the glob pattern."
2594: (let ((action (cond
2595: ((eq action :action-allow) "allow")
2596: ((eq action :action-warn) "warn")
2597: ((eq action :action-filter) "filter")
2598: ((eq action :action-deny) "deny")
2599: ((eq action :action-panic) "panic")
2600: ((eq action :action-stop) "stop")
2601: ((eq action :action-abort) "abort")
2602: ((eq action :action-kill) "kill")
2603: ((eq action :action-exit) "exit"))))
2604: (when action
2605: (let ((cmd (format "%s/mkbdev" action)))
2606: (syd--stat (syd--rule cmd glob ?+))))))
2607:
2608: (defun syd-mkbdev-del (action glob)
2609: "Remove the first matching mkbdev sandboxing actionlist entry.
2610: ACTION is a constant representing the sandboxing action.
2611: GLOB is a string representing the glob pattern."
2612: (let ((action (cond
2613: ((eq action :action-allow) "allow")
2614: ((eq action :action-warn) "warn")
2615: ((eq action :action-filter) "filter")
2616: ((eq action :action-deny) "deny")
2617: ((eq action :action-panic) "panic")
2618: ((eq action :action-stop) "stop")
2619: ((eq action :action-abort) "abort")
2620: ((eq action :action-kill) "kill")
2621: ((eq action :action-exit) "exit"))))
2622: (when action
2623: (let ((cmd (format "%s/mkbdev" action)))
2624: (syd--stat (syd--rule cmd glob ?-))))))
2625:
2626: (defun syd-mkbdev-rem (action glob)
2627: "Remove all matching mkbdev sandboxing actionlist entries.
2628: ACTION is a constant representing the sandboxing action.
2629: GLOB is a string representing the glob pattern."
2630: (let ((action (cond
2631: ((eq action :action-allow) "allow")
2632: ((eq action :action-warn) "warn")
2633: ((eq action :action-filter) "filter")
2634: ((eq action :action-deny) "deny")
2635: ((eq action :action-panic) "panic")
2636: ((eq action :action-stop) "stop")
2637: ((eq action :action-abort) "abort")
2638: ((eq action :action-kill) "kill")
2639: ((eq action :action-exit) "exit"))))
2640: (when action
2641: (let ((cmd (format "%s/mkbdev" action)))
2642: (syd--stat (syd--rule cmd glob ?^))))))
2643:
2644: (defun syd-mkcdev-add (action glob)
2645: "Add to the given actionlist of mkcdev sandboxing.
2646: ACTION is a constant representing the sandboxing action.
2647: GLOB is a string representing the glob pattern."
2648: (let ((action (cond
2649: ((eq action :action-allow) "allow")
2650: ((eq action :action-warn) "warn")
2651: ((eq action :action-filter) "filter")
2652: ((eq action :action-deny) "deny")
2653: ((eq action :action-panic) "panic")
2654: ((eq action :action-stop) "stop")
2655: ((eq action :action-abort) "abort")
2656: ((eq action :action-kill) "kill")
2657: ((eq action :action-exit) "exit"))))
2658: (when action
2659: (let ((cmd (format "%s/mkcdev" action)))
2660: (syd--stat (syd--rule cmd glob ?+))))))
2661:
2662: (defun syd-mkcdev-del (action glob)
2663: "Remove the first matching mkcdev sandboxing actionlist entry.
2664: ACTION is a constant representing the sandboxing action.
2665: GLOB is a string representing the glob pattern."
2666: (let ((action (cond
2667: ((eq action :action-allow) "allow")
2668: ((eq action :action-warn) "warn")
2669: ((eq action :action-filter) "filter")
2670: ((eq action :action-deny) "deny")
2671: ((eq action :action-panic) "panic")
2672: ((eq action :action-stop) "stop")
2673: ((eq action :action-abort) "abort")
2674: ((eq action :action-kill) "kill")
2675: ((eq action :action-exit) "exit"))))
2676: (when action
2677: (let ((cmd (format "%s/mkcdev" action)))
2678: (syd--stat (syd--rule cmd glob ?-))))))
2679:
2680: (defun syd-mkcdev-rem (action glob)
2681: "Remove all matching mkcdev sandboxing actionlist entries.
2682: ACTION is a constant representing the sandboxing action.
2683: GLOB is a string representing the glob pattern."
2684: (let ((action (cond
2685: ((eq action :action-allow) "allow")
2686: ((eq action :action-warn) "warn")
2687: ((eq action :action-filter) "filter")
2688: ((eq action :action-deny) "deny")
2689: ((eq action :action-panic) "panic")
2690: ((eq action :action-stop) "stop")
2691: ((eq action :action-abort) "abort")
2692: ((eq action :action-kill) "kill")
2693: ((eq action :action-exit) "exit"))))
2694: (when action
2695: (let ((cmd (format "%s/mkcdev" action)))
2696: (syd--stat (syd--rule cmd glob ?^))))))
2697:
2698: (defun syd-mkfifo-add (action glob)
2699: "Add to the given actionlist of mkfifo sandboxing.
2700: ACTION is a constant representing the sandboxing action.
2701: GLOB is a string representing the glob pattern."
2702: (let ((action (cond
2703: ((eq action :action-allow) "allow")
2704: ((eq action :action-warn) "warn")
2705: ((eq action :action-filter) "filter")
2706: ((eq action :action-deny) "deny")
2707: ((eq action :action-panic) "panic")
2708: ((eq action :action-stop) "stop")
2709: ((eq action :action-abort) "abort")
2710: ((eq action :action-kill) "kill")
2711: ((eq action :action-exit) "exit"))))
2712: (when action
2713: (let ((cmd (format "%s/mkfifo" action)))
2714: (syd--stat (syd--rule cmd glob ?+))))))
2715:
2716: (defun syd-mkfifo-del (action glob)
2717: "Remove the first matching mkfifo sandboxing actionlist entry.
2718: ACTION is a constant representing the sandboxing action.
2719: GLOB is a string representing the glob pattern."
2720: (let ((action (cond
2721: ((eq action :action-allow) "allow")
2722: ((eq action :action-warn) "warn")
2723: ((eq action :action-filter) "filter")
2724: ((eq action :action-deny) "deny")
2725: ((eq action :action-panic) "panic")
2726: ((eq action :action-stop) "stop")
2727: ((eq action :action-abort) "abort")
2728: ((eq action :action-kill) "kill")
2729: ((eq action :action-exit) "exit"))))
2730: (when action
2731: (let ((cmd (format "%s/mkfifo" action)))
2732: (syd--stat (syd--rule cmd glob ?-))))))
2733:
2734: (defun syd-mkfifo-rem (action glob)
2735: "Remove all matching mkfifo sandboxing actionlist entries.
2736: ACTION is a constant representing the sandboxing action.
2737: GLOB is a string representing the glob pattern."
2738: (let ((action (cond
2739: ((eq action :action-allow) "allow")
2740: ((eq action :action-warn) "warn")
2741: ((eq action :action-filter) "filter")
2742: ((eq action :action-deny) "deny")
2743: ((eq action :action-panic) "panic")
2744: ((eq action :action-stop) "stop")
2745: ((eq action :action-abort) "abort")
2746: ((eq action :action-kill) "kill")
2747: ((eq action :action-exit) "exit"))))
2748: (when action
2749: (let ((cmd (format "%s/mkfifo" action)))
2750: (syd--stat (syd--rule cmd glob ?^))))))
2751:
2752: (defun syd-mktemp-add (action glob)
2753: "Add to the given actionlist of mktemp sandboxing.
2754: ACTION is a constant representing the sandboxing action.
2755: GLOB is a string representing the glob pattern."
2756: (let ((action (cond
2757: ((eq action :action-allow) "allow")
2758: ((eq action :action-warn) "warn")
2759: ((eq action :action-filter) "filter")
2760: ((eq action :action-deny) "deny")
2761: ((eq action :action-panic) "panic")
2762: ((eq action :action-stop) "stop")
2763: ((eq action :action-abort) "abort")
2764: ((eq action :action-kill) "kill")
2765: ((eq action :action-exit) "exit"))))
2766: (when action
2767: (let ((cmd (format "%s/mktemp" action)))
2768: (syd--stat (syd--rule cmd glob ?+))))))
2769:
2770: (defun syd-mktemp-del (action glob)
2771: "Remove the first matching mktemp sandboxing actionlist entry.
2772: ACTION is a constant representing the sandboxing action.
2773: GLOB is a string representing the glob pattern."
2774: (let ((action (cond
2775: ((eq action :action-allow) "allow")
2776: ((eq action :action-warn) "warn")
2777: ((eq action :action-filter) "filter")
2778: ((eq action :action-deny) "deny")
2779: ((eq action :action-panic) "panic")
2780: ((eq action :action-stop) "stop")
2781: ((eq action :action-abort) "abort")
2782: ((eq action :action-kill) "kill")
2783: ((eq action :action-exit) "exit"))))
2784: (when action
2785: (let ((cmd (format "%s/mktemp" action)))
2786: (syd--stat (syd--rule cmd glob ?-))))))
2787:
2788: (defun syd-mktemp-rem (action glob)
2789: "Remove all matching mktemp sandboxing actionlist entries.
2790: ACTION is a constant representing the sandboxing action.
2791: GLOB is a string representing the glob pattern."
2792: (let ((action (cond
2793: ((eq action :action-allow) "allow")
2794: ((eq action :action-warn) "warn")
2795: ((eq action :action-filter) "filter")
2796: ((eq action :action-deny) "deny")
2797: ((eq action :action-panic) "panic")
2798: ((eq action :action-stop) "stop")
2799: ((eq action :action-abort) "abort")
2800: ((eq action :action-kill) "kill")
2801: ((eq action :action-exit) "exit"))))
2802: (when action
2803: (let ((cmd (format "%s/mktemp" action)))
2804: (syd--stat (syd--rule cmd glob ?^))))))
2805:
2806: (defun syd-net-bind-add (action addr)
2807: "Add to the given actionlist of net/bind sandboxing.
2808: ACTION is a constant representing the sandboxing action.
2809: ADDR is a string representing the address pattern."
2810: (let ((action (cond
2811: ((eq action :action-allow) "allow")
2812: ((eq action :action-warn) "warn")
2813: ((eq action :action-filter) "filter")
2814: ((eq action :action-deny) "deny")
2815: ((eq action :action-panic) "panic")
2816: ((eq action :action-stop) "stop")
2817: ((eq action :action-abort) "abort")
2818: ((eq action :action-kill) "kill")
2819: ((eq action :action-exit) "exit"))))
2820: (when action
2821: (let ((cmd (format "%s/net/bind" action)))
2822: (syd--stat (syd--rule cmd addr ?+))))))
2823:
2824: (defun syd-net-bind-del (action addr)
2825: "Remove the first matching net/bind sandboxing actionlist entry.
2826: ACTION is a constant representing the sandboxing action.
2827: ADDR is a string representing the address pattern."
2828: (let ((action (cond
2829: ((eq action :action-allow) "allow")
2830: ((eq action :action-warn) "warn")
2831: ((eq action :action-filter) "filter")
2832: ((eq action :action-deny) "deny")
2833: ((eq action :action-panic) "panic")
2834: ((eq action :action-stop) "stop")
2835: ((eq action :action-abort) "abort")
2836: ((eq action :action-kill) "kill")
2837: ((eq action :action-exit) "exit"))))
2838: (when action
2839: (let ((cmd (format "%s/net/bind" action)))
2840: (syd--stat (syd--rule cmd addr ?-))))))
2841:
2842: (defun syd-net-bind-rem (action addr)
2843: "Remove all matching net/bind sandboxing actionlist entries.
