vmm: make landlock configs VMM-level config

This requires stashing the config values in `struct Vmm`. The configs
should be validated before before creating the VMM thread. Refactor the
code and update documentation where necessary.

The place where the rules are applied remain the same.

Signed-off-by: Wei Liu <liuwe@microsoft.com>

vmm/src/config.rs

@@ -496,8 +496,6 @@ pub struct VmParams<'a> {
     pub igvm: Option<&'a str>,
     #[cfg(feature = "sev_snp")]
     pub host_data: Option<&'a str>,
-    pub landlock_enable: bool,
-    pub landlock_config: Option<Vec<&'a str>>,
 }
 
 impl<'a> VmParams<'a> {
@@ -563,10 +561,6 @@ impl<'a> VmParams<'a> {
         let igvm = args.get_one::<String>("igvm").map(|x| x as &str);
         #[cfg(feature = "sev_snp")]
         let host_data = args.get_one::<String>("host-data").map(|x| x as &str);
-        let landlock_enable = args.get_flag("landlock");
-        let landlock_config: Option<Vec<&str>> = args
-            .get_many::<String>("landlock-rules")
-            .map(|x| x.map(|y| y as &str).collect());
 
         VmParams {
             cpus,
@@ -605,8 +599,6 @@ impl<'a> VmParams<'a> {
             igvm,
             #[cfg(feature = "sev_snp")]
             host_data,
-            landlock_enable,
-            landlock_config,
         }
     }
 }
@@ -2334,6 +2326,12 @@ impl TpmConfig {
     }
 }
 
+#[derive(Clone, Debug, PartialEq, Eq, Deserialize, Serialize)]
+pub struct LandlockConfig {
+    pub path: PathBuf,
+    pub access: String,
+}
+
 impl LandlockConfig {
     pub const SYNTAX: &'static str = "Landlock parameters \
         \"path=<path/to/{file/dir}>,access=[rw]\"";
@@ -2725,12 +2723,6 @@ impl VmConfig {
             .map(|p| p.iommu_segments.is_some())
             .unwrap_or_default();
 
-        if let Some(landlock_configs) = &self.landlock_config {
-            for landlock_config in landlock_configs {
-                landlock_config.validate()?;
-            }
-        }
-
         Ok(id_list)
     }
 
@@ -2901,16 +2893,6 @@ impl VmConfig {
         #[cfg(feature = "guest_debug")]
         let gdb = vm_params.gdb;
 
-        let mut landlock_config: Option<Vec<LandlockConfig>> = None;
-        if let Some(ll_config) = vm_params.landlock_config {
-            landlock_config = Some(
-                ll_config
-                    .iter()
-                    .map(|rule| LandlockConfig::parse(rule))
-                    .collect::<Result<Vec<LandlockConfig>>>()?,
-            );
-        }
-
         let mut config = VmConfig {
             cpus: CpusConfig::parse(vm_params.cpus)?,
             memory: MemoryConfig::parse(vm_params.memory, vm_params.memory_zones)?,
@@ -2942,8 +2924,6 @@ impl VmConfig {
             platform,
             tpm,
             preserved_fds: None,
-            landlock_enable: vm_params.landlock_enable,
-            landlock_config,
         };
         config.validate().map_err(Error::Validation)?;
         Ok(config)
@@ -3070,7 +3050,6 @@ impl Clone for VmConfig {
                 .as_ref()
                 // SAFETY: FFI call with valid FDs
                 .map(|fds| fds.iter().map(|fd| unsafe { libc::dup(*fd) }).collect()),
-            landlock_config: self.landlock_config.clone(),
             ..*self
         }
     }
@@ -3869,8 +3848,6 @@ mod tests {
                     ..net_fixture()
                 },
             ]),
-            landlock_enable: false,
-            landlock_config: None,
         };
 
         let valid_config = RestoreConfig {
@@ -4059,8 +4036,6 @@ mod tests {
             platform: None,
             tpm: None,
             preserved_fds: None,
-            landlock_enable: false,
-            landlock_config: None,
         };
 
         assert!(valid_config.validate().is_ok());