landlock 0.1.0 → 0.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6cf65089e4af85184c67c7a2e6c679932dd21c492882ccf9cf4612d5603cb7a4
-  data.tar.gz: a987aaefb3e9ec52f69087c533fed5e384157aa4e1caebbc56226030c84e1112
+  metadata.gz: 60ae145a444fb3dd4c072fe4e5c8bac7de1836325a6d84e10be894d5b2f9ed2c
+  data.tar.gz: 983b4da291286f4c903d12cb625508f1a569de918167a2c3f1fab450fcdeb866
 SHA512:
-  metadata.gz: 6de7d6d837c0365fcf6d18e4cf3d41d291d6d043b71a3b05d1501e3c805faf7acd082865e67bad699814f0bdd342859f7790e80c3d58e510b83f8121e3445955
-  data.tar.gz: f87863bd3de8f8a8d5ce6ffd56382bafcf6cefc7ec74dca9ea9a7e6df7c5f759c556f51a2e687668d0fd30b809cf07a8136b73e26467dd069d021977a5abd4e2
+  metadata.gz: ff7628efa5a0f464788e1adfe215d457e77eef7d8c94d1c6ee17a61f651732e3012afe0a1ae04792709b7255e5e8196576f4b5b19a0f7351a719cdfa6e72b49b
+  data.tar.gz: 596b360c7dbcc2bd5079ea597df5b39d9d57c240ed6298d30ddeace1b955294e34bffe7f58353d3bcf01ae897bf2d738d5527c3cc25af1e485506de5f359d91e

data/CHANGELOG.md

@@ -0,0 +1,34 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+## [0.1.1] - 2026-04-30
+
+### Security
+
+- Require `Landlock.exec` and `Landlock.spawn` commands to be passed as argument arrays. This avoids Ruby's implicit shell execution path for string commands.
+- Execute subprocesses with an explicit `argv[0]` tuple (`[command, command]`) so array commands keep their no-shell behavior.
+- Use `exit! 127` for child setup failures before `exec`, preventing inherited `at_exit` handlers from running in the forked child.
+- Honor `unsetenv_others: true` by passing Ruby's `unsetenv_others` exec option instead of only constructing a reduced environment hash.
+- Add ABI v6 Landlock scoping support via `scope: [:signal, :abstract_unix_socket]` to restrict signalling and abstract Unix-domain socket access outside the sandbox domain.
+- Expose `allow_all_known:` on `Landlock.exec` and `Landlock.spawn` so subprocess sandboxes can deny unlisted filesystem actions without needing dummy allow rules.
+
+### Fixed
+
+- Allow high-level `read`, `write`, and `execute` helpers to target individual files by filtering directory-only rights before adding file path rules.
+- Fix fallback Landlock syscall numbers on i386, handle x32, and prefer platform `__NR_*` constants when available.
+- Convert path rule arguments before opening path file descriptors in the native extension to avoid leaking descriptors on argument conversion errors.
+
+### Documentation
+
+- Document important sandbox caveats: only handled rights are restricted, TCP rules do not cover UDP/pathname Unix sockets, already-open descriptors remain usable, and `restrict!` applies to the calling thread and future children.
+
+### Tests
+
+- Add coverage for no-shell argv validation, child setup failure behavior, `unsetenv_others`, strict filesystem subprocess policies, file-specific path rules, and ABI v6 signal scoping.
+
+## [0.1.0] - 2026-04-30
+
+### Added
+
+- Initial Ruby bindings for Linux Landlock rulesets, filesystem path rules, TCP port rules, and safe subprocess helpers.

data/README.md

@@ -1,12 +1,12 @@
 # landlock
 
-Ruby bindings for Linux [Landlock](https://docs.kernel.org/userspace-api/landlock.html): unprivileged, kernel-enforced sandboxing for the current process and its descendants.
+Ruby bindings for Linux [Landlock](https://docs.kernel.org/userspace-api/landlock.html): unprivileged, kernel-enforced sandboxing for the calling thread and its future descendants.
 
 This gem includes a small native extension around the three Landlock syscalls and a Ruby API for safe subprocess execution.
 
 ## Status
 
-Experimental. Filesystem support requires Landlock ABI v1+. TCP network rules require ABI v4+.
+Experimental. Filesystem support requires Landlock ABI v1+. TCP network rules require ABI v4+. Signal and abstract Unix-domain socket scopes require ABI v6+.
