Re: [RFC PATCH v1 10/11] samples/landlock: Add capability and namespace restriction support

Mickaël Salaün
2026-04-23T14:01:11Z

On Wed, Apr 22, 2026 at 11:20:45PM +0200, Günther Noack wrote:
> On Thu, Mar 12, 2026 at 11:04:43AM +0100, Mickaël Salaün wrote:
> > Extend the sandboxer sample to demonstrate the new Landlock capability
> > and namespace restriction features. The LL_CAPS environment variable
> > takes a colon-delimited list of allowed capability numbers (e.g. "18"
> > for CAP_SYS_CHROOT). The LL_NS variable takes a colon-delimited list of
> > allowed namespace types by short name (e.g. "user:uts:net"). Update
> > LANDLOCK_ABI_LAST to 9 and add best-effort degradation for older
> > kernels.
> >
> > Allow creating user and UTS namespaces but deny network namespaces
> > (works as an unprivileged user). All capabilities are available
> > (LL_CAPS is not set), but namespace creation is still restricted to the
> > types listed in LL_NS. The first command succeeds because user and UTS
> > types are in the allowed set, and sets the hostname inside the new UTS
> > namespace. The second command fails because the network namespace type
> > is not allowed by the LANDLOCK_PERM_NAMESPACE_ENTER rule:
> >
> > LL_FS_RO=/ LL_FS_RW=/proc LL_NS="user:uts" \
> > ./sandboxer /bin/sh -c \
> > "unshare --user --uts --map-root-user hostname sandbox \
> > && ! unshare --user --net true"
> >
> > Allow only user namespace creation and CAP_SYS_CHROOT (18), denying all
> > other capabilities and namespace types (works as an unprivileged user).
> > An unprivileged process creates a user namespace (no capability
> > required) and calls chroot inside it using the CAP_SYS_CHROOT granted
> > within the new namespace:
> >
> > LL_FS_RO=/ LL_FS_RW="" LL_NS="user" LL_CAPS="18" \
> > ./sandboxer /bin/sh -c \
> > "unshare --user --keep-caps chroot / true"
> >
> > Cc: Christian Brauner <brauner@kernel.org>
> > Cc: Günther Noack <gnoack@google.com>
> > Cc: Paul Moore <paul@paul-moore.com>
> > Cc: Serge E. Hallyn <serge@hallyn.com>
> > Signed-off-by: Mickaël Salaün <mic@digikod.net>
> > ---
> > samples/landlock/sandboxer.c | 164 +++++++++++++++++++++++++++++++++--
> > 1 file changed, 155 insertions(+), 9 deletions(-)
> >
> > diff --git a/samples/landlock/sandboxer.c b/samples/landlock/sandboxer.c
> > index 9f21088c0855..09c499703835 100644
> > --- a/samples/landlock/sandboxer.c
> > +++ b/samples/landlock/sandboxer.c
> > @@ -14,6 +14,8 @@
> > #include <fcntl.h>
> > #include <linux/landlock.h>
> > #include <linux/socket.h>
> > +#include <sched.h>
> > +#include <stdbool.h>
> > #include <stddef.h>
> > #include <stdio.h>
> > #include <stdlib.h>
> > @@ -22,12 +24,16 @@
> > #include <sys/stat.h>
> > #include <sys/syscall.h>
> > #include <unistd.h>
> > -#include <stdbool.h>
> >
> > #if defined(__GLIBC__)
> > #include <linux/prctl.h>
> > #endif
> >
> > +/* From include/linux/bits.h, not available in userspace. */
> > +#ifndef BITS_PER_TYPE
> > +#define BITS_PER_TYPE(type) (sizeof(type) * 8)
> > +#endif
> > +
> > #ifndef landlock_create_ruleset
> > static inline int
> > landlock_create_ruleset(const struct landlock_ruleset_attr *const attr,
> > @@ -60,6 +66,8 @@ static inline int landlock_restrict_self(const int ruleset_fd,
> > #define ENV_FS_RW_NAME "LL_FS_RW"
> > #define ENV_TCP_BIND_NAME "LL_TCP_BIND"
> > #define ENV_TCP_CONNECT_NAME "LL_TCP_CONNECT"
> > +#define ENV_CAPS_NAME "LL_CAPS"
> > +#define ENV_NS_NAME "LL_NS"
> > #define ENV_SCOPED_NAME "LL_SCOPED"
> > #define ENV_FORCE_LOG_NAME "LL_FORCE_LOG"
> > #define ENV_DELIMITER ":"
> > @@ -226,11 +234,125 @@ static int populate_ruleset_net(const char *const env_var, const int ruleset_fd,
> > return ret;
> > }
> >
> > +static __u64 str2ns(const char *const name)
> > +{
> > + static const struct {
> > + const char *name;
> > + __u64 value;
