landlock support on linux

[dkwo]

I was wondering if you would be interested to support landlock https://landlock.io for sandboxing services,
and in that case if @l0kod would be interested in implementing support in dinit, like they proposed for systemd.

[mobin-2008]

Keep in mind that Dinit currently doesn't accept new features since 0.20.0 release (until version 1.0 being released). See #512

[davmac314]

In addition to the feature freeze that Mobin mentioned, this proposal isn't detailed enough for me to really comment on. Read the contributor's guide for more information on when feature requests should/will be considered. Be aware that, a little while back, an attempt to add SELinux support was aborted due to lack of suitable knowledge by the contributor.

[dkwo]

I understand the feature freeze, and I just wanted to know whether dinit would be willing to accept something like this, at some point. I am not going to implement it myself. That's why I posted this as a discussion.

For the details, one could look at the corresponding systemd pr: systemd/systemd#39174 It boils down to being able to process config files for landlock, and then restrict the process accordingly (e.g. setpriv from util-linux already does this for filesystems), using the features already available in the kernel.

[davmac314]

If not willing to implement the feature yourself, this is just a pure feature request - and those aren't accepted, as per the contribution guide. For features that do have a potential contributor, there are still considerations which are detailed in the contribution guide which is why I directed you to that.

I prefer not to look at Systemd code to avoid potential license/legal/attribution issues (I know, between two open-source projects, this is perhaps mostly a theoretical concern, but still).

I don't have any particular concern about a simple security feature which just adds some extra service options, and tweaks a few parts of the service process launch. If it requires parsing files that's more of a concern; if it uses a library that would be a concern, etc. It would need to be optional at build time regardless.

[dkwo]

Indeed, this can be considered a pure feature request, and yes, I think a library would be needed.
Note that landlock is similar to plegde/unveil in openbsd, and is supported by the kernel.
It would be nice to have similar functionality in dinit as setpriv from util-linux, as far as landlock support.