 
 ```ruby
 require "landlock"
@@ -15,8 +15,12 @@ puts Landlock.abi_version
 puts Landlock.supported?
 ```
 
+See [CHANGELOG.md](CHANGELOG.md) for release notes.
+
 ## Safe subprocess execution
 
+Pass commands as an argument array. `Landlock.exec` and `Landlock.spawn` do not invoke a shell implicitly; use an explicit shell in the array if that is really required. Both helpers accept `env:` and `unsetenv_others:` and pass them through to `Kernel.exec` so subprocesses can run with a controlled environment.
+
 Allow Ruby to execute and read its runtime, but only allow outbound TCP connections to port 443:
 
 ```ruby
@@ -24,7 +28,8 @@ status = Landlock.exec(
   [RbConfig.ruby, "script.rb"],
   read: ["/usr", "/lib", "/lib64", "/etc/ssl"],
   execute: ["/usr", "/lib", "/lib64"],
-  connect_tcp: [443]
+  connect_tcp: [443],
+  allow_all_known: true
 )
 
 abort "failed" unless status.success?
@@ -35,12 +40,20 @@ Deny all outbound TCP except the listed ports:
 ```ruby
 Landlock.exec(
   ["curl", "https://example.com"],
-  read: ["/usr", "/lib", "/lib64", "/etc/ssl", "/etc/resolv.conf", "/etc/hosts"],
+  read: [
+    "/usr", "/lib", "/lib64",
+    "/etc/ssl", "/etc/resolv.conf", "/etc/hosts",
+    "/etc/nsswitch.conf", "/etc/gai.conf", "/etc/host.conf",
+    "/run/systemd/resolve", "/var/lib/sss"
+  ].select { |path| File.exist?(path) },
   execute: ["/usr", "/lib", "/lib64"],
-  connect_tcp: [443]
+  connect_tcp: [443],
+  allow_all_known: true
 )
 ```
 
+TLS and name-resolution dependencies vary by distribution and NSS configuration; add any local CA, DNS, NSS, or resolver paths your system needs.
+
 Allow binding a local TCP port:
 
 ```ruby
@@ -48,22 +61,27 @@ Landlock.exec(
   [RbConfig.ruby, "server.rb"],
   read: ["/usr", "/lib", "/lib64", Dir.pwd],
   execute: ["/usr", "/lib", "/lib64"],
-  bind_tcp: [9292]
+  bind_tcp: [9292],
+  allow_all_known: true
 )
 ```
 
 ## Restrict current process
 
-This is irreversible for the current thread/process. Use `Landlock.exec` or `Landlock.spawn` unless you really mean it.
+This is irreversible for the current thread and its future children. Use `Landlock.exec` or `Landlock.spawn` unless you really mean it.
 
 ```ruby
 Landlock.restrict!(
   read: ["/usr", "/app"],
   write: ["/tmp/my-output"],
-  connect_tcp: [443]
+  connect_tcp: [443],
+  scope: [:signal, :abstract_unix_socket],
+  allow_all_known: true
 )
 ```
 
+`write:` grants the filesystem rights needed for practical writes under the listed paths, including directory traversal and reads (`read_file`/`read_dir`). If you need exact rights, use `paths:` with an explicit `rights:` list.
+
 ## Lower-level path rules
 
 ```ruby
@@ -76,6 +94,48 @@ Landlock.restrict!(
 )
 ```
 
+## Performance
+
+Landlock enforcement is done by the kernel after a ruleset is installed. In normal use the practical cost should be dominated by the one-time sandbox setup and by the work your process already performs, not by Ruby-side wrappers.
+
+This repository includes a small benchmark suite that compares common workloads before and after applying a read-only Landlock policy:
+
+```sh
+bundle exec rake bench
+# or
+bundle exec ruby benchmark/landlock_overhead.rb
+```
+
+The suite reports median timings for CPU-only work, file metadata reads, small file reads, directory scans, and the one-time ruleset setup cost. You can tune the run length with environment variables:
+
+```sh
+SAMPLES=15 ITERATIONS=100000 DIR_ITERATIONS=5000 bundle exec rake bench
+```
+
+Sample output looks like:
+
+```text
+workload           baseline     landlocked        delta    delta %
+--------------------------------------------------------------------
+cpu_loop           0.650 ms       0.648 ms    -0.002 ms     -0.31%
+file_stat         42.100 ms      42.300 ms     0.200 ms      0.48%
+file_read        120.500 ms     120.900 ms     0.400 ms      0.33%
+dir_scan          88.000 ms      88.200 ms     0.200 ms      0.23%
+
+Setup cost (create ruleset, add read rules, restrict current process):
+  median 0.080 ms (25 samples)
+```
+
+Treat small positive or negative deltas as noise and benchmark on the kernel, filesystem, and hardware you deploy on. The expected result is no practical steady-state overhead for typical application work, with a small one-time cost when installing the sandbox.
