container: optionally isolate host abstract UNIX domain sockets via landlock

container/container.go

@@ -7,7 +7,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"log"
 	"os"
 	"os/exec"
 	"runtime"
@@ -15,7 +14,6 @@ import (
 	. "syscall"
 	"time"
 
-	"hakurei.app/container/landlock"
 	"hakurei.app/container/seccomp"
 )
 
@@ -183,12 +181,6 @@ func (p *Container) Start() error {
 		p.wait = make(chan struct{})
 
 		done <- func() error { // setup depending on per-thread state must happen here
-			if p.ScopeAbstract {
-				if err := landlock.ScopeAbstract(); err != nil {
-					log.Fatalf("could not scope abstract unix sockets: %v", err)
-				}
-			}
-
 			msg.Verbose("starting container init")
 			if err := p.cmd.Start(); err != nil {
 				return msg.WrapErr(err, err.Error())

container/init.go

@@ -13,6 +13,7 @@ import (
 	. "syscall"
 	"time"
 
+	"hakurei.app/container/landlock"
 	"hakurei.app/container/seccomp"
 )
 
@@ -263,6 +264,12 @@ func Init(prepare func(prefix string), setVerbose func(verbose bool)) {
 		msg.Verbose("syscall filter not configured")
 	}
 
+	if params.ScopeAbstract {
+		if err := landlock.ScopeAbstract(); err != nil {
+			log.Fatalf("could not scope abstract unix sockets: %v", err)
+		}
+	}
+
 	extraFiles := make([]*os.File, params.Count)
 	for i := range extraFiles {
 		// setup fd is placed before all extra files

container/landlock/landlock-helper.c

@@ -0,0 +1,14 @@
+#include <errno.h>
+#include <linux/landlock.h>
+#include <sys/psx_syscall.h>
+#include <sys/syscall.h>
+
+#include "landlock-helper.h"
+
+int hakurei_scope_abstract_unix_sockets(int* p_errno, int fd) {
+  int res = psx_syscall3(SYS_landlock_restrict_self, fd, 0, 0);
+
+  *p_errno = errno;
+
+  return res;
+}

container/landlock/landlock-helper.h

@@ -0,0 +1,3 @@
+#pragma once
+
+int hakurei_scope_abstract_unix_sockets(int* p_errno, int fd);

container/landlock/landlock.go

@@ -1,8 +1,12 @@
 package landlock
 
 /*
+#cgo linux pkg-config: --static libpsx
+
 #include <linux/landlock.h>
 #include <sys/syscall.h>
+
+#include "landlock-helper.h"
 */
 import "C"
 
@@ -17,13 +21,10 @@ const (
 	LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET = C.LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET
 
 	SYS_LANDLOCK_CREATE_RULESET = C.SYS_landlock_create_ruleset
-	SYS_LANDLOCK_RESTRICT_SELF  = C.SYS_landlock_restrict_self
 )
 
 type LandlockRulesetAttr = C.struct_landlock_ruleset_attr
 
-// ScopeAbstract calls landlock_restrict_self and must be called from a goroutine wired to an m
-// with the process starting from the same goroutine.
 func ScopeAbstract() error {
 	abi, _, err := syscall.Syscall(SYS_LANDLOCK_CREATE_RULESET, 0, 0, LANDLOCK_CREATE_RULESET_VERSION)
 
@@ -47,9 +48,10 @@ func ScopeAbstract() error {
 
 	defer syscall.Close(int(fd))
 
-	r, _, err := syscall.Syscall(SYS_LANDLOCK_RESTRICT_SELF, fd, 0, 0)
-	if r != 0 {
-		return fmt.Errorf("could not restrict self via landlock: errno %v", err)
+	var errno C.int
+	if rv := C.hakurei_scope_abstract_unix_sockets(&errno, C.int(fd)); rv != 0 {
+		return fmt.Errorf("could not restrict self via landlock: errno %v", errno)
 	}
+
 	return nil
 }

package.nix

@@ -5,6 +5,7 @@
   makeBinaryWrapper,
   xdg-dbus-proxy,
   pkg-config,
+  libcap,
   libffi,
   libseccomp,
   acl,
@@ -80,10 +81,16 @@ buildGoModule rec {
         hsu = "/run/wrappers/bin/hsu";
       };
 
-  # nix build environment does not allow acls
-  env.GO_TEST_SKIP_ACL = 1;
+  env = {
+    # required by libpsx
+    CGO_LDFLAGS_ALLOW = "-Wl,(--no-whole-archive|--whole-archive)";
+
+    # nix build environment does not allow acls
+    GO_TEST_SKIP_ACL = 1;
+  };
 
   buildInputs = [
+    libcap
     libffi
     libseccomp
     acl