From 287dbd4fc93e36852cbdeaa0771a9845ad9a3a44 Mon Sep 17 00:00:00 2001
From: Praveen K Paladugu <prapal@linux.microsoft.com>
Date: Tue, 13 Feb 2024 18:47:37 +0000
Subject: [PATCH] vmm: Introduce landlock cmdline parameter

Users can use this cmdline option to enable/disable Landlock based
sandboxing while running cloud-hypervisor.

Signed-off-by: Praveen K Paladugu <prapal@linux.microsoft.com>
---
 fuzz/fuzz_targets/http_api.rs |  1 +
 src/main.rs                   | 12 ++++++++++++
 vmm/src/config.rs             |  6 ++++++
 vmm/src/lib.rs                |  1 +
 vmm/src/vm_config.rs          |  2 ++
 5 files changed, 22 insertions(+)

diff --git a/fuzz/fuzz_targets/http_api.rs b/fuzz/fuzz_targets/http_api.rs
index a3f328630..d801c90f1 100644
--- a/fuzz/fuzz_targets/http_api.rs
+++ b/fuzz/fuzz_targets/http_api.rs
@@ -190,6 +190,7 @@ impl RequestHandler for StubApiRequestHandler {
                 platform: None,
                 tpm: None,
                 preserved_fds: None,
+                landlock_enable: false,
             })),
             state: VmState::Running,
             memory_actual_size: 0,
diff --git a/src/main.rs b/src/main.rs
index 68f951e95..2639ea2a4 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -271,6 +271,17 @@ fn create_app(default_vcpus: String, default_memory: String, default_rng: String
                 .num_args(1..)
                 .group("vm-config"),
         )
+        .arg(
+            Arg::new("landlock")
+                .long("landlock")
+                .num_args(0)
+                .help(
+                    "enable/disable Landlock.",
+                )
+                .action(ArgAction::SetTrue)
+                .default_value("false")
+                .group("vm-config"),
+        )
         .arg(
             Arg::new("net")
                 .long("net")
@@ -1032,6 +1043,7 @@ mod unit_tests {
             platform: None,
             tpm: None,
             preserved_fds: None,
+            landlock_enable: false,
         };
 
         assert_eq!(expected_vm_config, result_vm_config);
diff --git a/vmm/src/config.rs b/vmm/src/config.rs
index 24d2e3e83..b47ca37dd 100644
--- a/vmm/src/config.rs
+++ b/vmm/src/config.rs
@@ -472,6 +472,7 @@ pub struct VmParams<'a> {
     pub igvm: Option<&'a str>,
     #[cfg(feature = "sev_snp")]
     pub host_data: Option<&'a str>,
+    pub landlock_enable: bool,
 }
 
 impl<'a> VmParams<'a> {
@@ -537,6 +538,7 @@ impl<'a> VmParams<'a> {
         let igvm = args.get_one::<String>("igvm").map(|x| x as &str);
         #[cfg(feature = "sev_snp")]
         let host_data = args.get_one::<String>("host-data").map(|x| x as &str);
+        let landlock_enable = args.get_flag("landlock");
         VmParams {
             cpus,
             memory,
@@ -574,6 +576,7 @@ impl<'a> VmParams<'a> {
             igvm,
             #[cfg(feature = "sev_snp")]
             host_data,
+            landlock_enable,
         }
     }
 }
@@ -2854,6 +2857,7 @@ impl VmConfig {
             platform,
             tpm,
             preserved_fds: None,
+            landlock_enable: vm_params.landlock_enable,
         };
         config.validate().map_err(Error::Validation)?;
         Ok(config)
@@ -3778,6 +3782,7 @@ mod tests {
                     ..net_fixture()
                 },
             ]),
+            landlock_enable: false,
         };
 
         let valid_config = RestoreConfig {
@@ -3966,6 +3971,7 @@ mod tests {
             platform: None,
             tpm: None,
             preserved_fds: None,
+            landlock_enable: false,
         };
 
         assert!(valid_config.validate().is_ok());
diff --git a/vmm/src/lib.rs b/vmm/src/lib.rs
index 362188e90..cd38060ca 100644
--- a/vmm/src/lib.rs
+++ b/vmm/src/lib.rs
@@ -2189,6 +2189,7 @@ mod unit_tests {
             platform: None,
             tpm: None,
             preserved_fds: None,
+            landlock_enable: false,
         }))
     }
 
diff --git a/vmm/src/vm_config.rs b/vmm/src/vm_config.rs
index 1f323df06..ea3a588cc 100644
--- a/vmm/src/vm_config.rs
+++ b/vmm/src/vm_config.rs
@@ -645,4 +645,6 @@ pub struct VmConfig {
     // valid, and will be closed when the holding VmConfig instance is destroyed.
     #[serde(skip)]
     pub preserved_fds: Option<Vec<i32>>,
+    #[serde(default)]
+    pub landlock_enable: bool,
 }