4 ms·
I am puzzled by this: > A official c library doesn’t exist yet unfortunately, but there’s several out there you can try. > Landlock is a Linux Security Module
by smartmic 11mo ago
I am puzzled by this:
> A official c library doesn’t exist yet unfortunately, but there’s several out there you can try.
> Landlock is a Linux Security Module (LSM) available since Linux 5.13
Since when is not a C API the first and foremost interface for developers when it comes to Linux kernel stuff?
- muvlon 11mo agoThe first and foremost interface of the kernel is the syscall interface aka the uapi. libc and other C libraries like liburing or libcap are downstream of that. Many syscalls still don't have wrappers in libc after years of use.
- smartmic 11mo agoThanks for clarification! I meant more, why isn't there a C API first, but Rust, Haskell, and Go before that — that's kind of surprising or new to me.
- WJW 11mo agoI don't understand what you mean. There's no "official" Rust, Haskell and Go APIs for this thing either. All libraries available seem to be just what some third party made available. There's also several C libraries, just none that have been officially endorsed by the Linux kernel team.
- wging 11mo agoI read the article as saying that there's no official C library but unofficial ones do exist. Quote below, emphasis mine. > A official c library doesn’t exist yet unfortunately, but there’s several out there you can try. Also, it looks like there is more than zero support for C programs calling Landlock APIs. Even without a 3rd-party library you're not just calling syscall() with a magic number: https://docs.kernel.org/userspace-api/landlock.html https://docs.kernel.org/userspace-api/landlock.html https://github.com/torvalds/linux/blob/6bda50f4/include/uapi/linux/landlock.h https://github.com/torvalds/linux/blob/6bda50f4/include/uapi... https://github.com/torvalds/linux/blob/6bda50f4/include/linux/syscalls.h#L980 https://github.com/torvalds/linux/blob/6bda50f4/include/linu...
- nine_k 11mo agoGo is famous for not needing libc and talking to the kernel. Rust and Haskell have communities that are very interested in safety and security, so they are earlier adopters. For C, unofficial support apparently sufficed for now.
- samus 11mo agoYet for many syscalls there is an official library - in most cases a wrapper in libc, but especially io_uring is known to provide a C library that most applications ought to use instead of the raw syscalls.
- ijustlovemath 11mo agoIs io_uring not itself a set of syscalls?
- projektfu 11mo agohttps://github.com/axboe/liburing https://github.com/axboe/liburing "This is the io_uring library, liburing. liburing provides helpers to setup and teardown io_uring instances, and also a simplified interface for applications that don't need (or want) to deal with the full kernel side implementation."
- samus 11mo agoYes, it is. But it's rather complicated and not all applications need its full power. https://lwn.net/Articles/810414/ https://lwn.net/Articles/810414/
- moffkalast 11mo agoWhat do you call syscalls in then? Assembly?
- jeroenhd 11mo agoThe lack of a C API should not stop any C developers from using it, hopefully. The wrapper libraries are relatively simple (i.e. https://codeberg.org/git-bruh/landbox https://codeberg.org/git-bruh/landbox) and both Rust and Go can expose a C FFI in case developers would rather link against a more "official" library instead. The Linux kernel has a relatively simple example on how to use the syscall even if you can't find a library to deal with it for you: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/samples/landlock/sandboxer.c https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin... There is no "liblandlock" or whatever, though there totally could be. The only reason Rust, Go, and Haskell have an easy-to-use API for this syscall is because someone bothered to implement a wrapper and publish it to the usual package managers. Whatever procedure distros use to add new libraries could just as easily be used to push a landlock library/header to use it in C.
- mulle_nat 11mo agoI use this and have no problems with it: https://github.com/marty1885/landlock-unveil https://github.com/marty1885/landlock-unveil
- megous 11mo agoThere is a C API. man landlock_add_rule for example. https://github.com/torvalds/linux/blob/master/include/uapi/linux/landlock.h https://github.com/torvalds/linux/blob/master/include/uapi/l... you can add simple one-line wrappers if you don't like using syscall() function.
- wyldfire 11mo agoIt's pretty subtle but it's referring to The C Library, libc.{a,so,dll,etc}. The library provided by your toolchain that supports the language. Meaning glibc or musl or your favorite C library probably doesn't have this yet, but since the system calls are well defined you can use A C library (create your own header file using the _syscallN macro for example).
- Levitating 11mo ago> Since when is not a C API the first and foremost interface for developers when it comes to Linux kernel stuff? Since the kernel developers don't make userland software?
- habbekrats 11mo agohttps://man7.org/linux/man-pages/man7/landlock.7.html https://man7.org/linux/man-pages/man7/landlock.7.html most is rly there.
- eikenberry 10mo agoBecause C is not the primary interface language for kernel syscalls. There is no language specific primary interface as the syscall is the primary interface and it is language agnostic. This is one of Linux's great strengths, a stable syscall API that doesn't rely on a system library.