Add mount namespaces to linux sandbox #45
Conversation
cd-work
force-pushed
the
mount_namespaces
branch
from
ba25d4c to
4c48482
Compare
This will probably have implications that are more complicated than one might anticipate. The mount namespace resolves symlinks for example and bind mounts the actual directories instead, this would mean that with landlock you'd have to now give permissions for the symlink directory rather than the symlink target (since it's not a symlink anymore). While I don't think this is a big issue for our usecase, it definitely feels somewhat concerning. I've also confirmed that we cannot enforce landlock before the mount namespace without further changes. But it's probably worth testing if this works when allowing read/write access to our Worst-case we certainly could enforce an "either-or" policy, where mount namespaces are only used when landlock fails. Though this would somewhat invalidate the purpose of their introduction. |
This patch adds optional mount namespaces to the linux sandbox to allow for filesystem isolation on systems without landlock support. Filesystem isolation now requires either landlock OR namespace creation to be successful in order for the sandbox creation to be successful. Landlock will be layered on top of the mount namespace if both are available. While landlock automatically resolves symlink access, mount namespaces do not. So to allow access to `/usr/lib` through `/lib`, it is now necessary to allow both `/lib` AND `/usr/lib`.
This disables landlock if namespace isolation was successful, since they can do everything landlock can. Since the mount namespace provides a "fake" version of the root directory, landlock's restrictions on top of these could have unexpected effects.
This fixes an issue where previous sandbox's root directories created for bind mounts would be available in new sandboxes as empty directories. While this doesn't cause any security issues, it causes tests to fail and would likely be unexpected by consumers.
cd-work
force-pushed
the
mount_namespaces
branch
from
4c48482 to
9e98f7a
Compare
cd-work
force-pushed
the
mount_namespaces
branch
from
b119a36 to
a785e58
Compare
cd-work
force-pushed
the
mount_namespaces
branch
from
a785e58 to
c990b71
Compare
FYI, Landlock (kernel code and interface) only handles file descriptors. Dereferencing symlink or not is the choice of user space, and in this case I guess the rust-landlock's
Once sandboxed, a process cannot change the filesystem topology (which would enable it to escape the sandbox). |
This patch adds optional mount namespaces to the linux sandbox to
allow for filesystem isolation on systems without landlock support.
Filesystem isolation now requires either landlock OR namespace creation
to be successful in order for the sandbox creation to be successful.
Landlock will be layered on top of the mount namespace if both are
available.
While landlock automatically resolves symlink access, mount namespaces
do not. So to allow access to
/usr/libthrough/lib, it is nownecessary to allow both
/libAND/usr/lib.