2844: ACTION is a constant representing the sandboxing action.
2845: ADDR is a string representing the address pattern."
2846: (let ((action (cond
2847: ((eq action :action-allow) "allow")
2848: ((eq action :action-warn) "warn")
2849: ((eq action :action-filter) "filter")
2850: ((eq action :action-deny) "deny")
2851: ((eq action :action-panic) "panic")
2852: ((eq action :action-stop) "stop")
2853: ((eq action :action-abort) "abort")
2854: ((eq action :action-kill) "kill")
2855: ((eq action :action-exit) "exit"))))
2856: (when action
2857: (let ((cmd (format "%s/net/bind" action)))
2858: (syd--stat (syd--rule cmd addr ?^))))))
2859:
2860: (defun syd-net-connect-add (action addr)
2861: "Add to the given actionlist of net/connect sandboxing.
2862: ACTION is a constant representing the sandboxing action.
2863: ADDR is a string representing the address pattern."
2864: (let ((action (cond
2865: ((eq action :action-allow) "allow")
2866: ((eq action :action-warn) "warn")
2867: ((eq action :action-filter) "filter")
2868: ((eq action :action-deny) "deny")
2869: ((eq action :action-panic) "panic")
2870: ((eq action :action-stop) "stop")
2871: ((eq action :action-abort) "abort")
2872: ((eq action :action-kill) "kill")
2873: ((eq action :action-exit) "exit"))))
2874: (when action
2875: (let ((cmd (format "%s/net/connect" action)))
2876: (syd--stat (syd--rule cmd addr ?+))))))
2877:
2878: (defun syd-net-connect-del (action addr)
2879: "Remove the first matching net/connect sandboxing actionlist entry.
2880: ACTION is a constant representing the sandboxing action.
2881: ADDR is a string representing the address pattern."
2882: (let ((action (cond
2883: ((eq action :action-allow) "allow")
2884: ((eq action :action-warn) "warn")
2885: ((eq action :action-filter) "filter")
2886: ((eq action :action-deny) "deny")
2887: ((eq action :action-panic) "panic")
2888: ((eq action :action-stop) "stop")
2889: ((eq action :action-abort) "abort")
2890: ((eq action :action-kill) "kill")
2891: ((eq action :action-exit) "exit"))))
2892: (when action
2893: (let ((cmd (format "%s/net/connect" action)))
2894: (syd--stat (syd--rule cmd addr ?-))))))
2895:
2896: (defun syd-net-connect-rem (action addr)
2897: "Remove all matching net/connect sandboxing actionlist entries.
2898: ACTION is a constant representing the sandboxing action.
2899: ADDR is a string representing the address pattern."
2900: (let ((action (cond
2901: ((eq action :action-allow) "allow")
2902: ((eq action :action-warn) "warn")
2903: ((eq action :action-filter) "filter")
2904: ((eq action :action-deny) "deny")
2905: ((eq action :action-panic) "panic")
2906: ((eq action :action-stop) "stop")
2907: ((eq action :action-abort) "abort")
2908: ((eq action :action-kill) "kill")
2909: ((eq action :action-exit) "exit"))))
2910: (when action
2911: (let ((cmd (format "%s/net/connect" action)))
2912: (syd--stat (syd--rule cmd addr ?^))))))
2913:
2914: (defun syd-sendfd-add (action addr)
2915: "Add to the given actionlist of sendfd sandboxing.
2916: ACTION is a constant representing the sandboxing action.
2917: ADDR is a string representing the file descriptor name."
2918: (let ((action (cond
2919: ((eq action :action-allow) "allow")
2920: ((eq action :action-warn) "warn")
2921: ((eq action :action-filter) "filter")
2922: ((eq action :action-deny) "deny")
2923: ((eq action :action-panic) "panic")
2924: ((eq action :action-stop) "stop")
2925: ((eq action :action-abort) "abort")
2926: ((eq action :action-kill) "kill")
2927: ((eq action :action-exit) "exit"))))
2928: (when action
2929: (let ((cmd (format "%s/sendfd" action)))
2930: (syd--stat (syd--rule cmd addr ?+))))))
2931:
2932: (defun syd-sendfd-del (action addr)
2933: "Remove the first matching sendfd sandboxing actionlist entry.
2934: ACTION is a constant representing the sandboxing action.
2935: ADDR is a string representing the file descriptor name."
2936: (let ((action (cond
2937: ((eq action :action-allow) "allow")
2938: ((eq action :action-warn) "warn")
2939: ((eq action :action-filter) "filter")
2940: ((eq action :action-deny) "deny")
2941: ((eq action :action-panic) "panic")
2942: ((eq action :action-stop) "stop")
2943: ((eq action :action-abort) "abort")
2944: ((eq action :action-kill) "kill")
2945: ((eq action :action-exit) "exit"))))
2946: (when action
2947: (let ((cmd (format "%s/sendfd" action)))
2948: (syd--stat (syd--rule cmd addr ?-))))))
2949:
2950: (defun syd-sendfd-rem (action addr)
2951: "Remove all matching sendfd sandboxing actionlist entries.
2952: ACTION is a constant representing the sandboxing action.
2953: ADDR is a string representing the file descriptor name."
2954: (let ((action (cond
2955: ((eq action :action-allow) "allow")
2956: ((eq action :action-warn) "warn")
2957: ((eq action :action-filter) "filter")
2958: ((eq action :action-deny) "deny")
2959: ((eq action :action-panic) "panic")
2960: ((eq action :action-stop) "stop")
2961: ((eq action :action-abort) "abort")
2962: ((eq action :action-kill) "kill")
2963: ((eq action :action-exit) "exit"))))
2964: (when action
2965: (let ((cmd (format "%s/sendfd" action)))
2966: (syd--stat (syd--rule cmd addr ?^))))))
2967:
2968: (defun syd-recvfd-add (action addr)
2969: "Add to the given actionlist of recvfd sandboxing.
2970: ACTION is a constant representing the sandboxing action.
2971: ADDR is a string representing the file descriptor name."
2972: (let ((action (cond
2973: ((eq action :action-allow) "allow")
2974: ((eq action :action-warn) "warn")
2975: ((eq action :action-filter) "filter")
2976: ((eq action :action-deny) "deny")
2977: ((eq action :action-panic) "panic")
2978: ((eq action :action-stop) "stop")
2979: ((eq action :action-abort) "abort")
2980: ((eq action :action-kill) "kill")
2981: ((eq action :action-exit) "exit"))))
2982: (when action
2983: (let ((cmd (format "%s/recvfd" action)))
2984: (syd--stat (syd--rule cmd addr ?+))))))
2985:
2986: (defun syd-recvfd-del (action addr)
2987: "Remove the first matching recvfd sandboxing actionlist entry.
2988: ACTION is a constant representing the sandboxing action.
2989: ADDR is a string representing the file descriptor name."
2990: (let ((action (cond
2991: ((eq action :action-allow) "allow")
2992: ((eq action :action-warn) "warn")
2993: ((eq action :action-filter) "filter")
2994: ((eq action :action-deny) "deny")
2995: ((eq action :action-panic) "panic")
2996: ((eq action :action-stop) "stop")
2997: ((eq action :action-abort) "abort")
2998: ((eq action :action-kill) "kill")
2999: ((eq action :action-exit) "exit"))))
3000: (when action
3001: (let ((cmd (format "%s/recvfd" action)))
3002: (syd--stat (syd--rule cmd addr ?-))))))
3003:
3004: (defun syd-recvfd-rem (action addr)
3005: "Remove all matching recvfd sandboxing actionlist entries.
3006: ACTION is a constant representing the sandboxing action.
3007: ADDR is a string representing the file descriptor name."
3008: (let ((action (cond
3009: ((eq action :action-allow) "allow")
3010: ((eq action :action-warn) "warn")
3011: ((eq action :action-filter) "filter")
3012: ((eq action :action-deny) "deny")
3013: ((eq action :action-panic) "panic")
3014: ((eq action :action-stop) "stop")
3015: ((eq action :action-abort) "abort")
3016: ((eq action :action-kill) "kill")
3017: ((eq action :action-exit) "exit"))))
3018: (when action
3019: (let ((cmd (format "%s/recvfd" action)))
3020: (syd--stat (syd--rule cmd addr ?^))))))
3021:
3022: (defun syd-net-link-add (action addr)
3023: "Add to the given actionlist of net/link sandboxing.
3024: ACTION is a constant representing the sandboxing action.
3025: ADDR is a string representing the address pattern."
3026: (let ((action (cond
3027: ((eq action :action-allow) "allow")
3028: ((eq action :action-warn) "warn")
3029: ((eq action :action-filter) "filter")
3030: ((eq action :action-deny) "deny")
3031: ((eq action :action-panic) "panic")
3032: ((eq action :action-stop) "stop")
3033: ((eq action :action-abort) "abort")
3034: ((eq action :action-kill) "kill")
3035: ((eq action :action-exit) "exit"))))
3036: (when action
3037: (let ((cmd (format "%s/net/link" action)))
3038: (syd--stat (syd--rule cmd addr ?+))))))
3039:
3040: (defun syd-net-link-del (action addr)
3041: "Remove the first matching net/link sandboxing actionlist entry.
3042: ACTION is a constant representing the sandboxing action.
3043: ADDR is a string representing the address pattern."
3044: (let ((action (cond
3045: ((eq action :action-allow) "allow")
3046: ((eq action :action-warn) "warn")
3047: ((eq action :action-filter) "filter")
3048: ((eq action :action-deny) "deny")
3049: ((eq action :action-panic) "panic")
3050: ((eq action :action-stop) "stop")
3051: ((eq action :action-abort) "abort")
3052: ((eq action :action-kill) "kill")
3053: ((eq action :action-exit) "exit"))))
3054: (when action
3055: (let ((cmd (format "%s/net/link" action)))
3056: (syd--stat (syd--rule cmd addr ?-))))))
3057:
3058: (defun syd-net-link-rem (action addr)
3059: "Remove all matching net/link sandboxing actionlist entries.
3060: ACTION is a constant representing the sandboxing action.
3061: ADDR is a string representing the address pattern."
3062: (let ((action (cond
3063: ((eq action :action-allow) "allow")
3064: ((eq action :action-warn) "warn")
3065: ((eq action :action-filter) "filter")
3066: ((eq action :action-deny) "deny")
3067: ((eq action :action-panic) "panic")
3068: ((eq action :action-stop) "stop")
3069: ((eq action :action-abort) "abort")
3070: ((eq action :action-kill) "kill")
3071: ((eq action :action-exit) "exit"))))
3072: (when action
3073: (let ((cmd (format "%s/net/link" action)))
3074: (syd--stat (syd--rule cmd addr ?^))))))
3075:
3076: (defun syd-force-add (path alg hash action)
3077: "Add an entry to the Integrity Force map for Force Sandboxing.
3078: PATH is a fully-qualified file name.
3079: ALG is the hash algorithm (e.g. \"sha256\").
