1: ; syd.el --- Emacs Lisp binding for the syd(2) API -*- lexical-binding: t -*-
2:
3: ; Syd: rock-solid application kernel
4: ;
5: ; Copyright (c) 2023, 2024, 2025, 2026 Ali Polatel <alip@chesswob.org>
6: ;
7: ; Author: Ali Polatel <alip@chesswob.org>
8: ; SPDX-License-Identifier: GPL-3.0
9:
10: ; Commentary:
11:
12: ; This is the Emacs Lisp implementation of the virtual syd(2) stat
13: ; interface. A sandboxed process configures and queries the Syd
14: ; application kernel by issuing stat(2) calls on magic paths under
15: ; /dev/syd. Syd answers each with a character-special device. Every
16: ; public function here builds such a magic path and validates the
17: ; response with `syd--stat'.
18:
19: ; Code:
20:
21: ; Define lock states as keywords
22: (defconst syd-lock-off :lock-off
23: "The sandbox lock is off, allowing all sandbox commands.")
24:
25: (defconst syd-lock-exec :lock-exec
26: "Sandbox commands are allowed only from the syd exec child (the default).")
27:
28: (defconst syd-lock-drop :lock-drop
29: "Sandbox commands are allowed only to drop privileges.")
30:
31: (defconst syd-lock-read :lock-read
32: "Sandbox commands are allowed only to read sandbox state.")
33:
34: (defconst syd-lock-on :lock-on
35: "The sandbox lock is on, disallowing all sandbox commands.")
36:
37: ; Define sandbox actions as keywords
38: (defconst syd-action-allow :action-allow
39: "Allow system call.")
40:
41: (defconst syd-action-warn :action-warn
42: "Allow system call and warn.")
43:
44: (defconst syd-action-filter :action-filter
45: "Deny system call silently.")
46:
47: (defconst syd-action-deny :action-deny
48: "Deny system call and warn.")
49:
50: (defconst syd-action-panic :action-panic
51: "Deny system call, warn and panic the current Syd thread.")
52:
53: (defconst syd-action-stop :action-stop
54: "Deny system call, warn and stop offending process.")
55:
56: (defconst syd-action-abort :action-abort
57: "Deny system call, warn and abort offending process.")
58:
59: (defconst syd-action-kill :action-kill
60: "Deny system call, warn and kill offending process.")
61:
62: (defconst syd-action-exit :action-exit
63: "Warn, and exit Syd immediately with deny errno as exit value.")
64:
65: (defun syd-info ()
66: "Read the state of the syd sandbox from /dev/syd and return it as an alist.
67: If the `json' module is not available, returns nil."
68: (if (require 'json nil t)
69: (condition-case nil
70: (with-temp-buffer
71: (insert-file-contents "/dev/syd" nil nil (* 16 1024 1024))
72: (with-no-warnings
73: (let ((json-object-type 'alist)
74: (json-array-type 'list)
75: (json-key-type 'symbol)
76: (json-false nil)
77: (json-null nil))
78: (json-read))))
79: (file-error
80: (message "Error reading /dev/syd.")
81: nil)
82: (json-error
83: (message "JSON decoding error.")
84: nil))
85: (progn
86: (message "JSON module not available.")
87: nil)))
88:
89: (defun syd-api ()
90: "Perform a syd API check."
91: (if (syd--stat "/dev/syd/3")
92: 3 ; API number on success
93: nil)) ; On error, return nil
94:
95: (defun syd-check ()
96: "Check if '/dev/syd' is a character device."
97: (syd--stat "/dev/syd"))
98:
99: (defun syd-panic ()
100: "Cause syd to exit immediately with code 127."
101: (syd--stat "/dev/syd/panic"))
102:
103: (defun syd-ghost ()
104: "Initiate Ghost mode."
105: (syd--stat "/dev/syd/ghost"))
106:
107: (defun syd-load (fd)
108: "Cause syd to read configuration from the given file descriptor FD."
109: (let ((path (concat "/dev/syd/load/" (number-to-string fd))))
110: (syd--stat path)))
111:
112: (defun syd-lock (state)
113: "Set the sandbox lock to STATE.
114: STATE is one of the keywords `:lock-off', `:lock-exec', `:lock-drop',
115: `:lock-read' or `:lock-on'.
116: Return t on success, nil on failure."
117: (cond
118: ((eq state syd-lock-off) (syd--stat "/dev/syd/lock:off"))
119: ((eq state syd-lock-exec) (syd--stat "/dev/syd/lock:exec"))
120: ((eq state syd-lock-drop) (syd--stat "/dev/syd/lock:drop"))
121: ((eq state syd-lock-read) (syd--stat "/dev/syd/lock:read"))
122: ((eq state syd-lock-on) (syd--stat "/dev/syd/lock:on"))
123: (t nil))) ; Invalid state
124:
125: (defun syd-enabled-fs ()
126: "Check whether Filesystem sandboxing is enabled."
127: (syd--stat "/dev/syd/sandbox/fs?"))
128:
129: (defun syd-enable-fs ()
130: "Enable Filesystem sandboxing."
131: (syd--stat "/dev/syd/sandbox/fs:on"))
132:
133: (defun syd-disable-fs ()
134: "Disable Filesystem sandboxing."
135: (syd--stat "/dev/syd/sandbox/fs:off"))
136:
137: (defun syd-enabled-walk ()
138: "Check whether Walk sandboxing is enabled."
139: (syd--stat "/dev/syd/sandbox/walk?"))
140:
141: (defun syd-enable-walk ()
142: "Enable Walk sandboxing."
143: (syd--stat "/dev/syd/sandbox/walk:on"))
144:
145: (defun syd-disable-walk ()
146: "Disable Walk sandboxing."
147: (syd--stat "/dev/syd/sandbox/walk:off"))
148:
149: (defun syd-enabled-list ()
150: "Check whether List sandboxing is enabled."
151: (syd--stat "/dev/syd/sandbox/list?"))
152:
153: (defun syd-enable-list ()
154: "Enable List sandboxing."
155: (syd--stat "/dev/syd/sandbox/list:on"))
156:
157: (defun syd-disable-list ()
158: "Disable List sandboxing."
159: (syd--stat "/dev/syd/sandbox/list:off"))
160:
161: (defun syd-enabled-stat ()
162: "Check whether Stat sandboxing is enabled."
163: (syd--stat "/dev/syd/sandbox/stat?"))
164:
165: (defun syd-enable-stat ()
166: "Enable Stat sandboxing."
167: (syd--stat "/dev/syd/sandbox/stat:on"))
168:
169: (defun syd-disable-stat ()
170: "Disable Stat sandboxing."
171: (syd--stat "/dev/syd/sandbox/stat:off"))
172:
173: (defun syd-enabled-read ()
174: "Check whether Read sandboxing is enabled."
175: (syd--stat "/dev/syd/sandbox/read?"))
176:
177: (defun syd-enable-read ()
178: "Enable Read sandboxing."
179: (syd--stat "/dev/syd/sandbox/read:on"))
180:
181: (defun syd-disable-read ()
182: "Disable Read sandboxing."
183: (syd--stat "/dev/syd/sandbox/read:off"))
184:
185: (defun syd-enabled-write ()
186: "Check whether Write sandboxing is enabled."
187: (syd--stat "/dev/syd/sandbox/write?"))
188:
189: (defun syd-enable-write ()
190: "Enable Write sandboxing."
191: (syd--stat "/dev/syd/sandbox/write:on"))
192:
193: (defun syd-disable-write ()
194: "Disable Write sandboxing."
195: (syd--stat "/dev/syd/sandbox/write:off"))
196:
197: (defun syd-enabled-exec ()
198: "Check whether Exec sandboxing is enabled."
199: (syd--stat "/dev/syd/sandbox/exec?"))
200:
201: (defun syd-enable-exec ()
202: "Enable Exec sandboxing."
203: (syd--stat "/dev/syd/sandbox/exec:on"))
204:
205: (defun syd-disable-exec ()
206: "Disable Exec sandboxing."
207: (syd--stat "/dev/syd/sandbox/exec:off"))
208:
209: (defun syd-enabled-ioctl ()
210: "Check whether Ioctl sandboxing is enabled."
211: (syd--stat "/dev/syd/sandbox/ioctl?"))
212:
213: (defun syd-enable-ioctl ()
214: "Enable Ioctl sandboxing."
215: (syd--stat "/dev/syd/sandbox/ioctl:on"))
216:
217: (defun syd-disable-ioctl ()
218: "Disable Ioctl sandboxing."
219: (syd--stat "/dev/syd/sandbox/ioctl:off"))
220:
221: (defun syd-enabled-create ()
222: "Check whether create sandboxing is enabled."
223: (syd--stat "/dev/syd/sandbox/create?"))
224:
225: (defun syd-enable-create ()
226: "Enable create sandboxing."
227: (syd--stat "/dev/syd/sandbox/create:on"))
228:
229: (defun syd-disable-create ()
230: "Disable create sandboxing."
231: (syd--stat "/dev/syd/sandbox/create:off"))
232:
233: (defun syd-enabled-delete ()
234: "Check whether delete sandboxing is enabled."
235: (syd--stat "/dev/syd/sandbox/delete?"))
236:
237: (defun syd-enable-delete ()
238: "Enable delete sandboxing."
239: (syd--stat "/dev/syd/sandbox/delete:on"))
240:
241: (defun syd-disable-delete ()
242: "Disable delete sandboxing."
243: (syd--stat "/dev/syd/sandbox/delete:off"))
244:
245: (defun syd-enabled-rename ()
246: "Check whether rename sandboxing is enabled."
247: (syd--stat "/dev/syd/sandbox/rename?"))
248:
249: (defun syd-enable-rename ()
250: "Enable rename sandboxing."
251: (syd--stat "/dev/syd/sandbox/rename:on"))
252:
253: (defun syd-disable-rename ()
254: "Disable rename sandboxing."
255: (syd--stat "/dev/syd/sandbox/rename:off"))
256:
257: (defun syd-enabled-readlink ()
258: "Check whether readlink sandboxing is enabled."
259: (syd--stat "/dev/syd/sandbox/readlink?"))
260:
261: (defun syd-enable-readlink ()
262: "Enable readlink sandboxing."
263: (syd--stat "/dev/syd/sandbox/readlink:on"))
264:
265: (defun syd-disable-readlink ()
266: "Disable readlink sandboxing."
267: (syd--stat "/dev/syd/sandbox/readlink:off"))
268:
269: (defun syd-enabled-symlink ()
270: "Check whether symlink sandboxing is enabled."
271: (syd--stat "/dev/syd/sandbox/symlink?"))
272:
273: (defun syd-enable-symlink ()
274: "Enable symlink sandboxing."
275: (syd--stat "/dev/syd/sandbox/symlink:on"))
276:
277: (defun syd-disable-symlink ()
278: "Disable symlink sandboxing."
279: (syd--stat "/dev/syd/sandbox/symlink:off"))
280:
281: (defun syd-enabled-truncate ()
282: "Check whether Truncate sandboxing is enabled."
283: (syd--stat "/dev/syd/sandbox/truncate?"))
284:
285: (defun syd-enable-truncate ()
286: "Enable Truncate sandboxing."
287: (syd--stat "/dev/syd/sandbox/truncate:on"))
288:
289: (defun syd-disable-truncate ()
290: "Disable Truncate sandboxing."
291: (syd--stat "/dev/syd/sandbox/truncate:off"))
292:
293: (defun syd-enabled-chdir ()
294: "Check whether chdir sandboxing is enabled."
295: (syd--stat "/dev/syd/sandbox/chdir?"))
296:
297: (defun syd-enable-chdir ()
298: "Enable chdir sandboxing."
299: (syd--stat "/dev/syd/sandbox/chdir:on"))
300:
301: (defun syd-disable-chdir ()
302: "Disable chdir sandboxing."
303: (syd--stat "/dev/syd/sandbox/chdir:off"))
304:
305: (defun syd-enabled-readdir ()
306: "Check whether readdir sandboxing is enabled."
307: (syd--stat "/dev/syd/sandbox/readdir?"))
308:
309: (defun syd-enable-readdir ()
310: "Enable readdir sandboxing."
311: (syd--stat "/dev/syd/sandbox/readdir:on"))
312:
313: (defun syd-disable-readdir ()
314: "Disable readdir sandboxing."
315: (syd--stat "/dev/syd/sandbox/readdir:off"))
316:
317: (defun syd-enabled-mkdir ()
318: "Check whether mkdir sandboxing is enabled."
319: (syd--stat "/dev/syd/sandbox/mkdir?"))
320:
321: (defun syd-enable-mkdir ()
322: "Enable mkdir sandboxing."
323: (syd--stat "/dev/syd/sandbox/mkdir:on"))
324:
325: (defun syd-disable-mkdir ()
326: "Disable mkdir sandboxing."
327: (syd--stat "/dev/syd/sandbox/mkdir:off"))
328:
329: (defun syd-enabled-rmdir ()
330: "Check whether rmdir sandboxing is enabled."
331: (syd--stat "/dev/syd/sandbox/rmdir?"))
332:
333: (defun syd-enable-rmdir ()
334: "Enable rmdir sandboxing."
335: (syd--stat "/dev/syd/sandbox/rmdir:on"))
336:
337: (defun syd-disable-rmdir ()
338: "Disable rmdir sandboxing."
339: (syd--stat "/dev/syd/sandbox/rmdir:off"))
340:
341: (defun syd-enabled-chown ()
342: "Check whether chown sandboxing is enabled."
343: (syd--stat "/dev/syd/sandbox/chown?"))
344:
345: (defun syd-enable-chown ()
346: "Enable chown sandboxing."
347: (syd--stat "/dev/syd/sandbox/chown:on"))
348:
349: (defun syd-disable-chown ()
350: "Disable chown sandboxing."
351: (syd--stat "/dev/syd/sandbox/chown:off"))
352:
353: (defun syd-enabled-chgrp ()
354: "Check whether chgrp sandboxing is enabled."
355: (syd--stat "/dev/syd/sandbox/chgrp?"))
356:
357: (defun syd-enable-chgrp ()
358: "Enable chgrp sandboxing."
359: (syd--stat "/dev/syd/sandbox/chgrp:on"))
360:
361: (defun syd-disable-chgrp ()
362: "Disable chgrp sandboxing."
363: (syd--stat "/dev/syd/sandbox/chgrp:off"))
364:
365: (defun syd-enabled-chmod ()
366: "Check whether chmod sandboxing is enabled."
367: (syd--stat "/dev/syd/sandbox/chmod?"))
368:
369: (defun syd-enable-chmod ()
370: "Enable chmod sandboxing."
371: (syd--stat "/dev/syd/sandbox/chmod:on"))
372:
373: (defun syd-disable-chmod ()
374: "Disable chmod sandboxing."
375: (syd--stat "/dev/syd/sandbox/chmod:off"))
376:
377: (defun syd-enabled-chattr ()
378: "Check whether chattr sandboxing is enabled."
379: (syd--stat "/dev/syd/sandbox/chattr?"))
380:
381: (defun syd-enable-chattr ()
382: "Enable chattr sandboxing."
383: (syd--stat "/dev/syd/sandbox/chattr:on"))
384:
385: (defun syd-disable-chattr ()
386: "Disable chattr sandboxing."
387: (syd--stat "/dev/syd/sandbox/chattr:off"))
388:
389: (defun syd-enabled-chroot ()
390: "Check whether chroot sandboxing is enabled."
391: (syd--stat "/dev/syd/sandbox/chroot?"))
392:
393: (defun syd-enable-chroot ()
394: "Enable chroot sandboxing."
395: (syd--stat "/dev/syd/sandbox/chroot:on"))
396:
397: (defun syd-disable-chroot ()
398: "Disable chroot sandboxing."
399: (syd--stat "/dev/syd/sandbox/chroot:off"))
400:
401: (defun syd-enabled-notify ()
402: "Check whether notify sandboxing is enabled."
403: (syd--stat "/dev/syd/sandbox/notify?"))
404:
405: (defun syd-enable-notify ()
406: "Enable notify sandboxing."
407: (syd--stat "/dev/syd/sandbox/notify:on"))
408:
409: (defun syd-disable-notify ()
410: "Disable notify sandboxing."
411: (syd--stat "/dev/syd/sandbox/notify:off"))
412:
413: (defun syd-enabled-utime ()
414: "Check whether utime sandboxing is enabled."
415: (syd--stat "/dev/syd/sandbox/utime?"))
416:
417: (defun syd-enable-utime ()
418: "Enable utime sandboxing."
419: (syd--stat "/dev/syd/sandbox/utime:on"))
420:
421: (defun syd-disable-utime ()
422: "Disable utime sandboxing."
423: (syd--stat "/dev/syd/sandbox/utime:off"))
424:
425: (defun syd-enabled-mkbdev ()
426: "Check whether mkbdev sandboxing is enabled."
427: (syd--stat "/dev/syd/sandbox/mkbdev?"))
428:
429: (defun syd-enable-mkbdev ()
430: "Enable mkbdev sandboxing."
431: (syd--stat "/dev/syd/sandbox/mkbdev:on"))
432:
433: (defun syd-disable-mkbdev ()
434: "Disable mkbdev sandboxing."
435: (syd--stat "/dev/syd/sandbox/mkbdev:off"))
436:
437: (defun syd-enabled-mkcdev ()
438: "Check whether mkcdev sandboxing is enabled."
439: (syd--stat "/dev/syd/sandbox/mkcdev?"))
440:
441: (defun syd-enable-mkcdev ()
442: "Enable mkcdev sandboxing."
443: (syd--stat "/dev/syd/sandbox/mkcdev:on"))
444:
445: (defun syd-disable-mkcdev ()
446: "Disable mkcdev sandboxing."
447: (syd--stat "/dev/syd/sandbox/mkcdev:off"))
448:
449: (defun syd-enabled-mkfifo ()
450: "Check whether mkfifo sandboxing is enabled."
451: (syd--stat "/dev/syd/sandbox/mkfifo?"))
452:
453: (defun syd-enable-mkfifo ()
454: "Enable mkfifo sandboxing."
455: (syd--stat "/dev/syd/sandbox/mkfifo:on"))
456:
457: (defun syd-disable-mkfifo ()
458: "Disable mkfifo sandboxing."
459: (syd--stat "/dev/syd/sandbox/mkfifo:off"))
460:
461: (defun syd-enabled-mktemp ()
462: "Check whether mktemp sandboxing is enabled."
463: (syd--stat "/dev/syd/sandbox/mktemp?"))
464:
465: (defun syd-enable-mktemp ()
466: "Enable mktemp sandboxing."
467: (syd--stat "/dev/syd/sandbox/mktemp:on"))
468:
469: (defun syd-disable-mktemp ()
470: "Disable mktemp sandboxing."
471: (syd--stat "/dev/syd/sandbox/mktemp:off"))
472:
473: (defun syd-enabled-net ()
474: "Check whether Network sandboxing is enabled."
475: (syd--stat "/dev/syd/sandbox/net?"))
476:
477: (defun syd-enable-net ()
478: "Enable Network sandboxing."
479: (syd--stat "/dev/syd/sandbox/net:on"))
480:
481: (defun syd-disable-net ()
482: "Disable Network sandboxing."
483: (syd--stat "/dev/syd/sandbox/net:off"))
484:
485: (defun syd-enabled-lock ()
486: "Check whether lock sandboxing is enabled."
487: (syd--stat "/dev/syd/sandbox/lock?"))
488:
489: (defun syd-enabled-proxy ()
490: "Check whether proxy sandboxing is enabled."
491: (syd--stat "/dev/syd/sandbox/proxy?"))
492:
493: (defun syd-enabled-mem ()
494: "Check whether memory sandboxing is enabled."
495: (syd--stat "/dev/syd/sandbox/mem?"))
496:
497: (defun syd-disable-mem ()
498: "Disable memory sandboxing."
499: (syd--stat "/dev/syd/sandbox/mem:off"))
500:
501: (defun syd-enabled-pid ()
502: "Check whether PID sandboxing is enabled."
503: (syd--stat "/dev/syd/sandbox/pid?"))
504:
505: (defun syd-enable-pid ()
506: "Enable PID sandboxing."
507: (syd--stat "/dev/syd/sandbox/pid:on"))
508:
509: (defun syd-disable-pid ()
510: "Disable PID sandboxing."
511: (syd--stat "/dev/syd/sandbox/pid:off"))
512:
513: (defun syd-enabled-force ()
514: "Check whether force sandboxing is enabled."
515: (syd--stat "/dev/syd/sandbox/force?"))
516:
517: (defun syd-disable-force ()
518: "Disable force sandboxing."
519: (syd--stat "/dev/syd/sandbox/force:off"))
520:
521: (defun syd-enabled-tpe ()
522: "Check whether TPE sandboxing is enabled."
523: (syd--stat "/dev/syd/sandbox/tpe?"))
524:
525: (defun syd-enable-tpe ()
526: "Enable TPE sandboxing."
527: (syd--stat "/dev/syd/sandbox/tpe:on"))
528:
529: (defun syd-disable-tpe ()
530: "Disable TPE sandboxing."
531: (syd--stat "/dev/syd/sandbox/tpe:off"))
532:
533: (defun syd-default-fs (action)
534: "Set default action for Filesystem sandboxing.
535: ACTION is a constant representing the sandboxing action."
536: (let ((action (cond
537: ((eq action :action-allow) "allow")
538: ((eq action :action-warn) "warn")
539: ((eq action :action-filter) "filter")
540: ((eq action :action-deny) "deny")
541: ((eq action :action-panic) "panic")
542: ((eq action :action-stop) "stop")
543: ((eq action :action-abort) "abort")
544: ((eq action :action-kill) "kill")
545: ((eq action :action-exit) "exit"))))
546: (when action
547: (let ((cmd (format "/dev/syd/default/fs:%s" action)))
548: (syd--stat cmd)))))
549:
550: (defun syd-default-walk (action)
551: "Set default action for Walk sandboxing.
552: ACTION is a constant representing the sandboxing action."
553: (let ((action (cond
554: ((eq action :action-allow) "allow")
555: ((eq action :action-warn) "warn")
556: ((eq action :action-filter) "filter")
557: ((eq action :action-deny) "deny")
558: ((eq action :action-panic) "panic")
559: ((eq action :action-stop) "stop")
560: ((eq action :action-abort) "abort")
561: ((eq action :action-kill) "kill")
562: ((eq action :action-exit) "exit"))))
563: (when action
564: (let ((cmd (format "/dev/syd/default/walk:%s" action)))
565: (syd--stat cmd)))))
566:
567: (defun syd-default-list (action)
568: "Set default action for List sandboxing.
569: ACTION is a constant representing the sandboxing action."
570: (let ((action (cond
571: ((eq action :action-allow) "allow")
572: ((eq action :action-warn) "warn")
573: ((eq action :action-filter) "filter")
574: ((eq action :action-deny) "deny")
575: ((eq action :action-panic) "panic")
576: ((eq action :action-stop) "stop")
577: ((eq action :action-abort) "abort")
578: ((eq action :action-kill) "kill")
579: ((eq action :action-exit) "exit"))))
580: (when action
581: (let ((cmd (format "/dev/syd/default/list:%s" action)))
582: (syd--stat cmd)))))
583:
584: (defun syd-default-stat (action)
585: "Set default action for Stat sandboxing.
586: ACTION is a constant representing the sandboxing action."
587: (let ((action (cond
588: ((eq action :action-allow) "allow")
589: ((eq action :action-warn) "warn")
590: ((eq action :action-filter) "filter")
591: ((eq action :action-deny) "deny")
592: ((eq action :action-panic) "panic")
593: ((eq action :action-stop) "stop")
594: ((eq action :action-abort) "abort")
595: ((eq action :action-kill) "kill")
596: ((eq action :action-exit) "exit"))))
597: (when action
598: (let ((cmd (format "/dev/syd/default/stat:%s" action)))
599: (syd--stat cmd)))))
600:
601: (defun syd-default-read (action)
602: "Set default action for Read sandboxing.
