container: optionally isolate host abstract UNIX domain sockets via landlock

cmd/hpkg/app.go

@@ -28,6 +28,8 @@ type appInfo struct {
 	// passed through to [hst.Config]
 	Net bool `json:"net,omitempty"`
 	// passed through to [hst.Config]
+	ScopeAbstract bool `json:"scope_abstract,omitempty"`
+	// passed through to [hst.Config]
 	Device bool `json:"dev,omitempty"`
 	// passed through to [hst.Config]
 	Tty bool `json:"tty,omitempty"`

container/container.go

@@ -13,7 +13,9 @@ import (
 	"strconv"
 	. "syscall"
 	"time"
+	"unsafe"
 
+	"hakurei.app/container/landlock"
 	"hakurei.app/container/seccomp"
 )
 
@@ -92,6 +94,8 @@ type (
 		RetainSession bool
 		// Do not [syscall.CLONE_NEWNET].
 		HostNet bool
+		// Do not [landlock.LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET].
+		HostAbstract bool
 		// Retain CAP_SYS_ADMIN.
 		Privileged bool
 	}
@@ -185,6 +189,58 @@ func (p *Container) Start() error {
 					"prctl(PR_SET_NO_NEW_PRIVS):")
 			}
 
+			// landlock: depends on per-thread state but acts on a process group
+			{
+				scoped := landlock.LANDLOCK_SCOPE_SIGNAL
+				if !p.HostAbstract {
+					scoped |= landlock.LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET
+				}
+				rulesetAttr := landlock.NewRulesetAttr(scoped)
+
+				if abi, _, errno := Syscall(seccomp.SYS_LANDLOCK_CREATE_RULESET, 0, 0, landlock.LANDLOCK_CREATE_RULESET_VERSION); abi < 0 {
+					if p.HostAbstract {
+						// landlock can be skipped here as it restricts access to resources
+						// already covered by namespaces (pid)
+						goto landlockOut
+					}
+					return wrapErrSuffix(errno,
+						"landlock does not appear to be enabled:")
+				} else if abi < 6 {
+					if p.HostAbstract {
+						// see above comment
+						goto landlockOut
+					}
+					return msg.WrapErr(ENOSYS,
+						"kernel version too old for LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET")
+				} else {
+					msg.Verbosef("landlock abi version %d", abi)
+				}
+
+				if rulesetFd, _, errno := Syscall(seccomp.SYS_LANDLOCK_CREATE_RULESET,
+					uintptr(unsafe.Pointer(&rulesetAttr)),
+					unsafe.Sizeof(rulesetAttr), 0,
+				); rulesetFd < 0 {
+					return wrapErrSuffix(errno,
+						"cannot create landlock ruleset:")
+				} else {
+					CloseOnExec(int(rulesetFd))
+
+					var r uintptr
+					if r, _, errno = Syscall(seccomp.SYS_LANDLOCK_RESTRICT_SELF, rulesetFd, 0, 0); r != 0 {
+						_ = Close(int(rulesetFd))
+						return wrapErrSuffix(errno,
+							"cannot enforce landlock ruleset:")
+					}
+					msg.Verbosef("enforced landlock ruleset scoped %#x", int(scoped))
+					if err := Close(int(rulesetFd)); err != nil {
+						msg.Verbosef("cannot close landlock ruleset: %v", err)
+						// not fatal
+					}
+				}
+
+			landlockOut:
+			}
+
 			msg.Verbose("starting container init")
 			if err := p.cmd.Start(); err != nil {
 				return msg.WrapErr(err, err.Error())

container/landlock/landlock.go

@@ -0,0 +1,17 @@
+package landlock
+
+/*
+#include <linux/landlock.h>
+#include <sys/syscall.h>
+*/
+import "C"
+
+const (
+	LANDLOCK_CREATE_RULESET_VERSION     = C.LANDLOCK_CREATE_RULESET_VERSION
+	LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET = C.LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET
+	LANDLOCK_SCOPE_SIGNAL               = C.LANDLOCK_SCOPE_SIGNAL
+)
+
+type RulesetAttr = C.struct_landlock_ruleset_attr
+
+func NewRulesetAttr(scoped int) RulesetAttr { return RulesetAttr{scoped: C.__u64(scoped)} }