3080: HASH is a hexadecimal encoded checksum.
3081: ACTION is one of `:action-warn', `:action-filter', `:action-deny',
3082: `:action-panic', `:action-stop', `:action-abort', `:action-kill' or
3083: `:action-exit'."
3084: (let ((action (cond ((eq action :action-warn) "warn")
3085: ((eq action :action-filter) "filter")
3086: ((eq action :action-deny) "deny")
3087: ((eq action :action-panic) "panic")
3088: ((eq action :action-stop) "stop")
3089: ((eq action :action-abort) "abort")
3090: ((eq action :action-kill) "kill")
3091: ((eq action :action-exit) "exit"))))
3092: (when action
3093: (let ((cmd (format "/dev/syd/force+%s:%s:%s:%s" path alg hash action)))
3094: (syd--stat cmd)))))
3095:
3096: (defun syd-force-del (path)
3097: "Remove an entry from the Integrity Force map for Force Sandboxing.
3098: PATH is a fully-qualified file name."
3099: (let ((cmd (format "/dev/syd/force-%s" path)))
3100: (syd--stat cmd)))
3101:
3102: (defun syd-force-clr ()
3103: "Clear the Integrity Force map for Force Sandboxing."
3104: (syd--stat "/dev/syd/force^"))
3105:
3106: (defun syd-mem-max (size)
3107: "Set syd maximum per-process memory usage limit.
3108: SIZE can be an integer or a string representing the memory limit."
3109: (let ((size-str (cond ((integerp size) (number-to-string size))
3110: ((stringp size) size)
3111: (t (error "Size must be an integer or a string")))))
3112: (syd--stat (syd--rule "mem/max" size-str ?:))))
3113:
3114: (defun syd-mem-vm-max (size)
3115: "Set syd maximum per-process virtual memory usage limit.
3116: SIZE can be an integer or a string representing the memory limit."
3117: (let ((size-str (cond ((integerp size) (number-to-string size))
3118: ((stringp size) size)
3119: (t (error "Size must be an integer or a string")))))
3120: (syd--stat (syd--rule "mem/vm_max" size-str ?:))))
3121:
3122: (defun syd-pid-max (size)
3123: "Set syd maximum process ID limit for PID sandboxing.
3124: SIZE is a number representing the PID limit."
3125: (unless (numberp size)
3126: (error "Size must be a number"))
3127: (let ((path (format "/dev/syd/pid/max:%d" size)))
3128: (syd--stat path)))
3129:
3130: (defun syd-pipe-max (size)
3131: "Set syd maximum pipe(2) buffer size in bytes.
3132: The value may be lowered but not raised at runtime, and must be at
3133: least 512, the POSIX minimum.
3134: SIZE is a number representing the pipe buffer size."
3135: (unless (numberp size)
3136: (error "Size must be a number"))
3137: (let ((path (format "/dev/syd/pipe/max:%d" size)))
3138: (syd--stat path)))
3139:
3140: (defun syd-xattr-max (size)
3141: "Set syd maximum extended attribute value size in bytes.
3142: SIZE is a number representing the extended attribute value size."
3143: (unless (numberp size)
3144: (error "Size must be a number"))
3145: (let ((path (format "/dev/syd/xattr/max:%d" size)))
3146: (syd--stat path)))
3147:
3148: (defun syd-segvguard-expiry (timeout)
3149: "Specify SegvGuard entry expiry timeout in seconds.
3150: Setting this timeout to 0 effectively disables SegvGuard.
3151: TIMEOUT is a number representing the timeout in seconds."
3152: (unless (numberp timeout)
3153: (error "Timeout must be a number"))
3154: (let ((path (format "/dev/syd/segvguard/expiry:%d" timeout)))
3155: (syd--stat path)))
3156:
3157: (defun syd-segvguard-suspension (timeout)
3158: "Specify SegvGuard entry suspension timeout in seconds.
3159: TIMEOUT is a number representing the timeout in seconds."
3160: (unless (numberp timeout)
3161: (error "Timeout must be a number"))
3162: (let ((path (format "/dev/syd/segvguard/suspension:%d" timeout)))
3163: (syd--stat path)))
3164:
3165: (defun syd-segvguard-maxcrashes (limit)
3166: "Specify SegvGuard max number of crashes before suspension.
3167: LIMIT is a number representing the crash limit."
3168: (unless (numberp limit)
3169: (error "Limit must be a number"))
3170: (let ((path (format "/dev/syd/segvguard/maxcrashes:%d" limit)))
3171: (syd--stat path)))
3172:
3173: (defun syd-exec (file argv)
3174: "Execute a command outside the sandbox without sandboxing.
3175: FILE is the file path of the command as a string.
3176: ARGV is a list of strings representing the arguments to the command."
3177: (unless (stringp file)
3178: (error "File must be a string"))
3179: (let ((all-strings t))
3180: (dolist (arg argv)
3181: (unless (stringp arg)
3182: (setq all-strings nil)))
3183: (unless all-strings
3184: (error "All elements in ARGV must be strings")))
3185:
3186: (let ((cmd (mapconcat 'identity (cons file argv) "\x1F")))
3187: (syd--stat (concat "/dev/syd/cmd/exec!" cmd))))
3188:
3189: (defun syd--rule (rule elem op)
3190: "Helper function to construct a path for syd operations.
3191: RULE is a string representing the rule.
3192: ELEM is a string representing the element.
3193: OP is a character representing the operation."
3194: (unless (member op '(?+ ?- ?^ ?:))
3195: (error "Invalid operation"))
3196: (when (string-empty-p elem)
3197: (error "Element cannot be empty"))
3198: (concat "/dev/syd/" rule (char-to-string op) elem))
3199:
3200: (defun syd--stat (path)
3201: "Issue a single virtual syd stat(2) on PATH and report success."
3202: (condition-case nil
3203: (and (file-modes path 'nofollow) t)
3204: (error nil))) ; On error, return nil
3205:
3206: ;
3207: ; syd-3-mode: Font-lock highlighting for Syd v3 profiles (.syd-3 files).
3208: ;
3209:
3210: (defgroup syd-3 nil
3211: "Syntax highlighting for Syd v3 profiles."
3212: :group 'languages
3213: :prefix "syd-3-")
3214:
3215: (defface syd-3-error '((t :inherit error))
3216: "Face for an invalid syd-3 command, sub-key or value." :group 'syd-3)
3217: (defface syd-3-comment '((t :inherit font-lock-comment-face))
3218: "Face for a syd-3 comment." :group 'syd-3)
3219: (defface syd-3-identifier '((t :inherit font-lock-function-name-face))
3220: "Face for a syd-3 command name and its structural punctuation." :group 'syd-3)
3221: (defface syd-3-boolean '((t :inherit font-lock-constant-face))
3222: "Face for a syd-3 boolean value." :group 'syd-3)
3223: (defface syd-3-number '((t :inherit font-lock-constant-face))
3224: "Face for a syd-3 numeric value: integer, size, duration or port." :group 'syd-3)
3225: (defface syd-3-string '((t :inherit font-lock-string-face))
3226: "Face for a syd-3 string or path value." :group 'syd-3)
3227: (defface syd-3-constant '((t :inherit font-lock-constant-face))
3228: "Face for a syd-3 network address value." :group 'syd-3)
3229: (defface syd-3-type '((t :inherit font-lock-type-face))
3230: "Face for a syd-3 enumerated keyword value: none, tmpfs, an alias, ..." :group 'syd-3)
3231: (defface syd-3-special '((t :inherit font-lock-builtin-face))
3232: "Face for a syd-3 special value: action, netlink family, ioctl const, ..." :group 'syd-3)
3233:
3234: (defvar syd-3-font-lock-keywords
3235: (let* ((caps "all-lnx\\|all-nx\\|all-lx\\|all-ln\\|all-l\\|all-n\\|all-x\\|all\\|lpath\\|npath\\|rpath\\|wpath\\|cpath\\|dpath\\|spath\\|tpath\\|fown\\|fattr\\|inet\\|bnet\\|cnet\\|exec\\|force\\|lock\\|mem\\|pid\\|proxy\\|pty\\|tpe\\|fs\\|walk\\|list\\|stat\\|read\\|write\\|ioctl\\|create\\|delete\\|rename\\|readlink\\|symlink\\|truncate\\|chdir\\|readdir\\|mkdir\\|rmdir\\|chown\\|chgrp\\|chmod\\|chattr\\|chroot\\|notify\\|utime\\|mkbdev\\|mkcdev\\|mkfifo\\|mktemp\\|net/bind\\|net/connect\\|net\\|passfd\\|sendfd\\|recvfd")
3236: (dcaps (concat caps "\\|block\\|segvguard"))
3237: (ns "all\\|mount\\|uts\\|ipc\\|user\\|pid\\|net\\|cgroup\\|time")
3238: (act "allow\\|warn\\|filter\\|deny\\|panic\\|stop\\|abort\\|kill\\|exit")
