From 6cac99bd76dc048493b0085c85695639c31cff35 Mon Sep 17 00:00:00 2001 From: Alyssa Ross Date: Tue, 9 Sep 2025 10:53:10 +0200 Subject: [PATCH] vmm: error if landlock can't be enabled Since the user has to explicitly ask for Landlock to be enabled in Cloud Hypervisor, it's surprising that, even when they've done that, Landlock will silently not be enabled if the kernel doesn't support it. To prevent accidental absence of a desired security protection, exit with an error if Landlock, or the one feature of it we use in Cloud Hypervisor (file access) is not supported. Signed-off-by: Alyssa Ross --- vmm/src/landlock.rs | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/vmm/src/landlock.rs b/vmm/src/landlock.rs index 5f139e5c1..b7fbf6edb 100644 --- a/vmm/src/landlock.rs +++ b/vmm/src/landlock.rs @@ -9,8 +9,8 @@ use std::path::Path; #[cfg(test)] use landlock::make_bitflags; use landlock::{ - path_beneath_rules, Access, AccessFs, BitFlags, Ruleset, RulesetAttr, RulesetCreated, - RulesetCreatedAttr, RulesetError, ABI, + path_beneath_rules, Access, AccessFs, BitFlags, Compatible, Ruleset, RulesetAttr, + RulesetCreated, RulesetCreatedAttr, RulesetError, ABI, }; use thiserror::Error; @@ -75,8 +75,10 @@ impl Landlock { let file_access = AccessFs::from_all(ABI); let def_ruleset = Ruleset::default() + .set_compatibility(landlock::CompatLevel::HardRequirement) .handle_access(file_access) - .map_err(LandlockError::ManageRuleset)?; + .map_err(LandlockError::ManageRuleset)? + .set_compatibility(landlock::CompatLevel::HardRequirement); // By default, rulesets are created in `BestEffort` mode. This lets Landlock // to enable all the supported rules and silently ignore the unsupported ones.