603: ACTION is a constant representing the sandboxing action."
604: (let ((action (cond
605: ((eq action :action-allow) "allow")
606: ((eq action :action-warn) "warn")
607: ((eq action :action-filter) "filter")
608: ((eq action :action-deny) "deny")
609: ((eq action :action-panic) "panic")
610: ((eq action :action-stop) "stop")
611: ((eq action :action-abort) "abort")
612: ((eq action :action-kill) "kill")
613: ((eq action :action-exit) "exit"))))
614: (when action
615: (let ((cmd (format "/dev/syd/default/read:%s" action)))
616: (syd--stat cmd)))))
617:
618: (defun syd-default-write (action)
619: "Set default action for Write sandboxing.
620: ACTION is a constant representing the sandboxing action."
621: (let ((action (cond
622: ((eq action :action-allow) "allow")
623: ((eq action :action-warn) "warn")
624: ((eq action :action-filter) "filter")
625: ((eq action :action-deny) "deny")
626: ((eq action :action-panic) "panic")
627: ((eq action :action-stop) "stop")
628: ((eq action :action-abort) "abort")
629: ((eq action :action-kill) "kill")
630: ((eq action :action-exit) "exit"))))
631: (when action
632: (let ((cmd (format "/dev/syd/default/write:%s" action)))
633: (syd--stat cmd)))))
634:
635: (defun syd-default-exec (action)
636: "Set default action for Exec sandboxing.
637: ACTION is a constant representing the sandboxing action."
638: (let ((action (cond
639: ((eq action :action-allow) "allow")
640: ((eq action :action-warn) "warn")
641: ((eq action :action-filter) "filter")
642: ((eq action :action-deny) "deny")
643: ((eq action :action-panic) "panic")
644: ((eq action :action-stop) "stop")
645: ((eq action :action-abort) "abort")
646: ((eq action :action-kill) "kill")
647: ((eq action :action-exit) "exit"))))
648: (when action
649: (let ((cmd (format "/dev/syd/default/exec:%s" action)))
650: (syd--stat cmd)))))
651:
652: (defun syd-default-ioctl (action)
653: "Set default action for Ioctl sandboxing.
654: ACTION is a constant representing the sandboxing action."
655: (let ((action (cond
656: ((eq action :action-allow) "allow")
657: ((eq action :action-warn) "warn")
658: ((eq action :action-filter) "filter")
659: ((eq action :action-deny) "deny")
660: ((eq action :action-panic) "panic")
661: ((eq action :action-stop) "stop")
662: ((eq action :action-abort) "abort")
663: ((eq action :action-kill) "kill")
664: ((eq action :action-exit) "exit"))))
665: (when action
666: (let ((cmd (format "/dev/syd/default/ioctl:%s" action)))
667: (syd--stat cmd)))))
668:
669: (defun syd-default-create (action)
670: "Set default action for Create sandboxing.
671: ACTION is a constant representing the sandboxing action."
672: (let ((action (cond
673: ((eq action :action-allow) "allow")
674: ((eq action :action-warn) "warn")
675: ((eq action :action-filter) "filter")
676: ((eq action :action-deny) "deny")
677: ((eq action :action-panic) "panic")
678: ((eq action :action-stop) "stop")
679: ((eq action :action-abort) "abort")
680: ((eq action :action-kill) "kill")
681: ((eq action :action-exit) "exit"))))
682: (when action
683: (let ((cmd (format "/dev/syd/default/create:%s" action)))
684: (syd--stat cmd)))))
685:
686: (defun syd-default-delete (action)
687: "Set default action for Delete sandboxing.
688: ACTION is a constant representing the sandboxing action."
689: (let ((action (cond
690: ((eq action :action-allow) "allow")
691: ((eq action :action-warn) "warn")
692: ((eq action :action-filter) "filter")
693: ((eq action :action-deny) "deny")
694: ((eq action :action-panic) "panic")
695: ((eq action :action-stop) "stop")
696: ((eq action :action-abort) "abort")
697: ((eq action :action-kill) "kill")
698: ((eq action :action-exit) "exit"))))
699: (when action
700: (let ((cmd (format "/dev/syd/default/delete:%s" action)))
701: (syd--stat cmd)))))
702:
703: (defun syd-default-rename (action)
704: "Set default action for rename sandboxing.
705: ACTION is a constant representing the sandboxing action."
706: (let ((action (cond
707: ((eq action :action-allow) "allow")
708: ((eq action :action-warn) "warn")
709: ((eq action :action-filter) "filter")
710: ((eq action :action-deny) "deny")
711: ((eq action :action-panic) "panic")
712: ((eq action :action-stop) "stop")
713: ((eq action :action-abort) "abort")
714: ((eq action :action-kill) "kill")
715: ((eq action :action-exit) "exit"))))
716: (when action
717: (let ((cmd (format "/dev/syd/default/rename:%s" action)))
718: (syd--stat cmd)))))
719:
720: (defun syd-default-readlink (action)
721: "Set default action for readlink sandboxing.
722: ACTION is a constant representing the sandboxing action."
723: (let ((action (cond
724: ((eq action :action-allow) "allow")
725: ((eq action :action-warn) "warn")
726: ((eq action :action-filter) "filter")
727: ((eq action :action-deny) "deny")
728: ((eq action :action-panic) "panic")
729: ((eq action :action-stop) "stop")
730: ((eq action :action-abort) "abort")
731: ((eq action :action-kill) "kill")
732: ((eq action :action-exit) "exit"))))
733: (when action
734: (let ((cmd (format "/dev/syd/default/readlink:%s" action)))
735: (syd--stat cmd)))))
736:
737: (defun syd-default-symlink (action)
738: "Set default action for symlink sandboxing.
739: ACTION is a constant representing the sandboxing action."
740: (let ((action (cond
741: ((eq action :action-allow) "allow")
742: ((eq action :action-warn) "warn")
743: ((eq action :action-filter) "filter")
744: ((eq action :action-deny) "deny")
745: ((eq action :action-panic) "panic")
746: ((eq action :action-stop) "stop")
747: ((eq action :action-abort) "abort")
748: ((eq action :action-kill) "kill")
749: ((eq action :action-exit) "exit"))))
750: (when action
751: (let ((cmd (format "/dev/syd/default/symlink:%s" action)))
752: (syd--stat cmd)))))
753:
754: (defun syd-default-truncate (action)
755: "Set default action for Truncate sandboxing.
756: ACTION is a constant representing the sandboxing action."
757: (let ((action (cond
758: ((eq action :action-allow) "allow")
759: ((eq action :action-warn) "warn")
760: ((eq action :action-filter) "filter")
761: ((eq action :action-deny) "deny")
762: ((eq action :action-panic) "panic")
763: ((eq action :action-stop) "stop")
764: ((eq action :action-abort) "abort")
765: ((eq action :action-kill) "kill")
766: ((eq action :action-exit) "exit"))))
767: (when action
768: (let ((cmd (format "/dev/syd/default/truncate:%s" action)))
769: (syd--stat cmd)))))
770:
771: (defun syd-default-chdir (action)
772: "Set default action for chdir sandboxing.
773: ACTION is a constant representing the sandboxing action."
774: (let ((action (cond
775: ((eq action :action-allow) "allow")
776: ((eq action :action-warn) "warn")
777: ((eq action :action-filter) "filter")
778: ((eq action :action-deny) "deny")
779: ((eq action :action-panic) "panic")
780: ((eq action :action-stop) "stop")
781: ((eq action :action-abort) "abort")
782: ((eq action :action-kill) "kill")
783: ((eq action :action-exit) "exit"))))
784: (when action
785: (let ((cmd (format "/dev/syd/default/chdir:%s" action)))
786: (syd--stat cmd)))))
787:
788: (defun syd-default-readdir (action)
789: "Set default action for readdir sandboxing.
790: ACTION is a constant representing the sandboxing action."
791: (let ((action (cond
792: ((eq action :action-allow) "allow")
793: ((eq action :action-warn) "warn")
794: ((eq action :action-filter) "filter")
795: ((eq action :action-deny) "deny")
796: ((eq action :action-panic) "panic")
797: ((eq action :action-stop) "stop")
798: ((eq action :action-abort) "abort")
799: ((eq action :action-kill) "kill")
800: ((eq action :action-exit) "exit"))))
801: (when action
802: (let ((cmd (format "/dev/syd/default/readdir:%s" action)))
803: (syd--stat cmd)))))
804:
805: (defun syd-default-mkdir (action)
806: "Set default action for mkdir sandboxing.
807: ACTION is a constant representing the sandboxing action."
808: (let ((action (cond
809: ((eq action :action-allow) "allow")
810: ((eq action :action-warn) "warn")
811: ((eq action :action-filter) "filter")
812: ((eq action :action-deny) "deny")
813: ((eq action :action-panic) "panic")
814: ((eq action :action-stop) "stop")
815: ((eq action :action-abort) "abort")
816: ((eq action :action-kill) "kill")
817: ((eq action :action-exit) "exit"))))
818: (when action
819: (let ((cmd (format "/dev/syd/default/mkdir:%s" action)))
820: (syd--stat cmd)))))
821:
822: (defun syd-default-rmdir (action)
823: "Set default action for rmdir sandboxing.
824: ACTION is a constant representing the sandboxing action."
825: (let ((action (cond
826: ((eq action :action-allow) "allow")
827: ((eq action :action-warn) "warn")
828: ((eq action :action-filter) "filter")
829: ((eq action :action-deny) "deny")
830: ((eq action :action-panic) "panic")
831: ((eq action :action-stop) "stop")
832: ((eq action :action-abort) "abort")
833: ((eq action :action-kill) "kill")
834: ((eq action :action-exit) "exit"))))
835: (when action
836: (let ((cmd (format "/dev/syd/default/rmdir:%s" action)))
837: (syd--stat cmd)))))
838:
839: (defun syd-default-chown (action)
840: "Set default action for Chown sandboxing.
841: ACTION is a constant representing the sandboxing action."
842: (let ((action (cond
843: ((eq action :action-allow) "allow")
844: ((eq action :action-warn) "warn")
845: ((eq action :action-filter) "filter")
846: ((eq action :action-deny) "deny")
847: ((eq action :action-panic) "panic")
848: ((eq action :action-stop) "stop")
849: ((eq action :action-abort) "abort")
850: ((eq action :action-kill) "kill")
851: ((eq action :action-exit) "exit"))))
852: (when action
853: (let ((cmd (format "/dev/syd/default/chown:%s" action)))
854: (syd--stat cmd)))))
855:
856: (defun syd-default-chgrp (action)
857: "Set default action for Chgrp sandboxing.
858: ACTION is a constant representing the sandboxing action."
859: (let ((action (cond
860: ((eq action :action-allow) "allow")
861: ((eq action :action-warn) "warn")
862: ((eq action :action-filter) "filter")
863: ((eq action :action-deny) "deny")
864: ((eq action :action-panic) "panic")
865: ((eq action :action-stop) "stop")
866: ((eq action :action-abort) "abort")
867: ((eq action :action-kill) "kill")
868: ((eq action :action-exit) "exit"))))
869: (when action
870: (let ((cmd (format "/dev/syd/default/chgrp:%s" action)))
871: (syd--stat cmd)))))
872:
873: (defun syd-default-chmod (action)
874: "Set default action for chmod sandboxing.
875: ACTION is a constant representing the sandboxing action."
876: (let ((action (cond
877: ((eq action :action-allow) "allow")
878: ((eq action :action-warn) "warn")
879: ((eq action :action-filter) "filter")
880: ((eq action :action-deny) "deny")
881: ((eq action :action-panic) "panic")
882: ((eq action :action-stop) "stop")
883: ((eq action :action-abort) "abort")
884: ((eq action :action-kill) "kill")
885: ((eq action :action-exit) "exit"))))
886: (when action
887: (let ((cmd (format "/dev/syd/default/chmod:%s" action)))
888: (syd--stat cmd)))))
889:
890: (defun syd-default-chattr (action)
891: "Set default action for chattr sandboxing.
892: ACTION is a constant representing the sandboxing action."
893: (let ((action (cond
894: ((eq action :action-allow) "allow")
895: ((eq action :action-warn) "warn")
896: ((eq action :action-filter) "filter")
897: ((eq action :action-deny) "deny")
898: ((eq action :action-panic) "panic")
899: ((eq action :action-stop) "stop")
900: ((eq action :action-abort) "abort")
901: ((eq action :action-kill) "kill")
902: ((eq action :action-exit) "exit"))))
903: (when action
904: (let ((cmd (format "/dev/syd/default/chattr:%s" action)))
905: (syd--stat cmd)))))
906:
907: (defun syd-default-chroot (action)
908: "Set default action for chroot sandboxing.
909: ACTION is a constant representing the sandboxing action."
910: (let ((action (cond
911: ((eq action :action-allow) "allow")
912: ((eq action :action-warn) "warn")
913: ((eq action :action-filter) "filter")
914: ((eq action :action-deny) "deny")
915: ((eq action :action-panic) "panic")
916: ((eq action :action-stop) "stop")
917: ((eq action :action-abort) "abort")
918: ((eq action :action-kill) "kill")
919: ((eq action :action-exit) "exit"))))
920: (when action
921: (let ((cmd (format "/dev/syd/default/chroot:%s" action)))
922: (syd--stat cmd)))))
923:
924: (defun syd-default-notify (action)
925: "Set default action for notify sandboxing.
926: ACTION is a constant representing the sandboxing action."
927: (let ((action (cond
928: ((eq action :action-allow) "allow")
929: ((eq action :action-warn) "warn")
930: ((eq action :action-filter) "filter")
931: ((eq action :action-deny) "deny")
932: ((eq action :action-panic) "panic")
933: ((eq action :action-stop) "stop")
934: ((eq action :action-abort) "abort")
935: ((eq action :action-kill) "kill")
936: ((eq action :action-exit) "exit"))))
937: (when action
938: (let ((cmd (format "/dev/syd/default/notify:%s" action)))
939: (syd--stat cmd)))))
940:
941: (defun syd-default-utime (action)
942: "Set default action for utime sandboxing.
943: ACTION is a constant representing the sandboxing action."
944: (let ((action (cond
945: ((eq action :action-allow) "allow")
946: ((eq action :action-warn) "warn")
947: ((eq action :action-filter) "filter")
948: ((eq action :action-deny) "deny")
949: ((eq action :action-panic) "panic")
950: ((eq action :action-stop) "stop")
951: ((eq action :action-abort) "abort")
952: ((eq action :action-kill) "kill")
953: ((eq action :action-exit) "exit"))))
954: (when action
955: (let ((cmd (format "/dev/syd/default/utime:%s" action)))
956: (syd--stat cmd)))))
957:
958: (defun syd-default-mkbdev (action)
959: "Set default action for mkbdev sandboxing.
960: ACTION is a constant representing the sandboxing action."
961: (let ((action (cond
962: ((eq action :action-allow) "allow")
963: ((eq action :action-warn) "warn")
964: ((eq action :action-filter) "filter")
965: ((eq action :action-deny) "deny")
966: ((eq action :action-panic) "panic")
967: ((eq action :action-stop) "stop")
968: ((eq action :action-abort) "abort")
969: ((eq action :action-kill) "kill")
970: ((eq action :action-exit) "exit"))))
971: (when action
972: (let ((cmd (format "/dev/syd/default/mkbdev:%s" action)))
973: (syd--stat cmd)))))
974:
975: (defun syd-default-mkcdev (action)
976: "Set default action for mkcdev sandboxing.
977: ACTION is a constant representing the sandboxing action."
978: (let ((action (cond
979: ((eq action :action-allow) "allow")
980: ((eq action :action-warn) "warn")
981: ((eq action :action-filter) "filter")
982: ((eq action :action-deny) "deny")
983: ((eq action :action-panic) "panic")
984: ((eq action :action-stop) "stop")
985: ((eq action :action-abort) "abort")
986: ((eq action :action-kill) "kill")
987: ((eq action :action-exit) "exit"))))
988: (when action
989: (let ((cmd (format "/dev/syd/default/mkcdev:%s" action)))
990: (syd--stat cmd)))))
991:
992: (defun syd-default-mkfifo (action)
993: "Set default action for mkfifo sandboxing.
994: ACTION is a constant representing the sandboxing action."
995: (let ((action (cond
996: ((eq action :action-allow) "allow")
997: ((eq action :action-warn) "warn")
998: ((eq action :action-filter) "filter")
999: ((eq action :action-deny) "deny")
1000: ((eq action :action-panic) "panic")
1001: ((eq action :action-stop) "stop")
1002: ((eq action :action-abort) "abort")
1003: ((eq action :action-kill) "kill")
1004: ((eq action :action-exit) "exit"))))
1005: (when action
1006: (let ((cmd (format "/dev/syd/default/mkfifo:%s" action)))
1007: (syd--stat cmd)))))
1008:
1009: (defun syd-default-mktemp (action)
1010: "Set default action for mktemp sandboxing.
1011: ACTION is a constant representing the sandboxing action."
1012: (let ((action (cond
1013: ((eq action :action-allow) "allow")
1014: ((eq action :action-warn) "warn")
1015: ((eq action :action-filter) "filter")
1016: ((eq action :action-deny) "deny")
1017: ((eq action :action-panic) "panic")
1018: ((eq action :action-stop) "stop")
1019: ((eq action :action-abort) "abort")
1020: ((eq action :action-kill) "kill")
1021: ((eq action :action-exit) "exit"))))
1022: (when action
1023: (let ((cmd (format "/dev/syd/default/mktemp:%s" action)))
1024: (syd--stat cmd)))))
1025:
1026: (defun syd-default-net (action)
1027: "Set default action for Network sandboxing.
1028: ACTION is a constant representing the sandboxing action."
1029: (let ((action (cond
1030: ((eq action :action-allow) "allow")
1031: ((eq action :action-warn) "warn")
1032: ((eq action :action-filter) "filter")
1033: ((eq action :action-deny) "deny")
1034: ((eq action :action-panic) "panic")
1035: ((eq action :action-stop) "stop")
1036: ((eq action :action-abort) "abort")
1037: ((eq action :action-kill) "kill")
1038: ((eq action :action-exit) "exit"))))
1039: (when action
1040: (let ((cmd (format "/dev/syd/default/net:%s" action)))
1041: (syd--stat cmd)))))
1042:
1043: ; TODO: syd-default-block!
1044:
1045: (defun syd-default-mem (action)
1046: "Set default action for Memory sandboxing.
1047: ACTION is a constant representing the sandboxing action."
1048: (let ((action (cond
1049: ((eq action :action-allow) "allow")
1050: ((eq action :action-warn) "warn")
1051: ((eq action :action-filter) "filter")
1052: ((eq action :action-deny) "deny")
1053: ((eq action :action-panic) "panic")
1054: ((eq action :action-stop) "stop")
1055: ((eq action :action-abort) "abort")
1056: ((eq action :action-kill) "kill")
1057: ((eq action :action-exit) "exit"))))
1058: (when action
1059: (let ((cmd (format "/dev/syd/default/mem:%s" action)))
1060: (syd--stat cmd)))))
1061:
1062: (defun syd-default-pid (action)
1063: "Set default action for PID sandboxing.
1064: ACTION is a constant representing the sandboxing action."
1065: (let ((action (cond
1066: ((eq action :action-allow) "allow")
1067: ((eq action :action-warn) "warn")
1068: ((eq action :action-filter) "filter")
1069: ((eq action :action-deny) "deny")
1070: ((eq action :action-panic) "panic")
1071: ((eq action :action-stop) "stop")
1072: ((eq action :action-abort) "abort")
1073: ((eq action :action-kill) "kill")
1074: ((eq action :action-exit) "exit"))))
1075: (when action
1076: (let ((cmd (format "/dev/syd/default/pid:%s" action)))
1077: (syd--stat cmd)))))
1078:
1079: (defun syd-default-force (action)
1080: "Set default action for Force sandboxing.
1081: ACTION is a constant representing the sandboxing action."
1082: (let ((action (cond
1083: ((eq action :action-allow) "allow")
1084: ((eq action :action-warn) "warn")
1085: ((eq action :action-filter) "filter")
1086: ((eq action :action-deny) "deny")
1087: ((eq action :action-panic) "panic")
1088: ((eq action :action-stop) "stop")
1089: ((eq action :action-abort) "abort")
1090: ((eq action :action-kill) "kill")
1091: ((eq action :action-exit) "exit"))))
1092: (when action
1093: (let ((cmd (format "/dev/syd/default/force:%s" action)))
1094: (syd--stat cmd)))))
1095:
1096: (defun syd-default-segvguard (action)
1097: "Set default action for SegvGuard.
1098: ACTION is a constant representing the sandboxing action."
1099: (let ((action (cond
1100: ((eq action :action-allow) "allow")
1101: ((eq action :action-warn) "warn")
1102: ((eq action :action-filter) "filter")
1103: ((eq action :action-deny) "deny")
1104: ((eq action :action-panic) "panic")
1105: ((eq action :action-stop) "stop")
1106: ((eq action :action-abort) "abort")
1107: ((eq action :action-kill) "kill")
1108: ((eq action :action-exit) "exit"))))
1109: (when action
1110: (let ((cmd (format "/dev/syd/default/segvguard:%s" action)))
1111: (syd--stat cmd)))))
1112:
1113: (defun syd-default-tpe (action)
1114: "Set default action for TPE sandboxing.
1115: ACTION is a constant representing the sandboxing action."
1116: (let ((action (cond
1117: ((eq action :action-allow) "allow")
1118: ((eq action :action-warn) "warn")
1119: ((eq action :action-filter) "filter")
1120: ((eq action :action-deny) "deny")
1121: ((eq action :action-panic) "panic")
1122: ((eq action :action-stop) "stop")
1123: ((eq action :action-abort) "abort")
1124: ((eq action :action-kill) "kill")
1125: ((eq action :action-exit) "exit"))))
1126: (when action
1127: (let ((cmd (format "/dev/syd/default/tpe:%s" action)))
1128: (syd--stat cmd)))))
1129:
1130: (defun syd-ioctl-deny (request)
1131: "Add a request to the _ioctl_(2) denylist.
1132: REQUEST is the _ioctl_(2) request number to add to the denylist."
1133: (unless (numberp request)
1134: (error "Request must be a number"))
1135: (let ((path (format "/dev/syd/deny/ioctl+%d" request)))
1136: (syd--stat path)))
1137:
1138: (defun syd-fs-add (action glob)
1139: "Add to the given actionlist of Filesystem sandboxing.
1140: ACTION is a constant representing the sandboxing action.
1141: GLOB is a string representing the glob pattern."
1142: (let ((action (cond
1143: ((eq action :action-allow) "allow")
1144: ((eq action :action-warn) "warn")
1145: ((eq action :action-filter) "filter")
1146: ((eq action :action-deny) "deny")
1147: ((eq action :action-panic) "panic")
1148: ((eq action :action-stop) "stop")
1149: ((eq action :action-abort) "abort")
1150: ((eq action :action-kill) "kill")
1151: ((eq action :action-exit) "exit"))))
1152: (when action
1153: (let ((cmd (format "%s/fs" action)))
1154: (syd--stat (syd--rule cmd glob ?+))))))
1155:
1156: (defun syd-fs-del (action glob)
1157: "Remove the first matching Filesystem sandboxing actionlist entry.
1158: ACTION is a constant representing the sandboxing action.
1159: GLOB is a string representing the glob pattern."
1160: (let ((action (cond
1161: ((eq action :action-allow) "allow")
1162: ((eq action :action-warn) "warn")
1163: ((eq action :action-filter) "filter")
1164: ((eq action :action-deny) "deny")
1165: ((eq action :action-panic) "panic")
1166: ((eq action :action-stop) "stop")
1167: ((eq action :action-abort) "abort")
1168: ((eq action :action-kill) "kill")
1169: ((eq action :action-exit) "exit"))))
1170: (when action
1171: (let ((cmd (format "%s/fs" action)))
1172: (syd--stat (syd--rule cmd glob ?-))))))
1173:
1174: (defun syd-fs-rem (action glob)
1175: "Remove all matching Filesystem sandboxing actionlist entries.