3239: (fc "all-lnx\\|all-nx\\|all-lx\\|all-ln\\|all-l\\|all-n\\|all-x\\|all\\|lpath\\|npath\\|rpath\\|wpath\\|cpath\\|dpath\\|spath\\|tpath\\|fown\\|fattr\\|fs\\|walk\\|list\\|stat\\|read\\|write\\|exec\\|create\\|delete\\|rename\\|readlink\\|symlink\\|truncate\\|chdir\\|readdir\\|mkdir\\|rmdir\\|chown\\|chgrp\\|chmod\\|chattr\\|chroot\\|notify\\|utime\\|mkbdev\\|mkcdev\\|mkfifo\\|mktemp\\|passfd\\|sendfd\\|recvfd")
3240: (nc "net\\|inet\\|bnet\\|cnet")
3241: (nsub "bind\\|connect")
3242: (proto "tcp[46]?\\|udp[46]?\\|net[46]?\\|unix\\(?:gram\\|packet\\)?\\|\\${[^}]+}")
3243: (svc "[0-9]+\\(?:-[0-9]+\\)?\\(?:,[0-9]+\\(?:-[0-9]+\\)?\\)*\\|\\*\\|\\${[^}]+}")
3244: (lc "all-x\\|all\\|rpath\\|wpath\\|cpath\\|dpath\\|spath\\|tpath\\|inet\\|read\\|write\\|exec\\|ioctl\\|create\\|delete\\|rename\\|symlink\\|truncate\\|readdir\\|mkdir\\|rmdir\\|mkbdev\\|mkcdev\\|mkfifo\\|bind\\|connect\\|net\\|bnet\\|cnet")
3245: (clist (lambda (s) (concat "\\(?:" s "\\)\\(?:,\\(?:" s "\\)\\)*")))
3246: (fm (concat "\\(?:" fc "\\|" nc "\\)"))
3247: (link "all\\|route\\|usersock\\|firewall\\|sock_diag\\|nflog\\|xfrm\\|selinux\\|iscsi\\|audit\\|fib_lookup\\|inet_diag\\|connector\\|netfilter\\|ip6_fw\\|dnrtmsg\\|kobject_uevent\\|generic\\|scsitransport\\|ecryptfs\\|rdma\\|crypto\\|smc")
3248: (halg "blake2b-160\\|blake2b-256\\|blake2b-384\\|blake2b-512\\|blake2s-128\\|blake2s-256\\|blake3\\|crc32c\\|crc32\\|crc64\\|gost94\\|keccak256\\|keccak512\\|md4\\|md5\\|rmd128\\|rmd160\\|rmd256\\|rmd320\\|sha1\\|sha224\\|sha256\\|sha3-224\\|sha3-256\\|sha3-384\\|sha3-512\\|sha384\\|sha512\\|sm3\\|streebog256\\|streebog512\\|tiger2\\|tiger\\|wp256\\|wp384\\|wp512")
3249: (sev "emerg\\|alert\\|crit\\|error\\|warn\\|notice\\|info\\|debug")
3250: (tsafe "allow_safe_bind\\|allow_safe_setuid\\|allow_safe_setgid\\|allow_safe_syslog\\|deny_dotdot\\|deny_exec_elf32\\|deny_exec_elf_dynamic\\|deny_exec_elf_norelro\\|deny_exec_elf_static\\|deny_exec_script\\|deny_passrights\\|deny_tsc\\|deny_vdso\\|exit_wait_all\\|force_cloexec\\|force_local_net\\|force_no_symlinks\\|force_rand_fd\\|force_ro_open\\|force_wx_open\\|force_no_magiclinks\\|force_no_xdev\\|sync_seccomp")
3251: (tunsafe "allow_unsafe_any_addr\\|allow_unsafe_arch_prctl\\|allow_unsafe_bind\\|allow_unsafe_cap_fixup\\|allow_unsafe_caps\\|allow_unsafe_cbpf\\|allow_unsafe_cbpf_speculative\\|allow_unsafe_chown\\|allow_unsafe_chroot\\|allow_unsafe_copy\\|allow_unsafe_cpu\\|allow_unsafe_create\\|allow_unsafe_deleted\\|allow_unsafe_deprecated\\|allow_unsafe_dumpable\\|allow_unsafe_ebpf\\|allow_unsafe_env\\|allow_unsafe_exec_interactive\\|allow_unsafe_exec_ldso\\|allow_unsafe_exec_libc\\|allow_unsafe_exec_memory\\|allow_unsafe_exec_nopie\\|allow_unsafe_exec_noreg\\|allow_unsafe_exec_null\\|allow_unsafe_exec_script\\|allow_unsafe_exec_speculative\\|allow_unsafe_exec_stack\\|allow_unsafe_exec_textrel\\|allow_unsafe_fcntl\\|allow_unsafe_filename\\|allow_unsafe_futex\\|allow_unsafe_hardlinks\\|allow_unsafe_ip_pktinfo\\|allow_unsafe_ip_retopts\\|allow_unsafe_ipv6_rthdr\\|allow_unsafe_ipv6_scope\\|allow_unsafe_kcapi\\|allow_unsafe_kcmp\\|allow_unsafe_keyring\\|allow_unsafe_kptr\\|allow_unsafe_machine_id\\|allow_unsafe_madvise\\|allow_unsafe_magiclinks\\|allow_unsafe_memfd\\|allow_unsafe_mkbdev\\|allow_unsafe_mkcdev\\|allow_unsafe_msgqueue\\|allow_unsafe_netlink\\|allow_unsafe_nice\\|allow_unsafe_nocookie\\|allow_unsafe_nomseal\\|allow_unsafe_notify_bdev\\|allow_unsafe_notify_cdev\\|allow_unsafe_noxom\\|allow_unsafe_numa\\|allow_unsafe_oob\\|allow_unsafe_open_kfd\\|allow_unsafe_open_path\\|allow_unsafe_open_suid\\|allow_unsafe_page_cache\\|allow_unsafe_perf\\|allow_unsafe_perm_msgqueue\\|allow_unsafe_perm_shm\\|allow_unsafe_personality\\|allow_unsafe_pipe\\|allow_unsafe_pivot_root\\|allow_unsafe_pkey\\|allow_unsafe_prctl\\|allow_unsafe_proc_dumpable\\|allow_unsafe_proc_files\\|allow_unsafe_proc_name\\|allow_unsafe_prlimit\\|allow_unsafe_proc_pid_status\\|allow_unsafe_ptrace\\|allow_unsafe_recvmsg\\|allow_unsafe_rseq\\|allow_unsafe_setid\\|allow_unsafe_setsockopt\\|allow_unsafe_shm\\|allow_unsafe_socket\\|allow_unsafe_socketcall\\|allow_unsafe_stat_bdev\\|allow_unsafe_stat_cdev\\|allow_unsafe_sticky\\|allow_unsafe_sud\\|allow_unsafe_symlinks\\|allow_unsafe_sys_ptrace\\|allow_unsafe_sysinfo\\|allow_unsafe_syslog\\|allow_unsafe_tcp_devmem\\|allow_unsafe_tcp_fastopen\\|allow_unsafe_time\\|allow_unsafe_uname\\|allow_unsafe_vmsplice\\|allow_unsafe_xattr\\|allow_unsupp_cmsg\\|allow_unsupp_socket")
3252: (rlk "as\\|core\\|cpu\\|data\\|fsize\\|memlock\\|msgqueue\\|nice\\|nofile\\|nproc\\|rtprio\\|rttime\\|sigpending\\|stack")
3253: (bool "\\(?:1\\|on\\|t\\|tr\\|tru\\|true\\|✓\\|0\\|off\\|f\\|fa\\|fal\\|fals\\|false\\|✗\\)")
3254: (lock "\\(?:on\\|off\\|exec\\|ipc\\|drop\\|read-only\\|readonly\\|read\\|ro\\|1\\|0\\|x\\|r\\|i\\|d\\)")
3255: (int "[-+]?[0-9]+")
3256: (uint "[0-9]+")
3257: (size "[0-9]+[kKmMgGtTpP]?[bB]?")
3258: (dur "[0-9]+\\(?:\\.[0-9]+\\)?\\(?:us\\|ms\\|s\\|m\\|h\\|d\\|w\\)?")
3259: (dn "\\(?:[A-Za-z][A-Za-z0-9_]\\{0,15\\}\\|\\(?:[A-Za-z0-9_]*${[^}]*}\\)+[A-Za-z0-9_]*\\)")
3260: (ds (concat "\\(?:@" dn "\\|[^@ \t].*\\)"))
3261: (id '(0 'syd-3-identifier))
3262: (bln '(1 'syd-3-boolean t)) (num '(1 'syd-3-number t)) (str '(1 'syd-3-string t))
3263: (con '(1 'syd-3-constant t)) (typ '(1 'syd-3-type t)) (spc '(1 'syd-3-special t))
3264: (caplist (funcall clist caps))
3265: (dclist (funcall clist dcaps))
3266: (nslist (funcall clist ns))
3267: (fmlist (funcall clist fm))
3268: (nclist (funcall clist nc))
3269: (lclist (funcall clist lc))
3270: (an (concat "^\\(?9:@" dn "\\)/"))
3271: (nm '(9 'syd-3-type t))
3272: (truthy "1\\|on\\|t\\|tr\\|tru\\|true\\|✓")
3273: (scaps (concat "\\(?:\\(?:" caps "\\),\\)*\\(?:lock\\|proxy\\|pty\\)\\(?:,\\(?:" caps "\\)\\)*")))
3274: (list
3275: (list "^[ \t]*#.*$" '(0 'syd-3-comment))
3276: (list (concat "^lock:\\(?1:" lock "\\)$") id bln)
3277: (list "^\\(?:l\\|lock\\|stat\\|dump\\|panic\\|ghost\\)$" id)
3278: (list "^ipc:\\(?1:.+\\)$" id str)
3279: (list "^ipc/\\(?:uid\\|gid\\):\\(?1:none\\)$" id typ)
3280: (list (concat "^ipc/\\(?:uid\\|gid\\|max\\):\\(?1:" int "\\)$") id num)
3281: (list (concat "^ipc/idle:\\(?1:" dur "\\)$") id num)
3282: (list (concat "^log/level:\\(?1:" sev "\\)$") id typ)
3283: (list (concat "^log/level:\\(?1:" uint "\\)$") id num)
3284: (list (concat "^log/\\(?:verbose\\|rlimit_burst\\):\\(?1:" uint "\\)$") id num)
3285: (list (concat "^log/rlimit_interval:\\(?1:" dur "\\)$") id num)
3286: (list (concat "^log/lock/\\(?:same_exec_off\\|new_exec_on\\|subdomains_off\\):\\(?1:" bool "\\)$") id bln)
3287: (list "^pty/\\(?:row\\|col\\):\\(?1:none\\)$" id typ)
3288: (list (concat "^pty/\\(?:row\\|col\\):\\(?1:" uint "\\)$") id num)
3289: (list (concat "^mem/\\(?:max\\|vm_max\\):\\(?1:" size "\\)$") id num)
3290: (list (concat "^pid/max:\\(?1:" uint "\\)$") id num)
3291: (list (concat "^\\(?:mem\\|pid\\)/kill:\\(?1:" bool "\\)$") id bln)
3292: (list (concat "^rlimit/\\(?:" rlk "\\):.+$") id)
3293: (list (concat "^segvguard/\\(?:expiry\\|suspension\\|maxcrashes\\):\\(?1:" dur "\\)$") id num)
3294: (list (concat "^tpe/\\(?:negate\\|root_owned\\|user_owned\\|root_mount\\):\\(?1:" bool "\\)$") id bln)
3295: (list (concat "^tpe/gid:\\(?1:" uint "\\)$") id num)
3296: (list "^tpe/gid:none$" id)
3297: (list "^proxy/addr:\\(?1:.+\\)$" id con)
3298: (list (concat "^proxy/\\(?:port\\|ext/port\\):\\(?1:" int "\\)$") id num)
3299: (list "^proxy/ext/\\(?:host\\|unix\\):\\(?1:.+\\)$" id str)
3300: (list "^time:\\(?1:none\\)$" id typ)
3301: (list (concat "^time:\\(?1:" int "\\)$") id num)
3302: (list (concat "^time/\\(?:boot\\|mono\\):\\(?1:" int "\\)$") id num)
