Rust Landlock

The RestrictSelfFlag enum identifies configuration flags used specifically with the landlock_restrict_self() syscall. Unlike access rights or scopes, these flags control audit logging behavior and thread synchronization rather than access restrictions.

These flags are not passed to landlock_create_ruleset(). Instead, they are set using dedicated boolean setter methods on either RulesetCreatedAttr or RestrictSelfAttr. The library handles the mapping between your boolean input and the underlying UAPI bitmask (including polarity, such as mapping false to an _OFF constant) automatically.

Available flags:

• LogSameExec: Controls same-exec logging (set via RulesetCreatedAttr::log_same_exec()).
• LogNewExec: Controls new-exec logging (set via RulesetCreatedAttr::log_new_exec()).
• LogSubdomains: Controls subdomain logging (set via RestrictSelfAttr::log_subdomains()).
• AllThreads: Controls whether the restriction applies to all threads of the process (set via RestrictSelfAttr::all_threads()).

// Note: Flags are typically set via builder methods on attributes, e.g.:
// ruleset_created_attr.log_same_exec(true);
// restrict_self_attr.all_threads(true);

Landlock is a Linux security feature (available since kernel 5.13) that allows processes to restrict their own ambient rights, such as filesystem access, by creating security sandboxes. This helps mitigate the impact of bugs or malicious behavior in applications.

In this crate, you define a Ruleset containing specific Rules (like PathBeneath) and associated Access rights (like AccessFs). Once the ruleset is created, you call restrict_self() to enforce the sandbox on the current process.

Key Concepts:

• Ruleset: A collection of rules and access rights that define the sandbox boundaries.
• Access Rights: Specific permissions being handled (e.g., AccessFs::Execute, AccessNet::ConnectTcp).
• Compatibility Modes: The crate uses a CompatLevel to handle different kernel versions:
  • BestEffort (default): The Ruleset will determine compatibility based on the intersection of the running kernel's features and the requested features. If a feature is unsupported, it is gracefully downgraded or ignored.
  • HardRequirement: The application will immediately return an error if any requested Landlock feature is unsupported by the running kernel.
• Enforcement Status: After calling restrict_self(), you can check the RestrictionStatus to see if the ruleset was FullyEnforced, PartiallyEnforced, or NotEnforced.

Use the Ruleset builder to define which filesystem, network, or scope accesses your application should handle. You must call handle_access() to specify the access rights that the ruleset will manage before calling create().

Once created, a RulesetCreated object allows you to add specific rules (like PathBeneath) and finally apply the restrictions to the current process using restrict_self().

use landlock::{
    AccessFs, PathBeneath, PathFd, RestrictionStatus, Ruleset, RulesetAttr, 
    RulesetCreatedAttr, RulesetError, ABI
};
use std::os::unix::io::AsFd;

fn restrict_fd<T>(hierarchy: T) -> Result<RestrictionStatus, RulesetError>
where
    T: AsFd,
{
    let abi = ABI::V1;
    let access_all = AccessFs::from_all(abi);
    let access_read = AccessFs::from_read(abi);
    Ok(Ruleset::default()
        .handle_access(access_all)?
        .create()?
        .add_rule(PathBeneath::new(hierarchy, access_read))?
        .restrict_self()?)
}

let fd = PathFd::new("/home").expect("failed to open /home");
let status = restrict_fd(fd).expect("failed to build the ruleset");

To restrict a process, you typically follow this pattern: create a Ruleset, define the types of access you intend to handle, create the ruleset instance, add specific path or resource rules, and finally call restrict_self().

Note that handle_access must be called before create() to define the scope of what the ruleset is allowed to manage. If you add a rule with access rights that were not declared in handle_access, the library will return a RulesetError::AddRules error.

// Example: Restricting access to /usr and /etc
let status = Ruleset::from(ABI::V1)
    .handle_access(AccessFs::Execute)
    .unwrap()
    .create()
    .unwrap()
    .set_compatibility(CompatLevel::BestEffort)
    .add_rule(PathBeneath::new(
        PathFd::new("/usr").unwrap(),
        AccessFs::Execute,
    ))
    .unwrap()
    .add_rule(PathBeneath::new(
        PathFd::new("/etc").unwrap(),
        AccessFs::Execute,
    ))
    .unwrap()
    .restrict_self()
    .unwrap();