Hacker News Reader

Hacker News

Comment by smartmic | Hacker News Reader

Full thread

smartmic

I am puzzled by this:

> A official c library doesn’t exist yet unfortunately, but there’s several out there you can try.

> Landlock is a Linux Security Module (LSM) available since Linux 5.13

Since when is not a C API the first and foremost interface for developers when it comes to Linux kernel stuff?

View on HN

The first and foremost interface of the kernel is the syscall interface aka the uapi. libc and other C libraries like liburing or libcap are downstream of that. Many syscalls still don't have wrappers in libc after years of use.

Thanks for clarification! I meant more, why isn't there a C API first, but Rust, Haskell, and Go before that — that's kind of surprising or new to me.

I don't understand what you mean. There's no "official" Rust, Haskell and Go APIs for this thing either. All libraries available seem to be just what some third party made available. There's also several C libraries, just none that have been officially endorsed by the Linux kernel team.

I read the article as saying that there's no official C library but unofficial ones do exist. Quote below, emphasis mine.

> A official c library doesn’t exist yet unfortunately, but there’s several out there you can try.

Also, it looks like there is more than zero support for C programs calling Landlock APIs. Even without a 3rd-party library you're not just calling syscall() with a magic number:

https://docs.kernel.org/userspace-api/landlock.html

https://github.com/torvalds/linux/blob/6bda50f4/include/uapi...

https://github.com/torvalds/linux/blob/6bda50f4/include/linu...

Go is famous for not needing libc and talking to the kernel. Rust and Haskell have communities that are very interested in safety and security, so they are earlier adopters.

For C, unofficial support apparently sufficed for now.

Yet for many syscalls there is an official library - in most cases a wrapper in libc, but especially io_uring is known to provide a C library that most applications ought to use instead of the raw syscalls.

Is io_uring not itself a set of syscalls?

https://github.com/axboe/liburing

"This is the io_uring library, liburing. liburing provides helpers to setup and teardown io_uring instances, and also a simplified interface for applications that don't need (or want) to deal with the full kernel side implementation."

Yes, it is. But it's rather complicated and not all applications need its full power.

https://lwn.net/Articles/810414/

What do you call syscalls in then? Assembly?

It's pretty subtle but it's referring to The C Library, libc.{a,so,dll,etc}. The library provided by your toolchain that supports the language.

Meaning glibc or musl or your favorite C library probably doesn't have this yet, but since the system calls are well defined you can use A C library (create your own header file using the _syscallN macro for example).

> Since when is not a C API the first and foremost interface for developers when it comes to Linux kernel stuff?

Since the kernel developers don't make userland software?

The lack of a C API should not stop any C developers from using it, hopefully. The wrapper libraries are relatively simple (i.e. https://codeberg.org/git-bruh/landbox) and both Rust and Go can expose a C FFI in case developers would rather link against a more "official" library instead.

The Linux kernel has a relatively simple example on how to use the syscall even if you can't find a library to deal with it for you: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...

There is no "liblandlock" or whatever, though there totally could be. The only reason Rust, Go, and Haskell have an easy-to-use API for this syscall is because someone bothered to implement a wrapper and publish it to the usual package managers. Whatever procedure distros use to add new libraries could just as easily be used to push a landlock library/header to use it in C.

Because C is not the primary interface language for kernel syscalls. There is no language specific primary interface as the syscall is the primary interface and it is language agnostic. This is one of Linux's great strengths, a stable syscall API that doesn't rely on a system library.

There is a C API. man landlock_add_rule for example.

https://github.com/torvalds/linux/blob/master/include/uapi/l...

you can add simple one-line wrappers if you don't like using syscall() function.

https://man7.org/linux/man-pages/man7/landlock.7.html most is rly there.

I use this and have no problems with it: https://github.com/marty1885/landlock-unveil

Reply on news.ycombinator.com