Re: [bitbake-devel] [PATCH [RFC] 1/2] utils: Add landlock_restrict_network function

[Richard Purdie <richard.purdie@linuxfoundation.org>]

On Sat, 2026-06-13 at 13:52 +0200, Alexander Kanavin via
lists.openembedded.org wrote:
> On Fri, 12 Jun 2026 at 14:01, David Nyström via
> lists.openembedded.org
> <david.nystrom=est.tech@lists.openembedded.org> wrote:
> > +def landlock_restrict_network():
> > +    """Block TCP bind/connect using Landlock LSM (ABI v4+, kernel
> > 6.7+).
> > +    Gracefully skipped on older kernels. Stacks with
> > disable_network()."""
> > +
> > +    NR_CREATE = 444  # landlock_create_ruleset
> > +    NR_SELF   = 446  # landlock_restrict_self
> > +    NET_TCP   = 0x3  # BIND_TCP | CONNECT_TCP
> > +
> > +    libc = ctypes.CDLL('libc.so.6')
> > +
> > +    abi = libc.syscall(NR_CREATE, 0, 0, 1)
> > +    if abi < 4:
> > +        return False
> > +
> > +    attr = struct.pack("QQ", 0, NET_TCP)
> > +    buf = ctypes.create_string_buffer(attr)
> > +    fd = libc.syscall(NR_CREATE, buf, len(attr), 0)
> > +    if fd < 0:
> > +        return False
> > +
> > +    libc.prctl(38, 1, 0, 0, 0)  # PR_SET_NO_NEW_PRIVS
> > +    r = libc.syscall(NR_SELF, fd, 0)
> > +    os.close(fd)
> > +    return r == 0
> 
> Far too many magic numbers. I would really want to do this with an
> API.
> 
> This also needs some kind of test, e.g. that the function indeed has
> the desired effect.

Unfortunately, to use tech like this, we do end up needing to do
something like that and utils.py already has quite a bit of it. The
plus side is that the kernel is really good about maintaining these
APIs so the numbers are unlikely to change.

I wouldn't take something like this unless there was a really good case
for using it. Network isolation in more builds probably is a strong
enough use case...

Cheers,

Richard