Repository navigation
Conversation
BREAKING: hard Landlock floor raised from V7 (kernel 6.15) to V10 (kernel 7.2). oring refuses on anything below it. V10 is in the floor for the UDP net rights; beneath it Landlock cannot restrict UDP at all, so DNS egress could only be disclosed as unhandled, never gated. RESOLVE_UNIX (V9) is in it because Landlock has no hook on connect() to a pathname AF_UNIX socket below V9, so no filesystem tier can gate docker.sock or ssh-agent there. BREAKING: UDP is restricted by default in both built-in profiles. balanced grants outbound :53 only; strict grants none, so names do not resolve under strict. Both now report unhandled=- and pass --require-full-coverage. Two costs, stated plainly rather than discovered: kernel 7.2 is not released, so today the floor admits a self-built mainline kernel and nothing else; and the V10 UDP rights are in no published landlock release, so ring 1 comes from the maintainer's fork -- a git dependency pinned by REVISION, not a branch, so the crate that installs the cage cannot move under a build -- and oring cannot be published to crates.io, which rejects git dependencies. Ring 1 is not vendored. The fork is pinned at a rev verified file by file against the tree it replaced: one file differs, src/net.rs, by eleven lines, all doc comments. Cargo.lock carries a real source and commit SHA where the previous path patch carried neither -- better identification of an input that RustSec still cannot scan, since [advisories] is keyed to registry packages. deny.toml allows that source explicitly rather than silently. The cost is the hermetic clone: a build now fetches the pinned revision. SECURITY. A decoyed $HOME could silence the shared_cache_write= disclosure: the field read $HOME and nothing else, so HOME=/tmp/decoy made the seal line report `none` over a policy granting write on the real ~/.cargo/registry. It now takes the union of the passwd home and $HOME. And caller-supplied bytes reached the terminal unescaped at 13 of ~14 diagnostic sites, so a forged SEALED line was injectable through argv alone. Both are MISREPORT rather than BREACH — the cage was never affected, the operator's view of it was. EVIDENCE. NO_NEW_PRIVS and the FD scrub are measured for the first time, the latter at the boundary where an off-by-one would live. No shipped profile may reach a host credential store. The containment matrix now runs every denial cell BARE first and reports UNATTRIBUTABLE rather than PASS where the environment supplies the same denial — 21 of 21 attributed, replacing a hand-check that had already gone stale. Three documented controls are demonstrated against the residuals they are named for, each with a vacuity arm. DOCS. docs/DESIGN.md was split by reader job; section numbers did not change, so every DESIGN §n citation still resolves through an index. Correction history moved to docs/CORRECTIONS.md. CONTRIBUTING.md and CODE_OF_CONDUCT.md added. CI is the make targets. No hosted runner is at the V10 floor, so CI checks format, lints, dependency policy, the static build, the SMT gate and the fail-closed refusal — and witnesses no containment. `make check` on a >=7.2 host is the only thing that does. Full detail in CHANGELOG.md.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
RESOLVE_UNIX(V9) is in it because Landlock has no hook onconnect()to a pathname AF_UNIX socket below V9, so no filesystem tier can gate docker.sock or ssh-agent there.balancedgrants outbound :53 only;strictgrants none (names do not resolve under strict). Both now reportunhandled=-and pass--require-full-coverage.landlockrelease. The fork is pinned at a rev verified file-by-file against the tree it replaced (one file differs:src/net.rs, eleven doc-comment lines).Cargo.lockcarries a real source and commit SHA;deny.tomlallows that source explicitly. Consequence stated plainly: oring cannot be published to crates.io, and today the floor admits only a self-built mainline kernel.$HOMEcould silence theshared_cache_write=disclosure (now unions the passwd home with$HOME); caller-supplied bytes reached the terminal unescaped at 13 of ~14 diagnostic sites, making a forgedSEALEDline injectable through argv (closed bycrate::diag::safeand theOringError::Displaychokepoint, T26).NO_NEW_PRIVSand the FD scrub measured for the first time; the containment matrix runs every denial cell BARE first and reports UNATTRIBUTABLE rather than PASS where the environment supplies the same denial — 21 of 21 attributed.docs/DESIGN.mdsplit by reader job (section numbers unchanged, everyDESIGN §ncitation still resolves); correction history moved todocs/CORRECTIONS.md; CONTRIBUTING.md and CODE_OF_CONDUCT.md added.Full detail in CHANGELOG.md.
Verification
CI is the make targets, but no hosted runner is at the V10 floor — CI checks format, lints, dependency policy, the static build, the SMT gate and the fail-closed refusal, and witnesses no containment.
make checkon a ≥7.2 host is the only thing that does.