+
 ## Caveats
 
-Landlock is not a complete container. It does not impose CPU/memory limits, hide already-open file descriptors, or replace seccomp/namespaces/cgroups. For serious untrusted execution, combine it with controlled environment, `close_others`, resource limits, and preferably process isolation.
+Landlock is not a complete container. It does not impose CPU/memory limits, hide already-open file descriptors, or replace seccomp/namespaces/cgroups. For serious untrusted execution, combine it with a controlled environment, `close_others`, resource limits, and preferably process isolation.
+
+If a child fails during sandbox setup or `exec`, the helpers print a diagnostic and the child exits 127. That code can collide with a command that legitimately exits 127; unsupported kernels are checked before forking so they raise `Landlock::UnsupportedError` synchronously instead.
+
+Path rules follow the kernel's normal path resolution when the rule is installed. Because paths are opened without `O_NOFOLLOW`, a symlink rule applies to the symlink target's inode, not to the symlink path itself.
+
+Landlock only restricts access rights included in a ruleset's handled set: omitted categories remain allowed. Use `allow_all_known: true` when you want unlisted filesystem actions denied. The high-level helpers handle the categories you pass (`read`, `write`, `execute`, `connect_tcp`, `bind_tcp`, `scope`). Landlock's TCP rules do not cover UDP or pathname Unix-domain sockets; ABI v6+ scopes can restrict signals and abstract Unix-domain sockets.
+
+`Landlock.restrict!` applies to the calling thread and its future children; already-running sibling threads are not retroactively sandboxed. Prefer `Landlock.exec` or `Landlock.spawn` for subprocess sandboxing from a larger Ruby application.

data/benchmark/landlock_overhead.rb

@@ -0,0 +1,212 @@
+# frozen_string_literal: true
+
+require "json"
+require "rbconfig"
+require "tmpdir"
+require "fileutils"
+require "open3"
+
+root = File.expand_path("..", __dir__)
+lib_dir = File.join(root, "lib")
+ext_lib_dir = File.join(lib_dir, "landlock")
+
+$LOAD_PATH.unshift(lib_dir)
+$LOAD_PATH.unshift(ext_lib_dir)
+
+require "landlock"
+
+module LandlockBench
+  ROOT = File.expand_path("..", __dir__)
+  DEFAULT_SAMPLES = Integer(ENV.fetch("SAMPLES", 7))
+  DEFAULT_ITERATIONS = Integer(ENV.fetch("ITERATIONS", 25_000))
+  DIR_ITERATIONS = Integer(ENV.fetch("DIR_ITERATIONS", 2_000))
+  SETUP_SAMPLES = Integer(ENV.fetch("SETUP_SAMPLES", 25))
+
+  WORKLOADS = [
+    ["cpu_loop", "integer arithmetic loop"],
+    ["file_stat", "File.stat on an allowed file"],
+    ["file_read", "File.binread of a small allowed file"],
+    ["dir_scan", "Dir.foreach over an allowed directory"]
+  ].freeze
+
+  module_function
+
+  def monotonic_ns
+    Process.clock_gettime(Process::CLOCK_MONOTONIC, :nanosecond)
+  end
+
+  def measure
+    started = monotonic_ns
+    yield
+    monotonic_ns - started
+  end
+
+  def runtime_paths
+    [
+      File.dirname(RbConfig.ruby),
+      RbConfig::CONFIG["libdir"],
+      RbConfig::CONFIG["archlibdir"],
+      "/usr",
+      "/lib",
+      "/lib64",
+      "/etc"
+    ].compact.uniq.select { |path| File.exist?(path) }
+  end
+
+  def prepare_workspace
+    Dir.mktmpdir("landlock-bench") do |dir|
+      file = File.join(dir, "small.txt")
+      entries = File.join(dir, "entries")
+      Dir.mkdir(entries)
+      File.binwrite(file, "x" * 1024)
+      100.times { |index| File.binwrite(File.join(entries, "entry-#{index}.txt"), "x") }
+
+      yield({ "dir" => dir, "file" => file, "entries" => entries })
+    end
+  end
+
+  def child_command(payload)
+    [RbConfig.ruby, __FILE__, "--child", JSON.generate(payload)]
+  end
+
+  def run_child(payload)
+    stdout, stderr, status = Open3.capture3(*child_command(payload), chdir: ROOT)
+    unless status.success?
