Re: [PATCH 1/6] samples/landlock: Implement best-effort fallback for network rules.

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The best-effort fallback logic introduces an early return that bypasses `unsetenv()`, leaking sandbox configuration environment variables to the child process.
--

commit 9984581b44a9424255f8b9ce2c25354f65e0816c
Author: Günther Noack <gnoack3000@gmail.com>

samples/landlock: Implement best-effort fallback for network rules.

This commit adds a best-effort fallback for network rules in the sandboxer
sample tool. If the Landlock ABI version does not support a requested network
feature, the operation is treated as a no-op instead of causing an error.

> diff --git a/samples/landlock/sandboxer.c b/samples/landlock/sandboxer.c
> index 030583273f3f7..1c514efecafbf 100644
> --- a/samples/landlock/sandboxer.c
> +++ b/samples/landlock/sandboxer.c
> @@ -198,6 +198,10 @@ static int populate_ruleset_net(const char *const env_var, const int ruleset_fd,
>  		.allowed_access = allowed_access,
>  	};
>  
> +	/* A rule without access rights and flags is a no-op. */
> +	if (!allowed_access && !flags)
> +		return 0;
> +

[Severity: Medium]
Does this early return bypass the cleanup of the environment variable?

Looking at populate_ruleset_net(), if the tool runs on an older kernel where
a network feature is not supported, the feature is masked out and
allowed_access becomes 0. Taking this early return avoids the unsetenv(env_var)
call further down in the function:

static int populate_ruleset_net(...)
{
    ...
    if (!allowed_access && !flags)
        return 0;

    env_port_name = getenv(env_var);
    if (!env_port_name)
        return 0;
    env_port_name = strdup(env_port_name);
    unsetenv(env_var);
    ...
}

Will this inadvertently leak the sandbox configuration environment variables
(like LL_TCP_BIND) to the sandboxed child process?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260830201650.67050-1-gnoack3000@gmail.com?part=1