actiondfs: use mount credentials for Landlock-safe backing opens - #44
Open
zbarsky-openai wants to merge 1 commit into
Open
zbarsky-openai wants to merge 1 commit into
zbarsky-openai wants to merge 1 commit into
Conversation
Landlock-confined programs cannot read files from actiondfs even when their policy explicitly grants the visible actiondfs path: ```text PermissionError: [Errno 13] Permission denied: '/execroot/.../python3.12/encodings/__init__.py' ``` The visible path is authorized, but actiondfs then opens its hidden ext4 CAS or staging backing file with the already-confined task credentials. Landlock evaluates that unrelated underlying path and rejects the internal open. Follow Linux overlayfs's existing model: retain the mount creator's credentials, temporarily override task credentials only while opening internal directory, CAS, and staged backing files, then restore the caller immediately. The original VFS/Landlock check still applies to the user-visible actiondfs path. Release the saved credential when the superblock is destroyed. Validated by rebuilding and booting the actual ARM64 guest kernel through actiond (`f16f4f3f-df24-4954-8a61-793858c17bc7`, 943 real remote actions), then rerunning both production sandbox seccomp cases with a real Landlock policy (`08b932ab-9f76-4129-a0bb-3bba52793ea6`). The complete sandbox suite advanced to 178 passing tests; remaining failures are independent guest capability gaps.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Landlock-confined programs cannot read files from actiondfs even when their policy
explicitly grants the visible actiondfs path:
The visible path is authorized, but actiondfs then opens its hidden ext4 CAS or
staging backing file with the already-confined task credentials. Landlock
evaluates that unrelated underlying path and rejects the internal open.
Follow Linux overlayfs's existing model: retain the mount creator's credentials,
temporarily override task credentials only while opening internal directory,
CAS, and staged backing files, then restore the caller immediately. The original
VFS/Landlock check still applies to the user-visible actiondfs path. Release the
saved credential when the superblock is destroyed.
Validated by rebuilding and booting the actual ARM64 guest kernel through
actiond (
f16f4f3f-df24-4954-8a61-793858c17bc7, 943 real remote actions), thenrerunning both production sandbox seccomp cases with a real Landlock policy
(
08b932ab-9f76-4129-a0bb-3bba52793ea6). The complete sandbox suite advancedto 178 passing tests; remaining failures are independent guest capability gaps.