From 533d3a85d13af3c8d86398b81526266db070f062 Mon Sep 17 00:00:00 2001 From: Alyssa Ross Date: Mon, 8 Sep 2025 17:41:11 +0200 Subject: [PATCH] vmm: fix landlock on aarch64 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit arch::aarch64::fdt::create_cpu_nodes will always look at this if it exists. (If it doesn't exist, this is a no-op — add_rule_with_access() won't add rules for paths that don't exist.) Fixes: b3e5738b4 ("vmm: Introduce ApplyLandlock trait") Signed-off-by: Alyssa Ross --- vmm/src/vm_config.rs | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/vmm/src/vm_config.rs b/vmm/src/vm_config.rs index aff0d95f3..96269bfb2 100644 --- a/vmm/src/vm_config.rs +++ b/vmm/src/vm_config.rs @@ -960,6 +960,11 @@ impl VmConfig { pub(crate) fn apply_landlock(&self) -> LandlockResult<()> { let mut landlock = Landlock::new()?; + #[cfg(target_arch = "aarch64")] + { + landlock.add_rule_with_access(Path::new("/sys/devices/system/cpu/cpu0/cache"), "r")?; + } + if let Some(mem_zones) = &self.memory.zones { for zone in mem_zones.iter() { zone.apply_landlock(&mut landlock)?;