1176: ACTION is a constant representing the sandboxing action.
1177: GLOB is a string representing the glob pattern."
1178: (let ((action (cond
1179: ((eq action :action-allow) "allow")
1180: ((eq action :action-warn) "warn")
1181: ((eq action :action-filter) "filter")
1182: ((eq action :action-deny) "deny")
1183: ((eq action :action-panic) "panic")
1184: ((eq action :action-stop) "stop")
1185: ((eq action :action-abort) "abort")
1186: ((eq action :action-kill) "kill")
1187: ((eq action :action-exit) "exit"))))
1188: (when action
1189: (let ((cmd (format "%s/fs" action)))
1190: (syd--stat (syd--rule cmd glob ?^))))))
1191:
1192: (defun syd-walk-add (action glob)
1193: "Add to the given actionlist of walk sandboxing.
1194: ACTION is a constant representing the sandboxing action.
1195: GLOB is a string representing the glob pattern."
1196: (let ((action (cond
1197: ((eq action :action-allow) "allow")
1198: ((eq action :action-warn) "warn")
1199: ((eq action :action-filter) "filter")
1200: ((eq action :action-deny) "deny")
1201: ((eq action :action-panic) "panic")
1202: ((eq action :action-stop) "stop")
1203: ((eq action :action-abort) "abort")
1204: ((eq action :action-kill) "kill")
1205: ((eq action :action-exit) "exit"))))
1206: (when action
1207: (let ((cmd (format "%s/walk" action)))
1208: (syd--stat (syd--rule cmd glob ?+))))))
1209:
1210: (defun syd-walk-del (action glob)
1211: "Remove the first matching walk sandboxing actionlist entry.
1212: ACTION is a constant representing the sandboxing action.
1213: GLOB is a string representing the glob pattern."
1214: (let ((action (cond
1215: ((eq action :action-allow) "allow")
1216: ((eq action :action-warn) "warn")
1217: ((eq action :action-filter) "filter")
1218: ((eq action :action-deny) "deny")
1219: ((eq action :action-panic) "panic")
1220: ((eq action :action-stop) "stop")
1221: ((eq action :action-abort) "abort")
1222: ((eq action :action-kill) "kill")
1223: ((eq action :action-exit) "exit"))))
1224: (when action
1225: (let ((cmd (format "%s/walk" action)))
1226: (syd--stat (syd--rule cmd glob ?-))))))
1227:
1228: (defun syd-walk-rem (action glob)
1229: "Remove all matching walk sandboxing actionlist entries.
1230: ACTION is a constant representing the sandboxing action.
1231: GLOB is a string representing the glob pattern."
1232: (let ((action (cond
1233: ((eq action :action-allow) "allow")
1234: ((eq action :action-warn) "warn")
1235: ((eq action :action-filter) "filter")
1236: ((eq action :action-deny) "deny")
1237: ((eq action :action-panic) "panic")
1238: ((eq action :action-stop) "stop")
1239: ((eq action :action-abort) "abort")
1240: ((eq action :action-kill) "kill")
1241: ((eq action :action-exit) "exit"))))
1242: (when action
1243: (let ((cmd (format "%s/walk" action)))
1244: (syd--stat (syd--rule cmd glob ?^))))))
1245:
1246: (defun syd-list-add (action glob)
1247: "Add to the given actionlist of list sandboxing.
1248: ACTION is a constant representing the sandboxing action.
1249: GLOB is a string representing the glob pattern."
1250: (let ((action (cond
1251: ((eq action :action-allow) "allow")
1252: ((eq action :action-warn) "warn")
1253: ((eq action :action-filter) "filter")
1254: ((eq action :action-deny) "deny")
1255: ((eq action :action-panic) "panic")
1256: ((eq action :action-stop) "stop")
1257: ((eq action :action-abort) "abort")
1258: ((eq action :action-kill) "kill")
1259: ((eq action :action-exit) "exit"))))
1260: (when action
1261: (let ((cmd (format "%s/list" action)))
1262: (syd--stat (syd--rule cmd glob ?+))))))
1263:
1264: (defun syd-list-del (action glob)
1265: "Remove the first matching list sandboxing actionlist entry.
1266: ACTION is a constant representing the sandboxing action.
1267: GLOB is a string representing the glob pattern."
1268: (let ((action (cond
1269: ((eq action :action-allow) "allow")
1270: ((eq action :action-warn) "warn")
1271: ((eq action :action-filter) "filter")
1272: ((eq action :action-deny) "deny")
1273: ((eq action :action-panic) "panic")
1274: ((eq action :action-stop) "stop")
1275: ((eq action :action-abort) "abort")
1276: ((eq action :action-kill) "kill")
1277: ((eq action :action-exit) "exit"))))
1278: (when action
1279: (let ((cmd (format "%s/list" action)))
1280: (syd--stat (syd--rule cmd glob ?-))))))
1281:
1282: (defun syd-list-rem (action glob)
1283: "Remove all matching list sandboxing actionlist entries.
1284: ACTION is a constant representing the sandboxing action.
1285: GLOB is a string representing the glob pattern."
1286: (let ((action (cond
1287: ((eq action :action-allow) "allow")
1288: ((eq action :action-warn) "warn")
1289: ((eq action :action-filter) "filter")
1290: ((eq action :action-deny) "deny")
1291: ((eq action :action-panic) "panic")
1292: ((eq action :action-stop) "stop")
1293: ((eq action :action-abort) "abort")
1294: ((eq action :action-kill) "kill")
1295: ((eq action :action-exit) "exit"))))
1296: (when action
1297: (let ((cmd (format "%s/list" action)))
1298: (syd--stat (syd--rule cmd glob ?^))))))
1299:
1300: (defun syd-stat-add (action glob)
1301: "Add to the given actionlist of stat sandboxing.
1302: ACTION is a constant representing the sandboxing action.
1303: GLOB is a string representing the glob pattern."
1304: (let ((action (cond
1305: ((eq action :action-allow) "allow")
1306: ((eq action :action-warn) "warn")
1307: ((eq action :action-filter) "filter")
1308: ((eq action :action-deny) "deny")
1309: ((eq action :action-panic) "panic")
1310: ((eq action :action-stop) "stop")
1311: ((eq action :action-abort) "abort")
1312: ((eq action :action-kill) "kill")
1313: ((eq action :action-exit) "exit"))))
1314: (when action
1315: (let ((cmd (format "%s/stat" action)))
1316: (syd--stat (syd--rule cmd glob ?+))))))
1317:
1318: (defun syd-stat-del (action glob)
1319: "Remove the first matching stat sandboxing actionlist entry.
1320: ACTION is a constant representing the sandboxing action.
1321: GLOB is a string representing the glob pattern."
1322: (let ((action (cond
1323: ((eq action :action-allow) "allow")
1324: ((eq action :action-warn) "warn")
1325: ((eq action :action-filter) "filter")
1326: ((eq action :action-deny) "deny")
1327: ((eq action :action-panic) "panic")
1328: ((eq action :action-stop) "stop")
1329: ((eq action :action-abort) "abort")
1330: ((eq action :action-kill) "kill")
1331: ((eq action :action-exit) "exit"))))
1332: (when action
1333: (let ((cmd (format "%s/stat" action)))
1334: (syd--stat (syd--rule cmd glob ?-))))))
1335:
1336: (defun syd-stat-rem (action glob)
1337: "Remove all matching stat sandboxing actionlist entries.
1338: ACTION is a constant representing the sandboxing action.
1339: GLOB is a string representing the glob pattern."
1340: (let ((action (cond
1341: ((eq action :action-allow) "allow")
1342: ((eq action :action-warn) "warn")
1343: ((eq action :action-filter) "filter")
1344: ((eq action :action-deny) "deny")
1345: ((eq action :action-panic) "panic")
1346: ((eq action :action-stop) "stop")
1347: ((eq action :action-abort) "abort")
1348: ((eq action :action-kill) "kill")
1349: ((eq action :action-exit) "exit"))))
1350: (when action
1351: (let ((cmd (format "%s/stat" action)))
1352: (syd--stat (syd--rule cmd glob ?^))))))
1353:
1354: (defun syd-read-add (action glob)
1355: "Add to the given actionlist of read sandboxing.
1356: ACTION is a constant representing the sandboxing action.
1357: GLOB is a string representing the glob pattern."
1358: (let ((action (cond
1359: ((eq action :action-allow) "allow")
1360: ((eq action :action-warn) "warn")
1361: ((eq action :action-filter) "filter")
1362: ((eq action :action-deny) "deny")
1363: ((eq action :action-panic) "panic")
1364: ((eq action :action-stop) "stop")
1365: ((eq action :action-abort) "abort")
1366: ((eq action :action-kill) "kill")
1367: ((eq action :action-exit) "exit"))))
1368: (when action
1369: (let ((cmd (format "%s/read" action)))
1370: (syd--stat (syd--rule cmd glob ?+))))))
1371:
1372: (defun syd-read-del (action glob)
1373: "Remove the first matching read sandboxing actionlist entry.
1374: ACTION is a constant representing the sandboxing action.
1375: GLOB is a string representing the glob pattern."
1376: (let ((action (cond
1377: ((eq action :action-allow) "allow")
1378: ((eq action :action-warn) "warn")
1379: ((eq action :action-filter) "filter")
1380: ((eq action :action-deny) "deny")
1381: ((eq action :action-panic) "panic")
1382: ((eq action :action-stop) "stop")
1383: ((eq action :action-abort) "abort")
1384: ((eq action :action-kill) "kill")
1385: ((eq action :action-exit) "exit"))))
1386: (when action
1387: (let ((cmd (format "%s/read" action)))
1388: (syd--stat (syd--rule cmd glob ?-))))))
1389:
1390: (defun syd-read-rem (action glob)
1391: "Remove all matching read sandboxing actionlist entries.
1392: ACTION is a constant representing the sandboxing action.
1393: GLOB is a string representing the glob pattern."
1394: (let ((action (cond
1395: ((eq action :action-allow) "allow")
1396: ((eq action :action-warn) "warn")
1397: ((eq action :action-filter) "filter")
1398: ((eq action :action-deny) "deny")
1399: ((eq action :action-panic) "panic")
1400: ((eq action :action-stop) "stop")
1401: ((eq action :action-abort) "abort")
1402: ((eq action :action-kill) "kill")
1403: ((eq action :action-exit) "exit"))))
1404: (when action
1405: (let ((cmd (format "%s/read" action)))
1406: (syd--stat (syd--rule cmd glob ?^))))))
1407:
1408: (defun syd-write-add (action glob)
1409: "Add to the given actionlist of write sandboxing.
1410: ACTION is a constant representing the sandboxing action.
1411: GLOB is a string representing the glob pattern."
1412: (let ((action (cond
1413: ((eq action :action-allow) "allow")
1414: ((eq action :action-warn) "warn")
1415: ((eq action :action-filter) "filter")
1416: ((eq action :action-deny) "deny")
1417: ((eq action :action-panic) "panic")
1418: ((eq action :action-stop) "stop")
1419: ((eq action :action-abort) "abort")
1420: ((eq action :action-kill) "kill")
1421: ((eq action :action-exit) "exit"))))
1422: (when action
1423: (let ((cmd (format "%s/write" action)))
1424: (syd--stat (syd--rule cmd glob ?+))))))
1425:
1426: (defun syd-write-del (action glob)
1427: "Remove the first matching write sandboxing actionlist entry.
1428: ACTION is a constant representing the sandboxing action.
1429: GLOB is a string representing the glob pattern."
1430: (let ((action (cond
1431: ((eq action :action-allow) "allow")
1432: ((eq action :action-warn) "warn")
1433: ((eq action :action-filter) "filter")
1434: ((eq action :action-deny) "deny")
1435: ((eq action :action-panic) "panic")
1436: ((eq action :action-stop) "stop")
1437: ((eq action :action-abort) "abort")
1438: ((eq action :action-kill) "kill")
1439: ((eq action :action-exit) "exit"))))
1440: (when action
1441: (let ((cmd (format "%s/write" action)))
1442: (syd--stat (syd--rule cmd glob ?-))))))
1443:
1444: (defun syd-write-rem (action glob)
1445: "Remove all matching write sandboxing actionlist entries.
1446: ACTION is a constant representing the sandboxing action.
1447: GLOB is a string representing the glob pattern."
1448: (let ((action (cond
1449: ((eq action :action-allow) "allow")
1450: ((eq action :action-warn) "warn")
1451: ((eq action :action-filter) "filter")
1452: ((eq action :action-deny) "deny")
1453: ((eq action :action-panic) "panic")
1454: ((eq action :action-stop) "stop")
1455: ((eq action :action-abort) "abort")
1456: ((eq action :action-kill) "kill")
1457: ((eq action :action-exit) "exit"))))
1458: (when action
1459: (let ((cmd (format "%s/write" action)))
1460: (syd--stat (syd--rule cmd glob ?^))))))
1461:
1462: (defun syd-exec-add (action glob)
1463: "Add to the given actionlist of exec sandboxing.
1464: ACTION is a constant representing the sandboxing action.
1465: GLOB is a string representing the glob pattern."
1466: (let ((action (cond
1467: ((eq action :action-allow) "allow")
1468: ((eq action :action-warn) "warn")
1469: ((eq action :action-filter) "filter")
1470: ((eq action :action-deny) "deny")
1471: ((eq action :action-panic) "panic")
1472: ((eq action :action-stop) "stop")
1473: ((eq action :action-abort) "abort")
1474: ((eq action :action-kill) "kill")
1475: ((eq action :action-exit) "exit"))))
1476: (when action
1477: (let ((cmd (format "%s/exec" action)))
1478: (syd--stat (syd--rule cmd glob ?+))))))
1479:
1480: (defun syd-exec-del (action glob)
1481: "Remove the first matching exec sandboxing actionlist entry.
1482: ACTION is a constant representing the sandboxing action.
1483: GLOB is a string representing the glob pattern."
1484: (let ((action (cond
1485: ((eq action :action-allow) "allow")
1486: ((eq action :action-warn) "warn")
1487: ((eq action :action-filter) "filter")
1488: ((eq action :action-deny) "deny")
1489: ((eq action :action-panic) "panic")
1490: ((eq action :action-stop) "stop")
1491: ((eq action :action-abort) "abort")
1492: ((eq action :action-kill) "kill")
1493: ((eq action :action-exit) "exit"))))
1494: (when action
1495: (let ((cmd (format "%s/exec" action)))
1496: (syd--stat (syd--rule cmd glob ?-))))))
1497:
1498: (defun syd-exec-rem (action glob)
1499: "Remove all matching exec sandboxing actionlist entries.
1500: ACTION is a constant representing the sandboxing action.
1501: GLOB is a string representing the glob pattern."
1502: (let ((action (cond
1503: ((eq action :action-allow) "allow")
1504: ((eq action :action-warn) "warn")
1505: ((eq action :action-filter) "filter")
1506: ((eq action :action-deny) "deny")
1507: ((eq action :action-panic) "panic")
1508: ((eq action :action-stop) "stop")
1509: ((eq action :action-abort) "abort")
1510: ((eq action :action-kill) "kill")
1511: ((eq action :action-exit) "exit"))))
1512: (when action
1513: (let ((cmd (format "%s/exec" action)))
1514: (syd--stat (syd--rule cmd glob ?^))))))
1515:
1516: (defun syd-ioctl-add (action glob)
1517: "Add to the given actionlist of ioctl sandboxing.
1518: ACTION is a constant representing the sandboxing action.
1519: GLOB is a string representing the glob pattern."
1520: (let ((action (cond
1521: ((eq action :action-allow) "allow")
1522: ((eq action :action-warn) "warn")
1523: ((eq action :action-filter) "filter")
1524: ((eq action :action-deny) "deny")
1525: ((eq action :action-panic) "panic")
1526: ((eq action :action-stop) "stop")
1527: ((eq action :action-abort) "abort")
1528: ((eq action :action-kill) "kill")
1529: ((eq action :action-exit) "exit"))))
1530: (when action
1531: (let ((cmd (format "%s/ioctl" action)))
1532: (syd--stat (syd--rule cmd glob ?+))))))
1533:
1534: (defun syd-ioctl-del (action glob)
1535: "Remove the first matching ioctl sandboxing actionlist entry.
1536: ACTION is a constant representing the sandboxing action.
1537: GLOB is a string representing the glob pattern."
1538: (let ((action (cond
1539: ((eq action :action-allow) "allow")
1540: ((eq action :action-warn) "warn")
1541: ((eq action :action-filter) "filter")
1542: ((eq action :action-deny) "deny")
1543: ((eq action :action-panic) "panic")
1544: ((eq action :action-stop) "stop")
1545: ((eq action :action-abort) "abort")
1546: ((eq action :action-kill) "kill")
1547: ((eq action :action-exit) "exit"))))
1548: (when action
1549: (let ((cmd (format "%s/ioctl" action)))
1550: (syd--stat (syd--rule cmd glob ?-))))))
1551:
1552: (defun syd-ioctl-rem (action glob)
1553: "Remove all matching ioctl sandboxing actionlist entries.
1554: ACTION is a constant representing the sandboxing action.
1555: GLOB is a string representing the glob pattern."
1556: (let ((action (cond
1557: ((eq action :action-allow) "allow")
1558: ((eq action :action-warn) "warn")
1559: ((eq action :action-filter) "filter")
1560: ((eq action :action-deny) "deny")
1561: ((eq action :action-panic) "panic")
1562: ((eq action :action-stop) "stop")
1563: ((eq action :action-abort) "abort")
1564: ((eq action :action-kill) "kill")
1565: ((eq action :action-exit) "exit"))))
1566: (when action
1567: (let ((cmd (format "%s/ioctl" action)))
1568: (syd--stat (syd--rule cmd glob ?^))))))
1569:
1570: (defun syd-create-add (action glob)
1571: "Add to the given actionlist of create sandboxing.
1572: ACTION is a constant representing the sandboxing action.
1573: GLOB is a string representing the glob pattern."
1574: (let ((action (cond
1575: ((eq action :action-allow) "allow")
1576: ((eq action :action-warn) "warn")
1577: ((eq action :action-filter) "filter")
1578: ((eq action :action-deny) "deny")
1579: ((eq action :action-panic) "panic")
1580: ((eq action :action-stop) "stop")
1581: ((eq action :action-abort) "abort")
1582: ((eq action :action-kill) "kill")
1583: ((eq action :action-exit) "exit"))))
1584: (when action
1585: (let ((cmd (format "%s/create" action)))
1586: (syd--stat (syd--rule cmd glob ?+))))))
1587:
1588: (defun syd-create-del (action glob)
1589: "Remove the first matching create sandboxing actionlist entry.
1590: ACTION is a constant representing the sandboxing action.
1591: GLOB is a string representing the glob pattern."
1592: (let ((action (cond
1593: ((eq action :action-allow) "allow")
1594: ((eq action :action-warn) "warn")
1595: ((eq action :action-filter) "filter")
1596: ((eq action :action-deny) "deny")
1597: ((eq action :action-panic) "panic")
1598: ((eq action :action-stop) "stop")
1599: ((eq action :action-abort) "abort")
1600: ((eq action :action-kill) "kill")
1601: ((eq action :action-exit) "exit"))))
1602: (when action
1603: (let ((cmd (format "%s/create" action)))
1604: (syd--stat (syd--rule cmd glob ?-))))))
1605:
1606: (defun syd-create-rem (action glob)
1607: "Remove all matching create sandboxing actionlist entries.
1608: ACTION is a constant representing the sandboxing action.
1609: GLOB is a string representing the glob pattern."
1610: (let ((action (cond
1611: ((eq action :action-allow) "allow")
1612: ((eq action :action-warn) "warn")
1613: ((eq action :action-filter) "filter")
1614: ((eq action :action-deny) "deny")
1615: ((eq action :action-panic) "panic")
1616: ((eq action :action-stop) "stop")
1617: ((eq action :action-abort) "abort")
1618: ((eq action :action-kill) "kill")
1619: ((eq action :action-exit) "exit"))))
1620: (when action
1621: (let ((cmd (format "%s/create" action)))
1622: (syd--stat (syd--rule cmd glob ?^))))))
1623:
1624: (defun syd-delete-add (action glob)
1625: "Add to the given actionlist of delete sandboxing.
1626: ACTION is a constant representing the sandboxing action.
1627: GLOB is a string representing the glob pattern."
1628: (let ((action (cond
1629: ((eq action :action-allow) "allow")
1630: ((eq action :action-warn) "warn")
1631: ((eq action :action-filter) "filter")
1632: ((eq action :action-deny) "deny")
1633: ((eq action :action-panic) "panic")
1634: ((eq action :action-stop) "stop")
1635: ((eq action :action-abort) "abort")
1636: ((eq action :action-kill) "kill")
1637: ((eq action :action-exit) "exit"))))
1638: (when action
1639: (let ((cmd (format "%s/delete" action)))
1640: (syd--stat (syd--rule cmd glob ?+))))))
1641:
1642: (defun syd-delete-del (action glob)
1643: "Remove the first matching delete sandboxing actionlist entry.
1644: ACTION is a constant representing the sandboxing action.
1645: GLOB is a string representing the glob pattern."
1646: (let ((action (cond
1647: ((eq action :action-allow) "allow")
1648: ((eq action :action-warn) "warn")
1649: ((eq action :action-filter) "filter")
1650: ((eq action :action-deny) "deny")
1651: ((eq action :action-panic) "panic")
1652: ((eq action :action-stop) "stop")
1653: ((eq action :action-abort) "abort")
1654: ((eq action :action-kill) "kill")
1655: ((eq action :action-exit) "exit"))))
1656: (when action
1657: (let ((cmd (format "%s/delete" action)))
1658: (syd--stat (syd--rule cmd glob ?-))))))
1659:
1660: (defun syd-delete-rem (action glob)
1661: "Remove all matching delete sandboxing actionlist entries.
1662: ACTION is a constant representing the sandboxing action.
1663: GLOB is a string representing the glob pattern."
1664: (let ((action (cond
1665: ((eq action :action-allow) "allow")
1666: ((eq action :action-warn) "warn")
1667: ((eq action :action-filter) "filter")
1668: ((eq action :action-deny) "deny")
1669: ((eq action :action-panic) "panic")
1670: ((eq action :action-stop) "stop")
1671: ((eq action :action-abort) "abort")
1672: ((eq action :action-kill) "kill")
1673: ((eq action :action-exit) "exit"))))
1674: (when action
1675: (let ((cmd (format "%s/delete" action)))
1676: (syd--stat (syd--rule cmd glob ?^))))))
1677:
1678: (defun syd-rename-add (action glob)
1679: "Add to the given actionlist of rename sandboxing.
1680: ACTION is a constant representing the sandboxing action.
1681: GLOB is a string representing the glob pattern."
1682: (let ((action (cond
1683: ((eq action :action-allow) "allow")
1684: ((eq action :action-warn) "warn")
1685: ((eq action :action-filter) "filter")
1686: ((eq action :action-deny) "deny")
1687: ((eq action :action-panic) "panic")
1688: ((eq action :action-stop) "stop")
1689: ((eq action :action-abort) "abort")
1690: ((eq action :action-kill) "kill")
1691: ((eq action :action-exit) "exit"))))
1692: (when action
1693: (let ((cmd (format "%s/rename" action)))
1694: (syd--stat (syd--rule cmd glob ?+))))))
1695:
1696: (defun syd-rename-del (action glob)
1697: "Remove the first matching rename sandboxing actionlist entry.
1698: ACTION is a constant representing the sandboxing action.
1699: GLOB is a string representing the glob pattern."
