From 5643081a2aaf166cfcc6aaf4335dd9401cf68d44 Mon Sep 17 00:00:00 2001 From: zbarsky-openai Date: Mon, 24 Aug 2026 05:32:05 -0400 Subject: [PATCH] vm: enable Landlock in both guest kernels Sandbox tests executed inside actiond fail because its minimal guest kernels do not implement the Landlock system calls: ```text landlock.SyscallError: [Errno 38] Function not implemented: 'Error calling landlock_create_ruleset: syscall(444, None, 0, 1) = -1' Note: Cannot find Landlock syscalls - perhaps the kernel was not built with 'CONFIG_SECURITY_LANDLOCK=y' RuntimeError: Landlock not available in linux kernel, unable to create a safe sandbox. ``` Enable the kernel security framework and Landlock on both ARM64 and x86_64, and explicitly select Landlock in the boot-time LSM list. Linux automatically selects the required security-path and networking hooks. Both fragments were resolved through the repository's actual Linux 6.18.2 Kconfig parser with `allnoconfig`, verifying `CONFIG_SECURITY`, `CONFIG_SECURITY_LANDLOCK`, `CONFIG_SECURITY_PATH`, `CONFIG_SECURITY_NETWORK`, and `CONFIG_LSM` for both architectures. The original failure was reproduced remotely with `//project/oai_sandbox:pytest -k test_seccomp_default_action`. --- vm/linux.config | 3 +++ vm/linux_x86_64.config | 3 +++ 2 files changed, 6 insertions(+) diff --git a/vm/linux.config b/vm/linux.config index 69abcd9..e0d84b4 100644 --- a/vm/linux.config +++ b/vm/linux.config @@ -38,6 +38,7 @@ CONFIG_HYPERV_VSOCKETS=y CONFIG_INET=y CONFIG_JBD2=y CONFIG_KALLSYMS=y +CONFIG_LSM="landlock" CONFIG_MEMCG=y CONFIG_MISC_FILESYSTEMS=y CONFIG_MULTIUSER=y @@ -54,6 +55,8 @@ CONFIG_PROC_FS=y CONFIG_PRINTK=y CONFIG_RD_ZSTD=y CONFIG_SECCOMP=y +CONFIG_SECURITY=y +CONFIG_SECURITY_LANDLOCK=y CONFIG_SERIAL_AMBA_PL011=y CONFIG_SERIAL_AMBA_PL011_CONSOLE=y CONFIG_SCSI=y diff --git a/vm/linux_x86_64.config b/vm/linux_x86_64.config index 278a71f..030c583 100644 --- a/vm/linux_x86_64.config +++ b/vm/linux_x86_64.config @@ -37,6 +37,7 @@ CONFIG_JBD2=y CONFIG_KALLSYMS=y CONFIG_KERNEL_LZ4=y CONFIG_KVM_GUEST=y +CONFIG_LSM="landlock" CONFIG_MEMCG=y CONFIG_MISC_FILESYSTEMS=y CONFIG_MULTIUSER=y @@ -50,6 +51,8 @@ CONFIG_POSIX_TIMERS=y CONFIG_PROC_FS=y CONFIG_PRINTK=y CONFIG_SECCOMP=y +CONFIG_SECURITY=y +CONFIG_SECURITY_LANDLOCK=y CONFIG_SERIAL_8250=y CONFIG_SERIAL_8250_CONSOLE=y CONFIG_SIGNALFD=y