Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

libcontainer: add support for Landlock #3194

Draft
wants to merge 5 commits into
base: main
Choose a base branch
from
Draft

libcontainer: add support for Landlock #3194

wants to merge 5 commits into from
+304 −3

Commits on Sep 9, 2021

  1. libcontainer: add support for Landlock 

    This patch introduces Landlock Linux Security Module (LSM) support in
runc, which was landed in Linux kernel 5.13.

This allows unprivileged processes to create safe security sandboxes
that can securely restrict the ambient rights (e.g. global filesystem
access) for themselves.

runtime-spec: opencontainers/runtime-spec#1111

Fixes opencontainers#2859

Signed-off-by: Kailun Qin <[email protected]>
    @kailun-qin
    kailun-qin committed Sep 9, 2021
    Configuration menu
    Copy the full SHA
    e9341f2 View commit details
    Browse the repository at this point in the history

  2. Address comments 

    * use landlock.AccessFSSet type directly
* remove non-linux files
* some minor updates

Signed-off-by: Kailun Qin <[email protected]>
    @kailun-qin
    kailun-qin committed Sep 9, 2021
    Configuration menu
    Copy the full SHA
    6f64c97 View commit details
    Browse the repository at this point in the history

  3. Add unit test for SetupLandlock 

    Signed-off-by: Kailun Qin <[email protected]>
    @kailun-qin
    kailun-qin committed Sep 9, 2021
    Configuration menu
    Copy the full SHA
    6a698a6 View commit details
    Browse the repository at this point in the history

  4. Add check for DisableBestEffort in the unit test 

    Signed-off-by: Kailun Qin <[email protected]>
    @kailun-qin
    kailun-qin committed Sep 9, 2021
    Configuration menu
    Copy the full SHA
    22802a8 View commit details
    Browse the repository at this point in the history

  5. Update go-landlock and use NewConfig instead 

    Signed-off-by: Kailun Qin <[email protected]>
    @kailun-qin
    kailun-qin committed Sep 9, 2021
    Configuration menu
    Copy the full SHA
    075542f View commit details
    Browse the repository at this point in the history