1700: (let ((action (cond
1701: ((eq action :action-allow) "allow")
1702: ((eq action :action-warn) "warn")
1703: ((eq action :action-filter) "filter")
1704: ((eq action :action-deny) "deny")
1705: ((eq action :action-panic) "panic")
1706: ((eq action :action-stop) "stop")
1707: ((eq action :action-abort) "abort")
1708: ((eq action :action-kill) "kill")
1709: ((eq action :action-exit) "exit"))))
1710: (when action
1711: (let ((cmd (format "%s/rename" action)))
1712: (syd--stat (syd--rule cmd glob ?-))))))
1713:
1714: (defun syd-rename-rem (action glob)
1715: "Remove all matching rename sandboxing actionlist entries.
1716: ACTION is a constant representing the sandboxing action.
1717: GLOB is a string representing the glob pattern."
1718: (let ((action (cond
1719: ((eq action :action-allow) "allow")
1720: ((eq action :action-warn) "warn")
1721: ((eq action :action-filter) "filter")
1722: ((eq action :action-deny) "deny")
1723: ((eq action :action-panic) "panic")
1724: ((eq action :action-stop) "stop")
1725: ((eq action :action-abort) "abort")
1726: ((eq action :action-kill) "kill")
1727: ((eq action :action-exit) "exit"))))
1728: (when action
1729: (let ((cmd (format "%s/rename" action)))
1730: (syd--stat (syd--rule cmd glob ?^))))))
1731:
1732: (defun syd-readlink-add (action glob)
1733: "Add to the given actionlist of readlink sandboxing.
1734: ACTION is a constant representing the sandboxing action.
1735: GLOB is a string representing the glob pattern."
1736: (let ((action (cond
1737: ((eq action :action-allow) "allow")
1738: ((eq action :action-warn) "warn")
1739: ((eq action :action-filter) "filter")
1740: ((eq action :action-deny) "deny")
1741: ((eq action :action-panic) "panic")
1742: ((eq action :action-stop) "stop")
1743: ((eq action :action-abort) "abort")
1744: ((eq action :action-kill) "kill")
1745: ((eq action :action-exit) "exit"))))
1746: (when action
1747: (let ((cmd (format "%s/readlink" action)))
1748: (syd--stat (syd--rule cmd glob ?+))))))
1749:
1750: (defun syd-readlink-del (action glob)
1751: "Remove the first matching readlink sandboxing actionlist entry.
1752: ACTION is a constant representing the sandboxing action.
1753: GLOB is a string representing the glob pattern."
1754: (let ((action (cond
1755: ((eq action :action-allow) "allow")
1756: ((eq action :action-warn) "warn")
1757: ((eq action :action-filter) "filter")
1758: ((eq action :action-deny) "deny")
1759: ((eq action :action-panic) "panic")
1760: ((eq action :action-stop) "stop")
1761: ((eq action :action-abort) "abort")
1762: ((eq action :action-kill) "kill")
1763: ((eq action :action-exit) "exit"))))
1764: (when action
1765: (let ((cmd (format "%s/readlink" action)))
1766: (syd--stat (syd--rule cmd glob ?-))))))
1767:
1768: (defun syd-readlink-rem (action glob)
1769: "Remove all matching readlink sandboxing actionlist entries.
1770: ACTION is a constant representing the sandboxing action.
1771: GLOB is a string representing the glob pattern."
1772: (let ((action (cond
1773: ((eq action :action-allow) "allow")
1774: ((eq action :action-warn) "warn")
1775: ((eq action :action-filter) "filter")
1776: ((eq action :action-deny) "deny")
1777: ((eq action :action-panic) "panic")
1778: ((eq action :action-stop) "stop")
1779: ((eq action :action-abort) "abort")
1780: ((eq action :action-kill) "kill")
1781: ((eq action :action-exit) "exit"))))
1782: (when action
1783: (let ((cmd (format "%s/readlink" action)))
1784: (syd--stat (syd--rule cmd glob ?^))))))
1785:
1786: (defun syd-symlink-add (action glob)
1787: "Add to the given actionlist of symlink sandboxing.
1788: ACTION is a constant representing the sandboxing action.
1789: GLOB is a string representing the glob pattern."
1790: (let ((action (cond
1791: ((eq action :action-allow) "allow")
1792: ((eq action :action-warn) "warn")
1793: ((eq action :action-filter) "filter")
1794: ((eq action :action-deny) "deny")
1795: ((eq action :action-panic) "panic")
1796: ((eq action :action-stop) "stop")
1797: ((eq action :action-abort) "abort")
1798: ((eq action :action-kill) "kill")
1799: ((eq action :action-exit) "exit"))))
1800: (when action
1801: (let ((cmd (format "%s/symlink" action)))
1802: (syd--stat (syd--rule cmd glob ?+))))))
1803:
1804: (defun syd-symlink-del (action glob)
1805: "Remove the first matching symlink sandboxing actionlist entry.
1806: ACTION is a constant representing the sandboxing action.
1807: GLOB is a string representing the glob pattern."
1808: (let ((action (cond
1809: ((eq action :action-allow) "allow")
1810: ((eq action :action-warn) "warn")
1811: ((eq action :action-filter) "filter")
1812: ((eq action :action-deny) "deny")
1813: ((eq action :action-panic) "panic")
1814: ((eq action :action-stop) "stop")
1815: ((eq action :action-abort) "abort")
1816: ((eq action :action-kill) "kill")
1817: ((eq action :action-exit) "exit"))))
1818: (when action
1819: (let ((cmd (format "%s/symlink" action)))
1820: (syd--stat (syd--rule cmd glob ?-))))))
1821:
1822: (defun syd-symlink-rem (action glob)
1823: "Remove all matching symlink sandboxing actionlist entries.
1824: ACTION is a constant representing the sandboxing action.
1825: GLOB is a string representing the glob pattern."
1826: (let ((action (cond
1827: ((eq action :action-allow) "allow")
1828: ((eq action :action-warn) "warn")
1829: ((eq action :action-filter) "filter")
1830: ((eq action :action-deny) "deny")
1831: ((eq action :action-panic) "panic")
1832: ((eq action :action-stop) "stop")
1833: ((eq action :action-abort) "abort")
1834: ((eq action :action-kill) "kill")
1835: ((eq action :action-exit) "exit"))))
1836: (when action
1837: (let ((cmd (format "%s/symlink" action)))
1838: (syd--stat (syd--rule cmd glob ?^))))))
1839:
1840: (defun syd-truncate-add (action glob)
1841: "Add to the given actionlist of truncate sandboxing.
1842: ACTION is a constant representing the sandboxing action.
1843: GLOB is a string representing the glob pattern."
1844: (let ((action (cond
1845: ((eq action :action-allow) "allow")
1846: ((eq action :action-warn) "warn")
1847: ((eq action :action-filter) "filter")
1848: ((eq action :action-deny) "deny")
1849: ((eq action :action-panic) "panic")
1850: ((eq action :action-stop) "stop")
1851: ((eq action :action-abort) "abort")
1852: ((eq action :action-kill) "kill")
1853: ((eq action :action-exit) "exit"))))
1854: (when action
1855: (let ((cmd (format "%s/truncate" action)))
1856: (syd--stat (syd--rule cmd glob ?+))))))
1857:
1858: (defun syd-truncate-del (action glob)
1859: "Remove the first matching truncate sandboxing actionlist entry.
1860: ACTION is a constant representing the sandboxing action.
1861: GLOB is a string representing the glob pattern."
1862: (let ((action (cond
1863: ((eq action :action-allow) "allow")
1864: ((eq action :action-warn) "warn")
1865: ((eq action :action-filter) "filter")
1866: ((eq action :action-deny) "deny")
1867: ((eq action :action-panic) "panic")
1868: ((eq action :action-stop) "stop")
1869: ((eq action :action-abort) "abort")
1870: ((eq action :action-kill) "kill")
1871: ((eq action :action-exit) "exit"))))
1872: (when action
1873: (let ((cmd (format "%s/truncate" action)))
1874: (syd--stat (syd--rule cmd glob ?-))))))
1875:
1876: (defun syd-truncate-rem (action glob)
1877: "Remove all matching truncate sandboxing actionlist entries.
1878: ACTION is a constant representing the sandboxing action.
1879: GLOB is a string representing the glob pattern."
1880: (let ((action (cond
1881: ((eq action :action-allow) "allow")
1882: ((eq action :action-warn) "warn")
1883: ((eq action :action-filter) "filter")
1884: ((eq action :action-deny) "deny")
1885: ((eq action :action-panic) "panic")
1886: ((eq action :action-stop) "stop")
1887: ((eq action :action-abort) "abort")
1888: ((eq action :action-kill) "kill")
1889: ((eq action :action-exit) "exit"))))
1890: (when action
1891: (let ((cmd (format "%s/truncate" action)))
1892: (syd--stat (syd--rule cmd glob ?^))))))
1893:
1894: (defun syd-chdir-add (action glob)
1895: "Add to the given actionlist of chdir sandboxing.
1896: ACTION is a constant representing the sandboxing action.
1897: GLOB is a string representing the glob pattern."
1898: (let ((action (cond
1899: ((eq action :action-allow) "allow")
1900: ((eq action :action-warn) "warn")
1901: ((eq action :action-filter) "filter")
1902: ((eq action :action-deny) "deny")
1903: ((eq action :action-panic) "panic")
1904: ((eq action :action-stop) "stop")
1905: ((eq action :action-abort) "abort")
1906: ((eq action :action-kill) "kill")
1907: ((eq action :action-exit) "exit"))))
1908: (when action
1909: (let ((cmd (format "%s/chdir" action)))
1910: (syd--stat (syd--rule cmd glob ?+))))))
1911:
1912: (defun syd-chdir-del (action glob)
1913: "Remove the first matching chdir sandboxing actionlist entry.
1914: ACTION is a constant representing the sandboxing action.
1915: GLOB is a string representing the glob pattern."
1916: (let ((action (cond
1917: ((eq action :action-allow) "allow")
1918: ((eq action :action-warn) "warn")
1919: ((eq action :action-filter) "filter")
1920: ((eq action :action-deny) "deny")
1921: ((eq action :action-panic) "panic")
1922: ((eq action :action-stop) "stop")
1923: ((eq action :action-abort) "abort")
1924: ((eq action :action-kill) "kill")
1925: ((eq action :action-exit) "exit"))))
1926: (when action
1927: (let ((cmd (format "%s/chdir" action)))
1928: (syd--stat (syd--rule cmd glob ?-))))))
1929:
1930: (defun syd-chdir-rem (action glob)
1931: "Remove all matching chdir sandboxing actionlist entries.
1932: ACTION is a constant representing the sandboxing action.
1933: GLOB is a string representing the glob pattern."
1934: (let ((action (cond
1935: ((eq action :action-allow) "allow")
1936: ((eq action :action-warn) "warn")
1937: ((eq action :action-filter) "filter")
1938: ((eq action :action-deny) "deny")
1939: ((eq action :action-panic) "panic")
1940: ((eq action :action-stop) "stop")
1941: ((eq action :action-abort) "abort")
1942: ((eq action :action-kill) "kill")
1943: ((eq action :action-exit) "exit"))))
1944: (when action
1945: (let ((cmd (format "%s/chdir" action)))
1946: (syd--stat (syd--rule cmd glob ?^))))))
1947:
1948: (defun syd-readdir-add (action glob)
1949: "Add to the given actionlist of readdir sandboxing.
1950: ACTION is a constant representing the sandboxing action.
1951: GLOB is a string representing the glob pattern."
1952: (let ((action (cond
1953: ((eq action :action-allow) "allow")
1954: ((eq action :action-warn) "warn")
1955: ((eq action :action-filter) "filter")
1956: ((eq action :action-deny) "deny")
1957: ((eq action :action-panic) "panic")
1958: ((eq action :action-stop) "stop")
1959: ((eq action :action-abort) "abort")
1960: ((eq action :action-kill) "kill")
1961: ((eq action :action-exit) "exit"))))
1962: (when action
1963: (let ((cmd (format "%s/readdir" action)))
1964: (syd--stat (syd--rule cmd glob ?+))))))
1965:
1966: (defun syd-readdir-del (action glob)
1967: "Remove the first matching readdir sandboxing actionlist entry.
1968: ACTION is a constant representing the sandboxing action.
1969: GLOB is a string representing the glob pattern."
1970: (let ((action (cond
1971: ((eq action :action-allow) "allow")
1972: ((eq action :action-warn) "warn")
1973: ((eq action :action-filter) "filter")
1974: ((eq action :action-deny) "deny")
1975: ((eq action :action-panic) "panic")
1976: ((eq action :action-stop) "stop")
1977: ((eq action :action-abort) "abort")
1978: ((eq action :action-kill) "kill")
1979: ((eq action :action-exit) "exit"))))
1980: (when action
1981: (let ((cmd (format "%s/readdir" action)))
1982: (syd--stat (syd--rule cmd glob ?-))))))
1983:
1984: (defun syd-readdir-rem (action glob)
1985: "Remove all matching readdir sandboxing actionlist entries.
1986: ACTION is a constant representing the sandboxing action.
1987: GLOB is a string representing the glob pattern."
1988: (let ((action (cond
1989: ((eq action :action-allow) "allow")
1990: ((eq action :action-warn) "warn")
1991: ((eq action :action-filter) "filter")
1992: ((eq action :action-deny) "deny")
1993: ((eq action :action-panic) "panic")
1994: ((eq action :action-stop) "stop")
1995: ((eq action :action-abort) "abort")
1996: ((eq action :action-kill) "kill")
1997: ((eq action :action-exit) "exit"))))
1998: (when action
1999: (let ((cmd (format "%s/readdir" action)))
2000: (syd--stat (syd--rule cmd glob ?^))))))
2001:
2002: (defun syd-mkdir-add (action glob)
2003: "Add to the given actionlist of mkdir sandboxing.
2004: ACTION is a constant representing the sandboxing action.
2005: GLOB is a string representing the glob pattern."
2006: (let ((action (cond
2007: ((eq action :action-allow) "allow")
2008: ((eq action :action-warn) "warn")
2009: ((eq action :action-filter) "filter")
2010: ((eq action :action-deny) "deny")
2011: ((eq action :action-panic) "panic")
2012: ((eq action :action-stop) "stop")
2013: ((eq action :action-abort) "abort")
2014: ((eq action :action-kill) "kill")
2015: ((eq action :action-exit) "exit"))))
2016: (when action
2017: (let ((cmd (format "%s/mkdir" action)))
2018: (syd--stat (syd--rule cmd glob ?+))))))
2019:
2020: (defun syd-mkdir-del (action glob)
2021: "Remove the first matching mkdir sandboxing actionlist entry.
2022: ACTION is a constant representing the sandboxing action.
2023: GLOB is a string representing the glob pattern."
2024: (let ((action (cond
2025: ((eq action :action-allow) "allow")
2026: ((eq action :action-warn) "warn")
2027: ((eq action :action-filter) "filter")
2028: ((eq action :action-deny) "deny")
2029: ((eq action :action-panic) "panic")
2030: ((eq action :action-stop) "stop")
2031: ((eq action :action-abort) "abort")
2032: ((eq action :action-kill) "kill")
2033: ((eq action :action-exit) "exit"))))
2034: (when action
2035: (let ((cmd (format "%s/mkdir" action)))
2036: (syd--stat (syd--rule cmd glob ?-))))))
2037:
2038: (defun syd-mkdir-rem (action glob)
2039: "Remove all matching mkdir sandboxing actionlist entries.
2040: ACTION is a constant representing the sandboxing action.
2041: GLOB is a string representing the glob pattern."
2042: (let ((action (cond
2043: ((eq action :action-allow) "allow")
2044: ((eq action :action-warn) "warn")
2045: ((eq action :action-filter) "filter")
2046: ((eq action :action-deny) "deny")
2047: ((eq action :action-panic) "panic")
2048: ((eq action :action-stop) "stop")
2049: ((eq action :action-abort) "abort")
2050: ((eq action :action-kill) "kill")
2051: ((eq action :action-exit) "exit"))))
2052: (when action
2053: (let ((cmd (format "%s/mkdir" action)))
2054: (syd--stat (syd--rule cmd glob ?^))))))
2055:
2056: (defun syd-rmdir-add (action glob)
2057: "Add to the given actionlist of rmdir sandboxing.
2058: ACTION is a constant representing the sandboxing action.
2059: GLOB is a string representing the glob pattern."
2060: (let ((action (cond
2061: ((eq action :action-allow) "allow")
2062: ((eq action :action-warn) "warn")
2063: ((eq action :action-filter) "filter")
2064: ((eq action :action-deny) "deny")
2065: ((eq action :action-panic) "panic")
2066: ((eq action :action-stop) "stop")
2067: ((eq action :action-abort) "abort")
2068: ((eq action :action-kill) "kill")
2069: ((eq action :action-exit) "exit"))))
2070: (when action
2071: (let ((cmd (format "%s/rmdir" action)))
2072: (syd--stat (syd--rule cmd glob ?+))))))
2073:
2074: (defun syd-rmdir-del (action glob)
2075: "Remove the first matching rmdir sandboxing actionlist entry.
2076: ACTION is a constant representing the sandboxing action.
2077: GLOB is a string representing the glob pattern."
2078: (let ((action (cond
2079: ((eq action :action-allow) "allow")
2080: ((eq action :action-warn) "warn")
2081: ((eq action :action-filter) "filter")
2082: ((eq action :action-deny) "deny")
2083: ((eq action :action-panic) "panic")
2084: ((eq action :action-stop) "stop")
2085: ((eq action :action-abort) "abort")
2086: ((eq action :action-kill) "kill")
2087: ((eq action :action-exit) "exit"))))
2088: (when action
2089: (let ((cmd (format "%s/rmdir" action)))
2090: (syd--stat (syd--rule cmd glob ?-))))))
2091:
2092: (defun syd-rmdir-rem (action glob)
2093: "Remove all matching rmdir sandboxing actionlist entries.
2094: ACTION is a constant representing the sandboxing action.
2095: GLOB is a string representing the glob pattern."
2096: (let ((action (cond
2097: ((eq action :action-allow) "allow")
2098: ((eq action :action-warn) "warn")
2099: ((eq action :action-filter) "filter")
2100: ((eq action :action-deny) "deny")
2101: ((eq action :action-panic) "panic")
2102: ((eq action :action-stop) "stop")
2103: ((eq action :action-abort) "abort")
2104: ((eq action :action-kill) "kill")
2105: ((eq action :action-exit) "exit"))))
2106: (when action
2107: (let ((cmd (format "%s/rmdir" action)))
2108: (syd--stat (syd--rule cmd glob ?^))))))
2109:
2110: (defun syd-chown-add (action glob)
2111: "Add to the given actionlist of chown sandboxing.
2112: ACTION is a constant representing the sandboxing action.
2113: GLOB is a string representing the glob pattern."
2114: (let ((action (cond
2115: ((eq action :action-allow) "allow")
2116: ((eq action :action-warn) "warn")
2117: ((eq action :action-filter) "filter")
2118: ((eq action :action-deny) "deny")
2119: ((eq action :action-panic) "panic")
2120: ((eq action :action-stop) "stop")
2121: ((eq action :action-abort) "abort")
2122: ((eq action :action-kill) "kill")
2123: ((eq action :action-exit) "exit"))))
2124: (when action
2125: (let ((cmd (format "%s/chown" action)))
2126: (syd--stat (syd--rule cmd glob ?+))))))
2127:
2128: (defun syd-chown-del (action glob)
2129: "Remove the first matching chown sandboxing actionlist entry.
2130: ACTION is a constant representing the sandboxing action.
2131: GLOB is a string representing the glob pattern."
2132: (let ((action (cond
2133: ((eq action :action-allow) "allow")
2134: ((eq action :action-warn) "warn")
2135: ((eq action :action-filter) "filter")
2136: ((eq action :action-deny) "deny")
2137: ((eq action :action-panic) "panic")
2138: ((eq action :action-stop) "stop")
2139: ((eq action :action-abort) "abort")
2140: ((eq action :action-kill) "kill")
2141: ((eq action :action-exit) "exit"))))
2142: (when action
2143: (let ((cmd (format "%s/chown" action)))
2144: (syd--stat (syd--rule cmd glob ?-))))))
2145:
2146: (defun syd-chown-rem (action glob)
2147: "Remove all matching chown sandboxing actionlist entries.
2148: ACTION is a constant representing the sandboxing action.
2149: GLOB is a string representing the glob pattern."
2150: (let ((action (cond
2151: ((eq action :action-allow) "allow")
2152: ((eq action :action-warn) "warn")
2153: ((eq action :action-filter) "filter")
2154: ((eq action :action-deny) "deny")
2155: ((eq action :action-panic) "panic")
2156: ((eq action :action-stop) "stop")
2157: ((eq action :action-abort) "abort")
2158: ((eq action :action-kill) "kill")
2159: ((eq action :action-exit) "exit"))))
2160: (when action
2161: (let ((cmd (format "%s/chown" action)))
2162: (syd--stat (syd--rule cmd glob ?^))))))
2163:
2164: (defun syd-chgrp-add (action glob)
2165: "Add to the given actionlist of chgrp sandboxing.
2166: ACTION is a constant representing the sandboxing action.
2167: GLOB is a string representing the glob pattern."
2168: (let ((action (cond
2169: ((eq action :action-allow) "allow")
2170: ((eq action :action-warn) "warn")
2171: ((eq action :action-filter) "filter")
2172: ((eq action :action-deny) "deny")
2173: ((eq action :action-panic) "panic")
2174: ((eq action :action-stop) "stop")
2175: ((eq action :action-abort) "abort")
2176: ((eq action :action-kill) "kill")
2177: ((eq action :action-exit) "exit"))))
2178: (when action
2179: (let ((cmd (format "%s/chgrp" action)))
2180: (syd--stat (syd--rule cmd glob ?+))))))
2181:
2182: (defun syd-chgrp-del (action glob)
2183: "Remove the first matching chgrp sandboxing actionlist entry.
2184: ACTION is a constant representing the sandboxing action.
2185: GLOB is a string representing the glob pattern."
2186: (let ((action (cond
2187: ((eq action :action-allow) "allow")
2188: ((eq action :action-warn) "warn")
2189: ((eq action :action-filter) "filter")
2190: ((eq action :action-deny) "deny")
2191: ((eq action :action-panic) "panic")
2192: ((eq action :action-stop) "stop")
2193: ((eq action :action-abort) "abort")
2194: ((eq action :action-kill) "kill")
2195: ((eq action :action-exit) "exit"))))
2196: (when action
2197: (let ((cmd (format "%s/chgrp" action)))
2198: (syd--stat (syd--rule cmd glob ?-))))))
2199:
2200: (defun syd-chgrp-rem (action glob)
2201: "Remove all matching chgrp sandboxing actionlist entries.
2202: ACTION is a constant representing the sandboxing action.
2203: GLOB is a string representing the glob pattern."
2204: (let ((action (cond
2205: ((eq action :action-allow) "allow")
2206: ((eq action :action-warn) "warn")
2207: ((eq action :action-filter) "filter")
2208: ((eq action :action-deny) "deny")
2209: ((eq action :action-panic) "panic")
2210: ((eq action :action-stop) "stop")
2211: ((eq action :action-abort) "abort")
2212: ((eq action :action-kill) "kill")
2213: ((eq action :action-exit) "exit"))))
2214: (when action
2215: (let ((cmd (format "%s/chgrp" action)))
2216: (syd--stat (syd--rule cmd glob ?^))))))
2217:
2218: (defun syd-chmod-add (action glob)
2219: "Add to the given actionlist of chmod sandboxing.
2220: ACTION is a constant representing the sandboxing action.
2221: GLOB is a string representing the glob pattern."
2222: (let ((action (cond
2223: ((eq action :action-allow) "allow")
2224: ((eq action :action-warn) "warn")
2225: ((eq action :action-filter) "filter")
2226: ((eq action :action-deny) "deny")
2227: ((eq action :action-panic) "panic")
2228: ((eq action :action-stop) "stop")
2229: ((eq action :action-abort) "abort")
2230: ((eq action :action-kill) "kill")
2231: ((eq action :action-exit) "exit"))))
2232: (when action
2233: (let ((cmd (format "%s/chmod" action)))
2234: (syd--stat (syd--rule cmd glob ?+))))))
2235:
2236: (defun syd-chmod-del (action glob)
2237: "Remove the first matching chmod sandboxing actionlist entry.
