container: optionally isolate host abstract UNIX domain sockets via landlock

The socket is typically owned by the priv-user, and inaccessible by the target user, so just allowing access to the directory is not enough. This change fixes this oversight and add checks that will also be useful for merging #1.

Signed-off-by: Ophestra <cat@gensokyo.uk>

# Conflicts:
#	test/sandbox/case/device.nix
#	test/sandbox/case/tty.nix

cmd/hpkg/app.go

@@ -28,6 +28,8 @@ type appInfo struct {
 	// passed through to [hst.Config]
 	Net bool `json:"net,omitempty"`
 	// passed through to [hst.Config]
+	ScopeAbstract bool `json:"scope_abstract,omitempty"`
+	// passed through to [hst.Config]
 	Device bool `json:"dev,omitempty"`
 	// passed through to [hst.Config]
 	Tty bool `json:"tty,omitempty"`

container/container.go

@@ -7,6 +7,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"log"
 	"os"
 	"os/exec"
 	"runtime"
@@ -14,6 +15,7 @@ import (
 	. "syscall"
 	"time"
 
+	"hakurei.app/container/landlock"
 	"hakurei.app/container/seccomp"
 )
 
@@ -92,6 +94,8 @@ type (
 		RetainSession bool
 		// Do not [syscall.CLONE_NEWNET].
 		HostNet bool
+		// Scope abstract UNIX domain sockets using LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET.
+		ScopeAbstract bool
 		// Retain CAP_SYS_ADMIN.
 		Privileged bool
 	}
@@ -185,6 +189,12 @@ func (p *Container) Start() error {
 					"prctl(PR_SET_NO_NEW_PRIVS):")
 			}
 
+			if p.ScopeAbstract {
+				if err := landlock.ScopeAbstract(); err != nil {
+					log.Fatalf("could not scope abstract unix sockets: %v", err)
+				}
+			}
+
 			msg.Verbose("starting container init")
 			if err := p.cmd.Start(); err != nil {
 				return msg.WrapErr(err, err.Error())

container/landlock/landlock.go

@@ -0,0 +1,55 @@
+package landlock
+
+/*
+#include <linux/landlock.h>
+#include <sys/syscall.h>
+*/
+import "C"
+
+import (
+	"fmt"
+	"syscall"
+	"unsafe"
+)
+
+const (
+	LANDLOCK_CREATE_RULESET_VERSION     = C.LANDLOCK_CREATE_RULESET_VERSION
+	LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET = C.LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET
+
+	SYS_LANDLOCK_CREATE_RULESET = C.SYS_landlock_create_ruleset
+	SYS_LANDLOCK_RESTRICT_SELF  = C.SYS_landlock_restrict_self
+)
+
+type LandlockRulesetAttr = C.struct_landlock_ruleset_attr
+
+// ScopeAbstract calls landlock_restrict_self and must be called from a goroutine wired to an m
+// with the process starting from the same goroutine.
+func ScopeAbstract() error {
+	abi, _, err := syscall.Syscall(SYS_LANDLOCK_CREATE_RULESET, 0, 0, LANDLOCK_CREATE_RULESET_VERSION)
+
+	if err != 0 {
+		return fmt.Errorf("could not fetch landlock ABI: errno %v", err)
+	}
+
+	if abi < 6 {
+		return fmt.Errorf("landlock ABI must be >= 6, got %d", abi)
+	}
+
+	attrs := LandlockRulesetAttr{
+		scoped: LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET,
+	}
+
+	fd, _, err := syscall.Syscall(SYS_LANDLOCK_CREATE_RULESET, uintptr(unsafe.Pointer(&attrs)), unsafe.Sizeof(attrs), 0)
+
+	if err != 0 {
+		return fmt.Errorf("could not create landlock ruleset: errno %v", err)
+	}
+
+	defer syscall.Close(int(fd))
+
+	r, _, err := syscall.Syscall(SYS_LANDLOCK_RESTRICT_SELF, fd, 0, 0)
+	if r != 0 {
+		return fmt.Errorf("could not restrict self via landlock: errno %v", err)
+	}
+	return nil
+}