> > + } ns_map[] = {
> > + /* clang-format off */
> > + { "cgroup", CLONE_NEWCGROUP },
> > + { "ipc", CLONE_NEWIPC },
> > + { "mnt", CLONE_NEWNS },
> > + { "net", CLONE_NEWNET },
> > + { "pid", CLONE_NEWPID },
> > + { "time", CLONE_NEWTIME },
> > + { "user", CLONE_NEWUSER },
> > + { "uts", CLONE_NEWUTS },
> > + /* clang-format on */
> > + };
> > + size_t i;
> > +
> > + for (i = 0; i < sizeof(ns_map) / sizeof(ns_map[0]); i++) {
> > + if (strcmp(name, ns_map[i].name) == 0)
> > + return ns_map[i].value;
> > + }
> > + return 0;
> > +}
> > +
> > +static int populate_ruleset_caps(const char *const env_var,
> > + const int ruleset_fd)
> > +{
> > + int ret = 1;
> > + char *env_cap_name, *env_cap_name_next, *strcap;
> > + struct landlock_capability_attr cap_attr = {
> > + .allowed_perm = LANDLOCK_PERM_CAPABILITY_USE,
> > + };
> > +
> > + env_cap_name = getenv(env_var);
> > + if (!env_cap_name)
> > + return 0;
> > + env_cap_name = strdup(env_cap_name);
> > + unsetenv(env_var);
> > +
> > + env_cap_name_next = env_cap_name;
> > + while ((strcap = strsep(&env_cap_name_next, ENV_DELIMITER))) {
> > + __u64 cap;
> > +
> > + if (strcmp(strcap, "") == 0)
> > + continue;
> > +
> > + if (str2num(strcap, &cap) ||
>
> libcap has cap_from_name(3). I believe we are linking with libcap
> already to drop them before tests. (I have not used this function
> myself yet, but it sounds like it would address this case.)

libcap is only used for kselftests, not this sample, but yes, let's use
libcap here too.

>
>
> > + cap >= BITS_PER_TYPE(cap_attr.capabilities)) {
> > + fprintf(stderr,
> > + "Failed to parse capability at \"%s\"\n",
> > + strcap);
> > + goto out_free_name;
> > + }
> > + cap_attr.capabilities = 1ULL << cap;
> > + if (landlock_add_rule(ruleset_fd, LANDLOCK_RULE_CAPABILITY,
> > + &cap_attr, 0)) {
> > + fprintf(stderr,
> > + "Failed to update the ruleset with capability \"%llu\": %s\n",
> > + (unsigned long long)cap, strerror(errno));
> > + goto out_free_name;
> > + }
> > + }
> > + ret = 0;
> > +
> > +out_free_name:
> > + free(env_cap_name);
> > + return ret;
> > +}
> > +
> > +static int populate_ruleset_ns(const char *const env_var, const int ruleset_fd)
> > +{
> > + int ret = 1;
> > + char *env_ns_name, *env_ns_name_next, *strns;
> > + struct landlock_namespace_attr ns_attr = {
> > + .allowed_perm = LANDLOCK_PERM_NAMESPACE_ENTER,
> > + };
> > +
> > + env_ns_name = getenv(env_var);
> > + if (!env_ns_name)
> > + return 0;
> > + env_ns_name = strdup(env_ns_name);
> > + unsetenv(env_var);
> > +
> > + env_ns_name_next = env_ns_name;
> > + while ((strns = strsep(&env_ns_name_next, ENV_DELIMITER))) {
> > + __u64 ns_type;
> > +
> > + if (strcmp(strns, "") == 0)
> > + continue;
> > +
> > + ns_type = str2ns(strns);
> > + if (!ns_type) {
> > + fprintf(stderr, "Unknown namespace type \"%s\"\n",
> > + strns);
> > + goto out_free_name;
> > + }
> > + ns_attr.namespace_types = ns_type;
> > + if (landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NAMESPACE,
> > + &ns_attr, 0)) {
> > + fprintf(stderr,
> > + "Failed to update the ruleset with namespace \"%s\": %s\n",
> > + strns, strerror(errno));
> > + goto out_free_name;
> > + }
> > + }
> > + ret = 0;
> > +
> > +out_free_name:
> > + free(env_ns_name);
> > + return ret;
> > +}
> > +
> > /* Returns true on error, false otherwise. */
> > static bool check_ruleset_scope(const char *const env_var,
> > struct landlock_ruleset_attr *ruleset_attr)
> > {
> > - char *env_type_scope, *env_type_scope_next, *ipc_scoping_name;
> > + char *env_type_scope, *env_type_scope_next, *scope_name;
> > bool error = false;
> > bool abstract_scoping = false;
> > bool signal_scoping = false;
> > @@ -247,16 +369,14 @@ static bool check_ruleset_scope(const char *const env_var,
> >
> > env_type_scope = strdup(env_type_scope);
> > env_type_scope_next = env_type_scope;
