Re: Help with LANDLOCK_ACCESS_FS_EXECUTE

Hi Andrea,

On Mon, Jul 01, 2024 at 04:25:53PM +0200, Andrea Cervesato wrote:
> Hi all,
> 
> I'm actually writing a test for LANDLOCK_ACCESS_FS_EXECUTE flag in LTP [1].
> The test is really simple: it applies the EXECUTE landlock rule inside a
> folder and it verifies that a binary inside it can be executed.
> A similar test applies the rule only to the specific binary and check again
> its execution.

Good to know you're working on that!

> 
> But while I was writing the test, I encountered an issue with the specific
> rule setup, since EACCES is raised unexpectedly during binary execution.
> So I wrote a reproducer, assuming that LTP might be the issue, but it's not.
> The reproducer actually shows that binary can't be executed after applying
> the EXECUTE rule.
> 
> I will attach the source code to this email. Can you please tell me if
> there's something wrong with it?

I guess the binary you're trying to execute is dynamically linked, which
means that the kernel needs to open the related .so files on behalf of
the calling (sandboxed) process, which means that
LANDLOCK_ACCESS_FS_READ_FILE needs to be allowed on these files.  You
can use a static binary to avoid this kind of issue, or just not handle
LANDLOCK_ACCESS_FS_READ_FILE.

> 
> Best regards,
> Andrea Cervesato
> 
> 
> [1] https://linux-test-project.readthedocs.io/en/latest/