2238: ACTION is a constant representing the sandboxing action.
2239: GLOB is a string representing the glob pattern."
2240: (let ((action (cond
2241: ((eq action :action-allow) "allow")
2242: ((eq action :action-warn) "warn")
2243: ((eq action :action-filter) "filter")
2244: ((eq action :action-deny) "deny")
2245: ((eq action :action-panic) "panic")
2246: ((eq action :action-stop) "stop")
2247: ((eq action :action-abort) "abort")
2248: ((eq action :action-kill) "kill")
2249: ((eq action :action-exit) "exit"))))
2250: (when action
2251: (let ((cmd (format "%s/chmod" action)))
2252: (syd--stat (syd--rule cmd glob ?-))))))
2253:
2254: (defun syd-chmod-rem (action glob)
2255: "Remove all matching chmod sandboxing actionlist entries.
2256: ACTION is a constant representing the sandboxing action.
2257: GLOB is a string representing the glob pattern."
2258: (let ((action (cond
2259: ((eq action :action-allow) "allow")
2260: ((eq action :action-warn) "warn")
2261: ((eq action :action-filter) "filter")
2262: ((eq action :action-deny) "deny")
2263: ((eq action :action-panic) "panic")
2264: ((eq action :action-stop) "stop")
2265: ((eq action :action-abort) "abort")
2266: ((eq action :action-kill) "kill")
2267: ((eq action :action-exit) "exit"))))
2268: (when action
2269: (let ((cmd (format "%s/chmod" action)))
2270: (syd--stat (syd--rule cmd glob ?^))))))
2271:
2272: (defun syd-chattr-add (action glob)
2273: "Add to the given actionlist of chattr sandboxing.
2274: ACTION is a constant representing the sandboxing action.
2275: GLOB is a string representing the glob pattern."
2276: (let ((action (cond
2277: ((eq action :action-allow) "allow")
2278: ((eq action :action-warn) "warn")
2279: ((eq action :action-filter) "filter")
2280: ((eq action :action-deny) "deny")
2281: ((eq action :action-panic) "panic")
2282: ((eq action :action-stop) "stop")
2283: ((eq action :action-abort) "abort")
2284: ((eq action :action-kill) "kill")
2285: ((eq action :action-exit) "exit"))))
2286: (when action
2287: (let ((cmd (format "%s/chattr" action)))
2288: (syd--stat (syd--rule cmd glob ?+))))))
2289:
2290: (defun syd-chattr-del (action glob)
2291: "Remove the first matching chattr sandboxing actionlist entry.
2292: ACTION is a constant representing the sandboxing action.
2293: GLOB is a string representing the glob pattern."
2294: (let ((action (cond
2295: ((eq action :action-allow) "allow")
2296: ((eq action :action-warn) "warn")
2297: ((eq action :action-filter) "filter")
2298: ((eq action :action-deny) "deny")
2299: ((eq action :action-panic) "panic")
2300: ((eq action :action-stop) "stop")
2301: ((eq action :action-abort) "abort")
2302: ((eq action :action-kill) "kill")
2303: ((eq action :action-exit) "exit"))))
2304: (when action
2305: (let ((cmd (format "%s/chattr" action)))
2306: (syd--stat (syd--rule cmd glob ?-))))))
2307:
2308: (defun syd-chattr-rem (action glob)
2309: "Remove all matching chattr sandboxing actionlist entries.
2310: ACTION is a constant representing the sandboxing action.
2311: GLOB is a string representing the glob pattern."
2312: (let ((action (cond
2313: ((eq action :action-allow) "allow")
2314: ((eq action :action-warn) "warn")
2315: ((eq action :action-filter) "filter")
2316: ((eq action :action-deny) "deny")
2317: ((eq action :action-panic) "panic")
2318: ((eq action :action-stop) "stop")
2319: ((eq action :action-abort) "abort")
2320: ((eq action :action-kill) "kill")
2321: ((eq action :action-exit) "exit"))))
2322: (when action
2323: (let ((cmd (format "%s/chattr" action)))
2324: (syd--stat (syd--rule cmd glob ?^))))))
2325:
2326: (defun syd-chroot-add (action glob)
2327: "Add to the given actionlist of chroot sandboxing.
2328: ACTION is a constant representing the sandboxing action.
2329: GLOB is a string representing the glob pattern."
2330: (let ((action (cond
2331: ((eq action :action-allow) "allow")
2332: ((eq action :action-warn) "warn")
2333: ((eq action :action-filter) "filter")
2334: ((eq action :action-deny) "deny")
2335: ((eq action :action-panic) "panic")
2336: ((eq action :action-stop) "stop")
2337: ((eq action :action-abort) "abort")
2338: ((eq action :action-kill) "kill")
2339: ((eq action :action-exit) "exit"))))
2340: (when action
2341: (let ((cmd (format "%s/chroot" action)))
2342: (syd--stat (syd--rule cmd glob ?+))))))
2343:
2344: (defun syd-chroot-del (action glob)
2345: "Remove the first matching chroot sandboxing actionlist entry.
2346: ACTION is a constant representing the sandboxing action.
2347: GLOB is a string representing the glob pattern."
2348: (let ((action (cond
2349: ((eq action :action-allow) "allow")
2350: ((eq action :action-warn) "warn")
2351: ((eq action :action-filter) "filter")
2352: ((eq action :action-deny) "deny")
2353: ((eq action :action-panic) "panic")
2354: ((eq action :action-stop) "stop")
2355: ((eq action :action-abort) "abort")
2356: ((eq action :action-kill) "kill")
2357: ((eq action :action-exit) "exit"))))
2358: (when action
2359: (let ((cmd (format "%s/chroot" action)))
2360: (syd--stat (syd--rule cmd glob ?-))))))
2361:
2362: (defun syd-chroot-rem (action glob)
2363: "Remove all matching chroot sandboxing actionlist entries.
2364: ACTION is a constant representing the sandboxing action.
2365: GLOB is a string representing the glob pattern."
2366: (let ((action (cond
2367: ((eq action :action-allow) "allow")
2368: ((eq action :action-warn) "warn")
2369: ((eq action :action-filter) "filter")
2370: ((eq action :action-deny) "deny")
2371: ((eq action :action-panic) "panic")
2372: ((eq action :action-stop) "stop")
2373: ((eq action :action-abort) "abort")
2374: ((eq action :action-kill) "kill")
2375: ((eq action :action-exit) "exit"))))
2376: (when action
2377: (let ((cmd (format "%s/chroot" action)))
2378: (syd--stat (syd--rule cmd glob ?^))))))
2379:
2380: (defun syd-notify-add (action glob)
2381: "Add to the given actionlist of notify sandboxing.
2382: ACTION is a constant representing the sandboxing action.
2383: GLOB is a string representing the glob pattern."
2384: (let ((action (cond
2385: ((eq action :action-allow) "allow")
2386: ((eq action :action-warn) "warn")
2387: ((eq action :action-filter) "filter")
2388: ((eq action :action-deny) "deny")
2389: ((eq action :action-panic) "panic")
2390: ((eq action :action-stop) "stop")
2391: ((eq action :action-abort) "abort")
2392: ((eq action :action-kill) "kill")
2393: ((eq action :action-exit) "exit"))))
2394: (when action
2395: (let ((cmd (format "%s/notify" action)))
2396: (syd--stat (syd--rule cmd glob ?+))))))
2397:
2398: (defun syd-notify-del (action glob)
2399: "Remove the first matching notify sandboxing actionlist entry.
2400: ACTION is a constant representing the sandboxing action.
2401: GLOB is a string representing the glob pattern."
2402: (let ((action (cond
2403: ((eq action :action-allow) "allow")
2404: ((eq action :action-warn) "warn")
2405: ((eq action :action-filter) "filter")
2406: ((eq action :action-deny) "deny")
2407: ((eq action :action-panic) "panic")
2408: ((eq action :action-stop) "stop")
2409: ((eq action :action-abort) "abort")
2410: ((eq action :action-kill) "kill")
2411: ((eq action :action-exit) "exit"))))
2412: (when action
2413: (let ((cmd (format "%s/notify" action)))
2414: (syd--stat (syd--rule cmd glob ?-))))))
2415:
2416: (defun syd-notify-rem (action glob)
2417: "Remove all matching notify sandboxing actionlist entries.
2418: ACTION is a constant representing the sandboxing action.
2419: GLOB is a string representing the glob pattern."
2420: (let ((action (cond
2421: ((eq action :action-allow) "allow")
2422: ((eq action :action-warn) "warn")
2423: ((eq action :action-filter) "filter")
2424: ((eq action :action-deny) "deny")
2425: ((eq action :action-panic) "panic")
2426: ((eq action :action-stop) "stop")
2427: ((eq action :action-abort) "abort")
2428: ((eq action :action-kill) "kill")
2429: ((eq action :action-exit) "exit"))))
2430: (when action
2431: (let ((cmd (format "%s/notify" action)))
2432: (syd--stat (syd--rule cmd glob ?^))))))
2433:
2434: (defun syd-utime-add (action glob)
2435: "Add to the given actionlist of utime sandboxing.
2436: ACTION is a constant representing the sandboxing action.
2437: GLOB is a string representing the glob pattern."
2438: (let ((action (cond
2439: ((eq action :action-allow) "allow")
2440: ((eq action :action-warn) "warn")
2441: ((eq action :action-filter) "filter")
2442: ((eq action :action-deny) "deny")
2443: ((eq action :action-panic) "panic")
2444: ((eq action :action-stop) "stop")
2445: ((eq action :action-abort) "abort")
2446: ((eq action :action-kill) "kill")
2447: ((eq action :action-exit) "exit"))))
2448: (when action
2449: (let ((cmd (format "%s/utime" action)))
2450: (syd--stat (syd--rule cmd glob ?+))))))
2451:
2452: (defun syd-utime-del (action glob)
2453: "Remove the first matching utime sandboxing actionlist entry.
2454: ACTION is a constant representing the sandboxing action.
2455: GLOB is a string representing the glob pattern."
2456: (let ((action (cond
2457: ((eq action :action-allow) "allow")
2458: ((eq action :action-warn) "warn")
2459: ((eq action :action-filter) "filter")
2460: ((eq action :action-deny) "deny")
2461: ((eq action :action-panic) "panic")
2462: ((eq action :action-stop) "stop")
2463: ((eq action :action-abort) "abort")
2464: ((eq action :action-kill) "kill")
2465: ((eq action :action-exit) "exit"))))
2466: (when action
2467: (let ((cmd (format "%s/utime" action)))
2468: (syd--stat (syd--rule cmd glob ?-))))))
2469:
2470: (defun syd-utime-rem (action glob)
2471: "Remove all matching utime sandboxing actionlist entries.
2472: ACTION is a constant representing the sandboxing action.
2473: GLOB is a string representing the glob pattern."
2474: (let ((action (cond
2475: ((eq action :action-allow) "allow")
2476: ((eq action :action-warn) "warn")
2477: ((eq action :action-filter) "filter")
2478: ((eq action :action-deny) "deny")
2479: ((eq action :action-panic) "panic")
2480: ((eq action :action-stop) "stop")
2481: ((eq action :action-abort) "abort")
2482: ((eq action :action-kill) "kill")
2483: ((eq action :action-exit) "exit"))))
2484: (when action
2485: (let ((cmd (format "%s/utime" action)))
2486: (syd--stat (syd--rule cmd glob ?^))))))
2487:
2488: (defun syd-mkbdev-add (action glob)
2489: "Add to the given actionlist of mkbdev sandboxing.
2490: ACTION is a constant representing the sandboxing action.
2491: GLOB is a string representing the glob pattern."
2492: (let ((action (cond
2493: ((eq action :action-allow) "allow")
2494: ((eq action :action-warn) "warn")
2495: ((eq action :action-filter) "filter")
2496: ((eq action :action-deny) "deny")
2497: ((eq action :action-panic) "panic")
2498: ((eq action :action-stop) "stop")
2499: ((eq action :action-abort) "abort")
2500: ((eq action :action-kill) "kill")
2501: ((eq action :action-exit) "exit"))))
2502: (when action
2503: (let ((cmd (format "%s/mkbdev" action)))
2504: (syd--stat (syd--rule cmd glob ?+))))))
2505:
2506: (defun syd-mkbdev-del (action glob)
2507: "Remove the first matching mkbdev sandboxing actionlist entry.
2508: ACTION is a constant representing the sandboxing action.
2509: GLOB is a string representing the glob pattern."
2510: (let ((action (cond
2511: ((eq action :action-allow) "allow")
2512: ((eq action :action-warn) "warn")
2513: ((eq action :action-filter) "filter")
2514: ((eq action :action-deny) "deny")
2515: ((eq action :action-panic) "panic")
2516: ((eq action :action-stop) "stop")
2517: ((eq action :action-abort) "abort")
2518: ((eq action :action-kill) "kill")
2519: ((eq action :action-exit) "exit"))))
2520: (when action
2521: (let ((cmd (format "%s/mkbdev" action)))
2522: (syd--stat (syd--rule cmd glob ?-))))))
2523:
2524: (defun syd-mkbdev-rem (action glob)
2525: "Remove all matching mkbdev sandboxing actionlist entries.
2526: ACTION is a constant representing the sandboxing action.
2527: GLOB is a string representing the glob pattern."
2528: (let ((action (cond
2529: ((eq action :action-allow) "allow")
2530: ((eq action :action-warn) "warn")
2531: ((eq action :action-filter) "filter")
2532: ((eq action :action-deny) "deny")
2533: ((eq action :action-panic) "panic")
2534: ((eq action :action-stop) "stop")
2535: ((eq action :action-abort) "abort")
2536: ((eq action :action-kill) "kill")
2537: ((eq action :action-exit) "exit"))))
2538: (when action
2539: (let ((cmd (format "%s/mkbdev" action)))
2540: (syd--stat (syd--rule cmd glob ?^))))))
2541:
2542: (defun syd-mkcdev-add (action glob)
2543: "Add to the given actionlist of mkcdev sandboxing.
2544: ACTION is a constant representing the sandboxing action.
2545: GLOB is a string representing the glob pattern."
2546: (let ((action (cond
2547: ((eq action :action-allow) "allow")
2548: ((eq action :action-warn) "warn")
2549: ((eq action :action-filter) "filter")
2550: ((eq action :action-deny) "deny")
2551: ((eq action :action-panic) "panic")
2552: ((eq action :action-stop) "stop")
2553: ((eq action :action-abort) "abort")
2554: ((eq action :action-kill) "kill")
2555: ((eq action :action-exit) "exit"))))
2556: (when action
2557: (let ((cmd (format "%s/mkcdev" action)))
2558: (syd--stat (syd--rule cmd glob ?+))))))
2559:
2560: (defun syd-mkcdev-del (action glob)
2561: "Remove the first matching mkcdev sandboxing actionlist entry.
2562: ACTION is a constant representing the sandboxing action.
2563: GLOB is a string representing the glob pattern."
2564: (let ((action (cond
2565: ((eq action :action-allow) "allow")
2566: ((eq action :action-warn) "warn")
2567: ((eq action :action-filter) "filter")
2568: ((eq action :action-deny) "deny")
2569: ((eq action :action-panic) "panic")
2570: ((eq action :action-stop) "stop")
2571: ((eq action :action-abort) "abort")
2572: ((eq action :action-kill) "kill")
2573: ((eq action :action-exit) "exit"))))
2574: (when action
2575: (let ((cmd (format "%s/mkcdev" action)))
2576: (syd--stat (syd--rule cmd glob ?-))))))
2577:
2578: (defun syd-mkcdev-rem (action glob)
2579: "Remove all matching mkcdev sandboxing actionlist entries.
2580: ACTION is a constant representing the sandboxing action.
2581: GLOB is a string representing the glob pattern."
2582: (let ((action (cond
2583: ((eq action :action-allow) "allow")
2584: ((eq action :action-warn) "warn")
2585: ((eq action :action-filter) "filter")
2586: ((eq action :action-deny) "deny")
2587: ((eq action :action-panic) "panic")
2588: ((eq action :action-stop) "stop")
2589: ((eq action :action-abort) "abort")
2590: ((eq action :action-kill) "kill")
2591: ((eq action :action-exit) "exit"))))
2592: (when action
2593: (let ((cmd (format "%s/mkcdev" action)))
2594: (syd--stat (syd--rule cmd glob ?^))))))
2595:
2596: (defun syd-mkfifo-add (action glob)
2597: "Add to the given actionlist of mkfifo sandboxing.
2598: ACTION is a constant representing the sandboxing action.
2599: GLOB is a string representing the glob pattern."
2600: (let ((action (cond
2601: ((eq action :action-allow) "allow")
2602: ((eq action :action-warn) "warn")
2603: ((eq action :action-filter) "filter")
2604: ((eq action :action-deny) "deny")
2605: ((eq action :action-panic) "panic")
2606: ((eq action :action-stop) "stop")
2607: ((eq action :action-abort) "abort")
2608: ((eq action :action-kill) "kill")
2609: ((eq action :action-exit) "exit"))))
2610: (when action
2611: (let ((cmd (format "%s/mkfifo" action)))
2612: (syd--stat (syd--rule cmd glob ?+))))))
2613:
2614: (defun syd-mkfifo-del (action glob)
2615: "Remove the first matching mkfifo sandboxing actionlist entry.
2616: ACTION is a constant representing the sandboxing action.
2617: GLOB is a string representing the glob pattern."
2618: (let ((action (cond
2619: ((eq action :action-allow) "allow")
2620: ((eq action :action-warn) "warn")
2621: ((eq action :action-filter) "filter")
2622: ((eq action :action-deny) "deny")
2623: ((eq action :action-panic) "panic")
2624: ((eq action :action-stop) "stop")
2625: ((eq action :action-abort) "abort")
2626: ((eq action :action-kill) "kill")
2627: ((eq action :action-exit) "exit"))))
2628: (when action
2629: (let ((cmd (format "%s/mkfifo" action)))
2630: (syd--stat (syd--rule cmd glob ?-))))))
2631:
2632: (defun syd-mkfifo-rem (action glob)
2633: "Remove all matching mkfifo sandboxing actionlist entries.
2634: ACTION is a constant representing the sandboxing action.
2635: GLOB is a string representing the glob pattern."
2636: (let ((action (cond
2637: ((eq action :action-allow) "allow")
2638: ((eq action :action-warn) "warn")
2639: ((eq action :action-filter) "filter")
2640: ((eq action :action-deny) "deny")
2641: ((eq action :action-panic) "panic")
2642: ((eq action :action-stop) "stop")
2643: ((eq action :action-abort) "abort")
2644: ((eq action :action-kill) "kill")
2645: ((eq action :action-exit) "exit"))))
2646: (when action
2647: (let ((cmd (format "%s/mkfifo" action)))
2648: (syd--stat (syd--rule cmd glob ?^))))))
2649:
2650: (defun syd-mktemp-add (action glob)
2651: "Add to the given actionlist of mktemp sandboxing.
2652: ACTION is a constant representing the sandboxing action.
2653: GLOB is a string representing the glob pattern."
2654: (let ((action (cond
2655: ((eq action :action-allow) "allow")
2656: ((eq action :action-warn) "warn")
2657: ((eq action :action-filter) "filter")
2658: ((eq action :action-deny) "deny")
2659: ((eq action :action-panic) "panic")
2660: ((eq action :action-stop) "stop")
2661: ((eq action :action-abort) "abort")
2662: ((eq action :action-kill) "kill")
2663: ((eq action :action-exit) "exit"))))
2664: (when action
2665: (let ((cmd (format "%s/mktemp" action)))
2666: (syd--stat (syd--rule cmd glob ?+))))))
2667:
2668: (defun syd-mktemp-del (action glob)
2669: "Remove the first matching mktemp sandboxing actionlist entry.
2670: ACTION is a constant representing the sandboxing action.
2671: GLOB is a string representing the glob pattern."
2672: (let ((action (cond
2673: ((eq action :action-allow) "allow")
2674: ((eq action :action-warn) "warn")
2675: ((eq action :action-filter) "filter")
2676: ((eq action :action-deny) "deny")
2677: ((eq action :action-panic) "panic")
2678: ((eq action :action-stop) "stop")
2679: ((eq action :action-abort) "abort")
2680: ((eq action :action-kill) "kill")
2681: ((eq action :action-exit) "exit"))))
2682: (when action
2683: (let ((cmd (format "%s/mktemp" action)))
2684: (syd--stat (syd--rule cmd glob ?-))))))
2685:
2686: (defun syd-mktemp-rem (action glob)
2687: "Remove all matching mktemp sandboxing actionlist entries.
2688: ACTION is a constant representing the sandboxing action.
2689: GLOB is a string representing the glob pattern."
2690: (let ((action (cond
2691: ((eq action :action-allow) "allow")
2692: ((eq action :action-warn) "warn")
2693: ((eq action :action-filter) "filter")
2694: ((eq action :action-deny) "deny")
2695: ((eq action :action-panic) "panic")
2696: ((eq action :action-stop) "stop")
2697: ((eq action :action-abort) "abort")
2698: ((eq action :action-kill) "kill")
2699: ((eq action :action-exit) "exit"))))
2700: (when action
2701: (let ((cmd (format "%s/mktemp" action)))
2702: (syd--stat (syd--rule cmd glob ?^))))))
2703:
2704: (defun syd-net-bind-add (action addr)
2705: "Add to the given actionlist of net/bind sandboxing.
2706: ACTION is a constant representing the sandboxing action.
2707: ADDR is a string representing the address pattern."
2708: (let ((action (cond
2709: ((eq action :action-allow) "allow")
2710: ((eq action :action-warn) "warn")
2711: ((eq action :action-filter) "filter")
2712: ((eq action :action-deny) "deny")
2713: ((eq action :action-panic) "panic")
2714: ((eq action :action-stop) "stop")
2715: ((eq action :action-abort) "abort")
2716: ((eq action :action-kill) "kill")
2717: ((eq action :action-exit) "exit"))))
2718: (when action
2719: (let ((cmd (format "%s/net/bind" action)))
2720: (syd--stat (syd--rule cmd addr ?+))))))
2721:
2722: (defun syd-net-bind-del (action addr)
2723: "Remove the first matching net/bind sandboxing actionlist entry.
2724: ACTION is a constant representing the sandboxing action.
2725: ADDR is a string representing the address pattern."
2726: (let ((action (cond
2727: ((eq action :action-allow) "allow")
2728: ((eq action :action-warn) "warn")
2729: ((eq action :action-filter) "filter")
2730: ((eq action :action-deny) "deny")
2731: ((eq action :action-panic) "panic")
2732: ((eq action :action-stop) "stop")
2733: ((eq action :action-abort) "abort")
2734: ((eq action :action-kill) "kill")
2735: ((eq action :action-exit) "exit"))))
2736: (when action
2737: (let ((cmd (format "%s/net/bind" action)))
2738: (syd--stat (syd--rule cmd addr ?-))))))
2739:
2740: (defun syd-net-bind-rem (action addr)
2741: "Remove all matching net/bind sandboxing actionlist entries.
2742: ACTION is a constant representing the sandboxing action.
2743: ADDR is a string representing the address pattern."
2744: (let ((action (cond
2745: ((eq action :action-allow) "allow")
2746: ((eq action :action-warn) "warn")
2747: ((eq action :action-filter) "filter")
2748: ((eq action :action-deny) "deny")
2749: ((eq action :action-panic) "panic")
2750: ((eq action :action-stop) "stop")
2751: ((eq action :action-abort) "abort")
2752: ((eq action :action-kill) "kill")
2753: ((eq action :action-exit) "exit"))))
2754: (when action
2755: (let ((cmd (format "%s/net/bind" action)))
2756: (syd--stat (syd--rule cmd addr ?^))))))
2757:
2758: (defun syd-net-connect-add (action addr)
2759: "Add to the given actionlist of net/connect sandboxing.
2760: ACTION is a constant representing the sandboxing action.