hst/config.go

@@ -79,6 +79,8 @@ type (
 		Userns bool `json:"userns,omitempty"`
 		// share host net namespace
 		Net bool `json:"net,omitempty"`
+		// disallow accessing abstract UNIX domain sockets created outside the container
+		ScopeAbstract bool `json:"scope_abstract,omitempty"`
 		// allow dangerous terminal I/O
 		Tty bool `json:"tty,omitempty"`
 		// allow multiarch

internal/app/container_linux.go

@@ -33,6 +33,7 @@ func newContainer(s *hst.ContainerConfig, os sys.State, prefix string, uid, gid
 		SeccompPresets: s.SeccompPresets,
 		RetainSession:  s.Tty,
 		HostNet:        s.Net,
+		ScopeAbstract:  s.ScopeAbstract,
 
 		// the container is canceled when shim is requested to exit or receives an interrupt or termination signal;
 		// this behaviour is implemented in the shim

internal/app/seal_linux.go

@@ -416,6 +416,22 @@ func (seal *outcome) finalise(ctx context.Context, sys sys.State, config *hst.Co
 			seal.sys.ChangeHosts("#" + seal.user.uid.String())
 			seal.env[display] = d
 			seal.container.Bind(socketDir, socketDir, 0)
+
+			// the socket file at `/tmp/.X11-unix/X%d` is typically owned by the priv user
+			// and not accessible by the target user
+			var socketPath *container.Absolute
+			if len(d) > 1 && d[0] == ':' { // `:%d`
+				if n, err := strconv.Atoi(d[1:]); err == nil && n >= 0 {
+					socketPath = socketDir.Append("X" + strconv.Itoa(n))
+				}
+			} else if len(d) > 5 && strings.HasPrefix(d, "unix:") { // `unix:%s`
+				if a, err := container.NewAbs(d[5:]); err == nil {
+					socketPath = a
+				}
+			}
+			if socketPath != nil {
+				seal.sys.UpdatePermTypeOptional(system.EX11, socketPath.String(), acl.Read, acl.Write, acl.Execute)
+			}
 		}
 	}
 

nixos.nix

@@ -137,6 +137,7 @@ in
                         multiarch
                         env
                         ;
+                      scope_abstract = app.scopeAbstract;
                       map_real_uid = app.mapRealUid;
 
                       filesystem =

options.md

@@ -572,6 +572,28 @@ boolean
 
 
 
+*Example:*
+` true `
+
+
+## environment\.hakurei\.apps\.\<name>\.scopeAbstract
+
+
+
+Whether to restrict abstract UNIX domain socket access\.
+
+
+
+*Type:*
+boolean
+
+
+
+*Default:*
+` true `
+
+
+
 *Example:*
 ` true `
 

options.nix

@@ -182,6 +182,9 @@ in
               net = mkEnableOption "network access" // {
                 default = true;
               };
+              scopeAbstract = mkEnableOption "abstract unix domain socket access" // {
+                default = true;
+              };
 
               nix = mkEnableOption "nix daemon access";
               mapRealUid = mkEnableOption "mapping to priv-user uid";

system/acl.go

@@ -21,7 +21,17 @@ func (sys *I) UpdatePermType(et Enablement, path string, perms ...acl.Perm) *I {
 	sys.lock.Lock()
 	defer sys.lock.Unlock()
 
-	sys.ops = append(sys.ops, &ACL{et, path, perms})
+	sys.ops = append(sys.ops, &ACL{et, path, perms, false})
+
+	return sys
+}
+
+// UpdatePermTypeOptional appends an acl update Op that silently continues if the target does not exist.
+func (sys *I) UpdatePermTypeOptional(et Enablement, path string, perms ...acl.Perm) *I {
+	sys.lock.Lock()
+	defer sys.lock.Unlock()
+
+	sys.ops = append(sys.ops, &ACL{et, path, perms, true})
 
 	return sys
 }
@@ -30,14 +40,24 @@ type ACL struct {
 	et    Enablement
 	path  string
 	perms acl.Perms
+
+	// since revert operations are cross-process, the success of apply must not affect the outcome of revert
+	skipNotExist bool
 }
 
