From 11c17ca3194b2eb9ab8cdf16bf028aba6a52b953 Mon Sep 17 00:00:00 2001
From: Praveen K Paladugu <prapal@linux.microsoft.com>
Date: Tue, 9 Apr 2024 19:28:42 +0000
Subject: [PATCH] main: Enable landlock on main thread

Signed-off-by: Praveen K Paladugu <prapal@linux.microsoft.com>
---
 src/main.rs | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/src/main.rs b/src/main.rs
index 4008177a3..451c9985c 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -23,6 +23,7 @@ use vmm::api::dbus::{dbus_api_graceful_shutdown, DBusApiOptions};
 use vmm::api::http::http_api_graceful_shutdown;
 use vmm::api::ApiAction;
 use vmm::config;
+use vmm::landlock::{Landlock, LandlockError};
 use vmm_sys_util::eventfd::EventFd;
 use vmm_sys_util::signal::block_signal;
 
@@ -85,6 +86,10 @@ enum Error {
     LoggerSetup(log::SetLoggerError),
     #[error("Failed to gracefully shutdown http api: {0}")]
     HttpApiShutdown(#[source] vmm::Error),
+    #[error("Failed to create Landlock object: {0}")]
+    CreateLandlock(#[source] LandlockError),
+    #[error("Failed to apply Landlock: {0}")]
+    ApplyLandlock(#[source] LandlockError),
 }
 
 #[derive(Error, Debug)]
@@ -797,6 +802,13 @@ fn start_vmm(cmd_arguments: ArgMatches) -> Result<Option<String>, Error> {
         }
     }
 
+    if landlock_enable {
+        Landlock::new()
+            .map_err(Error::CreateLandlock)?
+            .restrict_self()
+            .map_err(Error::ApplyLandlock)?;
+    }
+
     vmm_thread_handle
         .thread_handle
         .join()