Re: Landlock setup

["Mickaël Salaün" <mic@digikod.net>]

Hi Yves,

On 07/11/2022 18:22, Yves Rutschle wrote:
> Hello everyone,
> 
> Following Mickael's presentation of Landlock at
> Pass-the-Salt 2022, I intend to add support for it to sslh.
> 
> I'm starting from the beginning: compiling and running the
> example, which so far complains the LSM is not loaded, when
> the kernel tells me it is...
> 
> I'm running a stock Debian where I manually add landlock to
> the command line:
> 
> [    0.000000] Command line: BOOT_IMAGE=/boot/vmlinuz-5.18.0-3-amd64 root=UUID=79c3bdf6-4be2-46d6-b006-bb17170247b1 ro quiet lsm=landlock

This is correct, but you may also want to enable other LSMs if you are 
using them (e.g. Yama). You should probably stick to the new default 
Debian Sid cmdline: 
https://salsa.debian.org/kernel-team/linux/-/commit/1ef40f40e593a5dc223e9ce171fa8f2cd5aba198

> 
> the kernel indicates the LSM is started:
> 
> [    0.076550] LSM: Security Framework initializing
> [    0.076559] landlock: Up and running.
> 
> 
> Yet running the example fails:
> 
> # LL_FS_RO="/bin:/lib:/usr:/proc:/etc:/dev/urandom" LL_FS_RW="/dev/null:/dev/full:/dev/zero:/dev/pts:/tmp" ./lock bash -i
> Failed to check Landlock compatibility: Function not implemented
> Hint: Landlock is not supported by the current kernel. To support it, build the kernel with CONFIG_SECURITY_LANDLOCK=y and prepend "landlock," to the content of CONFIG_LSM.
> 
> 
> 
> What would I be doing wrong?

Your setup is good and it should work. You can debug a bit more with an 
up-to-date strace (which will print the Landlock syscalls). I guess you 
are running this sample in a strict seccomp environment that denies 
Landlock syscalls. This may be the result of using an old container 
runtime (Docker, Podman and runc are now patched but the related fix may 
not be backported).