Re: Landlock setup

[Yves Rutschle <landlock@rutschle.net>]

On Mon, Nov 07, 2022 at 07:02:04PM +0100, Mickaël Salaün wrote:
> This is correct, but you may also want to enable other LSMs if you are using
> them (e.g. Yama). You should probably stick to the new default Debian Sid
> cmdline: https://salsa.debian.org/kernel-team/linux/-/commit/1ef40f40e593a5dc223e9ce171fa8f2cd5aba198

I'm on Debian 11 on this PC, which enables... nothing.

> Your setup is good and it should work. You can debug a bit more with an
> up-to-date strace (which will print the Landlock syscalls). I guess you are
> running this sample in a strict seccomp environment that denies Landlock
> syscalls. This may be the result of using an old container runtime (Docker,
> Podman and runc are now patched but the related fix may not be backported).

strace:

[...]
mprotect(0x7f5189b04000, 16384, PROT_READ) = 0
mprotect(0x558557b7c000, 4096, PROT_READ) = 0
mprotect(0x7f5189b5c000, 8192, PROT_READ) = 0
munmap(0x7f5189b15000, 94575)           = 0
[ Process PID=3958 runs in x32 mode. ]
syscall_0x400001bc(0, 0, 0x1, 0, 0x7f5189b3d2b0, 0x40) = -1 ENOSYS (Function not implemented)
[ Process PID=3958 runs in 64 bit mode. ]
dup(2)                                  = 3
[...]

=> I guess strace is not up to date. I dont think I have
seccomp enabled either, and I think it would interrupt (as
in kill) the syscall rather than return ENOSYS. I am not
running from a docker either.


Ok, so I guess I'll look into upgrading the kernel and
strace, or compiling it myself.

Cheers,
Y.