Re: Closing after landlock_add_rule?

Hi Yves,

As for any other kind of file descriptor, a Landlock ruleset should be
closed when it is not used.  However, such a file descriptor cannot
change currently enforced rulesets, so it would not be a security issue
to "leak" it.

File descriptors used to define a Landlock rules (e.g. file opened for a
path_beneath rule) should be closed once the rule is added to the
Landlock ruleset, and leaking such file descriptor could let a sandboxed
process to still read/write such *opened* file.  To avoid such risk, it
is advised to open such files with O_PATH.

Regards,
 Mickaël

On Sun, Sep 08, 2024 at 03:04:53PM +0000, Yves Rutschle wrote:
> Hello all,
> 
> So far my code did not close the filehandles it uses to
> create the fuleset using landlock_add_rule(). I recently
> received a commit to close the file descriptors.
> 
> Does landlock use the file handles after the ruleset is
> created, or is it ok to close them after? The man page does
> not discuss this.
> 
> Cheers,
> Y.
> 
> 
>