Sandbox escape via AF_UNIX sockets

[DemiMarie]

Landlock does not restrict connecting to AF_UNIX sockets, which allows a sandbox escape. The simplest escape is systemd-run on a systemd system, which allows executing arbitrary commands.

See landlock-lsm/linux#36 for why this isn't implemented yet.

[ethorsoe]

I guess this can proceed now based on linked ticket being closed.

I hope unix sockets would be similarly limited by path, like files, but I guess it's mostly defined by the kernel implementation.

[ethorsoe]

Or maybe this landlock-go support helps https://github.com/landlock-lsm/go-landlock/blob/main/landlock/config.go#L117 ?

[2kool4idkwhat]

Or maybe this landlock-go support helps https://github.com/landlock-lsm/go-landlock/blob/main/landlock/config.go#L117 ?

Yes, Landlock v9 ABI solves this issue. But it's only supported on kernels 7.1+, and more importantly landrun is unmaintained.

[ethorsoe]

Thanks, if landrun is abandoned, should the repo be marked archived or readme updated?

[2kool4idkwhat]

I don't know if the repo should be archived, but the readme definitely should mention that there's a known sandbox escape to avoid giving users a false sense of security.