container: optionally isolate host abstract UNIX domain sockets via landlock

container/container.go

@@ -13,7 +13,9 @@ import (
 	"strconv"
 	. "syscall"
 	"time"
+	"unsafe"
 
+	"hakurei.app/container/landlock"
 	"hakurei.app/container/seccomp"
 )
 
@@ -92,7 +94,7 @@ type (
 		RetainSession bool
 		// Do not [syscall.CLONE_NEWNET].
 		HostNet bool
-		// Do not [LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET].
+		// Do not [landlock.LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET].
 		HostAbstract bool
 		// Retain CAP_SYS_ADMIN.
 		Privileged bool
@@ -189,19 +191,19 @@ func (p *Container) Start() error {
 
 			// landlock: depends on per-thread state but acts on a process group
 			{
-				scoped := LANDLOCK_SCOPE_SIGNAL
+				scoped := landlock.LANDLOCK_SCOPE_SIGNAL
 				if !p.HostAbstract {
-					scoped |= LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET
+					scoped |= landlock.LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET
 				}
-				rulesetAttr := NewRulesetAttr(scoped)
+				rulesetAttr := landlock.NewRulesetAttr(scoped)
 
-				if abi, err := LandlockGetABI(); err != nil {
+				if abi, _, errno := Syscall(seccomp.SYS_LANDLOCK_CREATE_RULESET, 0, 0, landlock.LANDLOCK_CREATE_RULESET_VERSION); abi < 0 {
 					if p.HostAbstract {
 						// landlock can be skipped here as it restricts access to resources
 						// already covered by namespaces (pid)
 						goto landlockOut
 					}
-					return wrapErrSuffix(err,
+					return wrapErrSuffix(errno,
 						"landlock does not appear to be enabled:")
 				} else if abi < 6 {
 					if p.HostAbstract {
@@ -214,18 +216,23 @@ func (p *Container) Start() error {
 					msg.Verbosef("landlock abi version %d", abi)
 				}
 
-				msg.Verbosef("creating landlock ruleset scoped %#x", int(scoped))
-				if rulesetFd, err := LandlockCreateRuleset(&rulesetAttr, 0); err != nil {
-					return wrapErrSuffix(err,
+				if rulesetFd, _, errno := Syscall(seccomp.SYS_LANDLOCK_CREATE_RULESET,
+					uintptr(unsafe.Pointer(&rulesetAttr)),
+					unsafe.Sizeof(rulesetAttr), 0,
+				); rulesetFd < 0 {
+					return wrapErrSuffix(errno,
 						"cannot create landlock ruleset:")
 				} else {
-					msg.Verbose("enforcing landlock ruleset")
-					if err = LandlockRestrictSelf(rulesetFd, 0); err != nil {
-						_ = Close(rulesetFd)
-						return wrapErrSuffix(err,
+					CloseOnExec(int(rulesetFd))
+
+					var r uintptr
+					if r, _, errno = Syscall(seccomp.SYS_LANDLOCK_RESTRICT_SELF, rulesetFd, 0, 0); r != 0 {
+						_ = Close(int(rulesetFd))
+						return wrapErrSuffix(errno,
 							"cannot enforce landlock ruleset:")
 					}
-					if err = Close(rulesetFd); err != nil {
+					msg.Verbosef("enforced landlock ruleset scoped %#x", int(scoped))
+					if err := Close(int(rulesetFd)); err != nil {
 						msg.Verbosef("cannot close landlock ruleset: %v", err)
 						// not fatal
 					}

container/landlock.go

@@ -1,59 +0,0 @@
-package container
-
-/*
-#include <linux/landlock.h>
-#include <sys/syscall.h>
-*/
-import "C"
-import (
-	"syscall"
-	"unsafe"
-
-	"hakurei.app/container/seccomp"
-)
-
-const (
-	LANDLOCK_CREATE_RULESET_VERSION     = C.LANDLOCK_CREATE_RULESET_VERSION
-	LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET = C.LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET
-	LANDLOCK_SCOPE_SIGNAL               = C.LANDLOCK_SCOPE_SIGNAL
-)
-
-type RulesetAttr = C.struct_landlock_ruleset_attr
-
-func NewRulesetAttr(scoped int) RulesetAttr { return RulesetAttr{scoped: C.__u64(scoped)} }
-
-/* TODO: remove everything above this */
-
-func LandlockCreateRuleset(rulesetAttr *RulesetAttr, flags uintptr) (fd int, err error) {
-	var pointer, size uintptr
-	// NULL needed for abi version
-	if rulesetAttr != nil {
-		pointer = uintptr(unsafe.Pointer(rulesetAttr))
-		size = unsafe.Sizeof(*rulesetAttr)
-	}
-
-	rulesetFd, _, errno := syscall.Syscall(seccomp.SYS_LANDLOCK_CREATE_RULESET, pointer, size, flags)
-	fd = int(rulesetFd)
-	err = errno
-
-	if fd < 0 {
-		return
-	}
-
-	if rulesetAttr != nil { // not a fd otherwise
-		syscall.CloseOnExec(fd)
-	}
-	return fd, nil
-}
-
-func LandlockGetABI() (int, error) {
-	return LandlockCreateRuleset(nil, LANDLOCK_CREATE_RULESET_VERSION)
-}
-
-func LandlockRestrictSelf(rulesetFd int, flags uintptr) error {
-	r, _, errno := syscall.Syscall(seccomp.SYS_LANDLOCK_RESTRICT_SELF, uintptr(rulesetFd), flags, 0)
-	if r != 0 {
-		return errno
-	}
-	return nil
-}

container/landlock/landlock.go

@@ -0,0 +1,17 @@
+package landlock
+
+/*
+#include <linux/landlock.h>
+#include <sys/syscall.h>
+*/
+import "C"
+
+const (
+	LANDLOCK_CREATE_RULESET_VERSION     = C.LANDLOCK_CREATE_RULESET_VERSION
+	LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET = C.LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET
+	LANDLOCK_SCOPE_SIGNAL               = C.LANDLOCK_SCOPE_SIGNAL
+)
+
+type RulesetAttr = C.struct_landlock_ruleset_attr
+
+func NewRulesetAttr(scoped int) RulesetAttr { return RulesetAttr{scoped: C.__u64(scoped)} }