Landlock only subprocesses (without the parent)

[MarcCoquand]

Hi!

I'm working on a job queue that executes jobs using cmd.Exec(...). I understand it that the API landlocks the entire process because the mapping is not guaranteed between an OS thread and a goroutine. But in this case cmd.Exec exposes a os.Process, and I'm curious if it's possible to make landlock restrict a given os.Process. It would allow the job queue to lock down jobs, and restricting their access to the job queue's internal state files.

[gnoack]

Hello!

You are correct, the Go-Landlock library does not currently support this.

I have investigated this a while back. With the current implementation of the Go runtime library, it is not feasible:

• Go does not expose fork() and execve() syscalls individually, because it leads to multithreading problems (see e.g. https://thorstenball.com/blog/2014/10/13/why-threads-cant-fork/).
• When you follow the logic in os/exec, you'll find that it eventually starts processes using syscall.StartProcess (docs) - this function starts a subprocess, that means that it uses both fork() and execve() together.
• Going even deeper in, the implementation is in the end in syscall.forkAndExecInChild1() (Code). This function does all the things which need to happen in between fork() and execve(). It reads the things that are supposed to happen from a syscall.SysProcAttr, which can also be set on the os/exec.Cmd in the SysProcAttr field.

So, I think what would need to happen is:

• In the Go runtime:
  • Add a LandlockRulesetFD field to syscall.SysProcAttr. (Compare the CgroupFD field that already exists there.)
  • Extend syscall.forkAndExecInChild1() so that it reads this field from the SysProcAttr struct and calls landlock_restrict_self(2).
  • In the same way, make sure that we have a way to set no_new_privs through prctl(), which is a prerequisite for enforcing Landlock policies.
• In the Go-Landlock library:
  • Design a good API so that the (otherwise non-exposed) ruleset FD number can be wired through to the .SysProcAttr on the os/exec.Cmd struct.

[gnoack]

It was actually previously proposed to the Go standard library,
in the same form as I proposed it above as well:

• Proposal: proposal: syscall: add landlock support on Linux golang/go#47049
• Issue: syscall: support process sandboxing using Landlock on Linux golang/go#68595

The proposal was retracted at the time, but the reason was due to process reasons, not due to technical reasons.

We should probably revive this.

[gnoack]

golang/go#77630 PR for Go

[gnoack]

golang/go#68595 (comment) Go Proposal

[gnoack]

https://github.com/cnaize/landbox it is a library that offers a os/exec.Command()-like API for running subprocesses under Landlock. It is implemented by using an external sandboxer program as a wrapper. (It looks like it might be the one from the Linux samples directory, but I don't know for sure, since the library only bundles a precompiled binary)

I am counting the existence of this as further evidence that this feature would be useful. :)