3303: (list "^timeout:\\(?1:none\\)$" id typ)
3304: (list (concat "^timeout:\\(?1:" dur "\\)$") id num)
3305: (list "^uts/\\(?:host\\|domain\\|version\\):\\(?1:.+\\)$" id str)
3306: (list "^root:\\(?1:/.*\\)$" id str)
3307: (list "^root:\\(?1:tmpfs\\|tmp\\|t\\|ramfs\\|ram\\|r\\|none\\|off\\)$" id typ)
3308: (list (concat "^root/\\(?:fake\\|map\\):\\(?1:" bool "\\)$") id bln)
3309: (list "^workdir:\\(?1:/.*\\)$" id str)
3310: (list "^workdir:\\(?1:none\\|off\\)$" id typ)
3311: (list (concat "^sandbox/\\(?:" caplist "\\):\\(?1:" bool "\\)$") id bln)
3312: (list (concat "^sandbox/\\(?:" caplist "\\)\\?$") id)
3313: (list (concat "^unshare/\\(?:" nslist "\\):\\(?1:" bool "\\)$") id bln)
3314: (list (concat "^unshare/\\(?:" nslist "\\)\\?$") id)
3315: (list (concat "^default/\\(?:" dclist "\\):\\(?1:" act "\\)$") id spc)
3316: (list (concat "^trace/\\(?:" tsafe "\\|" tunsafe "\\):\\(?1:" bool "\\)$") id bln)
3317: (list "^trace/force_umask:\\(?1:-1\\|off\\|f\\|fa\\|fal\\|fals\\|false\\|✗\\|[0-7]+\\)$" id num)
3318: (list "^trace/memory_access:\\(?1:[012]\\)$" id num)
3319: (list (concat "^trace/allow_unsafe_namespace:\\(?1:all\\|none\\|off\\|" (funcall clist ns) "\\)$") id typ)
3320: (list "^setenv!.*$" id)
3321: (list "^unsetenv!.*$" id)
3322: (list "^clearenv!$" id)
3323: (list "^passenv[-+^].*$" id)
3324: (list "^cmd/exec!.*$" id)
3325: (list "^mask[-+^].*$" id)
3326: (list "^block[-+^!].*$" id)
3327: (list "^force[-^].*$" id)
3328: (list (concat "^force\\+/[^:]+:\\(?:" halg "\\):[0-9a-fA-F]+\\(?::[a-z]+\\)?$") id)
3329: (list "^set[ug]id[-+^].*$" id)
3330: (list "^bind\\(?:-try\\)?[-+^].*$" id)
3331: (list "^\\(?:sym\\)?link\\(?:-try\\)?[-+^].*$" id)
3332: (list "^mkdir\\(?:-try\\)?[-+^].*$" id)
3333: (list "^mkfile\\(?:-try\\)?[-+^].*$" id)
3334: (list "^mkfifo\\(?:-try\\)?[-+^].*$" id)
3335: (list "^\\(?:allow\\|deny\\)/ioctl[-+]\\(?1:0x[0-9A-Fa-f]+\\|0o[0-7]+\\|[0-9]+\\)$" id num)
3336: (list "^\\(?:allow\\|deny\\)/ioctl[-+]\\(?1:[A-Z][A-Z0-9_]+!?\\)$" id spc)
3337: (list "^allow/uring/\\(?:op\\|reg\\|flag\\)[-+^]\\(?1:[a-z][a-z0-9_]*\\(?:,[a-z][a-z0-9_]*\\)*\\)?$" id con)
3338: (list (concat "^allow/net/link[-+^]\\(?1:" link "\\)$") id spc)
3339: (list (concat "^allow/lock/\\(?:" lclist "\\)[-+^]\\(?1:[0-9]+\\(?:-[0-9]+\\)?\\(?:,[0-9]+\\(?:-[0-9]+\\)?\\)*\\)$") id num)
3340: (list (concat "^allow/lock/\\(?:" lclist "\\)[-+^]\\(?1:/.*\\)$") id str)
3341: (list (concat "^\\(?:" act "\\)/\\(?:" fmlist "\\)[-+^]\\(?1:.+\\)$") id str)
3342: (list (concat "^\\(?:" act "\\)/\\(?:" fmlist "\\)[-+^]\\(?1:!.+\\)$") id typ)
3343: (list (concat "^\\(?:" act "\\)/\\(?:\\(?:" nclist "\\)\\|net/\\(?:" nsub "\\)\\)[-+^]\\(?1:" proto "\\)[!@]\\(?2:!unknown\\|!unnamed\\|[^! \t]+\\)\\(?3:!\\(?:" svc "\\)\\)?$")
3344: id typ '(2 'syd-3-constant t) '(3 'syd-3-number t t))
3345: (list (concat "^\\(?:" act "\\)/\\(?:\\(?:" nclist "\\)\\|net/\\(?:" nsub "\\)\\)[-+^]\\(?1:[^!@]+\\)\\(?2:[!@][0-9,-]+\\)?$")
3346: id con '(2 'syd-3-number t t))
3347: (list "^include .*$" id)
3348: (list "^include_profile .*$" id)
3349: (list "^domain\\^$" id)
3350: (list (concat "^domain[-+]\\(?1:@" dn "\\)\\(?2::" ds "\\)?$") id typ '(2 'syd-3-string t t))
3351: (list (concat "^move/\\(?1:@" dn "\\)/\\(?:exec\\|mmap\\|chdir\\|exit\\)\\(?:\\^$\\|[-+]\\(?2:[^ \t].*\\)$\\)")
3352: id typ '(2 'syd-3-string t t))
3353: (list (concat "^move/\\(?1:@" dn "\\)/\\(?:bind\\|connect\\|accept\\)[-+]\\(?2:" proto "\\)[!@]\\(?3:!unknown\\|!unnamed\\|[^! \t]+\\)\\(?4:!\\(?:" svc "\\)\\)?$")
3354: id typ '(2 'syd-3-type t) '(3 'syd-3-constant t t) '(4 'syd-3-number t t))
3355: (list (concat "^move/\\(?1:@" dn "\\)/\\(?:bind\\|connect\\|accept\\)\\(?:\\^$\\|[-+]\\(?2:[^! \t]+\\)\\(?3:![0-9-]+\\)?$\\)")
3356: id typ '(2 'syd-3-constant t t) '(3 'syd-3-number t t))
3357: (list (concat "^move/\\(?1:@" dn "\\)/\\(?:bind\\|connect\\)[-+]\\(?2:\\(?:[/@]\\|!unknown\\|!unnamed\\)[^ \t]*\\)$")
3358: id typ '(2 'syd-3-string t t))
3359: (list (concat "^cmd/move!\\(?1:@?" dn "\\)$") id typ)
3360: (list (concat an "sandbox/\\(?:" caplist "\\):\\(?1:" bool "\\)$") id nm bln)
3361: (list (concat an "sandbox/\\(?:" caplist "\\)\\?$") id nm)
3362: (list (concat "^@[^/ \t]+/sandbox/\\(?:" scaps "\\):\\(?:" truthy "\\)$") '(0 'syd-3-error t))
3363: (list (concat an "default/\\(?:" dclist "\\):\\(?1:" act "\\)$") id nm spc)
3364: (list (concat an "\\(?:" act "\\)/\\(?:" fmlist "\\)[-+^]\\(?1:.+\\)$") id nm str)
3365: (list (concat an "\\(?:" act "\\)/\\(?:\\(?:" nclist "\\)\\|net/\\(?:" nsub "\\)\\)[-+^]\\(?1:" proto "\\)[!@]\\(?2:!unknown\\|!unnamed\\|[^! \t]+\\)\\(?3:!\\(?:" svc "\\)\\)?$")
3366: id nm typ '(2 'syd-3-constant t) '(3 'syd-3-number t t))
3367: (list (concat an "\\(?:" act "\\)/\\(?:\\(?:" nclist "\\)\\|net/\\(?:" nsub "\\)\\)[-+^]\\(?1:[^!@]+\\)\\(?2:[!@][0-9,-]+\\)?$")
3368: id nm con '(2 'syd-3-number t t))
3369: (list (concat an "\\(?:allow\\|deny\\)/ioctl[-+]\\(?1:0x[0-9A-Fa-f]+\\|0o[0-7]+\\|[0-9]+\\)$") id nm num)
3370: (list (concat an "\\(?:allow\\|deny\\)/ioctl[-+]\\(?1:[A-Z][A-Z0-9_]+!?\\)$") id nm spc)
3371: (list (concat an "\\(?:mem\\|pid\\)/kill:\\(?1:" bool "\\)$") id nm bln)
3372: (list (concat an "mem/\\(?:max\\|vm_max\\):\\(?1:" size "\\)$") id nm num)
3373: (list (concat an "pid/max:\\(?1:" uint "\\)$") id nm num)
3374: (list (concat an "tpe/\\(?:negate\\|root_owned\\|user_owned\\|root_mount\\):\\(?1:" bool "\\)$") id nm bln)
3375: (list (concat an "tpe/gid:\\(?1:" uint "\\)$") id nm num)
3376: (list (concat an "tpe/gid:none$") id nm)
3377: (list (concat an "segvguard/\\(?:expiry\\|suspension\\|maxcrashes\\):\\(?1:" dur "\\)$") id nm num)
3378: (list (concat an "uts/\\(?:host\\|domain\\|version\\):\\(?1:.+\\)$") id nm str)
3379: (list (concat an "mask[-+^].*$") id nm)
3380: (list (concat an "block[-+^!].*$") id nm)
3381: (list (concat an "force[-^].*$") id nm)
3382: (list (concat an "force\\+/[^:]+:\\(?:" halg "\\):[0-9a-fA-F]+\\(?::[a-z]+\\)?$") id nm)
3383: (list (concat an "\\(?:stat\\|dump\\)$") id nm)
3384: (list (concat an "include .*$") id nm)
3385: (list (concat an "include_profile .*$") id nm)
3386: (list (concat an "move/\\(?1:@" dn "\\)/\\(?:exec\\|mmap\\|chdir\\|exit\\)\\(?:\\^$\\|[-+]\\(?2:[^ \t].*\\)$\\)")
3387: id nm typ '(2 'syd-3-string t t))
3388: (list (concat an "move/\\(?1:@" dn "\\)/\\(?:bind\\|connect\\|accept\\)[-+]\\(?2:" proto "\\)[!@]\\(?3:!unknown\\|!unnamed\\|[^! \t]+\\)\\(?4:!\\(?:" svc "\\)\\)?$")
3389: id nm typ '(2 'syd-3-type t) '(3 'syd-3-constant t t) '(4 'syd-3-number t t))
3390: (list (concat an "move/\\(?1:@" dn "\\)/\\(?:bind\\|connect\\|accept\\)\\(?:\\^$\\|[-+]\\(?2:[^! \t]+\\)\\(?3:![0-9-]+\\)?$\\)")
3391: id nm typ '(2 'syd-3-constant t t) '(3 'syd-3-number t t))
3392: (list (concat an "move/\\(?1:@" dn "\\)/\\(?:bind\\|connect\\)[-+]\\(?2:\\(?:[/@]\\|!unknown\\|!unnamed\\)[^ \t]*\\)$")
3393: id nm typ '(2 'syd-3-string t t))
3394: (list "^.+$" '(0 'syd-3-error))))
3395: "Font-lock keywords for `syd-3-mode'.
3396: Valid commands are highlighted (their value by colour class) the final
3397: catch-all flags any remaining line as an error.")
3398:
3399: ;###autoload
3400: (define-derived-mode syd-3-mode prog-mode "Syd3"
3401: "Major mode for editing Syd v3 profiles (.syd-3 files)."
3402: (setq-local comment-start "#")
3403: (setq-local comment-start-skip "#+[ \t]*")
3404: (setq-local font-lock-defaults '(syd-3-font-lock-keywords t nil)))
3405:
3406: ;###autoload
3407: (add-to-list 'auto-mode-alist '("\\.syd-3\\'" . syd-3-mode))
3408:
3409: (defun syd-3--value-classes (line)
3410: "Fontify LINE in `syd-3-mode' and report its highlighting."
