touching (existing) files is allowed, even with --rox /

[leapfog]

I expected --rox / to make sure, nothing on disk is ever modified. And creating files actually is prevented. But already existing files can be touched, their timestamp modified. At least I was surprised about this finding.

[leapfog]

$ landrun --version; uname -r
landrun version 0.1.15
7.1.1

$ rm -f /dev/shm/foo
$ landrun --rox / touch /dev/shm/foo
touch: cannot touch '/dev/shm/foo': Permission denied

$ touch /dev/shm/foo
$ landrun --rox / touch /dev/shm/foo

-> the file's timestamp has been modified

[rusty-snake]

File metadata (stat, xattr, ...) is not yet covered by landlock:

https://www.man7.org/linux/man-pages/man7/landlock.7.html

It is currently not possible to restrict some file-related actions accessible through these system call families: chdir(2), stat(2), flock(2), chmod(2), chown(2), setxattr(2), utime(2), fcntl(2), access(2). Future Landlock evolutions will enable to restrict them.

This also includes things modifying like SELinux labels (if allowed by SELinux policy), touching files, querying existence of any file with known path and getting size/time, modifying metadata.

And YOU CAN connect TO ANY NAMED UNIX-SOCKET if allowed by DAC.