container: optionally isolate host abstract UNIX domain sockets via landlock

cmd/hpkg/app.go

@@ -28,6 +28,8 @@ type appInfo struct {
 	// passed through to [hst.Config]
 	Net bool `json:"net,omitempty"`
 	// passed through to [hst.Config]
+	ScopeAbstract bool `json:"scope_abstract,omitempty"`
+	// passed through to [hst.Config]
 	Device bool `json:"dev,omitempty"`
 	// passed through to [hst.Config]
 	Tty bool `json:"tty,omitempty"`

container/container.go

@@ -92,6 +92,8 @@ type (
 		RetainSession bool
 		// Do not [syscall.CLONE_NEWNET].
 		HostNet bool
+		// Scope abstract UNIX domain sockets using LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET.
+		ScopeAbstract bool
 		// Retain CAP_SYS_ADMIN.
 		Privileged bool
 	}

container/init.go

@@ -13,6 +13,7 @@ import (
 	. "syscall"
 	"time"
 
+	"hakurei.app/container/landlock"
 	"hakurei.app/container/seccomp"
 )
 
@@ -263,6 +264,12 @@ func Init(prepare func(prefix string), setVerbose func(verbose bool)) {
 		msg.Verbose("syscall filter not configured")
 	}
 
+	if params.ScopeAbstract {
+		if err := landlock.ScopeAbstract(); err != nil {
+			log.Fatalf("could not scope abstract unix sockets: %v", err)
+		}
+	}
+
 	extraFiles := make([]*os.File, params.Count)
 	for i := range extraFiles {
 		// setup fd is placed before all extra files

container/landlock/landlock-helper.c

@@ -0,0 +1,14 @@
+#include <errno.h>
+#include <linux/landlock.h>
+#include <sys/psx_syscall.h>
+#include <sys/syscall.h>
+
+#include "landlock-helper.h"
+
+int hakurei_scope_abstract_unix_sockets(int* p_errno, int fd) {
+  int res = psx_syscall3(SYS_landlock_restrict_self, fd, 0, 0);
+
+  *p_errno = errno;
+
+  return res;
+}

container/landlock/landlock-helper.h

@@ -0,0 +1,3 @@
+#pragma once
+
+int hakurei_scope_abstract_unix_sockets(int* p_errno, int fd);

container/landlock/landlock.go

@@ -0,0 +1,57 @@
+package landlock
+
+/*
+#cgo linux pkg-config: --static libpsx
+
+#include <linux/landlock.h>
+#include <sys/syscall.h>
+
+#include "landlock-helper.h"
+*/
+import "C"
+
+import (
+	"fmt"
+	"syscall"
+	"unsafe"
+)
+
+const (
+	LANDLOCK_CREATE_RULESET_VERSION     = C.LANDLOCK_CREATE_RULESET_VERSION
+	LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET = C.LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET
+
+	SYS_LANDLOCK_CREATE_RULESET = C.SYS_landlock_create_ruleset
+)
+
+type LandlockRulesetAttr = C.struct_landlock_ruleset_attr
+
+func ScopeAbstract() error {
+	abi, _, err := syscall.Syscall(SYS_LANDLOCK_CREATE_RULESET, 0, 0, LANDLOCK_CREATE_RULESET_VERSION)
+
+	if err != 0 {
+		return fmt.Errorf("could not fetch landlock ABI: errno %v", err)
+	}
+
+	if abi < 6 {
+		return fmt.Errorf("landlock ABI must be >= 6, got %d", abi)
+	}
+
+	attrs := LandlockRulesetAttr{
+		scoped: LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET,
+	}
+
+	fd, _, err := syscall.Syscall(SYS_LANDLOCK_CREATE_RULESET, uintptr(unsafe.Pointer(&attrs)), unsafe.Sizeof(attrs), 0)
+
+	if err != 0 {
+		return fmt.Errorf("could not create landlock ruleset: errno %v", err)
+	}
+
+	defer syscall.Close(int(fd))
+
+	var errno C.int
+	if rv := C.hakurei_scope_abstract_unix_sockets(&errno, C.int(fd)); rv != 0 {
+		return fmt.Errorf("could not restrict self via landlock: errno %v", errno)
+	}
+
+	return nil
+}

hst/config.go

@@ -79,6 +79,8 @@ type (
 		Userns bool `json:"userns,omitempty"`
 		// share host net namespace
 		Net bool `json:"net,omitempty"`
+		// disallow accessing abstract UNIX domain sockets created outside the container
+		ScopeAbstract bool `json:"scope_abstract,omitempty"`
 		// allow dangerous terminal I/O
 		Tty bool `json:"tty,omitempty"`
 		// allow multiarch

internal/app/container_linux.go

@@ -33,6 +33,7 @@ func newContainer(s *hst.ContainerConfig, os sys.State, prefix string, uid, gid
 		SeccompPresets: s.SeccompPresets,
 		RetainSession:  s.Tty,
 		HostNet:        s.Net,
+		ScopeAbstract:  s.ScopeAbstract,
 