+      abort "bench child failed (#{status.exitstatus})\nSTDOUT:\n#{stdout}\nSTDERR:\n#{stderr}"
+    end
+
+    JSON.parse(stdout)
+  end
+
+  def run_parent
+    puts "Landlock performance benchmark"
+    puts "Ruby: #{RUBY_DESCRIPTION}"
+    puts "Landlock ABI: #{Landlock.abi_version}"
+    puts "Samples: #{DEFAULT_SAMPLES}, iterations: #{DEFAULT_ITERATIONS}"
+    puts
+
+    prepare_workspace do |workspace|
+      read_paths = (runtime_paths + [workspace.fetch("dir")]).uniq
+      common = {
+        mode: "workloads",
+        iterations: DEFAULT_ITERATIONS,
+        dir_iterations: DIR_ITERATIONS,
+        read_paths: read_paths,
+        workspace: workspace
+      }
+
+      baseline = collect_samples(DEFAULT_SAMPLES) { run_child(common.merge(sandbox: false)) }
+
+      unless Landlock.supported?
+        puts "Landlock is not supported on this host; only baseline timings were collected."
+        print_workload_table(baseline, nil)
+        return
+      end
+
+      sandbox = collect_samples(DEFAULT_SAMPLES) { run_child(common.merge(sandbox: true)) }
+      setup = collect_samples(SETUP_SAMPLES) do
+        run_child(mode: "setup", read_paths: read_paths).fetch("setup_ns")
+      end
+
+      print_workload_table(baseline, sandbox)
+      puts
+      puts "Setup cost (create ruleset, add read rules, restrict current process):"
+      puts "  median #{format_ms(median(setup))} (#{SETUP_SAMPLES} samples)"
+      puts
+      puts "Lower is better. Negative deltas mean the sandboxed sample was faster in this run."
+      puts "Expect small differences to be noise; compare medians across repeated runs."
+    end
+  end
+
+  def collect_samples(count)
+    Array.new(count) { yield }
+  end
+
+  def print_workload_table(baseline, sandbox)
+    puts format("%-12s %14s %14s %12s %10s", "workload", "baseline", "landlocked", "delta", "delta %")
+    puts "-" * 68
+
+    WORKLOADS.each do |name, description|
+      base = median(baseline.map { |sample| sample.fetch(name) })
+      if sandbox
+        locked = median(sandbox.map { |sample| sample.fetch(name) })
+        delta = locked - base
+        pct = base.positive? ? (delta.to_f / base * 100.0) : 0.0
+        puts format(
+          "%-12s %14s %14s %12s %9.2f%%",
+          name,
+          format_ms(base),
+          format_ms(locked),
+          format_ms(delta),
+          pct
+        )
+      else
+        puts format("%-12s %14s %14s %12s %10s", name, format_ms(base), "n/a", "n/a", "n/a")
+      end
+      puts "  #{description}"
+    end
+  end
+
+  def median(values)
+    sorted = values.sort
+    midpoint = sorted.length / 2
+    return sorted.fetch(midpoint) if sorted.length.odd?