 func (a *ACL) Type() Enablement { return a.et }
 
 func (a *ACL) apply(sys *I) error {
 	msg.Verbose("applying ACL", a)
-	return wrapErrSuffix(acl.Update(a.path, sys.uid, a.perms...),
-		fmt.Sprintf("cannot apply ACL entry to %q:", a.path))
+	if err := acl.Update(a.path, sys.uid, a.perms...); err != nil {
+		if !a.skipNotExist || !os.IsNotExist(err) {
+			return wrapErrSuffix(err,
+				fmt.Sprintf("cannot apply ACL entry to %q:", a.path))
+		}
+		msg.Verbosef("path %q does not exist", a.path)
+		return nil
+	}
+	return nil
 }
 
 func (a *ACL) revert(sys *I, ec *Criteria) error {

system/acl_test.go

@@ -20,7 +20,7 @@ func TestUpdatePerm(t *testing.T) {
 		t.Run(tc.path+permSubTestSuffix(tc.perms), func(t *testing.T) {
 			sys := New(150)
 			sys.UpdatePerm(tc.path, tc.perms...)
-			(&tcOp{Process, tc.path}).test(t, sys.ops, []Op{&ACL{Process, tc.path, tc.perms}}, "UpdatePerm")
+			(&tcOp{Process, tc.path}).test(t, sys.ops, []Op{&ACL{Process, tc.path, tc.perms, false}}, "UpdatePerm")
 		})
 	}
 }
@@ -42,7 +42,7 @@ func TestUpdatePermType(t *testing.T) {
 		t.Run(tc.path+"_"+TypeString(tc.et)+permSubTestSuffix(tc.perms), func(t *testing.T) {
 			sys := New(150)
 			sys.UpdatePermType(tc.et, tc.path, tc.perms...)
-			tc.test(t, sys.ops, []Op{&ACL{tc.et, tc.path, tc.perms}}, "UpdatePermType")
+			tc.test(t, sys.ops, []Op{&ACL{tc.et, tc.path, tc.perms, false}}, "UpdatePermType")
 		})
 	}
 }

system/dbus/proc.go

@@ -64,6 +64,10 @@ func (p *Proxy) Start() error {
 			argF, func(z *container.Container) {
 				z.SeccompFlags |= seccomp.AllowMultiarch
 				z.SeccompPresets |= seccomp.PresetStrict
+
+				// xdg-dbus-proxy requires host abstract UNIX domain socket access
+				z.ScopeAbstract = false
+
 				z.Hostname = "hakurei-dbus"
 				if p.output != nil {
 					z.Stdout, z.Stderr = p.output, p.output

test/sandbox/case/device.nix

@@ -243,7 +243,7 @@ in
     seccomp = true;
 
     try_socket = "/tmp/.X11-unix/X0";
-    socket_abstract = true;
+    socket_abstract = false;
     socket_pathname = true;
   };
 }

test/sandbox/case/mapuid.nix

@@ -269,7 +269,7 @@ in
     seccomp = true;
 
     try_socket = "/tmp/.X11-unix/X0";
-    socket_abstract = true;
+    socket_abstract = false;
     socket_pathname = false;
   };
 }

test/sandbox/case/pdlike.nix

@@ -264,7 +264,7 @@ in
     seccomp = true;
 
     try_socket = "/tmp/.X11-unix/X0";
-    socket_abstract = true;
+    socket_abstract = false;
     socket_pathname = false;
   };
 }

test/sandbox/case/preset.nix

@@ -262,7 +262,7 @@ in
     seccomp = true;
 
     try_socket = "/tmp/.X11-unix/X0";
-    socket_abstract = true;
+    socket_abstract = false;
     socket_pathname = false;
   };
 }

test/sandbox/case/tty.nix

@@ -275,7 +275,7 @@ in
     seccomp = true;
 
     try_socket = "/tmp/.X11-unix/X0";
-    socket_abstract = true;
+    socket_abstract = false;
     socket_pathname = true;
   };
 }