fix(security): warn when Landlock may silently degrade#868
fix(security): warn when Landlock may silently degrade#868fdzdev wants to merge 1 commit intoNVIDIA:mainfrom
Conversation
📝 WalkthroughWalkthroughAfter creating a sandbox, the code now performs a best-effort OS/kernel check and emits Landlock-related warnings: an unconditional macOS Docker VM kernel notice and a Linux Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
cv
left a comment
cv
left a comment
There was a problem hiding this comment.
The underlying issue is real — best_effort silently dropping Landlock is worth surfacing. The Linux host kernel check is straightforward and correct since Docker shares the host kernel.
The macOS path is weak though: it warns every macOS user unconditionally when it could just check the Docker VM's actual kernel version via docker info --format '{{.KernelVersion}}'. That gives you the VM kernel without even spinning up a container. If that's ≥ 5.13, there's nothing to warn about.
As-is, the macOS warning is noisy without being actionable — it tells the user "depends on the Docker VM kernel" but doesn't do the one thing that would answer the question.
|
FYI — OpenShell is already tracking this upstream:
Once that lands, OpenShell itself will report whether Landlock enforcement actually stuck, which makes the host-side kernel guessing here unnecessary. |
fdzdev
force-pushed
the
fix/landlock-degradation-warn
branch
from
e06072c to
93db763
Compare
wscurran
added
bug
- Check Docker VM kernel version on macOS via docker info (actionable, not unconditional) - Check host kernel version on Linux via uname -r - Warn only when kernel < 5.13 (Landlock minimum) - Warning only — never blocks sandbox creation (wrapped in try/catch) Made-with: Cursor
fdzdev
force-pushed
the
fix/landlock-degradation-warn
branch
from
93db763 to
3d2d2bf
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@bin/lib/onboard.js`:
- Around line 2283-2294: The macOS branch currently only prints the Landlock
warning when the Docker VM kernel parses as <5.13; change it so macOS always
emits the Landlock warning to match the PR/test plan: keep the existing
runCapture("docker info...") and parsing of vmKernel but always log a general
macOS Landlock warning (using process.platform === "darwin"), and if vmKernel is
present and parses to a version <5.13 add the existing specific message about
lack of Landlock support; if vmKernel is unparsable still emit the general
warning (and optionally include the raw vmKernel value) so the security signal
is never silently skipped.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 598da946-0617-4fc1-8498-b067424d8b1c
📒 Files selected for processing (1)
bin/lib/onboard.js
| if (process.platform === "darwin") { | ||
| const vmKernel = runCapture("docker info --format '{{.KernelVersion}}'", { ignoreError: true }).trim(); | ||
| if (vmKernel) { | ||
| const parts = vmKernel.split("."); | ||
| const major = parseInt(parts[0], 10); | ||
| const minor = parseInt(parts[1], 10); | ||
| if (!isNaN(major) && !isNaN(minor) && (major < 5 || (major === 5 && minor < 13))) { | ||
| console.warn(` ⚠ Landlock: Docker VM kernel ${vmKernel} does not support Landlock (requires ≥5.13).`); | ||
| console.warn(" Sandbox filesystem restrictions will silently degrade (best_effort mode)."); | ||
| } | ||
| } | ||
| } else if (process.platform === "linux") { |
There was a problem hiding this comment.
macOS Landlock warning is too narrow and misses the stated security signal.
Line [2283]–Line [2293] only warns on macOS when Docker VM kernel parses as < 5.13. The PR objective/test plan says macOS hosts should warn regardless, so this can silently skip the warning on macOS with kernel >= 5.13 (or unparsable versions).
Suggested fix
try {
if (process.platform === "darwin") {
const vmKernel = runCapture("docker info --format '{{.KernelVersion}}'", { ignoreError: true }).trim();
- if (vmKernel) {
- const parts = vmKernel.split(".");
- const major = parseInt(parts[0], 10);
- const minor = parseInt(parts[1], 10);
- if (!isNaN(major) && !isNaN(minor) && (major < 5 || (major === 5 && minor < 13))) {
- console.warn(` ⚠ Landlock: Docker VM kernel ${vmKernel} does not support Landlock (requires ≥5.13).`);
- console.warn(" Sandbox filesystem restrictions will silently degrade (best_effort mode).");
- }
- }
+ console.warn(
+ vmKernel
+ ? ` ⚠ Landlock: macOS host (Docker VM kernel ${vmKernel}). Landlock enforcement may silently degrade (best_effort mode).`
+ : " ⚠ Landlock: macOS host. Landlock enforcement may silently degrade (best_effort mode)."
+ );
} else if (process.platform === "linux") {
const uname = runCapture("uname -r", { ignoreError: true }).trim();
if (uname) {
const parts = uname.split(".");📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| if (process.platform === "darwin") { | |
| const vmKernel = runCapture("docker info --format '{{.KernelVersion}}'", { ignoreError: true }).trim(); | |
| if (vmKernel) { | |
| const parts = vmKernel.split("."); | |
| const major = parseInt(parts[0], 10); | |
| const minor = parseInt(parts[1], 10); | |
| if (!isNaN(major) && !isNaN(minor) && (major < 5 || (major === 5 && minor < 13))) { | |
| console.warn(` ⚠ Landlock: Docker VM kernel ${vmKernel} does not support Landlock (requires ≥5.13).`); | |
| console.warn(" Sandbox filesystem restrictions will silently degrade (best_effort mode)."); | |
| } | |
| } | |
| } else if (process.platform === "linux") { | |
| if (process.platform === "darwin") { | |
| const vmKernel = runCapture("docker info --format '{{.KernelVersion}}'", { ignoreError: true }).trim(); | |
| console.warn( | |
| vmKernel | |
| ? ` ⚠ Landlock: macOS host (Docker VM kernel ${vmKernel}). Landlock enforcement may silently degrade (best_effort mode).` | |
| : " ⚠ Landlock: macOS host. Landlock enforcement may silently degrade (best_effort mode)." | |
| ); | |
| } else if (process.platform === "linux") { |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@bin/lib/onboard.js` around lines 2283 - 2294, The macOS branch currently only
prints the Landlock warning when the Docker VM kernel parses as <5.13; change it
so macOS always emits the Landlock warning to match the PR/test plan: keep the
existing runCapture("docker info...") and parsing of vmKernel but always log a
general macOS Landlock warning (using process.platform === "darwin"), and if
vmKernel is present and parses to a version <5.13 add the existing specific
message about lack of Landlock support; if vmKernel is unparsable still emit the
general warning (and optionally include the raw vmKernel value) so the security
signal is never silently skipped.
|
Addressed — macOS path now checks the Docker VM kernel via Also noting this is an interim measure until openshell#599 lands upstream. |
3 participants
Summary
landlock: compatibility: best_effortwhich silently drops filesystem restrictions on unsupported kernels (CWE-440, NVBUG 6002804)createSandbox()that warns on macOS hosts and Linux kernels < 5.13Test plan
nemoclaw onboardon macOS → see⚠ Landlock: macOS hostwarning after sandbox creationnemoclaw onboardon Linux ≥ 5.13 → no warningnemoclaw onboardon Linux < 5.13 → see⚠ Landlock: Kernel X.Y does not support Landlockwarninguname -rfails for any reason → no crash, no warning (try/catch)Summary by CodeRabbit