+
+    (sorted.fetch(midpoint - 1) + sorted.fetch(midpoint)) / 2.0
+  end
+
+  def format_ms(ns)
+    format("%.3f ms", ns.to_f / 1_000_000.0)
+  end
+
+  def run_child_mode(payload)
+    case payload.fetch("mode")
+    when "setup"
+      puts JSON.generate("setup_ns" => measure { restrict_for(payload) })
+    when "workloads"
+      restrict_for(payload) if payload.fetch("sandbox")
+      puts JSON.generate(run_workloads(payload))
+    else
+      raise ArgumentError, "unknown child mode: #{payload.fetch("mode").inspect}"
+    end
+  end
+
+  def restrict_for(payload)
+    Landlock.restrict!(read: payload.fetch("read_paths"))
+  end
+
+  def run_workloads(payload)
+    iterations = Integer(payload.fetch("iterations"))
+    dir_iterations = Integer(payload.fetch("dir_iterations"))
+    workspace = payload.fetch("workspace")
+    file = workspace.fetch("file")
+    entries = workspace.fetch("entries")
+    sink = 0
+
+    GC.disable
+    {
+      "cpu_loop" => measure do
+        iterations.times { |index| sink ^= ((index * 31) & 0xffff) }
+      end,
+      "file_stat" => measure do
+        iterations.times { sink ^= File.stat(file).size }
+      end,
+      "file_read" => measure do
+        iterations.times { sink ^= File.binread(file).bytesize }
+      end,
+      "dir_scan" => measure do
+        dir_iterations.times do
+          Dir.foreach(entries) { |entry| sink ^= entry.bytesize }
+        end
+      end
+    }.merge("sink" => sink)
+  ensure
+    GC.enable
+  end
+end
+
+if ARGV.first == "--child"
+  LandlockBench.run_child_mode(JSON.parse(ARGV.fetch(1)))
+else
+  LandlockBench.run_parent
+end

data/ext/landlock/landlock.c

@@ -14,7 +14,18 @@
 #endif
 
 #ifndef SYS_landlock_create_ruleset
-# if defined(__x86_64__)
+# if defined(__NR_landlock_create_ruleset) && defined(__NR_landlock_add_rule) && defined(__NR_landlock_restrict_self)
+#  define SYS_landlock_create_ruleset __NR_landlock_create_ruleset
+#  define SYS_landlock_add_rule __NR_landlock_add_rule
+#  define SYS_landlock_restrict_self __NR_landlock_restrict_self
+# elif defined(__x86_64__) && defined(__ILP32__)
+#  ifndef __X32_SYSCALL_BIT
+#   define __X32_SYSCALL_BIT 0x40000000
+#  endif
+#  define SYS_landlock_create_ruleset (__X32_SYSCALL_BIT + 444)
+#  define SYS_landlock_add_rule (__X32_SYSCALL_BIT + 445)
+#  define SYS_landlock_restrict_self (__X32_SYSCALL_BIT + 446)
+# elif defined(__x86_64__)
 #  define SYS_landlock_create_ruleset 444
 #  define SYS_landlock_add_rule 445
 #  define SYS_landlock_restrict_self 446
@@ -23,9 +34,9 @@
 #  define SYS_landlock_add_rule 445
 #  define SYS_landlock_restrict_self 446
 # elif defined(__i386__)
-#  define SYS_landlock_create_ruleset 451
-#  define SYS_landlock_add_rule 452
-#  define SYS_landlock_restrict_self 453
+#  define SYS_landlock_create_ruleset 444
+#  define SYS_landlock_add_rule 445
+#  define SYS_landlock_restrict_self 446
 # endif
 #endif
 
@@ -97,6 +108,13 @@
 #define LANDLOCK_ACCESS_NET_CONNECT_TCP (1ULL << 1)
 #endif
 
+#ifndef LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET
+#define LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET (1ULL << 0)
+#endif
+#ifndef LANDLOCK_SCOPE_SIGNAL
+#define LANDLOCK_SCOPE_SIGNAL (1ULL << 1)
+#endif
+
 #ifndef O_PATH
 #define O_PATH 010000000
 #endif
@@ -170,16 +188,24 @@ static VALUE rb_ll_abi_version(VALUE self) {
   return LONG2NUM(abi);
 }
 
-static VALUE rb_ll_create_ruleset(VALUE self, VALUE fs_bits, VALUE net_bits) {
+static VALUE rb_ll_create_ruleset(int argc, VALUE *argv, VALUE self) {
+  VALUE fs_bits, net_bits, scoped_bits;
+  rb_scan_args(argc, argv, "21", &fs_bits, &net_bits, &scoped_bits);
+
   struct rb_landlock_ruleset_attr attr;
   uint64_t handled_access_net = NUM2ULL(net_bits);
-  size_t attr_size = handled_access_net == 0 ?