2761: ADDR is a string representing the address pattern."
2762: (let ((action (cond
2763: ((eq action :action-allow) "allow")
2764: ((eq action :action-warn) "warn")
2765: ((eq action :action-filter) "filter")
2766: ((eq action :action-deny) "deny")
2767: ((eq action :action-panic) "panic")
2768: ((eq action :action-stop) "stop")
2769: ((eq action :action-abort) "abort")
2770: ((eq action :action-kill) "kill")
2771: ((eq action :action-exit) "exit"))))
2772: (when action
2773: (let ((cmd (format "%s/net/connect" action)))
2774: (syd--stat (syd--rule cmd addr ?+))))))
2775:
2776: (defun syd-net-connect-del (action addr)
2777: "Remove the first matching net/connect sandboxing actionlist entry.
2778: ACTION is a constant representing the sandboxing action.
2779: ADDR is a string representing the address pattern."
2780: (let ((action (cond
2781: ((eq action :action-allow) "allow")
2782: ((eq action :action-warn) "warn")
2783: ((eq action :action-filter) "filter")
2784: ((eq action :action-deny) "deny")
2785: ((eq action :action-panic) "panic")
2786: ((eq action :action-stop) "stop")
2787: ((eq action :action-abort) "abort")
2788: ((eq action :action-kill) "kill")
2789: ((eq action :action-exit) "exit"))))
2790: (when action
2791: (let ((cmd (format "%s/net/connect" action)))
2792: (syd--stat (syd--rule cmd addr ?-))))))
2793:
2794: (defun syd-net-connect-rem (action addr)
2795: "Remove all matching net/connect sandboxing actionlist entries.
2796: ACTION is a constant representing the sandboxing action.
2797: ADDR is a string representing the address pattern."
2798: (let ((action (cond
2799: ((eq action :action-allow) "allow")
2800: ((eq action :action-warn) "warn")
2801: ((eq action :action-filter) "filter")
2802: ((eq action :action-deny) "deny")
2803: ((eq action :action-panic) "panic")
2804: ((eq action :action-stop) "stop")
2805: ((eq action :action-abort) "abort")
2806: ((eq action :action-kill) "kill")
2807: ((eq action :action-exit) "exit"))))
2808: (when action
2809: (let ((cmd (format "%s/net/connect" action)))
2810: (syd--stat (syd--rule cmd addr ?^))))))
2811:
2812: (defun syd-net-sendfd-add (action addr)
2813: "Add to the given actionlist of net/sendfd sandboxing.
2814: ACTION is a constant representing the sandboxing action.
2815: ADDR is a string representing the address pattern."
2816: (let ((action (cond
2817: ((eq action :action-allow) "allow")
2818: ((eq action :action-warn) "warn")
2819: ((eq action :action-filter) "filter")
2820: ((eq action :action-deny) "deny")
2821: ((eq action :action-panic) "panic")
2822: ((eq action :action-stop) "stop")
2823: ((eq action :action-abort) "abort")
2824: ((eq action :action-kill) "kill")
2825: ((eq action :action-exit) "exit"))))
2826: (when action
2827: (let ((cmd (format "%s/net/sendfd" action)))
2828: (syd--stat (syd--rule cmd addr ?+))))))
2829:
2830: (defun syd-net-sendfd-del (action addr)
2831: "Remove the first matching net/sendfd sandboxing actionlist entry.
2832: ACTION is a constant representing the sandboxing action.
2833: ADDR is a string representing the address pattern."
2834: (let ((action (cond
2835: ((eq action :action-allow) "allow")
2836: ((eq action :action-warn) "warn")
2837: ((eq action :action-filter) "filter")
2838: ((eq action :action-deny) "deny")
2839: ((eq action :action-panic) "panic")
2840: ((eq action :action-stop) "stop")
2841: ((eq action :action-abort) "abort")
2842: ((eq action :action-kill) "kill")
2843: ((eq action :action-exit) "exit"))))
2844: (when action
2845: (let ((cmd (format "%s/net/sendfd" action)))
2846: (syd--stat (syd--rule cmd addr ?-))))))
2847:
2848: (defun syd-net-sendfd-rem (action addr)
2849: "Remove all matching net/sendfd sandboxing actionlist entries.
2850: ACTION is a constant representing the sandboxing action.
2851: ADDR is a string representing the address pattern."
2852: (let ((action (cond
2853: ((eq action :action-allow) "allow")
2854: ((eq action :action-warn) "warn")
2855: ((eq action :action-filter) "filter")
2856: ((eq action :action-deny) "deny")
2857: ((eq action :action-panic) "panic")
2858: ((eq action :action-stop) "stop")
2859: ((eq action :action-abort) "abort")
2860: ((eq action :action-kill) "kill")
2861: ((eq action :action-exit) "exit"))))
2862: (when action
2863: (let ((cmd (format "%s/net/sendfd" action)))
2864: (syd--stat (syd--rule cmd addr ?^))))))
2865:
2866: (defun syd-net-link-add (action addr)
2867: "Add to the given actionlist of net/link sandboxing.
2868: ACTION is a constant representing the sandboxing action.
2869: ADDR is a string representing the address pattern."
2870: (let ((action (cond
2871: ((eq action :action-allow) "allow")
2872: ((eq action :action-warn) "warn")
2873: ((eq action :action-filter) "filter")
2874: ((eq action :action-deny) "deny")
2875: ((eq action :action-panic) "panic")
2876: ((eq action :action-stop) "stop")
2877: ((eq action :action-abort) "abort")
2878: ((eq action :action-kill) "kill")
2879: ((eq action :action-exit) "exit"))))
2880: (when action
2881: (let ((cmd (format "%s/net/link" action)))
2882: (syd--stat (syd--rule cmd addr ?+))))))
2883:
2884: (defun syd-net-link-del (action addr)
2885: "Remove the first matching net/link sandboxing actionlist entry.
2886: ACTION is a constant representing the sandboxing action.
2887: ADDR is a string representing the address pattern."
2888: (let ((action (cond
2889: ((eq action :action-allow) "allow")
2890: ((eq action :action-warn) "warn")
2891: ((eq action :action-filter) "filter")
2892: ((eq action :action-deny) "deny")
2893: ((eq action :action-panic) "panic")
2894: ((eq action :action-stop) "stop")
2895: ((eq action :action-abort) "abort")
2896: ((eq action :action-kill) "kill")
2897: ((eq action :action-exit) "exit"))))
2898: (when action
2899: (let ((cmd (format "%s/net/link" action)))
2900: (syd--stat (syd--rule cmd addr ?-))))))
2901:
2902: (defun syd-net-link-rem (action addr)
2903: "Remove all matching net/link sandboxing actionlist entries.
2904: ACTION is a constant representing the sandboxing action.
2905: ADDR is a string representing the address pattern."
2906: (let ((action (cond
2907: ((eq action :action-allow) "allow")
2908: ((eq action :action-warn) "warn")
2909: ((eq action :action-filter) "filter")
2910: ((eq action :action-deny) "deny")
2911: ((eq action :action-panic) "panic")
2912: ((eq action :action-stop) "stop")
2913: ((eq action :action-abort) "abort")
2914: ((eq action :action-kill) "kill")
2915: ((eq action :action-exit) "exit"))))
2916: (when action
2917: (let ((cmd (format "%s/net/link" action)))
2918: (syd--stat (syd--rule cmd addr ?^))))))
2919:
2920: (defun syd-force-add (path alg hash action)
2921: "Add an entry to the Integrity Force map for Force Sandboxing.
2922: PATH is a fully-qualified file name.
2923: ALG is the hash algorithm (e.g. \"sha256\").
2924: HASH is a hexadecimal encoded checksum.
2925: ACTION is one of `:action-warn', `:action-filter', `:action-deny',
2926: `:action-panic', `:action-stop', `:action-abort', `:action-kill' or
2927: `:action-exit'."
2928: (let ((action (cond ((eq action :action-warn) "warn")
2929: ((eq action :action-filter) "filter")
2930: ((eq action :action-deny) "deny")
2931: ((eq action :action-panic) "panic")
2932: ((eq action :action-stop) "stop")
2933: ((eq action :action-abort) "abort")
2934: ((eq action :action-kill) "kill")
2935: ((eq action :action-exit) "exit"))))
2936: (when action
2937: (let ((cmd (format "/dev/syd/force+%s:%s:%s:%s" path alg hash action)))
2938: (syd--stat cmd)))))
2939:
2940: (defun syd-force-del (path)
2941: "Remove an entry from the Integrity Force map for Force Sandboxing.
2942: PATH is a fully-qualified file name."
2943: (let ((cmd (format "/dev/syd/force-%s" path)))
2944: (syd--stat cmd)))
2945:
2946: (defun syd-force-clr ()
2947: "Clear the Integrity Force map for Force Sandboxing."
2948: (syd--stat "/dev/syd/force^"))
2949:
2950: (defun syd-mem-max (size)
2951: "Set syd maximum per-process memory usage limit.
2952: SIZE can be an integer or a string representing the memory limit."
2953: (let ((size-str (cond ((integerp size) (number-to-string size))
2954: ((stringp size) size)
2955: (t (error "Size must be an integer or a string")))))
2956: (syd--stat (syd--rule "mem/max" size-str ?:))))
2957:
2958: (defun syd-mem-vm-max (size)
2959: "Set syd maximum per-process virtual memory usage limit.
2960: SIZE can be an integer or a string representing the memory limit."
2961: (let ((size-str (cond ((integerp size) (number-to-string size))
2962: ((stringp size) size)
2963: (t (error "Size must be an integer or a string")))))
2964: (syd--stat (syd--rule "mem/vm_max" size-str ?:))))
2965:
2966: (defun syd-pid-max (size)
2967: "Set syd maximum process ID limit for PID sandboxing.
2968: SIZE is a number representing the PID limit."
2969: (unless (numberp size)
2970: (error "Size must be a number"))
2971: (let ((path (format "/dev/syd/pid/max:%d" size)))
2972: (syd--stat path)))
2973:
2974: (defun syd-pipe-max (size)
2975: "Set syd maximum pipe(2) buffer size in bytes.
2976: The value may be lowered but not raised at runtime, and must be at
2977: least 512, the POSIX minimum.
2978: SIZE is a number representing the pipe buffer size."
2979: (unless (numberp size)
2980: (error "Size must be a number"))
2981: (let ((path (format "/dev/syd/pipe/max:%d" size)))
2982: (syd--stat path)))
2983:
2984: (defun syd-xattr-max (size)
2985: "Set syd maximum extended attribute value size in bytes.
2986: SIZE is a number representing the extended attribute value size."
2987: (unless (numberp size)
2988: (error "Size must be a number"))
2989: (let ((path (format "/dev/syd/xattr/max:%d" size)))
2990: (syd--stat path)))
2991:
2992: (defun syd-segvguard-expiry (timeout)
2993: "Specify SegvGuard entry expiry timeout in seconds.
2994: Setting this timeout to 0 effectively disables SegvGuard.
2995: TIMEOUT is a number representing the timeout in seconds."
2996: (unless (numberp timeout)
2997: (error "Timeout must be a number"))
2998: (let ((path (format "/dev/syd/segvguard/expiry:%d" timeout)))
2999: (syd--stat path)))
3000:
3001: (defun syd-segvguard-suspension (timeout)
3002: "Specify SegvGuard entry suspension timeout in seconds.
3003: TIMEOUT is a number representing the timeout in seconds."
3004: (unless (numberp timeout)
3005: (error "Timeout must be a number"))
3006: (let ((path (format "/dev/syd/segvguard/suspension:%d" timeout)))
3007: (syd--stat path)))
3008:
3009: (defun syd-segvguard-maxcrashes (limit)
3010: "Specify SegvGuard max number of crashes before suspension.
3011: LIMIT is a number representing the crash limit."
3012: (unless (numberp limit)
3013: (error "Limit must be a number"))
3014: (let ((path (format "/dev/syd/segvguard/maxcrashes:%d" limit)))
3015: (syd--stat path)))
3016:
3017: (defun syd-exec (file argv)
3018: "Execute a command outside the sandbox without sandboxing.
3019: FILE is the file path of the command as a string.
3020: ARGV is a list of strings representing the arguments to the command."
3021: (unless (stringp file)
3022: (error "File must be a string"))
3023: (let ((all-strings t))
3024: (dolist (arg argv)
3025: (unless (stringp arg)
3026: (setq all-strings nil)))
3027: (unless all-strings
3028: (error "All elements in ARGV must be strings")))
3029:
3030: (let ((cmd (mapconcat 'identity (cons file argv) "\x1F")))
3031: (syd--stat (concat "/dev/syd/cmd/exec!" cmd))))
3032:
3033: (defun syd--rule (rule elem op)
3034: "Helper function to construct a path for syd operations.
3035: RULE is a string representing the rule.
3036: ELEM is a string representing the element.
3037: OP is a character representing the operation."
3038: (unless (member op '(?+ ?- ?^ ?:))
3039: (error "Invalid operation"))
3040: (when (string-empty-p elem)
3041: (error "Element cannot be empty"))
3042: (concat "/dev/syd/" rule (char-to-string op) elem))
3043:
3044: (defun syd--stat (path)
3045: "Issue a single virtual syd stat(2) on PATH and report success."
3046: (condition-case nil
3047: (and (file-modes path 'nofollow) t)
3048: (error nil))) ; On error, return nil
3049:
3050: ;
3051: ; syd-3-mode: Font-lock highlighting for Syd v3 profiles (.syd-3 files).
3052: ;
3053:
3054: (defgroup syd-3 nil
3055: "Syntax highlighting for Syd v3 profiles."
3056: :group 'languages
3057: :prefix "syd-3-")
3058:
3059: (defface syd-3-error '((t :inherit error))
3060: "Face for an invalid syd-3 command, sub-key or value." :group 'syd-3)
3061: (defface syd-3-comment '((t :inherit font-lock-comment-face))
3062: "Face for a syd-3 comment." :group 'syd-3)
3063: (defface syd-3-identifier '((t :inherit font-lock-function-name-face))
3064: "Face for a syd-3 command name and its structural punctuation." :group 'syd-3)
3065: (defface syd-3-boolean '((t :inherit font-lock-constant-face))
3066: "Face for a syd-3 boolean value." :group 'syd-3)
3067: (defface syd-3-number '((t :inherit font-lock-constant-face))
3068: "Face for a syd-3 numeric value: integer, size, duration or port." :group 'syd-3)
3069: (defface syd-3-string '((t :inherit font-lock-string-face))
3070: "Face for a syd-3 string or path value." :group 'syd-3)
3071: (defface syd-3-constant '((t :inherit font-lock-constant-face))
3072: "Face for a syd-3 network address value." :group 'syd-3)
3073: (defface syd-3-type '((t :inherit font-lock-type-face))
3074: "Face for a syd-3 enumerated keyword value: none, tmpfs, an alias, ..." :group 'syd-3)
3075: (defface syd-3-special '((t :inherit font-lock-builtin-face))
3076: "Face for a syd-3 special value: action, netlink family, ioctl const, ..." :group 'syd-3)
3077:
3078: (defvar syd-3-font-lock-keywords
3079: (let* ((caps "all-lnx\\|all-nx\\|all-lx\\|all-ln\\|all-l\\|all-n\\|all-x\\|all\\|lpath\\|npath\\|rpath\\|wpath\\|cpath\\|dpath\\|spath\\|tpath\\|fown\\|fattr\\|inet\\|bnet\\|cnet\\|snet\\|exec\\|force\\|lock\\|mem\\|pid\\|proxy\\|pty\\|tpe\\|fs\\|walk\\|list\\|stat\\|read\\|write\\|ioctl\\|create\\|delete\\|rename\\|readlink\\|symlink\\|truncate\\|chdir\\|readdir\\|mkdir\\|rmdir\\|chown\\|chgrp\\|chmod\\|chattr\\|chroot\\|notify\\|utime\\|mkbdev\\|mkcdev\\|mkfifo\\|mktemp\\|net/bind\\|net/connect\\|net/sendfd\\|net")
3080: (dcaps (concat caps "\\|block\\|segvguard"))
3081: (ns "all\\|mount\\|uts\\|ipc\\|user\\|pid\\|net\\|cgroup\\|time")
3082: (act "allow\\|warn\\|filter\\|deny\\|panic\\|stop\\|abort\\|kill\\|exit")
3083: (fc "all-lnx\\|all-nx\\|all-lx\\|all-ln\\|all-l\\|all-n\\|all-x\\|all\\|lpath\\|npath\\|rpath\\|wpath\\|cpath\\|dpath\\|spath\\|tpath\\|fown\\|fattr\\|fs\\|walk\\|list\\|stat\\|read\\|write\\|exec\\|create\\|delete\\|rename\\|readlink\\|symlink\\|truncate\\|chdir\\|readdir\\|mkdir\\|rmdir\\|chown\\|chgrp\\|chmod\\|chattr\\|chroot\\|notify\\|utime\\|mkbdev\\|mkcdev\\|mkfifo\\|mktemp")
3084: (nc "net\\|inet\\|bnet\\|cnet\\|snet")
3085: (nsub "bind\\|connect\\|sendfd")
3086: (proto "tcp[46]?\\|udp[46]?\\|net[46]?\\|unix\\(?:gram\\|packet\\)?\\|\\${[^}]+}")
3087: (svc "[0-9]+\\(?:-[0-9]+\\)?\\(?:,[0-9]+\\(?:-[0-9]+\\)?\\)*\\|\\*\\|\\${[^}]+}")
3088: (lc "all-x\\|all\\|rpath\\|wpath\\|cpath\\|dpath\\|spath\\|tpath\\|inet\\|read\\|write\\|exec\\|ioctl\\|create\\|delete\\|rename\\|symlink\\|truncate\\|readdir\\|mkdir\\|rmdir\\|mkbdev\\|mkcdev\\|mkfifo\\|bind\\|connect\\|net\\|bnet\\|cnet")
3089: (clist (lambda (s) (concat "\\(?:" s "\\)\\(?:,\\(?:" s "\\)\\)*")))
3090: (fm (concat "\\(?:" fc "\\|" nc "\\)"))
3091: (link "all\\|route\\|usersock\\|firewall\\|sock_diag\\|nflog\\|xfrm\\|selinux\\|iscsi\\|audit\\|fib_lookup\\|inet_diag\\|connector\\|netfilter\\|ip6_fw\\|dnrtmsg\\|kobject_uevent\\|generic\\|scsitransport\\|ecryptfs\\|rdma\\|crypto\\|smc")
3092: (halg "blake2b-160\\|blake2b-256\\|blake2b-384\\|blake2b-512\\|blake2s-128\\|blake2s-256\\|blake3\\|crc32c\\|crc32\\|crc64\\|gost94\\|keccak256\\|keccak512\\|md4\\|md5\\|rmd128\\|rmd160\\|rmd256\\|rmd320\\|sha1\\|sha224\\|sha256\\|sha3-224\\|sha3-256\\|sha3-384\\|sha3-512\\|sha384\\|sha512\\|sm3\\|streebog256\\|streebog512\\|tiger2\\|tiger\\|wp256\\|wp384\\|wp512")
3093: (sev "emerg\\|alert\\|crit\\|error\\|warn\\|notice\\|info\\|debug")
3094: (tsafe "allow_safe_bind\\|allow_safe_setuid\\|allow_safe_setgid\\|allow_safe_syslog\\|deny_dotdot\\|deny_exec_elf32\\|deny_exec_elf_dynamic\\|deny_exec_elf_norelro\\|deny_exec_elf_static\\|deny_exec_script\\|deny_passrights\\|deny_tsc\\|deny_vdso\\|exit_wait_all\\|force_cloexec\\|force_local_net\\|force_no_symlinks\\|force_rand_fd\\|force_ro_open\\|force_wx_open\\|force_no_magiclinks\\|force_no_xdev\\|sync_seccomp")
3095: (tunsafe "allow_unsafe_any_addr\\|allow_unsafe_arch_prctl\\|allow_unsafe_bind\\|allow_unsafe_cap_fixup\\|allow_unsafe_caps\\|allow_unsafe_cbpf\\|allow_unsafe_cbpf_speculative\\|allow_unsafe_chown\\|allow_unsafe_chroot\\|allow_unsafe_copy\\|allow_unsafe_cpu\\|allow_unsafe_create\\|allow_unsafe_deleted\\|allow_unsafe_deprecated\\|allow_unsafe_dumpable\\|allow_unsafe_ebpf\\|allow_unsafe_env\\|allow_unsafe_exec_interactive\\|allow_unsafe_exec_ldso\\|allow_unsafe_exec_libc\\|allow_unsafe_exec_memory\\|allow_unsafe_exec_nopie\\|allow_unsafe_exec_noreg\\|allow_unsafe_exec_null\\|allow_unsafe_exec_script\\|allow_unsafe_exec_speculative\\|allow_unsafe_exec_stack\\|allow_unsafe_exec_textrel\\|allow_unsafe_fcntl\\|allow_unsafe_filename\\|allow_unsafe_futex\\|allow_unsafe_hardlinks\\|allow_unsafe_ip_pktinfo\\|allow_unsafe_ip_retopts\\|allow_unsafe_ipv6_rthdr\\|allow_unsafe_ipv6_scope\\|allow_unsafe_kcapi\\|allow_unsafe_kcmp\\|allow_unsafe_keyring\\|allow_unsafe_kptr\\|allow_unsafe_machine_id\\|allow_unsafe_madvise\\|allow_unsafe_magiclinks\\|allow_unsafe_memfd\\|allow_unsafe_mkbdev\\|allow_unsafe_mkcdev\\|allow_unsafe_msgqueue\\|allow_unsafe_netlink\\|allow_unsafe_nice\\|allow_unsafe_nocookie\\|allow_unsafe_nomseal\\|allow_unsafe_notify_bdev\\|allow_unsafe_notify_cdev\\|allow_unsafe_noxom\\|allow_unsafe_numa\\|allow_unsafe_oob\\|allow_unsafe_open_kfd\\|allow_unsafe_open_path\\|allow_unsafe_open_suid\\|allow_unsafe_page_cache\\|allow_unsafe_perf\\|allow_unsafe_perm_msgqueue\\|allow_unsafe_perm_shm\\|allow_unsafe_personality\\|allow_unsafe_pipe\\|allow_unsafe_pivot_root\\|allow_unsafe_pkey\\|allow_unsafe_prctl\\|allow_unsafe_proc_dumpable\\|allow_unsafe_proc_files\\|allow_unsafe_proc_name\\|allow_unsafe_prlimit\\|allow_unsafe_proc_pid_status\\|allow_unsafe_ptrace\\|allow_unsafe_recvmsg\\|allow_unsafe_rseq\\|allow_unsafe_sendfd_bdev\\|allow_unsafe_sendfd_cdev\\|allow_unsafe_sendfd_dir\\|allow_unsafe_sendfd_fifo\\|allow_unsafe_sendfd_magiclink\\|allow_unsafe_sendfd_memfd\\|allow_unsafe_sendfd_misc\\|allow_unsafe_sendfd_secretmem\\|allow_unsafe_sendfd_socket\\|allow_unsafe_sendfd_symlink\\|allow_unsafe_setid\\|allow_unsafe_setsockopt\\|allow_unsafe_shm\\|allow_unsafe_socket\\|allow_unsafe_socketcall\\|allow_unsafe_stat_bdev\\|allow_unsafe_stat_cdev\\|allow_unsafe_sticky\\|allow_unsafe_sud\\|allow_unsafe_symlinks\\|allow_unsafe_sys_ptrace\\|allow_unsafe_sysinfo\\|allow_unsafe_syslog\\|allow_unsafe_tcp_devmem\\|allow_unsafe_tcp_fastopen\\|allow_unsafe_time\\|allow_unsafe_uname\\|allow_unsafe_vmsplice\\|allow_unsafe_xattr\\|allow_unsupp_cmsg\\|allow_unsupp_socket")
3096: (rlk "as\\|core\\|cpu\\|data\\|fsize\\|memlock\\|msgqueue\\|nice\\|nofile\\|nproc\\|rtprio\\|rttime\\|sigpending\\|stack")
3097: (bool "\\(?:1\\|on\\|t\\|tr\\|tru\\|true\\|✓\\|0\\|off\\|f\\|fa\\|fal\\|fals\\|false\\|✗\\)")
3098: (lock "\\(?:on\\|off\\|exec\\|ipc\\|drop\\|read-only\\|readonly\\|read\\|ro\\|1\\|0\\|x\\|r\\|i\\|d\\)")
3099: (int "[-+]?[0-9]+")
3100: (uint "[0-9]+")
3101: (size "[0-9]+[kKmMgGtTpP]?[bB]?")