hst/config.go

@@ -79,6 +79,8 @@ type (
 		Userns bool `json:"userns,omitempty"`
 		// share host net namespace
 		Net bool `json:"net,omitempty"`
+		// share abstract unix socket scope
+		Abstract bool `json:"abstract,omitempty"`
 		// allow dangerous terminal I/O
 		Tty bool `json:"tty,omitempty"`
 		// allow multiarch

internal/app/container_linux.go

@@ -33,6 +33,7 @@ func newContainer(s *hst.ContainerConfig, os sys.State, prefix string, uid, gid
 		SeccompPresets: s.SeccompPresets,
 		RetainSession:  s.Tty,
 		HostNet:        s.Net,
+		HostAbstract:   s.Abstract,
 
 		// the container is canceled when shim is requested to exit or receives an interrupt or termination signal;
 		// this behaviour is implemented in the shim

nixos.nix

@@ -137,6 +137,7 @@ in
                         multiarch
                         env
                         ;
+                      scope_abstract = app.scopeAbstract;
                       map_real_uid = app.mapRealUid;
 
                       filesystem =

options.md

@@ -572,6 +572,28 @@ boolean
 
 
 
+*Example:*
+` true `
+
+
+## environment\.hakurei\.apps\.\<name>\.scopeAbstract
+
+
+
+Whether to restrict abstract UNIX domain socket access\.
+
+
+
+*Type:*
+boolean
+
+
+
+*Default:*
+` true `
+
+
+
 *Example:*
 ` true `
 

options.nix

@@ -182,6 +182,9 @@ in
               net = mkEnableOption "network access" // {
                 default = true;
               };
+              scopeAbstract = mkEnableOption "abstract unix domain socket access" // {
+                default = true;
+              };
 
               nix = mkEnableOption "nix daemon access";
               mapRealUid = mkEnableOption "mapping to priv-user uid";

system/dbus/proc.go

@@ -64,6 +64,10 @@ func (p *Proxy) Start() error {
 			argF, func(z *container.Container) {
 				z.SeccompFlags |= seccomp.AllowMultiarch
 				z.SeccompPresets |= seccomp.PresetStrict
+
+				// xdg-dbus-proxy fails with scoped abstract unix sockets despite pathname socket being available
+				z.HostAbstract = true
+
 				z.Hostname = "hakurei-dbus"
 				if p.output != nil {
 					z.Stdout, z.Stderr = p.output, p.output

test/sandbox/case/device.nix

@@ -243,7 +243,7 @@ in
     seccomp = true;
 
     try_socket = "/tmp/.X11-unix/X0";
-    socket_abstract = true;
+    socket_abstract = false;
     socket_pathname = true;
   };
 }

test/sandbox/case/mapuid.nix

@@ -269,7 +269,7 @@ in
     seccomp = true;
 
     try_socket = "/tmp/.X11-unix/X0";
-    socket_abstract = true;
+    socket_abstract = false;
     socket_pathname = false;
   };
 }

test/sandbox/case/pdlike.nix

@@ -264,7 +264,7 @@ in
     seccomp = true;
 
     try_socket = "/tmp/.X11-unix/X0";
-    socket_abstract = true;
+    socket_abstract = false;
     socket_pathname = false;
   };
 }

test/sandbox/case/preset.nix

@@ -262,7 +262,7 @@ in
     seccomp = true;
 
     try_socket = "/tmp/.X11-unix/X0";
-    socket_abstract = true;
+    socket_abstract = false;
     socket_pathname = false;
   };
 }

test/sandbox/case/tty.nix

@@ -275,7 +275,7 @@ in
     seccomp = true;
 
     try_socket = "/tmp/.X11-unix/X0";
-    socket_abstract = true;
+    socket_abstract = false;
     socket_pathname = true;
   };
 }