-                     offsetof(struct rb_landlock_ruleset_attr, handled_access_net) :
-                     offsetof(struct rb_landlock_ruleset_attr, scoped);
+  uint64_t scoped = NIL_P(scoped_bits) ? 0 : NUM2ULL(scoped_bits);
+  size_t attr_size = offsetof(struct rb_landlock_ruleset_attr, handled_access_net);
+  if (scoped != 0) {
+    attr_size = sizeof(struct rb_landlock_ruleset_attr);
+  } else if (handled_access_net != 0) {
+    attr_size = offsetof(struct rb_landlock_ruleset_attr, scoped);
+  }
 
   memset(&attr, 0, sizeof(attr));
   attr.handled_access_fs = NUM2ULL(fs_bits);
   attr.handled_access_net = handled_access_net;
+  attr.scoped = scoped;
 
   long fd = ll_create_ruleset(&attr, attr_size, 0);
   if (fd < 0) raise_syscall_error("landlock_create_ruleset");
@@ -187,6 +213,8 @@ static VALUE rb_ll_create_ruleset(VALUE self, VALUE fs_bits, VALUE net_bits) {
 }
 
 static VALUE rb_ll_add_path_rule(VALUE self, VALUE ruleset_fd, VALUE path, VALUE access_bits) {
+  int ruleset = NUM2INT(ruleset_fd);
+  uint64_t allowed_access = NUM2ULL(access_bits);
   Check_Type(path, T_STRING);
   const char *cpath = StringValueCStr(path);
   int parent_fd = open(cpath, O_PATH | O_CLOEXEC);
@@ -194,10 +222,10 @@ static VALUE rb_ll_add_path_rule(VALUE self, VALUE ruleset_fd, VALUE path, VALUE
 
   struct rb_landlock_path_beneath_attr rule;
   memset(&rule, 0, sizeof(rule));
-  rule.allowed_access = NUM2ULL(access_bits);
+  rule.allowed_access = allowed_access;
   rule.parent_fd = parent_fd;
 
-  long ret = ll_add_rule(NUM2INT(ruleset_fd), LANDLOCK_RULE_PATH_BENEATH, &rule, 0);
+  long ret = ll_add_rule(ruleset, LANDLOCK_RULE_PATH_BENEATH, &rule, 0);
   int saved_errno = errno;
   close(parent_fd);
   if (ret < 0) {
@@ -253,7 +281,7 @@ void Init_landlock(void) {
   }
 
   rb_define_singleton_method(mLandlock, "abi_version", rb_ll_abi_version, 0);
-  rb_define_singleton_method(mLandlock, "_create_ruleset", rb_ll_create_ruleset, 2);
+  rb_define_singleton_method(mLandlock, "_create_ruleset", rb_ll_create_ruleset, -1);
   rb_define_singleton_method(mLandlock, "_add_path_rule", rb_ll_add_path_rule, 3);
   rb_define_singleton_method(mLandlock, "_add_net_rule", rb_ll_add_net_rule, 3);
   rb_define_singleton_method(mLandlock, "_restrict_self", rb_ll_restrict_self, 1);
@@ -277,4 +305,6 @@ void Init_landlock(void) {
   rb_define_const(mLandlock, "ACCESS_FS_IOCTL_DEV", ULL2NUM(LANDLOCK_ACCESS_FS_IOCTL_DEV));
   rb_define_const(mLandlock, "ACCESS_NET_BIND_TCP", ULL2NUM(LANDLOCK_ACCESS_NET_BIND_TCP));
   rb_define_const(mLandlock, "ACCESS_NET_CONNECT_TCP", ULL2NUM(LANDLOCK_ACCESS_NET_CONNECT_TCP));
+  rb_define_const(mLandlock, "SCOPE_ABSTRACT_UNIX_SOCKET", ULL2NUM(LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET));
+  rb_define_const(mLandlock, "SCOPE_SIGNAL", ULL2NUM(LANDLOCK_SCOPE_SIGNAL));
 }

data/lib/landlock/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Landlock
-  VERSION = "0.1.0"
+  VERSION = "0.1.1"
 end

data/lib/landlock.rb

@@ -41,12 +41,18 @@ module Landlock
     connect_tcp: ACCESS_NET_CONNECT_TCP
   }.freeze
 
+  SCOPE_FLAGS = {
+    abstract_unix_socket: SCOPE_ABSTRACT_UNIX_SOCKET,
+    signal: SCOPE_SIGNAL
+  }.freeze
+
   READ_RIGHTS = %i[read_file read_dir].freeze
   EXEC_RIGHTS = %i[execute read_file read_dir].freeze
   WRITE_RIGHTS = %i[
     read_file read_dir write_file truncate remove_dir remove_file make_char
     make_dir make_reg make_sock make_fifo make_block make_sym refer
   ].freeze
+  FILE_PATH_RIGHTS = %i[execute write_file read_file truncate ioctl_dev].freeze
 
   module_function
 
@@ -56,18 +62,19 @@ module Landlock
     false
   end
 
-  def restrict!(read: [], write: [], execute: [], connect_tcp: [], bind_tcp: [], paths: [], allow_all_known: false)
+  def restrict!(read: [], write: [], execute: [], connect_tcp: [], bind_tcp: [], paths: [], scope: [], allow_all_known: false)
     abi = abi_version
     raise UnsupportedError, "Linux Landlock is unavailable" unless abi.positive?