3102: (dur "[0-9]+\\(?:\\.[0-9]+\\)?\\(?:us\\|ms\\|s\\|m\\|h\\|d\\|w\\)?")
3103: (dn "\\(?:[A-Za-z][A-Za-z0-9_]\\{0,15\\}\\|\\(?:[A-Za-z0-9_]*${[^}]*}\\)+[A-Za-z0-9_]*\\)")
3104: (ds (concat "\\(?:@" dn "\\|[^@ \t].*\\)"))
3105: (id '(0 'syd-3-identifier))
3106: (bln '(1 'syd-3-boolean t)) (num '(1 'syd-3-number t)) (str '(1 'syd-3-string t))
3107: (con '(1 'syd-3-constant t)) (typ '(1 'syd-3-type t)) (spc '(1 'syd-3-special t))
3108: (caplist (funcall clist caps))
3109: (dclist (funcall clist dcaps))
3110: (nslist (funcall clist ns))
3111: (fmlist (funcall clist fm))
3112: (nclist (funcall clist nc))
3113: (lclist (funcall clist lc))
3114: (an (concat "^\\(?9:@" dn "\\)/"))
3115: (nm '(9 'syd-3-type t))
3116: (truthy "1\\|on\\|t\\|tr\\|tru\\|true\\|✓")
3117: (scaps (concat "\\(?:\\(?:" caps "\\),\\)*\\(?:lock\\|proxy\\|pty\\)\\(?:,\\(?:" caps "\\)\\)*")))
3118: (list
3119: (list "^[ \t]*#.*$" '(0 'syd-3-comment))
3120: (list (concat "^lock:\\(?1:" lock "\\)$") id bln)
3121: (list "^\\(?:l\\|lock\\|stat\\|dump\\|panic\\|ghost\\)$" id)
3122: (list "^ipc:\\(?1:.+\\)$" id str)
3123: (list "^ipc/\\(?:uid\\|gid\\):\\(?1:none\\)$" id typ)
3124: (list (concat "^ipc/\\(?:uid\\|gid\\|max\\):\\(?1:" int "\\)$") id num)
3125: (list (concat "^ipc/idle:\\(?1:" dur "\\)$") id num)
3126: (list (concat "^log/level:\\(?1:" sev "\\)$") id typ)
3127: (list (concat "^log/level:\\(?1:" uint "\\)$") id num)
3128: (list (concat "^log/\\(?:verbose\\|rlimit_burst\\):\\(?1:" uint "\\)$") id num)
3129: (list (concat "^log/rlimit_interval:\\(?1:" dur "\\)$") id num)
3130: (list (concat "^log/lock/\\(?:same_exec_off\\|new_exec_on\\|subdomains_off\\):\\(?1:" bool "\\)$") id bln)
3131: (list "^pty/\\(?:row\\|col\\):\\(?1:none\\)$" id typ)
3132: (list (concat "^pty/\\(?:row\\|col\\):\\(?1:" uint "\\)$") id num)
3133: (list (concat "^mem/\\(?:max\\|vm_max\\):\\(?1:" size "\\)$") id num)
3134: (list (concat "^pid/max:\\(?1:" uint "\\)$") id num)
3135: (list (concat "^\\(?:mem\\|pid\\)/kill:\\(?1:" bool "\\)$") id bln)
3136: (list (concat "^rlimit/\\(?:" rlk "\\):.+$") id)
3137: (list (concat "^segvguard/\\(?:expiry\\|suspension\\|maxcrashes\\):\\(?1:" dur "\\)$") id num)
3138: (list (concat "^tpe/\\(?:negate\\|root_owned\\|user_owned\\|root_mount\\):\\(?1:" bool "\\)$") id bln)
3139: (list (concat "^tpe/gid:\\(?1:" uint "\\)$") id num)
3140: (list "^tpe/gid:none$" id)
3141: (list "^proxy/addr:\\(?1:.+\\)$" id con)
3142: (list (concat "^proxy/\\(?:port\\|ext/port\\):\\(?1:" int "\\)$") id num)
3143: (list "^proxy/ext/\\(?:host\\|unix\\):\\(?1:.+\\)$" id str)
3144: (list "^time:\\(?1:none\\)$" id typ)
3145: (list (concat "^time:\\(?1:" int "\\)$") id num)
3146: (list (concat "^time/\\(?:boot\\|mono\\):\\(?1:" int "\\)$") id num)
3147: (list "^timeout:\\(?1:none\\)$" id typ)
3148: (list (concat "^timeout:\\(?1:" dur "\\)$") id num)
3149: (list "^uts/\\(?:host\\|domain\\|version\\):\\(?1:.+\\)$" id str)
3150: (list "^root:\\(?1:/.*\\)$" id str)
3151: (list "^root:\\(?1:tmpfs\\|tmp\\|t\\|ramfs\\|ram\\|r\\|none\\|off\\)$" id typ)
3152: (list (concat "^root/\\(?:fake\\|map\\):\\(?1:" bool "\\)$") id bln)
3153: (list "^workdir:\\(?1:/.*\\)$" id str)
3154: (list "^workdir:\\(?1:none\\|off\\)$" id typ)
3155: (list (concat "^sandbox/\\(?:" caplist "\\):\\(?1:" bool "\\)$") id bln)
3156: (list (concat "^sandbox/\\(?:" caplist "\\)\\?$") id)
3157: (list (concat "^unshare/\\(?:" nslist "\\):\\(?1:" bool "\\)$") id bln)
3158: (list (concat "^unshare/\\(?:" nslist "\\)\\?$") id)
3159: (list (concat "^default/\\(?:" dclist "\\):\\(?1:" act "\\)$") id spc)
3160: (list (concat "^trace/\\(?:" tsafe "\\|" tunsafe "\\):\\(?1:" bool "\\)$") id bln)
3161: (list "^trace/force_umask:\\(?1:-1\\|off\\|f\\|fa\\|fal\\|fals\\|false\\|✗\\|[0-7]+\\)$" id num)
3162: (list "^trace/memory_access:\\(?1:[012]\\)$" id num)
3163: (list (concat "^trace/allow_unsafe_namespace:\\(?1:all\\|none\\|off\\|" (funcall clist ns) "\\)$") id typ)
3164: (list "^setenv!.*$" id)
3165: (list "^unsetenv!.*$" id)
3166: (list "^clearenv!$" id)
3167: (list "^passenv[-+^].*$" id)
3168: (list "^cmd/exec!.*$" id)
3169: (list "^mask[-+^].*$" id)
3170: (list "^block[-+^!].*$" id)
3171: (list "^force[-^].*$" id)
3172: (list (concat "^force\\+/[^:]+:\\(?:" halg "\\):[0-9a-fA-F]+\\(?::[a-z]+\\)?$") id)
3173: (list "^set[ug]id[-+^].*$" id)
3174: (list "^bind\\(?:-try\\)?[-+^].*$" id)
3175: (list "^\\(?:sym\\)?link\\(?:-try\\)?[-+^].*$" id)
3176: (list "^mkdir\\(?:-try\\)?[-+^].*$" id)
3177: (list "^mkfile\\(?:-try\\)?[-+^].*$" id)
3178: (list "^mkfifo\\(?:-try\\)?[-+^].*$" id)
3179: (list "^\\(?:allow\\|deny\\)/ioctl[-+]\\(?1:0x[0-9A-Fa-f]+\\|0o[0-7]+\\|[0-9]+\\)$" id num)
3180: (list "^\\(?:allow\\|deny\\)/ioctl[-+]\\(?1:[A-Z][A-Z0-9_]+!?\\)$" id spc)
3181: (list "^allow/uring/\\(?:op\\|reg\\|flag\\)[-+^]\\(?1:[a-z][a-z0-9_]*\\(?:,[a-z][a-z0-9_]*\\)*\\)?$" id con)
3182: (list (concat "^allow/net/link[-+^]\\(?1:" link "\\)$") id spc)
3183: (list (concat "^allow/lock/\\(?:" lclist "\\)[-+^]\\(?1:[0-9]+\\(?:-[0-9]+\\)?\\(?:,[0-9]+\\(?:-[0-9]+\\)?\\)*\\)$") id num)
3184: (list (concat "^allow/lock/\\(?:" lclist "\\)[-+^]\\(?1:/.*\\)$") id str)
3185: (list (concat "^\\(?:" act "\\)/\\(?:" fmlist "\\)[-+^]\\(?1:.+\\)$") id str)
3186: (list (concat "^\\(?:" act "\\)/\\(?:\\(?:" nclist "\\)\\|net/\\(?:" nsub "\\)\\)[-+^]\\(?1:" proto "\\)[!@]\\(?2:!unknown\\|!unnamed\\|[^! \t]+\\)\\(?3:!\\(?:" svc "\\)\\)?$")
3187: id typ '(2 'syd-3-constant t) '(3 'syd-3-number t t))
3188: (list (concat "^\\(?:" act "\\)/\\(?:\\(?:" nclist "\\)\\|net/\\(?:" nsub "\\)\\)[-+^]\\(?1:[^!@]+\\)\\(?2:[!@][0-9,-]+\\)?$")
3189: id con '(2 'syd-3-number t t))
3190: (list "^include .*$" id)
3191: (list "^include_profile .*$" id)
3192: (list "^domain\\^$" id)
3193: (list (concat "^domain[-+]\\(?1:@" dn "\\)\\(?2::" ds "\\)?$") id typ '(2 'syd-3-string t t))
3194: (list (concat "^move/\\(?1:@" dn "\\)/\\(?:exec\\|mmap\\|chdir\\|exit\\)\\(?:\\^$\\|[-+]\\(?2:[^ \t].*\\)$\\)")
3195: id typ '(2 'syd-3-string t t))
3196: (list (concat "^move/\\(?1:@" dn "\\)/\\(?:bind\\|connect\\|accept\\)[-+]\\(?2:" proto "\\)[!@]\\(?3:!unknown\\|!unnamed\\|[^! \t]+\\)\\(?4:!\\(?:" svc "\\)\\)?$")
3197: id typ '(2 'syd-3-type t) '(3 'syd-3-constant t t) '(4 'syd-3-number t t))
3198: (list (concat "^move/\\(?1:@" dn "\\)/\\(?:bind\\|connect\\|accept\\)\\(?:\\^$\\|[-+]\\(?2:[^! \t]+\\)\\(?3:![0-9-]+\\)?$\\)")
3199: id typ '(2 'syd-3-constant t t) '(3 'syd-3-number t t))
3200: (list (concat "^move/\\(?1:@" dn "\\)/\\(?:bind\\|connect\\)[-+]\\(?2:\\(?:[/@]\\|!unknown\\|!unnamed\\)[^ \t]*\\)$")
3201: id typ '(2 'syd-3-string t t))
3202: (list (concat "^cmd/move!\\(?1:@?" dn "\\)$") id typ)
3203: (list (concat an "sandbox/\\(?:" caplist "\\):\\(?1:" bool "\\)$") id nm bln)
3204: (list (concat an "sandbox/\\(?:" caplist "\\)\\?$") id nm)
3205: (list (concat "^@[^/ \t]+/sandbox/\\(?:" scaps "\\):\\(?:" truthy "\\)$") '(0 'syd-3-error t))
3206: (list (concat an "default/\\(?:" dclist "\\):\\(?1:" act "\\)$") id nm spc)
3207: (list (concat an "\\(?:" act "\\)/\\(?:" fmlist "\\)[-+^]\\(?1:.+\\)$") id nm str)
3208: (list (concat an "\\(?:" act "\\)/\\(?:\\(?:" nclist "\\)\\|net/\\(?:" nsub "\\)\\)[-+^]\\(?1:" proto "\\)[!@]\\(?2:!unknown\\|!unnamed\\|[^! \t]+\\)\\(?3:!\\(?:" svc "\\)\\)?$")
3209: id nm typ '(2 'syd-3-constant t) '(3 'syd-3-number t t))
3210: (list (concat an "\\(?:" act "\\)/\\(?:\\(?:" nclist "\\)\\|net/\\(?:" nsub "\\)\\)[-+^]\\(?1:[^!@]+\\)\\(?2:[!@][0-9,-]+\\)?$")
3211: id nm con '(2 'syd-3-number t t))
3212: (list (concat an "\\(?:allow\\|deny\\)/ioctl[-+]\\(?1:0x[0-9A-Fa-f]+\\|0o[0-7]+\\|[0-9]+\\)$") id nm num)
3213: (list (concat an "\\(?:allow\\|deny\\)/ioctl[-+]\\(?1:[A-Z][A-Z0-9_]+!?\\)$") id nm spc)
3214: (list (concat an "\\(?:mem\\|pid\\)/kill:\\(?1:" bool "\\)$") id nm bln)
3215: (list (concat an "mem/\\(?:max\\|vm_max\\):\\(?1:" size "\\)$") id nm num)
3216: (list (concat an "pid/max:\\(?1:" uint "\\)$") id nm num)
3217: (list (concat an "tpe/\\(?:negate\\|root_owned\\|user_owned\\|root_mount\\):\\(?1:" bool "\\)$") id nm bln)
3218: (list (concat an "tpe/gid:\\(?1:" uint "\\)$") id nm num)
3219: (list (concat an "tpe/gid:none$") id nm)
3220: (list (concat an "segvguard/\\(?:expiry\\|suspension\\|maxcrashes\\):\\(?1:" dur "\\)$") id nm num)
3221: (list (concat an "uts/\\(?:host\\|domain\\|version\\):\\(?1:.+\\)$") id nm str)
3222: (list (concat an "mask[-+^].*$") id nm)
3223: (list (concat an "block[-+^!].*$") id nm)
3224: (list (concat an "force[-^].*$") id nm)
3225: (list (concat an "force\\+/[^:]+:\\(?:" halg "\\):[0-9a-fA-F]+\\(?::[a-z]+\\)?$") id nm)
3226: (list (concat an "\\(?:stat\\|dump\\)$") id nm)
3227: (list (concat an "include .*$") id nm)
3228: (list (concat an "include_profile .*$") id nm)
3229: (list (concat an "move/\\(?1:@" dn "\\)/\\(?:exec\\|mmap\\|chdir\\|exit\\)\\(?:\\^$\\|[-+]\\(?2:[^ \t].*\\)$\\)")
3230: id nm typ '(2 'syd-3-string t t))
3231: (list (concat an "move/\\(?1:@" dn "\\)/\\(?:bind\\|connect\\|accept\\)[-+]\\(?2:" proto "\\)[!@]\\(?3:!unknown\\|!unnamed\\|[^! \t]+\\)\\(?4:!\\(?:" svc "\\)\\)?$")
3232: id nm typ '(2 'syd-3-type t) '(3 'syd-3-constant t t) '(4 'syd-3-number t t))
3233: (list (concat an "move/\\(?1:@" dn "\\)/\\(?:bind\\|connect\\|accept\\)\\(?:\\^$\\|[-+]\\(?2:[^! \t]+\\)\\(?3:![0-9-]+\\)?$\\)")
3234: id nm typ '(2 'syd-3-constant t t) '(3 'syd-3-number t t))
3235: (list (concat an "move/\\(?1:@" dn "\\)/\\(?:bind\\|connect\\)[-+]\\(?2:\\(?:[/@]\\|!unknown\\|!unnamed\\)[^ \t]*\\)$")
3236: id nm typ '(2 'syd-3-string t t))
3237: (list "^.+$" '(0 'syd-3-error))))
3238: "Font-lock keywords for `syd-3-mode'.
3239: Valid commands are highlighted (their value by colour class) the final
3240: catch-all flags any remaining line as an error.")
3241:
3242: ;###autoload
3243: (define-derived-mode syd-3-mode prog-mode "Syd3"
3244: "Major mode for editing Syd v3 profiles (.syd-3 files)."
3245: (setq-local comment-start "#")
3246: (setq-local comment-start-skip "#+[ \t]*")
3247: (setq-local font-lock-defaults '(syd-3-font-lock-keywords t nil)))
3248:
3249: ;###autoload
3250: (add-to-list 'auto-mode-alist '("\\.syd-3\\'" . syd-3-mode))
3251:
3252: (defun syd-3--value-classes (line)
3253: "Fontify LINE in `syd-3-mode' and report its highlighting."
3254: (let ((g2c '((syd-3-boolean . "B") (syd-3-number . "N") (syd-3-string . "S")
3255: (syd-3-constant . "C") (syd-3-type . "T") (syd-3-special . "P"))))
3256: (with-temp-buffer
3257: (insert line)
3258: (syd-3-mode)
3259: (font-lock-ensure)
3260: (let ((err nil) (classes '()) (pos (point-min)))
3261: (while (< pos (point-max))
3262: (let* ((face (get-text-property pos 'face))
3263: (class (cdr (assq face g2c))))
3264: (when (eq face 'syd-3-error) (setq err t))
3265: (when (and class (not (member class classes)))
3266: (setq classes (cons class classes))))
3267: (setq pos (1+ pos)))
3268: (cons err classes)))))
3269:
3270: (defconst syd-3--syntax-cases
3271: '(("lock:on" nil "B") ("lock:drop" nil "B") ("l" nil) ("lock" nil)
3272: ("stat" nil) ("dump" nil) ("panic" nil) ("ghost" nil)
3273: ("ipc:@/run/syd.sock" nil "S") ("ipc:none" nil) ("ipc/uid:1000" nil "N")
3274: ("ipc/uid:none" nil "T") ("ipc/gid:0" nil "N") ("ipc/max:64" nil "N")
3275: ("ipc/idle:30" nil "N") ("ipc/idle:5m" nil "N")
3276: ("log/level:debug" nil "T") ("log/verbose:3" nil "N") ("log/rlimit_burst:5" nil "N")
3277: ("log/rlimit_interval:5s" nil "N") ("log/lock/new_exec_on:1" nil "B")
3278: ("log/lock/same_exec_off:true" nil "B")
3279: ("pty/row:80" nil "N") ("pty/col:24" nil "N") ("pty/col:none" nil "T")
3280: ("mem/max:1G" nil "N") ("mem/vm_max:512M" nil "N") ("pid/max:100" nil "N")
3281: ("mem/kill:1" nil "B") ("pid/kill:0" nil "B")
3282: ("rlimit/nofile:1024" nil) ("rlimit/as:1G" nil) ("rlimit/nice:10" nil) ("rlimit/cpu:30" nil)
3283: ("segvguard/expiry:5m" nil "N") ("segvguard/suspension:300" nil "N") ("segvguard/maxcrashes:3" nil "N")
3284: ("tpe/gid:1000" nil "N") ("tpe/gid:none" nil) ("tpe/negate:on" nil "B")
3285: ("tpe/root_owned:off" nil "B") ("tpe/root_mount:1" nil "B") ("tpe/user_owned:true" nil "B")
3286: ("proxy/addr:127.0.0.1" nil "C") ("proxy/port:8080" nil "N") ("proxy/ext/host:example.com" nil "S")
3287: ("proxy/ext/port:443" nil "N") ("proxy/ext/unix:/run/p.sock" nil "S")
3288: ("time:5" nil "N") ("time:-5" nil "N") ("time/boot:100" nil "N") ("time/mono:-42" nil "N")
3289: ("time:none" nil "T") ("timeout:30" nil "N") ("timeout:none" nil "T")
3290: ("uts/host:myhost" nil "S") ("uts/domain:example" nil "S") ("uts/version:1.0" nil "S")
3291: ("root:/newroot" nil "S") ("root:tmpfs" nil "T") ("root:ramfs" nil "T") ("root:none" nil "T")
3292: ("root/map:on" nil "B") ("root/fake:off" nil "B") ("workdir:/home" nil "S")
3293: ("sandbox/fs:on" nil "B") ("sandbox/readlink:on" nil "B") ("sandbox/mkbdev:off" nil "B")
3294: ("sandbox/mkcdev:on" nil "B") ("sandbox/all:on" nil "B") ("sandbox/all-l:on" nil "B")
3295: ("sandbox/all-lnx:on" nil "B") ("sandbox/all-nx:on" nil "B") ("sandbox/all-lx:on" nil "B")
3296: ("sandbox/all-ln:on" nil "B") ("sandbox/all-n:on" nil "B") ("sandbox/all-n:off" nil "B")
3297: ("sandbox/all-x:off" nil "B") ("sandbox/lpath:on" nil "B") ("sandbox/bnet:on" nil "B")
3298: ("sandbox/read,write:off" nil "B") ("sandbox/pty:on" nil "B") ("sandbox/fs?" nil)
3299: ("default/fs:deny" nil "P") ("default/read:allow" nil "P") ("default/readlink:warn" nil "P")
3300: ("default/block:deny" nil "P") ("default/segvguard:kill" nil "P")
3301: ("default/all-l:deny" nil "P") ("default/all-n:warn" nil "P")
3302: ("default/all-x:allow" nil "P")
3303: ("default/all-lnx:kill" nil "P") ("default/all-nx:panic" nil "P")
3304: ("default/all-lx:abort" nil "P") ("default/all-ln:exit" nil "P")
3305: ("default/read,write:deny" nil "P")
3306: ("unshare/mount:on" nil "B") ("unshare/all:on" nil "B") ("unshare/mount,net:off" nil "B")
3307: ("unshare/mount?" nil)
3308: ("trace/allow_unsafe_sys_ptrace:1" nil "B") ("trace/allow_unsafe_ptrace:1" nil "B") ("trace/allow_unsafe_kcmp:1" nil "B") ("trace/allow_unsafe_fcntl:0" nil "B")
3309: ("trace/allow_unsafe_proc_files:on" nil "B") ("trace/allow_unsafe_socketcall:1" nil "B") ("trace/sync_seccomp:1" nil "B")
3310: ("trace/deny_dotdot:on" nil "B") ("trace/force_cloexec:on" nil "B")
3311: ("trace/allow_safe_bind:on" nil "B") ("trace/force_umask:022" nil "N")
3312: ("trace/force_umask:off" nil "N") ("trace/memory_access:2" nil "N")
3313: ("trace/allow_unsafe_namespace:mount,net" nil "T") ("trace/allow_unsafe_namespace:all" nil "T")
3314: ("setenv!FOO=bar" nil) ("unsetenv!FOO" nil) ("clearenv!" nil)
3315: ("passenv+LD_*" nil) ("passenv-FOO" nil) ("passenv^FOO" nil) ("cmd/exec!/bin/echo" nil)
3316: ("mask+/proc:/dev/null" nil) ("mask^" nil)
3317: ("block+1.2.3.0/24" nil) ("block-1.2.3.4" nil) ("block^" nil)
3318: ("force+/usr/bin/x:sha256:deadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0de:deny" nil)
3319: ("force+/usr/bin/x:blake3:deadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0de" nil)
3320: ("force+/usr/bin/x:crc32:deadc0de" nil) ("force+/usr/bin/x:crc32c:deadc0de" nil)
3321: ("force+/usr/bin/x:crc64:deadc0dedeadc0de:kill" nil)
3322: ("force+/usr/bin/x:tiger2:deadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0de" nil)
3323: ("force+/usr/bin/x:rmd320:deadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0de" nil)
3324: ("force+/usr/bin/x:sha3-512:deadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0de" nil)
3325: ("force+/usr/bin/x:streebog256:deadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0dedeadc0de" nil)
3326: ("force+/usr/bin/x:xxhash64:deadc0dedeadc0de" t)
3327: ("force+/usr/bin/x:md6:deadc0dedeadc0dedeadc0dedeadc0de" t)
3328: ("force+/usr/bin/x:sha2:deadc0de" t)
3329: ("force-/usr/bin/x" nil) ("force^" nil)
3330: ("setuid+1000:2000" nil) ("setgid+1000:2000" nil) ("setuid^1000" nil)
3331: ("bind+/src:/dst" nil) ("bind-try+/src:/dst" nil) ("bind-/dst" nil)
3332: ("link+/a:/b" nil) ("link-try+/a:/b" nil) ("symlink+/a:/b" nil) ("symlink-try+/a:/b" nil)
3333: ("link^" nil) ("mkdir+/tmp/d:0755" nil) ("mkdir-try+/tmp/d" nil)
3334: ("mkfile+/tmp/f" nil) ("mkfifo+/tmp/f" nil) ("mkfifo-try+/tmp/f" nil)
3335: ("allow/ioctl+0x5401" nil "N") ("deny/ioctl+TIOCSTI" nil "P") ("allow/ioctl-0o21505" nil "N")
3336: ("allow/uring/op+read,write" nil "C") ("allow/uring/reg+register_files" nil "C")
3337: ("allow/uring/reg-register_probe" nil "C") ("allow/uring/flag+async" nil "C")
3338: ("allow/read+/etc/**" nil "S") ("warn/write+/etc" nil "S") ("filter/exec+/bin/sh" nil "S")
3339: ("deny/stat+/x" nil "S") ("panic/create+/x" nil "S") ("stop/delete+/x" nil "S")
3340: ("abort/rename+/x" nil "S") ("kill/chmod+/x" nil "S") ("exit/chown+/x" nil "S")
