container: optionally isolate host abstract UNIX domain sockets via landlock

container/container.go

@@ -7,6 +7,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"log"
 	"os"
 	"os/exec"
 	"runtime"
@@ -14,6 +15,7 @@ import (
 	. "syscall"
 	"time"
 
+	"hakurei.app/container/landlock"
 	"hakurei.app/container/seccomp"
 )
 
@@ -181,6 +183,12 @@ func (p *Container) Start() error {
 		p.wait = make(chan struct{})
 
 		done <- func() error { // setup depending on per-thread state must happen here
+			if p.ScopeAbstract {
+				if err := landlock.ScopeAbstract(); err != nil {
+					log.Fatalf("could not scope abstract unix sockets: %v", err)
+				}
+			}
+
 			msg.Verbose("starting container init")
 			if err := p.cmd.Start(); err != nil {
 				return msg.WrapErr(err, err.Error())

container/init.go

@@ -13,7 +13,6 @@ import (
 	. "syscall"
 	"time"
 
-	"hakurei.app/container/landlock"
 	"hakurei.app/container/seccomp"
 )
 
@@ -264,12 +263,6 @@ func Init(prepare func(prefix string), setVerbose func(verbose bool)) {
 		msg.Verbose("syscall filter not configured")
 	}
 
-	if params.ScopeAbstract {
-		if err := landlock.ScopeAbstract(); err != nil {
-			log.Fatalf("could not scope abstract unix sockets: %v", err)
-		}
-	}
-
 	extraFiles := make([]*os.File, params.Count)
 	for i := range extraFiles {
 		// setup fd is placed before all extra files

container/landlock/landlock-helper.c

@@ -1,14 +0,0 @@
-#include <errno.h>
-#include <linux/landlock.h>
-#include <sys/psx_syscall.h>
-#include <sys/syscall.h>
-
-#include "landlock-helper.h"
-
-int hakurei_scope_abstract_unix_sockets(int* p_errno, int fd) {
-  int res = psx_syscall3(SYS_landlock_restrict_self, fd, 0, 0);
-
-  *p_errno = errno;
-
-  return res;
-}

container/landlock/landlock-helper.h

@@ -1,3 +0,0 @@
-#pragma once
-
-int hakurei_scope_abstract_unix_sockets(int* p_errno, int fd);

container/landlock/landlock.go

@@ -1,12 +1,8 @@
 package landlock
 
 /*
-#cgo linux pkg-config: --static libpsx
-
 #include <linux/landlock.h>
 #include <sys/syscall.h>
-
-#include "landlock-helper.h"
 */
 import "C"
 
@@ -21,10 +17,13 @@ const (
 	LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET = C.LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET
 
 	SYS_LANDLOCK_CREATE_RULESET = C.SYS_landlock_create_ruleset
+	SYS_LANDLOCK_RESTRICT_SELF  = C.SYS_landlock_restrict_self
 )
 
 type LandlockRulesetAttr = C.struct_landlock_ruleset_attr
 
+// ScopeAbstract calls landlock_restrict_self and must be called from a goroutine wired to an m
+// with the process starting from the same goroutine.
 func ScopeAbstract() error {
 	abi, _, err := syscall.Syscall(SYS_LANDLOCK_CREATE_RULESET, 0, 0, LANDLOCK_CREATE_RULESET_VERSION)
 
@@ -48,10 +47,9 @@ func ScopeAbstract() error {
 
 	defer syscall.Close(int(fd))
 
-	var errno C.int
-	if rv := C.hakurei_scope_abstract_unix_sockets(&errno, C.int(fd)); rv != 0 {
-		return fmt.Errorf("could not restrict self via landlock: errno %v", errno)
+	r, _, err := syscall.Syscall(SYS_LANDLOCK_RESTRICT_SELF, fd, 0, 0)
+	if r != 0 {
+		return fmt.Errorf("could not restrict self via landlock: errno %v", err)
 	}
-
 	return nil
 }

package.nix

@@ -5,7 +5,6 @@
   makeBinaryWrapper,
   xdg-dbus-proxy,
   pkg-config,
-  libcap,
   libffi,
   libseccomp,
   acl,
@@ -81,16 +80,10 @@ buildGoModule rec {
         hsu = "/run/wrappers/bin/hsu";
       };
 
-  env = {
-    # required by libpsx
-    CGO_LDFLAGS_ALLOW = "-Wl,(--no-whole-archive|--whole-archive)";
-
-    # nix build environment does not allow acls
-    GO_TEST_SKIP_ACL = 1;
-  };
+  # nix build environment does not allow acls
+  env.GO_TEST_SKIP_ACL = 1;
 
   buildInputs = [
-    libcap
     libffi
     libseccomp
     acl