 
     fs_handled = allow_all_known ? _fs_rights_for_abi(abi) : _handled_fs_for(read:, write:, execute:, paths:, abi:)
     net_handled = _handled_net_for(connect_tcp:, bind_tcp:, abi:)
+    scoped = _scope_for(scope:, abi:)
 
-    if fs_handled.zero? && net_handled.zero?
-      raise ArgumentError, "empty Landlock policy: provide filesystem paths or TCP ports"
+    if fs_handled.zero? && net_handled.zero? && scoped.zero?
+      raise ArgumentError, "empty Landlock policy: provide filesystem paths, TCP ports, or scopes"
     end
 
-    fd = _create_ruleset(fs_handled, net_handled)
+    fd = _create_ruleset(fs_handled, net_handled, scoped)
     begin
       add_path_rules(fd, read, READ_RIGHTS, abi)
       add_path_rules(fd, execute, EXEC_RIGHTS, abi)
@@ -75,7 +82,10 @@ module Landlock
 
       paths.each do |rule|
         path, rights = normalize_path_rule(rule)
-        _add_path_rule(fd, File.expand_path(path), mask(rights, FS_RIGHTS, abi))
+        access_mask = mask(rights, FS_RIGHTS, abi)
+        next if access_mask.zero?
+
+        _add_path_rule(fd, File.expand_path(path), access_mask)
       end
 
       add_net_rules(fd, connect_tcp, [:connect_tcp], abi)
@@ -89,20 +99,19 @@ module Landlock
     true
   end
 
-  def exec(argv, read: [], write: [], execute: [], connect_tcp: [], bind_tcp: [], paths: [], chdir: nil, env: nil, unsetenv_others: false, close_others: true)
-    argv = Array(argv)
-    raise ArgumentError, "argv must not be empty" if argv.empty?
+  def exec(argv, read: [], write: [], execute: [], connect_tcp: [], bind_tcp: [], paths: [], scope: [], chdir: nil, env: nil, unsetenv_others: false, close_others: true, allow_all_known: false)
+    argv = normalize_argv(argv)
+    ensure_landlock_supported!
 
     pid = fork do
-      # Safe after fork: this runs only in the child process before exec.
-      Dir.chdir(chdir) if chdir # rubocop:disable Discourse/NoChdir
-      restrict!(read:, write:, execute:, connect_tcp:, bind_tcp:, paths:)
-
-      if env
-        exec_env = unsetenv_others ? env : ENV.to_h.merge(env)
-        Kernel.exec(exec_env, *argv, close_others: close_others)
-      else
-        Kernel.exec(*argv, close_others: close_others)
+      begin
+        # Safe after fork: this runs only in the child process before exec.
+        Dir.chdir(chdir) if chdir # rubocop:disable Discourse/NoChdir
+        restrict!(read:, write:, execute:, connect_tcp:, bind_tcp:, paths:, scope:, allow_all_known:)
+
+        Kernel.exec(*kernel_exec_args(argv, env, unsetenv_others:, close_others:))
+      rescue Exception => error
+        exit_child!(error)
       end
     end
 
@@ -110,35 +119,85 @@ module Landlock
     status
   end
 
-  def spawn(argv, **opts)
-    argv = Array(argv)
-    raise ArgumentError, "argv must not be empty" if argv.empty?
+  def spawn(argv, read: [], write: [], execute: [], connect_tcp: [], bind_tcp: [], paths: [], scope: [], chdir: nil, env: nil, unsetenv_others: false, close_others: true, allow_all_known: false)
+    argv = normalize_argv(argv)
+    ensure_landlock_supported!
 
     fork do
-      # Safe after fork: this runs only in the child process before exec.