3341: ("allow/readlink+/etc" nil "S") ("allow/mkbdev+/dev/x" nil "S") ("allow/mkcdev+/dev/x" nil "S")
3342: ("allow/all-l+/x" nil "S") ("allow/all-n+/x" nil "S") ("allow/all-x+/x" nil "S")
3343: ("allow/all-lnx,lpath+/x" nil "S") ("allow/all-nx+/x" nil "S")
3344: ("allow/all-lx+/x" nil "S") ("allow/all-ln+/x" nil "S")
3345: ("allow/read,write+/x" nil "S")
3346: ("allow/net/bind+1.2.3.4!80" nil "C" "S") ("allow/net/connect+127.0.0.1!443" nil "C" "S")
3347: ("allow/net+1.2.3.4!22" nil "C" "S") ("allow/net/bind+any!80" nil nil "S")
3348: ("allow/inet+loopback" nil nil "S")
3349: ("allow/net/connect+tcp!127.0.0.1!80" nil "T" "S")
3350: ("allow/net/connect+tcp!127.0.0.1!80" nil "C" "S")
3351: ("allow/net/connect+udp!9.9.9.9!53" nil "N" "S")
3352: ("allow/net/bind+tcp6!::1!8080" nil "T" "S")
3353: ("allow/net/connect+net!10.0.0.0/8!22,80,443" nil "N" "S")
3354: ("allow/net/connect+udp!loopback!*" nil "T" "S")
3355: ("allow/net/connect+tcp!*!443" nil "T" "S")
3356: ("allow/net/connect+unix!/run/foo.sock" nil "T")
3357: ("allow/net/bind+unix!@dbus-*" nil "T")
3358: ("allow/net/bind+unixgram!@dbus-*" nil "T")
3359: ("allow/net/sendfd+unix!!unknown" nil "T")
3360: ("allow/net/connect+unix!!unnamed" nil "T")
3361: ("allow/net/connect+tcp!${ADDR}!${PORT}" nil "T")
3362: ("allow/net/connect+tcp!127.0.0.1!${PORT}" nil "T")
3363: ("allow/net/connect+${ADDR}!${PORT}" nil)
3364: ("allow/net/connect+${ADDR}@${PORT}" nil)
3365: ("allow/net/link+route" nil "P") ("allow/net/link+inet_diag" nil "P")
3366: ("allow/lock/read+/etc" nil "S") ("allow/lock/mkbdev+/dev" nil "S")
3367: ("allow/lock/connect+22" nil "N") ("allow/lock/bind+80" nil "N")
3368: ("include /etc/foo.syd-3" nil) ("include_profile linux" nil)
3369: ("domain+@web" nil "T") ("domain+@web:@default" nil "S") ("domain+@sandbox:fs" nil "S")
3370: ("domain+@jail:/etc/jail.syd-3" nil "S") ("domain+@mynet2" nil "T")
3371: ("domain-@web" nil "T") ("domain^" nil)
3372: ("domain+@a" nil "T") ("domain+@WebDomain" nil "T") ("domain+@a_b_2" nil "T")
3373: ("domain+@aaaaaaaaaaaaaaaa" nil "T") ("domain+@${DOM}" nil "T")
3374: ("domain+@web:${SEED}" nil "T") ("domain+@web:@my_other" nil "S")
3375: ("domain+@1web" t) ("domain+@_web" t) ("domain+@my-net" t) ("domain+@my.net" t)
3376: ("domain+@web!" t) ("domain+@web/x" t) ("domain+@aaaaaaaaaaaaaaaaa" t)
3377: ("domain+@web:@bad-seed" t) ("domain+@web:@1bad" t) ("domain-@my-net" t)
3378: ("move/@my-net/exec+/x" t) ("move/@1net/exec+/x" t)
3379: ("move/@aaaaaaaaaaaaaaaaa/exec+/x" t)
3380: ("@my-net/allow/read+/etc" t) ("@1web/sandbox/exec:on" t)
3381: ("cmd/move!my-net" t) ("cmd/move!@my-net" t) ("cmd/move!1web" t)
3382: ("move/@net/exec+/usr/bin/curl" nil "S") ("move/@net/exec+/usr/bin/curl" nil "T")
3383: ("move/@net/exec-/usr/bin/curl" nil "S") ("move/@net/exec^" nil "T")
3384: ("move/@net/mmap+/usr/lib/**.so" nil "S") ("move/@net/chdir+/srv" nil "S")
3385: ("move/@net/exit+/usr/bin/helper" nil "S")
3386: ("move/@mynet/bind+0.0.0.0/0!8080" nil "C") ("move/@net/bind+0.0.0.0/0!8080" nil "N")
3387: ("move/@net/connect+127.0.0.1!443" nil "C") ("move/@net/accept+0.0.0.0/0!1-65535" nil "N")
3388: ("move/@net/bind^" nil "T")
3389: ("move/@net/bind+/run/app.sock" nil "S") ("move/@net/connect+/run/db.sock" nil "S")
3390: ("move/@net/bind+@my.service" nil "S") ("move/@net/connect+@dbus-*" nil "S")
3391: ("move/@net/bind+!unnamed" nil "S")
3392: ("move/@db/connect+tcp!10.0.0.7!5432" nil "T")
3393: ("move/@db/connect+tcp!10.0.0.7!5432" nil "C")
3394: ("move/@db/connect+udp!127.0.0.1!53" nil "N")
3395: ("move/@net/bind+unix!/run/app.sock" nil "T")
3396: ("move/@net/bind+unix!@my.service" nil "T")
3397: ("move/@net/bind+unix!!unknown" nil "T")
3398: ("move/@net/bind+unix!!unnamed" nil "T")
3399: ("move/@db/connect+tcp!${ADDR}!${PORT}" nil "T")
3400: ("cmd/move!web" nil "T") ("cmd/move!@web" nil "T")
3401: ("@web/allow/read+/etc/hosts" nil "T") ("@web/allow/read+/etc/hosts" nil "S")
3402: ("@web/allow/net/bind+1.2.3.4!80" nil "C") ("@web/default/read:allow" nil "P")
3403: ("@web/mem/max:1G" nil "N") ("@web/mem/kill:1" nil "B")
3404: ("@web/segvguard/maxcrashes:3" nil "N") ("@web/uts/host:myhost" nil "S")
3405: ("@web/tpe/gid:1000" nil "N")
3406: ("@db/move/@net/connect+0.0.0.0/0!5432" nil "C") ("@db/move/@net/connect+0.0.0.0/0!5432" nil "N")
3407: ("@web/sandbox/exec:on" nil "B") ("@web/sandbox/lock:off" nil "B") ("@web/sandbox/all:on" nil "B")
3408: ("@web/sandbox/all-l:on" nil "B") ("@web/sandbox/all-n:off" nil "B")
3409: ("@web/sandbox/all-x:on" nil "B") ("@web/sandbox/all-nx:on" nil "B")
3410: ("@web/sandbox/mem:on" nil "B")
3411: ("@web/sandbox/readlink:on" nil "B") ("@web/sandbox/lock?" nil)
3412: ("domain+web" t) ("domain+@" t) ("domain^junk" t) ("move/foo+/x" t) ("move//exec+/x" t)
3413: ("move/@net/bogus+/x" t) ("move/@net/EXEC+/x" t) ("move/@net/exec" t)
3414: ("move/@net/exec^junk" t) ("move/@net/exec+" t) ("cmd/move!" t)
3415: ("@web/domain+@x" t) ("@web/totallyunknown:x" t)
3416: ("@web/lock:on" t) ("@web/timeout:5" t) ("@web/rlimit/nofile:1024" t) ("@web/proxy/port:8080" t)
3417: ("@web/pty/row:80" t) ("@web/ipc/uid:0" t) ("@web/unshare/mount:on" t) ("@web/root:/x" t)
3418: ("@web/workdir:/x" t) ("@web/log/level:debug" t)
3419: ("@web/setenv!FOO=bar" t) ("@web/setuid+1000:2000" t) ("@web/bind+/a:/b" t)
3420: ("@web/link+/a:/b" t) ("@web/mkdir+/d:0755" t) ("@web/allow/lock/read+/x" t)
3421: ("@web/allow/net/link+route" t) ("@web/trace/allow_unsafe_ptrace:1" t)
3422: ("@web/sandbox/lock:on" t) ("@web/sandbox/proxy:on" t)
3423: ("@web/sandbox/pty:true" t) ("@web/sandbox/exec,lock:on" t)
3424: ("totallyunknown:x" t) ("bogusdirective" t) ("sandbox/reaD:on" t) ("sandbox/mkdev:on" t)
3425: ("sandbox/bogus:on" t) ("default/boguscap:deny" t) ("default/mkdev:deny" t)
3426: ("unshare/bogus:on" t) ("uts/bogus:x" t) ("root/bogus:on" t) ("ipc/bogus:1" t)
3427: ("log/bogus:1" t) ("log/lock/bogus:1" t) ("mem/bogus:1" t) ("pid/bogus:1" t)
3428: ("tpe/bogus:on" t) ("segvguard/bogus:1" t) ("proxy/bogus:1" t) ("proxy/ext/bogus:1" t)
3429: ("trace/allow_unsafe_bogus:on" t) ("trace/bogus:on" t)
3430: ("time/bogus:1" t) ("warn/ioctl+foo" t) ("allow/bogus+/x" t) ("allow/net/accept+any" t)
3431: ("allow/net/bogus+any" t) ("allow/lock/bogus+/x" t) ("pty/bogus:1" t)
3432: ("config/bogus:1" t) ("mkbogus+/x" t))
3433: "Syntax-highlighting test cases for `syd-3-mode'.
3434: Each entry is (LINE EXPECT-ERROR [VALUE-CLASS [FORBIDDEN-CLASS]]).")
3435:
3436: (defun syd-3-syntax-test ()
3437: "Run the `syd-3-mode' highlighting suite, report TAP, then exit."
3438: (let ((out (list "TAP version 13"
3439: (format "1..%d" (length syd-3--syntax-cases))))
3440: (count 0)
3441: (failures 0))
3442: (dolist (case syd-3--syntax-cases)
3443: (setq count (1+ count))
3444: (let* ((line (nth 0 case))
3445: (want-error (nth 1 case))
3446: (want-class (nth 2 case))
3447: (forbid-class (nth 3 case))
3448: (result (syd-3--value-classes line))
3449: (have-error (car result))
3450: (have-classes (cdr result))
3451: (names '(("B" . "Boolean") ("N" . "Number") ("S" . "String")
3452: ("C" . "Constant") ("T" . "Type") ("P" . "Special")))
3453: (full (lambda (code) (or (cdr (assoc code names)) code)))
3454: (actual (if have-classes
3455: (mapconcat full
3456: (sort (copy-sequence have-classes) #'string<) ",")
3457: "-"))
3458: (reasons '()))
3459: (when (and want-error (not have-error))
3460: (push '("error" . "ok") reasons))
3461: (when (and (not want-error) have-error)
3462: (push '("ok" . "error") reasons))
3463: (when (and want-class (not (member want-class have-classes)))
3464: (push (cons (funcall full want-class) actual) reasons))
3465: (when (and forbid-class (member forbid-class have-classes))
3466: (push (cons (concat "not " (funcall full forbid-class)) actual) reasons))
3467: (if (null reasons)
3468: (push (format "ok %d - %s" count line) out)
3469: (setq failures (1+ failures))
3470: (push (format "not ok %d - %s" count line) out)
3471: (dolist (r reasons)
3472: (push (format "# expected: %s" (car r)) out)
3473: (push (format "# actual: %s" (cdr r)) out)))))
3474: (push (format "# %d tests, %d failures" (length syd-3--syntax-cases) failures)
3475: out)
3476: (princ (mapconcat #'identity (nreverse out) "\n"))
3477: (princ "\n")
3478: (kill-emacs (if (zerop failures) 0 1))))
3479:
3480: (defun syd-el-main-test ()
3481: "Define and run the embedded ERT test suite for syd.el, then exit."
3482: (require 'ert)
3483: (eval
3484: '(progn
3485: (ert-deftest syd-el-api ()
3486: "API version query and liveness check."
3487: (should (eq (syd-api) 3))
3488: (should (syd-check)))
3489:
3490: (ert-deftest syd-el-stat-validation ()
3491: (should (syd--stat "/dev/null"))
3492: (should-not (syd--stat "/syd-el-no-such-path-xyzzy"))
3493: (let ((reg (make-temp-file "syd-el-")))
3494: (unwind-protect
3495: (should (syd--stat reg))
3496: (delete-file reg))
3497: (should-not (syd--stat reg))))
3498:
3499: (ert-deftest syd-el-toggle ()
3500: (dolist (cat '("fs" "walk" "read" "write" "exec"
3501: "create" "delete" "rename" "symlink" "truncate"
3502: "readdir" "mkdir" "rmdir" "chown" "chgrp" "chmod"
3503: "chattr" "chroot" "utime" "mkbdev" "mkcdev"
3504: "mkfifo" "mktemp" "net" "tpe"))
3505: (let ((enabled (intern (format "syd-enabled-%s" cat)))
3506: (enable (intern (format "syd-enable-%s" cat)))
3507: (disable (intern (format "syd-disable-%s" cat))))
3508: (let ((was (funcall enabled)))
3509: (should (funcall enable))
3510: (should (funcall enabled))
3511: (should (funcall disable))
3512: (should-not (funcall enabled))
3513: (if was (funcall enable) (funcall disable))
3514: (should (eq (and (funcall enabled) t) (and was t)))))))
3515:
3516: (ert-deftest syd-el-force-startup ()
3517: (should (syd-enabled-force))
3518: (should (syd-disable-force))
3519: (should-not (syd-enabled-force)))
3520:
3521: (ert-deftest syd-el-query ()
3522: (dolist (q '(syd-enabled-proxy syd-enabled-lock
3523: syd-enabled-mem))
3524: (should (memq (funcall q) '(t nil))))
3525: (should (syd-disable-mem))
3526: (should-not (syd-enabled-mem)))
3527:
3528: (ert-deftest syd-el-startup-only ()
3529: (dolist (cat '("chdir" "ioctl" "list" "notify" "readlink" "stat" "pid"))
3530: (let ((enabled (intern (format "syd-enabled-%s" cat)))
3531: (enable (intern (format "syd-enable-%s" cat)))
3532: (disable (intern (format "syd-disable-%s" cat))))
3533: (should-not (funcall enable))
3534: (should (funcall disable))
3535: (should-not (funcall enabled)))))
3536:
3537: (ert-deftest syd-el-default ()
3538: (dolist (act '(:action-allow :action-warn :action-filter :action-deny
3539: :action-panic :action-stop :action-abort :action-kill
3540: :action-exit))
3541: (should (syd-default-fs act)))
3542: (dolist (cap '("fs" "walk" "list" "stat" "read" "write" "exec"
3543: "ioctl" "create" "delete" "rename" "readlink"
3544: "symlink" "truncate" "chdir" "readdir" "mkdir"
3545: "rmdir" "chown" "chgrp" "chmod" "chattr" "chroot"
3546: "notify" "utime" "mkbdev" "mkcdev" "mkfifo" "mktemp"
3547: "net" "mem" "force" "tpe" "segvguard"))
3548: (should (funcall (intern (format "syd-default-%s" cap))
3549: :action-deny)))
3550: (should (syd-default-pid :action-stop))
3551: (dolist (cap '("mem" "force" "tpe" "segvguard"))
3552: (should-not (funcall (intern (format "syd-default-%s" cap))
3553: :action-allow)))
3554: (should-not (syd-default-pid :action-deny))
3555: (should (syd-default-fs :action-deny)))
3556:
3557: (ert-deftest syd-el-rules ()
3558: (should (syd-fs-add :action-deny "securityfs"))
3559: (should (syd-fs-del :action-deny "securityfs"))
3560: (should (syd-fs-rem :action-deny "securityfs"))
3561: (let ((glob "/tmp/syd-el-test"))
3562: (dolist (cap '("walk" "list" "stat" "read" "write" "exec"
3563: "create" "delete" "rename" "readlink" "symlink"
3564: "truncate" "chdir" "readdir" "mkdir" "rmdir"
3565: "chown" "chgrp" "chmod" "chattr" "chroot" "notify"
3566: "utime" "mkbdev" "mkcdev" "mkfifo" "mktemp"))
3567: (let ((add (intern (format "syd-%s-add" cap)))
3568: (del (intern (format "syd-%s-del" cap)))
3569: (rem (intern (format "syd-%s-rem" cap))))
3570: (should (funcall add :action-deny glob))
3571: (should (funcall del :action-deny glob))
3572: (should (funcall rem :action-deny glob))))))
3573:
3574: (ert-deftest syd-el-net-rules ()
3575: (dolist (spec '(("net-bind" . "127.0.0.1!8080")
3576: ("net-connect" . "::1!443")
3577: ("net-sendfd" . "!unnamed")))
3578: (let* ((cap (car spec))
3579: (addr (cdr spec))
3580: (add (intern (format "syd-%s-add" cap)))
3581: (del (intern (format "syd-%s-del" cap)))
3582: (rem (intern (format "syd-%s-rem" cap))))
3583: (should (funcall add :action-allow addr))
3584: (should (funcall del :action-allow addr))
3585: (should (funcall rem :action-allow addr))))
3586: (should-not (syd-net-link-add :action-allow "route"))
3587: (should-not (syd-net-link-del :action-allow "route"))
3588: (should-not (syd-net-link-rem :action-allow "route")))
3589:
3590: (ert-deftest syd-el-limits ()
3591: (should (syd-mem-max "1G"))
3592: (should (syd-mem-max 1073741824))
3593: (should (syd-mem-vm-max "2G"))
3594: (should (syd-pid-max 4096))
3595: (should (syd-pipe-max 4096))
3596: (should (syd-pipe-max 4096))
3597: (should-not (syd-pipe-max 8192))
3598: (should (syd-xattr-max 4096))
3599: (should (syd-xattr-max 4096))
3600: (should-not (syd-xattr-max 65537)))
3601:
3602: (ert-deftest syd-el-segvguard ()
3603: (should (syd-segvguard-expiry 120))
3604: (should (syd-segvguard-suspension 300))
3605: (should (syd-segvguard-maxcrashes 5)))
3606:
3607: (ert-deftest syd-el-force-rule ()
3608: (let ((hash (make-string 64 ?a)))
3609: (should (syd-force-add "/usr/bin/syd-el-test" "sha256" hash
3610: :action-deny))
3611: (should (syd-force-del "/usr/bin/syd-el-test"))
3612: (should (syd-force-clr))))
3613:
3614: (ert-deftest syd-el-rule-helper ()
3615: (should (equal (syd--rule "fs" "/tmp/x" ?+) "/dev/syd/fs+/tmp/x"))
3616: (should (equal (syd--rule "allow/net/bind" "127.0.0.1!80" ?+)
3617: "/dev/syd/allow/net/bind+127.0.0.1!80"))
3618: (should (equal (syd--rule "fs" "/x" ?-) "/dev/syd/fs-/x"))
3619: (should (equal (syd--rule "fs" "/x" ?^) "/dev/syd/fs^/x"))
3620: (should (equal (syd--rule "fs" "/x" ?:) "/dev/syd/fs:/x"))
3621: (should-error (syd--rule "fs" "/x" ?z))
3622: (should-error (syd--rule "fs" "" ?+)))
3623:
3624: (ert-deftest syd-el-info ()
3625: (let ((info (syd-info)))
3626: (should (consp info))
3627: (should (stringp (cdr (assq 'default_fs info))))))
3628:
3629: (ert-deftest syd-el-ioctl ()
3630: (should (syd-ioctl-add :action-allow "FIONREAD"))
3631: (should (syd-ioctl-del :action-allow "FIONREAD"))
3632: (should (syd-ioctl-rem :action-allow "FIONREAD"))
3633: (should (syd-ioctl-deny #xDEADCA11))
3634: (should-error (syd-ioctl-deny "not-a-number")))
3635:
3636: (ert-deftest syd-el-exec ()
3637: (should-error (syd-exec 42 nil))
3638: (should-error (syd-exec "/bin/true" '("ok" 7)))
3639: (let ((true (if (file-executable-p "/bin/true")
3640: "/bin/true" "/usr/bin/true")))
3641: (should (syd-exec true nil))))
3642:
3643: (ert-deftest syd-el-load ()
3644: (should-not (syd-load 9999)))
3645:
3646: (ert-deftest syd-el-lock ()
3647: (should-not (syd-lock :lock-off))
3648: (should (syd-lock :lock-exec))
3649: (should (syd-lock :lock-drop))
3650: (should (syd-lock :lock-on))
3651: (dolist (st '(:lock-off :lock-exec :lock-drop :lock-read :lock-on))
3652: (should-not (syd-lock st)))
3653: (should-not (syd-lock :lock-bogus))))
3654: t)
3655: (let ((tests '(syd-el-rule-helper
3656: syd-el-api
3657: syd-el-info
3658: syd-el-stat-validation
3659: syd-el-toggle
3660: syd-el-startup-only
3661: syd-el-force-startup
3662: syd-el-query
3663: syd-el-default
3664: syd-el-rules
3665: syd-el-net-rules
3666: syd-el-ioctl
3667: syd-el-limits
3668: syd-el-segvguard
3669: syd-el-force-rule
3670: syd-el-exec
3671: syd-el-load
3672: syd-el-lock))
3673: (count 0)
3674: (failures 0))
3675: (princ "TAP version 13\n")
3676: (princ (format "1..%d\n" (length tests)))
3677: (dolist (name tests)
3678: (setq count (1+ count))
3679: (let* ((result (ert-run-test (ert-get-test name)))
3680: (passed (ert-test-passed-p result)))
3681: (if passed
3682: (princ (format "ok %d - %s\n" count name))
3683: (setq failures (1+ failures))
3684: (princ (format "not ok %d - %s\n" count name))
3685: (let ((condition
3686: (ignore-errors
3687: (ert-test-result-with-condition-condition result))))
3688: (when condition
3689: (dolist (line (split-string (format "%S" condition) "\n" t))
3690: (princ (format "# %s\n" line))))))))
3691: (princ (format "# %d tests, %d failures\n" (length tests) failures))
3692: (kill-emacs (if (zerop failures) 0 1))))
3693:
3694: (provide 'syd)
3695: ; syd.el ends here
3696:
29/08/2026 00:07:34, src/syd.el, Ali Polatel