 		// the container is canceled when shim is requested to exit or receives an interrupt or termination signal;
 		// this behaviour is implemented in the shim

nixos.nix

@@ -137,6 +137,7 @@ in
                         multiarch
                         env
                         ;
+                      scope_abstract = app.scopeAbstract;
                       map_real_uid = app.mapRealUid;
 
                       filesystem =

options.md

@@ -572,6 +572,28 @@ boolean
 
 
 
+*Example:*
+` true `
+
+
+## environment\.hakurei\.apps\.\<name>\.scopeAbstract
+
+
+
+Whether to restrict abstract UNIX domain socket access\.
+
+
+
+*Type:*
+boolean
+
+
+
+*Default:*
+` true `
+
+
+
 *Example:*
 ` true `
 

options.nix

@@ -182,6 +182,9 @@ in
               net = mkEnableOption "network access" // {
                 default = true;
               };
+              scopeAbstract = mkEnableOption "abstract unix domain socket access" // {
+                default = true;
+              };
 
               nix = mkEnableOption "nix daemon access";
               mapRealUid = mkEnableOption "mapping to priv-user uid";

package.nix

@@ -5,6 +5,7 @@
   makeBinaryWrapper,
   xdg-dbus-proxy,
   pkg-config,
+  libcap,
   libffi,
   libseccomp,
   acl,
@@ -80,10 +81,16 @@ buildGoModule rec {
         hsu = "/run/wrappers/bin/hsu";
       };
 
-  # nix build environment does not allow acls
-  env.GO_TEST_SKIP_ACL = 1;
+  env = {
+    # required by libpsx
+    CGO_LDFLAGS_ALLOW = "-Wl,(--no-whole-archive|--whole-archive)";
+
+    # nix build environment does not allow acls
+    GO_TEST_SKIP_ACL = 1;
+  };
 
   buildInputs = [
+    libcap
     libffi
     libseccomp
     acl

system/dbus/proc.go

@@ -64,6 +64,10 @@ func (p *Proxy) Start() error {
 			argF, func(z *container.Container) {
 				z.SeccompFlags |= seccomp.AllowMultiarch
 				z.SeccompPresets |= seccomp.PresetStrict
+
+				// xdg-dbus-proxy requires host abstract UNIX domain socket access
+				z.ScopeAbstract = false
+
 				z.Hostname = "hakurei-dbus"
 				if p.output != nil {
 					z.Stdout, z.Stderr = p.output, p.output

test/sandbox/case/device.nix

@@ -243,7 +243,7 @@ in
     seccomp = true;
 
     try_socket = "/tmp/.X11-unix/X0";
-    socket_abstract = true;
+    socket_abstract = false;
     socket_pathname = true;
   };
 }

test/sandbox/case/mapuid.nix

@@ -269,7 +269,7 @@ in
     seccomp = true;
 
     try_socket = "/tmp/.X11-unix/X0";
-    socket_abstract = true;
+    socket_abstract = false;
     socket_pathname = false;
   };
 }

test/sandbox/case/pdlike.nix

@@ -264,7 +264,7 @@ in
     seccomp = true;
 
     try_socket = "/tmp/.X11-unix/X0";
-    socket_abstract = true;
+    socket_abstract = false;
     socket_pathname = false;
   };
 }

test/sandbox/case/preset.nix

@@ -262,7 +262,7 @@ in
     seccomp = true;
 
     try_socket = "/tmp/.X11-unix/X0";
-    socket_abstract = true;
+    socket_abstract = false;
     socket_pathname = false;
   };
 }

test/sandbox/case/tty.nix

@@ -275,7 +275,7 @@ in
     seccomp = true;
 
     try_socket = "/tmp/.X11-unix/X0";
-    socket_abstract = true;
+    socket_abstract = false;
     socket_pathname = true;
   };
 }