kata-containers/cloud-hypervisor
1
0
Fork 0
mirror of https://github.com/cloud-hypervisor/cloud-hypervisor.git synced 2026-08-05 02:19:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

vmm: error if landlock can't be enabled

Browse Source 
Since the user has to explicitly ask for Landlock to be enabled in
Cloud Hypervisor, it's surprising that, even when they've done that,
Landlock will silently not be enabled if the kernel doesn't support
it.

To prevent accidental absence of a desired security protection, exit
with an error if Landlock, or the one feature of it we use in Cloud
Hypervisor (file access) is not supported.

Signed-off-by: Alyssa Ross <hi@alyssa.is>
This commit is contained in:
Alyssa Ross
2025-09-09 10:53:10 +02:00
committed by Rob Bradford
parent 533d3a85d1
commit 6cac99bd76
1 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
vmm/src/landlock.rs
View File

@@ -9,8 +9,8 @@ use std::path::Path;
#[cfg(test)]
use landlock::make_bitflags;
use landlock::{
path_beneath_rules, Access, AccessFs, BitFlags, Ruleset, RulesetAttr, RulesetCreated,
RulesetCreatedAttr, RulesetError, ABI,
path_beneath_rules, Access, AccessFs, BitFlags, Compatible, Ruleset, RulesetAttr,
RulesetCreated, RulesetCreatedAttr, RulesetError, ABI,
};
use thiserror::Error;
@@ -75,8 +75,10 @@ impl Landlock {
let file_access = AccessFs::from_all(ABI);
let def_ruleset = Ruleset::default()
.set_compatibility(landlock::CompatLevel::HardRequirement)
.handle_access(file_access)
.map_err(LandlockError::ManageRuleset)?;
.map_err(LandlockError::ManageRuleset)?
.set_compatibility(landlock::CompatLevel::HardRequirement);
// By default, rulesets are created in `BestEffort` mode. This lets Landlock
// to enable all the supported rules and silently ignore the unsupported ones.