> > - while ((ipc_scoping_name =
> > - strsep(&env_type_scope_next, ENV_DELIMITER))) {
> > - if (strcmp("a", ipc_scoping_name) == 0 && !abstract_scoping) {
> > + while ((scope_name = strsep(&env_type_scope_next, ENV_DELIMITER))) {
> > + if (strcmp("a", scope_name) == 0 && !abstract_scoping) {
> > abstract_scoping = true;
> > - } else if (strcmp("s", ipc_scoping_name) == 0 &&
> > - !signal_scoping) {
> > + } else if (strcmp("s", scope_name) == 0 && !signal_scoping) {
> > signal_scoping = true;
> > } else {
> > fprintf(stderr, "Unknown or duplicate scope \"%s\"\n",
> > - ipc_scoping_name);
> > + scope_name);
> > error = true;
> > goto out_free_name;
> > }
> > @@ -299,7 +419,7 @@ static bool check_ruleset_scope(const char *const env_var,
> >
> > /* clang-format on */
> >
> > -#define LANDLOCK_ABI_LAST 8
> > +#define LANDLOCK_ABI_LAST 9
> >
> > #define XSTR(s) #s
> > #define STR(s) XSTR(s)
> > @@ -322,6 +442,10 @@ static const char help[] =
> > "means an empty list):\n"
> > "* " ENV_TCP_BIND_NAME ": ports allowed to bind (server)\n"
> > "* " ENV_TCP_CONNECT_NAME ": ports allowed to connect (client)\n"
> > + "* " ENV_CAPS_NAME ": capability numbers allowed to use "
> > + "(e.g. 10 for CAP_NET_BIND_SERVICE, 21 for CAP_SYS_ADMIN)\n"
> > + "* " ENV_NS_NAME ": namespace types allowed to enter "
> > + "(cgroup, ipc, mnt, net, pid, time, user, uts)\n"
> > "* " ENV_SCOPED_NAME ": actions denied on the outside of the landlock domain\n"
> > " - \"a\" to restrict opening abstract unix sockets\n"
> > " - \"s\" to restrict sending signals\n"
> > @@ -334,6 +458,8 @@ static const char help[] =
> > ENV_FS_RW_NAME "=\"/dev/null:/dev/full:/dev/zero:/dev/pts:/tmp\" "
> > ENV_TCP_BIND_NAME "=\"9418\" "
> > ENV_TCP_CONNECT_NAME "=\"80:443\" "
> > + ENV_CAPS_NAME "=\"21\" "
> > + ENV_NS_NAME "=\"user:uts:net\" "
> > ENV_SCOPED_NAME "=\"a:s\" "
> > "%1$s bash -i\n"
> > "\n"
> > @@ -357,6 +483,8 @@ int main(const int argc, char *const argv[], char *const *const envp)
> > LANDLOCK_ACCESS_NET_CONNECT_TCP,
> > .scoped = LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET |
> > LANDLOCK_SCOPE_SIGNAL,
> > + .handled_perm = LANDLOCK_PERM_CAPABILITY_USE |
> > + LANDLOCK_PERM_NAMESPACE_ENTER,
> > };
> > int supported_restrict_flags = LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON;
> > int set_restrict_flags = 0;
> > @@ -438,6 +566,10 @@ int main(const int argc, char *const argv[], char *const *const envp)
> > ~LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON;
> > __attribute__((fallthrough));
> > case 7:
> > + __attribute__((fallthrough));
> > + case 8:
> > + /* Removes permission support for ABI < 9 */
> > + ruleset_attr.handled_perm = 0;
> > /* Must be printed for any ABI < LANDLOCK_ABI_LAST. */
> > fprintf(stderr,
> > "Hint: You should update the running kernel "
> > @@ -470,6 +602,14 @@ int main(const int argc, char *const argv[], char *const *const envp)
> > ~LANDLOCK_ACCESS_NET_CONNECT_TCP;
> > }
> >
> > + /* Removes capability handling if not set by a user. */
> > + if (!getenv(ENV_CAPS_NAME))
> > + ruleset_attr.handled_perm &= ~LANDLOCK_PERM_CAPABILITY_USE;
> > +
> > + /* Removes namespace handling if not set by a user. */
> > + if (!getenv(ENV_NS_NAME))
> > + ruleset_attr.handled_perm &= ~LANDLOCK_PERM_NAMESPACE_ENTER;
> > +
> > if (check_ruleset_scope(ENV_SCOPED_NAME, &ruleset_attr))
> > return 1;
> >
> > @@ -514,6 +654,12 @@ int main(const int argc, char *const argv[], char *const *const envp)
> > goto err_close_ruleset;
> > }
> >
> > + if (populate_ruleset_caps(ENV_CAPS_NAME, ruleset_fd))
> > + goto err_close_ruleset;
> > +
> > + if (populate_ruleset_ns(ENV_NS_NAME, ruleset_fd))
> > + goto err_close_ruleset;
> > +
> > if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
> > perror("Failed to restrict privileges");
> > goto err_close_ruleset;
> > --
> > 2.53.0
> >
>