Draft
Conversation
9 tasks
This subpackage sets up brew to be sandboxed using the Landlock LSM, restricting its filesystem and network access.
The version installed by apt is too outdated.
This limits inter-process communication via signals or abstract Unix sockets to processes in the same or a nested Landlock domain.
Landlock attempts to set the no_new_privs bit when restricting the process. If this fails for whatever reason, we should warn the user.
* Simplify Landlock sandbox by dropping support for non-standard Homebrew prefixes (which are already unsupported by Homebrew). * Warn about sandbox escapes via pathname sockets--unfortunately the current version of Landlock doesn't protect against that escape vector, but the next Landlock version is expected to.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This subpackage sets up brew to be sandboxed using the Landlock LSM, restricting its filesystem, network, and IPC access.
Note, this change by itself won't enable the sandbox on secureblue images; that won't happen until we start installing
homebrew-sandboxon the images. The only impact this will have on secureblue without further action is to change the directory that Homebrew uses for temporary files to/var/tmp/homebrew(instead of the default/var/tmp).Also, the
landlockcrate used by the sandbox currently isn't packaged for Fedora, so it will need to be added to the Copr repo for this to build. This is easy to do—the following custom build script will generate its spec file:#!/bin/sh rust2rpm landlock