3411: (let ((g2c '((syd-3-boolean . "B") (syd-3-number . "N") (syd-3-string . "S")
3412: (syd-3-constant . "C") (syd-3-type . "T") (syd-3-special . "P"))))
3413: (with-temp-buffer
3414: (insert line)
3415: (syd-3-mode)
3416: (font-lock-ensure)
3417: (let ((err nil) (classes '()) (pos (point-min)))
3418: (while (< pos (point-max))
3419: (let* ((face (get-text-property pos 'face))
3420: (class (cdr (assq face g2c))))
3421: (when (eq face 'syd-3-error) (setq err t))
3422: (when (and class (not (member class classes)))
3423: (setq classes (cons class classes))))
3424: (setq pos (1+ pos)))
3425: (cons err classes)))))
3426:
3427: (defconst syd-3--syntax-cases
3428: '(("lock:on" nil "B") ("lock:drop" nil "B") ("l" nil) ("lock" nil)
3429: ("stat" nil) ("dump" nil) ("panic" nil) ("ghost" nil)
3430: ("ipc:@/run/syd.sock" nil "S") ("ipc:none" nil) ("ipc/uid:1000" nil "N")
3431: ("ipc/uid:none" nil "T") ("ipc/gid:0" nil "N") ("ipc/max:64" nil "N")
3432: ("ipc/idle:30" nil "N") ("ipc/idle:5m" nil "N")
3433: ("log/level:debug" nil "T") ("log/verbose:3" nil "N") ("log/rlimit_burst:5" nil "N")
3434: ("log/rlimit_interval:5s" nil "N") ("log/lock/new_exec_on:1" nil "B")
3435: ("log/lock/same_exec_off:true" nil "B")
3436: ("pty/row:80" nil "N") ("pty/col:24" nil "N") ("pty/col:none" nil "T")
3437: ("mem/max:1G" nil "N") ("mem/vm_max:512M" nil "N") ("pid/max:100" nil "N")
3438: ("mem/kill:1" nil "B") ("pid/kill:0" nil "B")
3439: ("rlimit/nofile:1024" nil) ("rlimit/as:1G" nil) ("rlimit/nice:10" nil) ("rlimit/cpu:30" nil)
3440: ("segvguard/expiry:5m" nil "N") ("segvguard/suspension:300" nil "N") ("segvguard/maxcrashes:3" nil "N")
3441: ("tpe/gid:1000" nil "N") ("tpe/gid:none" nil) ("tpe/negate:on" nil "B")
3442: ("tpe/root_owned:off" nil "B") ("tpe/root_mount:1" nil "B") ("tpe/user_owned:true" nil "B")
3443: ("proxy/addr:127.0.0.1" nil "C") ("proxy/port:8080" nil "N") ("proxy/ext/host:example.com" nil "S")
3444: ("proxy/ext/port:443" nil "N") ("proxy/ext/unix:/run/p.sock" nil "S")
3445: ("time:5" nil "N") ("time:-5" nil "N") ("time/boot:100" nil "N") ("time/mono:-42" nil "N")
3446: ("time:none" nil "T") ("timeout:30" nil "N") ("timeout:none" nil "T")
3447: ("uts/host:myhost" nil "S") ("uts/domain:example" nil "S") ("uts/version:1.0" nil "S")
3448: ("root:/newroot" nil "S") ("root:tmpfs" nil "T") ("root:ramfs" nil "T") ("root:none" nil "T")
3449: ("root/map:on" nil "B") ("root/fake:off" nil "B") ("workdir:/home" nil "S")
3450: ("sandbox/fs:on" nil "B") ("sandbox/readlink:on" nil "B") ("sandbox/mkbdev:off" nil "B")
3451: ("sandbox/mkcdev:on" nil "B") ("sandbox/all:on" nil "B") ("sandbox/all-l:on" nil "B")
3452: ("sandbox/all-lnx:on" nil "B") ("sandbox/all-nx:on" nil "B") ("sandbox/all-lx:on" nil "B")
3453: ("sandbox/all-ln:on" nil "B") ("sandbox/all-n:on" nil "B") ("sandbox/all-n:off" nil "B")
3454: ("sandbox/all-x:off" nil "B") ("sandbox/lpath:on" nil "B") ("sandbox/bnet:on" nil "B")
3455: ("sandbox/read,write:off" nil "B") ("sandbox/pty:on" nil "B") ("sandbox/fs?" nil)
3456: ("default/fs:deny" nil "P") ("default/read:allow" nil "P") ("default/readlink:warn" nil "P")
3457: ("default/block:deny" nil "P") ("default/segvguard:kill" nil "P")
3458: ("default/all-l:deny" nil "P") ("default/all-n:warn" nil "P")
3459: ("default/all-x:allow" nil "P")
3460: ("default/all-lnx:kill" nil "P") ("default/all-nx:panic" nil "P")
3461: ("default/all-lx:abort" nil "P") ("default/all-ln:exit" nil "P")
3462: ("default/read,write:deny" nil "P")
3463: ("unshare/mount:on" nil "B") ("unshare/all:on" nil "B") ("unshare/mount,net:off" nil "B")
3464: ("unshare/mount?" nil)
3465: ("trace/allow_unsafe_sys_ptrace:1" nil "B") ("trace/allow_unsafe_ptrace:1" nil "B") ("trace/allow_unsafe_kcmp:1" nil "B") ("trace/allow_unsafe_fcntl:0" nil "B")
3466: ("trace/allow_unsafe_proc_files:on" nil "B") ("trace/allow_unsafe_socketcall:1" nil "B") ("trace/sync_seccomp:1" nil "B")
3467: ("trace/deny_dotdot:on" nil "B") ("trace/force_cloexec:on" nil "B")
3468: ("trace/allow_safe_bind:on" nil "B") ("trace/force_umask:022" nil "N")
3469: ("trace/force_umask:off" nil "N") ("trace/memory_access:2" nil "N")
3470: ("trace/allow_unsafe_namespace:mount,net" nil "T") ("trace/allow_unsafe_namespace:all" nil "T")
3471: ("setenv!FOO=bar" nil) ("unsetenv!FOO" nil) ("clearenv!" nil)
3472: ("passenv+LD_*" nil) ("passenv-FOO" nil) ("passenv^FOO" nil) ("cmd/exec!/bin/echo" nil)
3473: ("mask+/proc:/dev/null" nil) ("mask^" nil)
3474: ("block+1.2.3.0/24" nil) ("block-1.2.3.4" nil) ("block^" nil)
3475: ("force+/usr/bin/x:sha256:deadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0de:deny" nil)
3476: ("force+/usr/bin/x:blake3:deadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0de" nil)
3477: ("force+/usr/bin/x:crc32:deadc0de" nil) ("force+/usr/bin/x:crc32c:deadc0de" nil)
3478: ("force+/usr/bin/x:crc64:deadc0dedeadc0de:kill" nil)
3479: ("force+/usr/bin/x:tiger2:deadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0de" nil)
3480: ("force+/usr/bin/x:rmd320:deadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0de" nil)
3481: ("force+/usr/bin/x:sha3-512:deadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0de" nil)
3482: ("force+/usr/bin/x:streebog256:deadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0de" nil)
3483: ("force+/usr/bin/x:xxhash64:deadc0dedeadc0de" t)
3484: ("force+/usr/bin/x:md6:deadc0dedeadc0dedeadc0dedeadc0de" t)
3485: ("force+/usr/bin/x:sha2:deadc0de" t)
3486: ("force-/usr/bin/x" nil) ("force^" nil)
3487: ("setuid+1000:2000" nil) ("setgid+1000:2000" nil) ("setuid^1000" nil)
3488: ("bind+/src:/dst" nil) ("bind-try+/src:/dst" nil) ("bind-/dst" nil)
3489: ("link+/a:/b" nil) ("link-try+/a:/b" nil) ("symlink+/a:/b" nil) ("symlink-try+/a:/b" nil)
3490: ("link^" nil) ("mkdir+/tmp/d:0755" nil) ("mkdir-try+/tmp/d" nil)
3491: ("mkfile+/tmp/f" nil) ("mkfifo+/tmp/f" nil) ("mkfifo-try+/tmp/f" nil)
3492: ("allow/ioctl+0x5401" nil "N") ("deny/ioctl+TIOCSTI" nil "P") ("allow/ioctl-0o21505" nil "N")
3493: ("allow/uring/op+read,write" nil "C") ("allow/uring/reg+register_files" nil "C")
3494: ("allow/uring/reg-register_probe" nil "C") ("allow/uring/flag+async" nil "C")
3495: ("allow/read+/etc/**" nil "S") ("warn/write+/etc" nil "S") ("filter/exec+/bin/sh" nil "S")
3496: ("deny/stat+/x" nil "S") ("panic/create+/x" nil "S") ("stop/delete+/x" nil "S")
3497: ("abort/rename+/x" nil "S") ("kill/chmod+/x" nil "S") ("exit/chown+/x" nil "S")
3498: ("allow/readlink+/etc" nil "S") ("allow/mkbdev+/dev/x" nil "S") ("allow/mkcdev+/dev/x" nil "S")
3499: ("allow/all-l+/x" nil "S") ("allow/all-n+/x" nil "S") ("allow/all-x+/x" nil "S")
3500: ("allow/all-lnx,lpath+/x" nil "S") ("allow/all-nx+/x" nil "S")
3501: ("allow/all-lx+/x" nil "S") ("allow/all-ln+/x" nil "S")
3502: ("allow/read,write+/x" nil "S")
3503: ("allow/net/bind+1.2.3.4!80" nil "C" "S") ("allow/net/connect+127.0.0.1!443" nil "C" "S")
3504: ("allow/net+1.2.3.4!22" nil "C" "S") ("allow/net/bind+any!80" nil nil "S")
3505: ("allow/inet+loopback" nil nil "S")
3506: ("allow/net/connect+tcp!127.0.0.1!80" nil "T" "S")
3507: ("allow/net/connect+tcp!127.0.0.1!80" nil "C" "S")
3508: ("allow/net/connect+udp!9.9.9.9!53" nil "N" "S")
3509: ("allow/net/bind+tcp6!::1!8080" nil "T" "S")
3510: ("allow/net/connect+net!10.0.0.0/8!22,80,443" nil "N" "S")
3511: ("allow/net/connect+udp!loopback!*" nil "T" "S")
3512: ("allow/net/connect+tcp!*!443" nil "T" "S")
3513: ("allow/net/connect+unix!/run/foo.sock" nil "T")
3514: ("allow/net/bind+unix!@dbus-*" nil "T")
3515: ("allow/net/bind+unixgram!@dbus-*" nil "T")
3516: ("allow/sendfd+!file" nil "T")
3517: ("allow/sendfd+!memfd:*" nil "T")
3518: ("allow/recvfd+!eventpoll" nil "T")
3519: ("deny/passfd+!unknown" nil "T")
3520: ("allow/create+!eventpoll" nil "T" "S")
3521: ("allow/create,passfd+!eventpoll" nil "T" "S")
3522: ("deny/create+!eventfd" nil "T" "S")
3523: ("allow/create+!signalfd" nil "T" "S")
3524: ("allow/create+!timerfd" nil "T" "S")
3525: ("allow/create+!inotify" nil "T" "S")
3526: ("allow/create+!fanotify" nil "T" "S")
3527: ("allow/create+!secretmem" nil "T" "S")
3528: ("allow/create+!pipe" nil "T" "S")
3529: ("allow/create+!memfd:x" nil "T" "S")
3530: ("deny/create+!notification_pipe" nil "T" "S")