-      Dir.chdir(opts[:chdir]) if opts[:chdir] # rubocop:disable Discourse/NoChdir
-      restrict!(
-        read: opts.fetch(:read, []),
-        write: opts.fetch(:write, []),
-        execute: opts.fetch(:execute, []),
-        connect_tcp: opts.fetch(:connect_tcp, []),
-        bind_tcp: opts.fetch(:bind_tcp, []),
-        paths: opts.fetch(:paths, [])
-      )
-      Kernel.exec(*argv, close_others: opts.fetch(:close_others, true))
+      begin
+        # Safe after fork: this runs only in the child process before exec.
+        Dir.chdir(chdir) if chdir # rubocop:disable Discourse/NoChdir
+        restrict!(read:, write:, execute:, connect_tcp:, bind_tcp:, paths:, scope:, allow_all_known:)
+        Kernel.exec(*kernel_exec_args(argv, env, unsetenv_others:, close_others:))
+      rescue Exception => error
+        exit_child!(error)
+      end
+    end
+  end
+
+  def normalize_argv(argv)
+    raise ArgumentError, "argv must be an Array of command arguments" unless argv.is_a?(Array)
+    raise ArgumentError, "argv must not be empty" if argv.empty?
+
+    argv
+  end
+  private_class_method :normalize_argv
+
+  def argv_for_exec(argv)
+    command = argv.fetch(0)
+    [[command, command], *argv.drop(1)]
+  end
+  private_class_method :argv_for_exec
+
+  def kernel_exec_args(argv, env, unsetenv_others:, close_others:)
+    exec_options = { close_others: close_others }
+    exec_options[:unsetenv_others] = true if unsetenv_others
+
+    if env
+      [env, *argv_for_exec(argv), exec_options]
+    else
+      [*argv_for_exec(argv), exec_options]
     end
   end
+  private_class_method :kernel_exec_args
+
+  def ensure_landlock_supported!
+    raise UnsupportedError, "Linux Landlock is unavailable" unless abi_version.positive?
+  end
+  private_class_method :ensure_landlock_supported!
+
+  def exit_child!(error)
+    warn "Landlock child failed before exec: #{error.class}: #{error.message}"
+  ensure
+    exit! 127
+  end
+  private_class_method :exit_child!
+
+  def path_rights(path, rights)
+    File.directory?(path) ? rights : Array(rights) & FILE_PATH_RIGHTS
+  end
+  private_class_method :path_rights
 
   def add_path_rules(fd, paths, rights, abi)
-    Array(paths).each { |path| _add_path_rule(fd, File.expand_path(path), mask(rights, FS_RIGHTS, abi)) }
+    Array(paths).each do |path|
+      expanded_path = File.expand_path(path)
+      access_mask = mask(path_rights(expanded_path, rights), FS_RIGHTS, abi)
+      next if access_mask.zero?
+
+      _add_path_rule(fd, expanded_path, access_mask)
+    end
   end
   private_class_method :add_path_rules
 
   def add_net_rules(fd, ports, rights, abi)
-    return if Array(ports).empty?
+    ports = Array(ports)
+    return if ports.empty?
     raise UnsupportedError, "Landlock network rules require ABI v4+; running ABI v#{abi}" if abi < 4
 
-    Array(ports).each { |port| _add_net_rule(fd, Integer(port), mask(rights, NET_RIGHTS, abi)) }
+    access_mask = mask(rights, NET_RIGHTS, abi)
+    return if access_mask.zero?
+
+    ports.each { |port| _add_net_rule(fd, Integer(port), access_mask) }
   end
   private_class_method :add_net_rules
 
@@ -192,4 +251,13 @@ module Landlock
     bits
   end
   private_class_method :_handled_net_for
+
+  def _scope_for(scope:, abi:)
+    bits = mask(scope, SCOPE_FLAGS, abi)
+    return 0 if bits.zero?
+    raise UnsupportedError, "Landlock scopes require ABI v6+; running ABI v#{abi}" if abi < 6
+
+    bits
+  end
+  private_class_method :_scope_for
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: landlock
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: ruby
 authors:
 - Sam Saffron
@@ -74,8 +74,10 @@ extensions:
 - ext/landlock/extconf.rb
 extra_rdoc_files: []
 files:
+- CHANGELOG.md
 - LICENSE.txt
 - README.md
+- benchmark/landlock_overhead.rb
 - ext/landlock/extconf.rb
 - ext/landlock/landlock.c
 - lib/landlock.rb