Landlock read rules can't grant access to host bind mounts (fakeowner): reads are denied even with a rule on / #784

Bug report

Description

A process restricted with Landlock cannot read files on a host bind mount, even when the ruleset allows reading beneath / or the file itself. The same restriction works for files in the image and on named volumes. Without Landlock, the bind-mounted file reads normally.

Host bind mounts appear as fakeowner in the container's mount table. Our guess, which we haven't verified: the fakeowner layer opens its backing file (on the virtiofs share) in the calling task's context. Landlock then checks that inner open against a path outside the container's mount namespace, which no rule can name. Overlayfs handles its backing-file opens so that Landlock doesn't evaluate them this way.

This may be related to #765, which reports fakeowner binding descriptors to the backing virtiofs inode, but this case occurs with the Apple Virtualization framework, not only Docker VMM.

Reproduction

Public image, util-linux setpriv ≥ 2.40:

mkdir -p ~/landlock-repro && echo 'hello from the host' > ~/landlock-repro/file.txt

# 1. No Landlock: reads fine
docker run --rm -v ~/landlock-repro:/hostshare:ro debian:trixie \
  cat /hostshare/file.txt /etc/hostname

# 2. Landlock restricts read-file, allowed beneath /: the bind-mounted file is denied
docker run --rm -v ~/landlock-repro:/hostshare:ro debian:trixie \
  setpriv --landlock-access fs:read-file --landlock-rule path-beneath:read-file:/ \
  cat /hostshare/file.txt /etc/hostname

# 3. Control: the same rule on a named volume reads fine
docker volume create ll-vol
docker run --rm -v ll-vol:/vol debian:trixie sh -c 'echo hello > /vol/file.txt'
docker run --rm -v ll-vol:/vol debian:trixie \
  setpriv --landlock-access fs:read-file --landlock-rule path-beneath:read-file:/ cat /vol/file.txt

Expected: case 2 prints both files, since read access is allowed beneath /.

Actual:

<container hostname>
cat: /hostshare/file.txt: Permission denied

A rule on the file itself (path-beneath:read-file:/hostshare/file.txt) is denied the same way. Case 3 prints hello.

Mount entry inside the container:

… /<user>/landlock-repro /hostshare ro,nosuid,nodev,relatime - fakeowner /run/host_mark/Users rw,fakeowner

Environment

• Docker Desktop 4.96.3 (244472), engine 29.9.2, macOS on Apple Silicon (aarch64)
• VMM: Apple Virtualization framework; file sharing: VirtioFS
• VM kernel: 7.0.14-linuxkit
• util-linux setpriv 2.41.5 (debian:trixie)

Impact

Tools that use Landlock to confine processes to a project directory, a common pattern for sandboxing build scripts and AI coding agents, can't read anything in a bind-mounted project on Docker Desktop. They either fail or have to drop read confinement.

Platform

macOS

Version information

Client:
 Version:           29.9.2
 API version:       1.56
 Go version:        go1.26.10
 Git commit:        a82e528
 Built:             Tue Oct 20 18:43:59 2026
 OS/Arch:           darwin/arm64
 Context:           desktop-linux

Server: Docker Desktop 4.96.3 (244472)
 Engine:
  Version:          29.9.2
  API version:      1.56 (minimum version 1.40)
  Go version:       go1.26.10
  Git commit:       0367cbe
  Built:            Tue Oct 20 18:44:14 2026
  OS/Arch:          linux/arm64
  Experimental:     false
 containerd:
  Version:          v2.4.2
  GitCommit:        b7a25261e029d68978bbf290df0a62fc819b3c51
 runc:
  Version:          1.5.2
  GitCommit:        v1.5.2-0-g29dd3dc2
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

Diagnostics ID

No response