procd/jail/landlock.c, branch masterOpenWrt service / process managerhttps://git.openwrt.org/project/procd/atom?h=master2026-08-21T04:26:55Zjail: integrate the Landlock LSM via OCI annotations2026-08-21T04:26:55ZDaniel Golle2026-06-17T12:41:34Zurn:sha1:b15ef29c6c983d6dd85e71f9cf3fc3ef86b87ca3
Add a Landlock backend (landlock.c) that builds a ruleset from a set of
path rules and applies it with landlock_restrict_self() just before exec,
using the syscalls directly with a cached ABI probe so it degrades on
kernels without Landlock. Rules are expressed through OCI annotations:
landlock.ro, .rx and .rw map colon-separated path lists to read, execute
and write access masks. Any Landlock rule implies no_new_privs.
Annotation parsing in parseOCI() also gains mdwe flag handling with a
no_inherit-requires-refuse_exec_gain sanity check, the cgroup
memory.pct limit derived from MemTotal, and the private ubus/netifd
switches keyed off the landlock.rw value. A bundle that bind-mounts the
host's /etc/resolv.conf while running its own netifd is now rejected, as
the bind would shadow the container's own resolvers.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>