Documentation
¶
Overview ¶
Package landlock applies a process-wide Landlock filesystem policy derived from rshell AllowedPaths entries.
Restrict is irreversible. Callers must invoke it only in a disposable one-shot worker, after opening the file descriptors the worker needs and before running untrusted work.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrUnsupported = errors.New("Landlock filesystem sandbox is unsupported")
ErrUnsupported indicates that Landlock cannot be applied on this platform or that the running Linux kernel cannot enforce the complete policy. A privileged worker must treat this as a hard failure.
Functions ¶
func Restrict ¶
Restrict applies an exact, process-wide Landlock policy derived from allowedPaths, without command-dependent trusted path exceptions.
func RestrictReadOnlyWithTrustedPaths ¶
func RestrictReadOnlyWithTrustedPaths(allowedPaths []string, trustedPaths []TrustedPath) error
RestrictReadOnlyWithTrustedPaths applies a process-wide policy that treats every backend AllowedPaths entry as read-only, even when it carries a :rw suffix. This is used for selectively elevated read-only actions so the kernel policy cannot expose write rights that the interpreter mode rejects.
func RestrictWithTrustedPaths ¶
func RestrictWithTrustedPaths(allowedPaths []string, trustedPaths []TrustedPath) error
RestrictWithTrustedPaths applies an exact, process-wide Landlock policy. Backend AllowedPaths entries without a suffix and entries ending in :ro grant file reads and directory listing. :rw additionally grants regular-file creation, writes, and truncation. It does not grant deletion. Linking, renaming, execution, directory mutation, file removal, and special-file creation are handled but never granted by backend AllowedPaths.
trustedPaths are narrow exceptions derived locally from the actual builtin command. They are not part of the backend AllowedPaths contract and must not be populated from unsigned request data.
Every configured target is opened exactly once with O_PATH. Backend AllowedPaths use openat2 with RESOLVE_NO_SYMLINKS and RESOLVE_NO_MAGICLINKS, while fixed trusted kernel paths may follow the symlink and magic-link components they require. The same descriptor is used both to validate its object type and to add the Landlock rule, eliminating a validate-close-reopen race. An exact /dev/null read-write rule preserves rshell's unconditional null-redirection contract. Missing and inaccessible required paths fail closed, and the policy never uses best-effort enforcement.
Types ¶
type TrustedPath ¶
type TrustedPath struct {
Path string
Kind TrustedPathKind
Access TrustedPathAccess
Optional bool
}
TrustedPath is a command-dependent filesystem exception for an in-process builtin. It must be derived from the command being dispatched, not accepted as unsigned worker input.
Optional may only be used for a known path whose absence is expected, such as one of systemd's alternative journal directories. Other open errors still fail closed.
type TrustedPathAccess ¶
type TrustedPathAccess uint8
TrustedPathAccess describes the narrow operations granted to a trusted command-dependent path.
const ( // TrustedPathReadOnly grants file reads and, for directories, listing. TrustedPathReadOnly TrustedPathAccess = iota // TrustedPathReadRemoveFiles additionally permits removing files beneath a // directory. It is intended for an independently authorized journal vacuum. TrustedPathReadRemoveFiles )
type TrustedPathKind ¶
type TrustedPathKind uint8
TrustedPathKind distinguishes a directory hierarchy from one exact file. Backend AllowedPaths remain directory hierarchies; this type is only for command-dependent paths which trusted in-process builtins open directly.
const ( // TrustedPathDirectory grants access beneath a directory hierarchy. TrustedPathDirectory TrustedPathKind = iota // TrustedPathFile grants access to one exact regular or pseudo file. TrustedPathFile )
Source Files