3531: ("allow/sendfd+!dir" nil "T")
3532: ("allow/sendfd+!socket" nil "T")
3533: ("allow/recvfd+!fifo" nil "T")
3534: ("allow/recvfd+!symlink" nil "T")
3535: ("allow/passfd+!magiclink" nil "T")
3536: ("deny/sendfd+!bdev" nil "T")
3537: ("deny/recvfd+!cdev" nil "T")
3538: ("allow/sendfd,recvfd+!nsfs" nil "T")
3539: ("deny/passfd+!pidfd" nil "T")
3540: ("allow/recvfd+!io_uring" nil "T")
3541: ("allow/all+!bpf-map" nil "T")
3542: ("allow/recvfd+!i915.gem" nil "T")
3543: ("allow/sendfd+!seccomp notify" nil "T")
3544: ("allow/sendfd+!bpf-*" nil "T")
3545: ("allow/sendfd+!memfd:/foo*" nil "T")
3546: ("allow/sendfd+!memfd-hugetlb:*" nil "T")
3547: ("allow/sendfd+!notification_pipe" nil "T")
3548: ("allow/passfd+!all" nil "T")
3549: ("allow/passfd+!*" nil "T")
3550: ("allow/sendfd+!/dev/null" nil "T" "S")
3551: ("allow/net/connect+unix!!unnamed" nil "T")
3552: ("allow/net/connect+tcp!${ADDR}!${PORT}" nil "T")
3553: ("allow/net/connect+tcp!127.0.0.1!${PORT}" nil "T")
3554: ("allow/net/connect+${ADDR}!${PORT}" nil)
3555: ("allow/net/connect+${ADDR}@${PORT}" nil)
3556: ("allow/net/link+route" nil "P") ("allow/net/link+inet_diag" nil "P")
3557: ("allow/lock/read+/etc" nil "S") ("allow/lock/mkbdev+/dev" nil "S")
3558: ("allow/lock/connect+22" nil "N") ("allow/lock/bind+80" nil "N")
3559: ("include /etc/foo.syd-3" nil) ("include_profile linux" nil)
3560: ("domain+@web" nil "T") ("domain+@web:@default" nil "S") ("domain+@sandbox:fs" nil "S")
3561: ("domain+@jail:/etc/jail.syd-3" nil "S") ("domain+@mynet2" nil "T")
3562: ("domain-@web" nil "T") ("domain^" nil)
3563: ("domain+@a" nil "T") ("domain+@WebDomain" nil "T") ("domain+@a_b_2" nil "T")
3564: ("domain+@aaaaaaaaaaaaaaaa" nil "T") ("domain+@${DOM}" nil "T")
3565: ("domain+@web:${SEED}" nil "T") ("domain+@web:@my_other" nil "S")
3566: ("domain+@1web" t) ("domain+@_web" t) ("domain+@my-net" t) ("domain+@my.net" t)
3567: ("domain+@web!" t) ("domain+@web/x" t) ("domain+@aaaaaaaaaaaaaaaaa" t)
3568: ("domain+@web:@bad-seed" t) ("domain+@web:@1bad" t) ("domain-@my-net" t)
3569: ("move/@my-net/exec+/x" t) ("move/@1net/exec+/x" t)
3570: ("move/@aaaaaaaaaaaaaaaaa/exec+/x" t)
3571: ("@my-net/allow/read+/etc" t) ("@1web/sandbox/exec:on" t)
3572: ("cmd/move!my-net" t) ("cmd/move!@my-net" t) ("cmd/move!1web" t)
3573: ("move/@net/exec+/usr/bin/curl" nil "S") ("move/@net/exec+/usr/bin/curl" nil "T")
3574: ("move/@net/exec-/usr/bin/curl" nil "S") ("move/@net/exec^" nil "T")
3575: ("move/@net/mmap+/usr/lib/**.so" nil "S") ("move/@net/chdir+/srv" nil "S")
3576: ("move/@net/exit+/usr/bin/helper" nil "S")
3577: ("move/@mynet/bind+0.0.0.0/0!8080" nil "C") ("move/@net/bind+0.0.0.0/0!8080" nil "N")
3578: ("move/@net/connect+127.0.0.1!443" nil "C") ("move/@net/accept+0.0.0.0/0!1-65535" nil "N")
3579: ("move/@net/bind^" nil "T")
3580: ("move/@net/bind+/run/app.sock" nil "S") ("move/@net/connect+/run/db.sock" nil "S")
3581: ("move/@net/bind+@my.service" nil "S") ("move/@net/connect+@dbus-*" nil "S")
3582: ("move/@net/bind+!unnamed" nil "S")
3583: ("move/@db/connect+tcp!10.0.0.7!5432" nil "T")
3584: ("move/@db/connect+tcp!10.0.0.7!5432" nil "C")
3585: ("move/@db/connect+udp!127.0.0.1!53" nil "N")
3586: ("move/@net/bind+unix!/run/app.sock" nil "T")
3587: ("move/@net/bind+unix!@my.service" nil "T")
3588: ("move/@net/bind+unix!!unknown" nil "T")
3589: ("move/@net/bind+unix!!unnamed" nil "T")
3590: ("move/@db/connect+tcp!${ADDR}!${PORT}" nil "T")
3591: ("cmd/move!web" nil "T") ("cmd/move!@web" nil "T")
3592: ("@web/allow/read+/etc/hosts" nil "T") ("@web/allow/read+/etc/hosts" nil "S")
3593: ("@web/allow/net/bind+1.2.3.4!80" nil "C") ("@web/default/read:allow" nil "P")
3594: ("@web/mem/max:1G" nil "N") ("@web/mem/kill:1" nil "B")
3595: ("@web/segvguard/maxcrashes:3" nil "N") ("@web/uts/host:myhost" nil "S")
3596: ("@web/tpe/gid:1000" nil "N")
3597: ("@db/move/@net/connect+0.0.0.0/0!5432" nil "C") ("@db/move/@net/connect+0.0.0.0/0!5432" nil "N")
3598: ("@web/sandbox/exec:on" nil "B") ("@web/sandbox/lock:off" nil "B") ("@web/sandbox/all:on" nil "B")
3599: ("@web/sandbox/all-l:on" nil "B") ("@web/sandbox/all-n:off" nil "B")
3600: ("@web/sandbox/all-x:on" nil "B") ("@web/sandbox/all-nx:on" nil "B")
3601: ("@web/sandbox/mem:on" nil "B")
3602: ("@web/sandbox/readlink:on" nil "B") ("@web/sandbox/lock?" nil)
3603: ("domain+web" t) ("domain+@" t) ("domain^junk" t) ("move/foo+/x" t) ("move//exec+/x" t)
3604: ("move/@net/bogus+/x" t) ("move/@net/EXEC+/x" t) ("move/@net/exec" t)
3605: ("move/@net/exec^junk" t) ("move/@net/exec+" t) ("cmd/move!" t)
3606: ("@web/domain+@x" t) ("@web/totallyunknown:x" t)
3607: ("@web/lock:on" t) ("@web/timeout:5" t) ("@web/rlimit/nofile:1024" t) ("@web/proxy/port:8080" t)
3608: ("@web/pty/row:80" t) ("@web/ipc/uid:0" t) ("@web/unshare/mount:on" t) ("@web/root:/x" t)
3609: ("@web/workdir:/x" t) ("@web/log/level:debug" t)
3610: ("@web/setenv!FOO=bar" t) ("@web/setuid+1000:2000" t) ("@web/bind+/a:/b" t)
3611: ("@web/link+/a:/b" t) ("@web/mkdir+/d:0755" t) ("@web/allow/lock/read+/x" t)
3612: ("@web/allow/net/link+route" t) ("@web/trace/allow_unsafe_ptrace:1" t)
3613: ("@web/sandbox/lock:on" t) ("@web/sandbox/proxy:on" t)
3614: ("@web/sandbox/pty:true" t) ("@web/sandbox/exec,lock:on" t)
3615: ("totallyunknown:x" t) ("bogusdirective" t) ("sandbox/reaD:on" t) ("sandbox/mkdev:on" t)
3616: ("sandbox/bogus:on" t) ("default/boguscap:deny" t) ("default/mkdev:deny" t)
3617: ("unshare/bogus:on" t) ("uts/bogus:x" t) ("root/bogus:on" t) ("ipc/bogus:1" t)
3618: ("log/bogus:1" t) ("log/lock/bogus:1" t) ("mem/bogus:1" t) ("pid/bogus:1" t)
3619: ("tpe/bogus:on" t) ("segvguard/bogus:1" t) ("proxy/bogus:1" t) ("proxy/ext/bogus:1" t)
3620: ("trace/allow_unsafe_bogus:on" t) ("trace/bogus:on" t)
3621: ("time/bogus:1" t) ("warn/ioctl+foo" t) ("allow/bogus+/x" t) ("allow/net/accept+any" t)
3622: ("allow/net/bogus+any" t) ("allow/lock/bogus+/x" t) ("pty/bogus:1" t)
3623: ("config/bogus:1" t) ("mkbogus+/x" t))
3624: "Syntax-highlighting test cases for `syd-3-mode'.
3625: Each entry is (LINE EXPECT-ERROR [VALUE-CLASS [FORBIDDEN-CLASS]]).")
3626:
3627: (defun syd-3-syntax-test ()
3628: "Run the `syd-3-mode' highlighting suite, report TAP, then exit."
3629: (let ((out (list "TAP version 13"
3630: (format "1..%d" (length syd-3--syntax-cases))))
3631: (count 0)
3632: (failures 0))
3633: (dolist (case syd-3--syntax-cases)
3634: (setq count (1+ count))
3635: (let* ((line (nth 0 case))
3636: (want-error (nth 1 case))
3637: (want-class (nth 2 case))
3638: (forbid-class (nth 3 case))
3639: (result (syd-3--value-classes line))
3640: (have-error (car result))
3641: (have-classes (cdr result))
3642: (names '(("B" . "Boolean") ("N" . "Number") ("S" . "String")
3643: ("C" . "Constant") ("T" . "Type") ("P" . "Special")))
3644: (full (lambda (code) (or (cdr (assoc code names)) code)))
3645: (actual (if have-classes
3646: (mapconcat full
3647: (sort (copy-sequence have-classes) #'string<) ",")
3648: "-"))
3649: (reasons '()))
3650: (when (and want-error (not have-error))
3651: (push '("error" . "ok") reasons))
3652: (when (and (not want-error) have-error)
3653: (push '("ok" . "error") reasons))
3654: (when (and want-class (not (member want-class have-classes)))
3655: (push (cons (funcall full want-class) actual) reasons))
3656: (when (and forbid-class (member forbid-class have-classes))
3657: (push (cons (concat "not " (funcall full forbid-class)) actual) reasons))
3658: (if (null reasons)
3659: (push (format "ok %d - %s" count line) out)
3660: (setq failures (1+ failures))
3661: (push (format "not ok %d - %s" count line) out)
3662: (dolist (r reasons)
3663: (push (format "# expected: %s" (car r)) out)
3664: (push (format "# actual: %s" (cdr r)) out)))))
3665: (push (format "# %d tests, %d failures" (length syd-3--syntax-cases) failures)
3666: out)
3667: (princ (mapconcat #'identity (nreverse out) "\n"))
3668: (princ "\n")
3669: (kill-emacs (if (zerop failures) 0 1))))
3670:
3671: (defun syd-el-main-test ()
3672: "Define and run the embedded ERT test suite for syd.el, then exit."
3673: (require 'ert)
3674: (eval
3675: '(progn
3676: (ert-deftest syd-el-api ()
3677: "API version query and liveness check."
3678: (should (eq (syd-api) 3))
3679: (should (syd-check)))
3680:
3681: (ert-deftest syd-el-stat-validation ()
3682: (should (syd--stat "/dev/null"))
3683: (should-not (syd--stat "/syd-el-no-such-path-xyzzy"))
3684: (let ((reg (make-temp-file "syd-el-")))
3685: (unwind-protect
3686: (should (syd--stat reg))
3687: (delete-file reg))
3688: (should-not (syd--stat reg))))
3689:
3690: (ert-deftest syd-el-toggle ()
3691: (dolist (cat '("fs" "walk" "read" "write" "exec"
3692: "create" "delete" "rename" "symlink" "truncate"
3693: "readdir" "mkdir" "rmdir" "chown" "chgrp" "chmod"
3694: "chattr" "chroot" "utime" "mkbdev" "mkcdev"
3695: "mkfifo" "mktemp" "net" "sendfd" "recvfd" "tpe"))
3696: (let ((enabled (intern (format "syd-enabled-%s" cat)))
3697: (enable (intern (format "syd-enable-%s" cat)))
3698: (disable (intern (format "syd-disable-%s" cat))))
3699: (let ((was (funcall enabled)))
3700: (should (funcall enable))
3701: (should (funcall enabled))
3702: (should (funcall disable))
3703: (should-not (funcall enabled))
3704: (if was (funcall enable) (funcall disable))
3705: (should (eq (and (funcall enabled) t) (and was t)))))))
3706:
3707: (ert-deftest syd-el-force-startup ()
3708: ; Force sandboxing is a compile time feature of Syd.
3709: (when (syd-have-force)
3710: (should (syd-enabled-force))
3711: (should (syd-disable-force)))
3712: (should-not (syd-enabled-force)))
3713:
3714: (ert-deftest syd-el-query ()
3715: (dolist (q '(syd-enabled-proxy syd-enabled-lock
3716: syd-enabled-mem))
3717: (should (memq (funcall q) '(t nil))))
3718: (should (syd-disable-mem))
3719: (should-not (syd-enabled-mem)))
3720:
3721: (ert-deftest syd-el-startup-only ()
3722: (dolist (cat '("chdir" "ioctl" "list" "notify" "readlink" "stat" "pid"))
3723: (let ((enabled (intern (format "syd-enabled-%s" cat)))
3724: (enable (intern (format "syd-enable-%s" cat)))
3725: (disable (intern (format "syd-disable-%s" cat))))
3726: (should-not (funcall enable))
3727: (should (funcall disable))
3728: (should-not (funcall enabled)))))
3729:
3730: (ert-deftest syd-el-default ()
3731: (dolist (act '(:action-allow :action-warn :action-filter :action-deny
3732: :action-panic :action-stop :action-abort :action-kill
3733: :action-exit))
3734: (should (syd-default-fs act)))
3735: (dolist (cap '("fs" "walk" "list" "stat" "read" "write" "exec"
3736: "ioctl" "create" "delete" "rename" "readlink"
3737: "symlink" "truncate" "chdir" "readdir" "mkdir"
3738: "rmdir" "chown" "chgrp" "chmod" "chattr" "chroot"
3739: "notify" "utime" "mkbdev" "mkcdev" "mkfifo" "mktemp"
3740: "net" "net-bind" "net-connect" "sendfd" "recvfd"
3741: "mem" "tpe" "segvguard"))
3742: (should (funcall (intern (format "syd-default-%s" cap))
3743: :action-deny)))
3744: (should (syd-default-pid :action-stop))
3745: (dolist (cap '("mem" "tpe" "segvguard"))
3746: (should-not (funcall (intern (format "syd-default-%s" cap))
3747: :action-allow)))
3748: ; Force sandboxing is a compile time feature of Syd.
3749: (when (syd-have-force)
3750: (should (syd-default-force :action-deny))
3751: (should-not (syd-default-force :action-allow))
3752: (should (syd-default-force :action-warn)))
3753: (should-not (syd-default-pid :action-deny))
3754: (should (syd-default-fs :action-deny)))
3755:
3756: (ert-deftest syd-el-feature-probes ()
3757: (should (memq (syd-have-force) '(nil t)))
3758: (should (integerp (syd-landlock-abi))))
3759:
3760: (ert-deftest syd-el-rules ()
3761: (should (syd-fs-add :action-deny "securityfs"))
3762: (should (syd-fs-del :action-deny "securityfs"))
3763: (should (syd-fs-rem :action-deny "securityfs"))
3764: (let ((glob "/tmp/syd-el-test"))
3765: (dolist (cap '("walk" "list" "stat" "read" "write" "exec"
3766: "create" "delete" "rename" "readlink" "symlink"
3767: "truncate" "chdir" "readdir" "mkdir" "rmdir"
3768: "chown" "chgrp" "chmod" "chattr" "chroot" "notify"
3769: "utime" "mkbdev" "mkcdev" "mkfifo" "mktemp"))
3770: (let ((add (intern (format "syd-%s-add" cap)))
3771: (del (intern (format "syd-%s-del" cap)))
3772: (rem (intern (format "syd-%s-rem" cap))))
3773: (should (funcall add :action-deny glob))
3774: (should (funcall del :action-deny glob))
3775: (should (funcall rem :action-deny glob))))))
3776:
3777: (ert-deftest syd-el-net-rules ()
3778: (dolist (spec '(("net-bind" . "127.0.0.1!8080")
3779: ("net-connect" . "::1!443")
3780: ("sendfd" . "!file")
3781: ("recvfd" . "!eventpoll")))
3782: (let* ((cap (car spec))
3783: (addr (cdr spec))
3784: (add (intern (format "syd-%s-add" cap)))
3785: (del (intern (format "syd-%s-del" cap)))
3786: (rem (intern (format "syd-%s-rem" cap))))
3787: (should (funcall add :action-allow addr))
3788: (should (funcall del :action-allow addr))
3789: (should (funcall rem :action-allow addr))))
3790: (should-not (syd-net-link-add :action-allow "route"))
3791: (should-not (syd-net-link-del :action-allow "route"))
3792: (should-not (syd-net-link-rem :action-allow "route")))
3793:
3794: (ert-deftest syd-el-limits ()
3795: (should (syd-mem-max "1G"))
3796: (should (syd-mem-max 1073741824))
3797: (should (syd-mem-vm-max "2G"))
3798: (should (syd-pid-max 4096))
3799: (let ((page (alist-get 'pipe_max (syd-info))))
3800: (should (syd-pipe-max page))
3801: (should (syd-pipe-max page))
3802: (should-not (syd-pipe-max (* 2 page))))
3803: (should (syd-xattr-max 4096))
3804: (should (syd-xattr-max 4096))
3805: (should-not (syd-xattr-max 65537)))
3806:
3807: (ert-deftest syd-el-segvguard ()
3808: (should (syd-segvguard-expiry 120))
3809: (should (syd-segvguard-suspension 300))
3810: (should (syd-segvguard-maxcrashes 5)))
3811:
3812: (ert-deftest syd-el-force-rule ()
3813: ; Force sandboxing is a compile time feature of Syd.
3814: (when (syd-have-force)
3815: (let ((hash (make-string 64 ?a)))
3816: (should (syd-force-add "/usr/bin/syd-el-test" "sha256" hash
3817: :action-deny))
3818: (should (syd-force-del "/usr/bin/syd-el-test"))
3819: (should (syd-force-clr)))))
3820:
3821: (ert-deftest syd-el-rule-helper ()
3822: (should (equal (syd--rule "fs" "/tmp/x" ?+) "/dev/syd/fs+/tmp/x"))
3823: (should (equal (syd--rule "allow/net/bind" "127.0.0.1!80" ?+)
3824: "/dev/syd/allow/net/bind+127.0.0.1!80"))
3825: (should (equal (syd--rule "fs" "/x" ?-) "/dev/syd/fs-/x"))
3826: (should (equal (syd--rule "fs" "/x" ?^) "/dev/syd/fs^/x"))
3827: (should (equal (syd--rule "fs" "/x" ?:) "/dev/syd/fs:/x"))
3828: (should-error (syd--rule "fs" "/x" ?z))
3829: (should-error (syd--rule "fs" "" ?+)))
3830:
3831: (ert-deftest syd-el-info ()
3832: (let ((info (syd-info)))
3833: (should (consp info))
3834: (should (stringp (cdr (assq 'default_fs info))))))
3835:
3836: (ert-deftest syd-el-ioctl ()
3837: (should (syd-ioctl-add :action-allow "FIONREAD"))
3838: (should (syd-ioctl-del :action-allow "FIONREAD"))
3839: (should (syd-ioctl-rem :action-allow "FIONREAD"))
3840: (should (syd-ioctl-deny #xDEADCA11))
3841: (should-error (syd-ioctl-deny "not-a-number")))
3842:
3843: (ert-deftest syd-el-exec ()
3844: (should-error (syd-exec 42 nil))
3845: (should-error (syd-exec "/bin/true" '("ok" 7)))
3846: (let ((true (if (file-executable-p "/bin/true")
3847: "/bin/true" "/usr/bin/true")))
3848: (should (syd-exec true nil))))
3849:
3850: (ert-deftest syd-el-load ()
3851: (should-not (syd-load 9999)))
3852:
3853: (ert-deftest syd-el-lock ()
3854: (should-not (syd-lock :lock-off))
3855: (should (syd-lock :lock-exec))
3856: (should (syd-lock :lock-drop))
3857: (should (syd-lock :lock-on))
3858: (dolist (st '(:lock-off :lock-exec :lock-drop :lock-read :lock-on))
3859: (should-not (syd-lock st)))
3860: (should-not (syd-lock :lock-bogus))))
3861: t)
3862: (let ((tests '(syd-el-rule-helper
3863: syd-el-api
3864: syd-el-info
3865: syd-el-stat-validation
3866: syd-el-toggle
3867: syd-el-startup-only
3868: syd-el-force-startup
3869: syd-el-query
3870: syd-el-feature-probes
3871: syd-el-default
3872: syd-el-rules
3873: syd-el-net-rules
3874: syd-el-ioctl
3875: syd-el-limits
3876: syd-el-segvguard
3877: syd-el-force-rule
3878: syd-el-exec
3879: syd-el-load
3880: syd-el-lock))
3881: (count 0)
3882: (failures 0))
3883: (princ "TAP version 13\n")
3884: (princ (format "1..%d\n" (length tests)))
3885: (dolist (name tests)
3886: (setq count (1+ count))
3887: (let* ((result (ert-run-test (ert-get-test name)))
3888: (passed (ert-test-passed-p result)))
3889: (if passed
3890: (princ (format "ok %d - %s\n" count name))
3891: (setq failures (1+ failures))
3892: (princ (format "not ok %d - %s\n" count name))
3893: (let ((condition
3894: (ignore-errors
3895: (ert-test-result-with-condition-condition result))))
3896: (when condition
3897: (dolist (line (split-string (format "%S" condition) "\n" t))
3898: (princ (format "# %s\n" line))))))))
3899: (princ (format "# %d tests, %d failures\n" (length tests) failures))
3900: (kill-emacs (if (zerop failures) 0 1))))
3901:
3902: (provide 'syd)
3903: ; syd.el ends here
3904:
31/08/2026 20:14:43, src/syd.el, Ali Polatel