landlock 0.5 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5bfc5c69234e004834818ba52aab192c9219ff0a398d40ada62c4f45be461cdb
-  data.tar.gz: 6ec4b746a959a8f68c5ba11e1c4b7342d0a4facda031a8627f05ae6fedc6c6cf
+  metadata.gz: a98542d0874b26516a80943ad75765373f5d244278753a2da572c6455f5f104f
+  data.tar.gz: c3c872446787663432a661431584718c91e4407e051854ed46cdfe90888f83b4
 SHA512:
-  metadata.gz: efd09558eb3b207ca4be70d4a6509b39338f9cc6374f6422a0fbeee87f2fb8fbb99dd4095044a27f94355062da6016672719a64ab3af78d8d89f622b3b0bb64b
-  data.tar.gz: f7e6d2ebf580fd200fa05217d3266f4a48e93d226757e4a3d9c409d22a844c3f6245fb81956201a4b03c3b8ced3ddd29c169653367efa007a8cd1c71bc833048
+  metadata.gz: 13445eecb00b8d57ec553f99db67084608ab9aac280b27071f8b1c3dcddf50918b0a2b6f2c86f0f5629b56e59679615d796944dcfb4f779f59ba73c5f0175d52
+  data.tar.gz: fe97fb721314537abb9dd71c58426443165488b967c5d28f165f8da624ceff5522f3a18f5ebc48e1da384bf928b1f8c58b32be739963881056159cc4b9e92420

data/CHANGELOG.md

@@ -4,6 +4,22 @@ All notable changes to this project will be documented in this file.
 
 ## Unreleased
 
+## [0.6.0] - 2026-09-23
+
+### Added
+
+- Add `seccomp_deny_child_processes: true` to `capture`, `capture!`, and `fork` to deny child processes.
+
+### Fixed
+
+- Clean up remaining process-group members before `Landlock.capture`, `Landlock.capture!`, or `Landlock.fork` returns after normal completion.
+
+## [0.5.1] - 2026-09-09
+
+### Fixed
+
+- Allow `Landlock.fork(on_unsupported: :run_without_landlock)` to fall back when the support check is blocked or unavailable, including on macOS.
+
 ## [0.5] - 2026-09-01
 
 ### Added

data/README.md

@@ -104,7 +104,7 @@ stdout, stderr, status = Landlock.capture(
 
 `Landlock.capture!` has the same return shape for successful commands, but raises `Landlock::CommandError` for unsuccessful statuses. The error also exposes `stdout`, `stderr`, `status`, and `result`.
 
-`Landlock.capture` requires an actual restriction: provide Landlock rules, `seccomp_deny_network: true`, or `rlimits:`. This avoids accidentally running a command completely unsandboxed when a dynamically built policy is empty. It also requires Linux Landlock support and raises `Landlock::UnsupportedError` when unavailable; it does not fall back to running the command unsandboxed.
+`Landlock.capture` requires an actual restriction: provide Landlock rules, `seccomp_deny_network: true`, `seccomp_deny_child_processes: true`, or `rlimits:`. This avoids accidentally running a command completely unsandboxed when a dynamically built policy is empty. It also requires Linux Landlock support and raises `Landlock::UnsupportedError` when unavailable; it does not fall back to running the command unsandboxed.
 
 Pass `stdin:` when a tool should read from standard input instead of a file:
 
@@ -125,6 +125,7 @@ Capture options:
 - `connect_tcp:` and `bind_tcp:` — allowed TCP ports, with the same `nil` versus `[]` distinction. `[]` denies all TCP for that operation and requires ABI v4+; `nil` leaves TCP unrestricted.
 - `scope:` — Landlock ABI v6+ scopes such as `:signal` and `:abstract_unix_socket`.
 - `seccomp_deny_network:` — additionally deny common Linux network syscalls with seccomp. This is Linux-specific and intended as defense in depth.
+- `seccomp_deny_child_processes:` — deny process creation with seccomp. Defaults to `false`. This denies `fork`, `vfork`, and `clone` without `CLONE_THREAD`. `clone3` returns `ENOSYS` so compatible runtimes can fall back to `clone`. Runtimes that require `clone3` without fallback are unsupported. Filter installation failure prevents the command or block from running.
 - `rlimits:` — resource limits. Supported keys are `:cpu_seconds`, `:memory_bytes`, `:file_size_bytes`, `:open_files`, and `:processes`. Values must be non-negative integers.
 - `timeout:` — wall-clock timeout in seconds. On timeout capture terminates the process group and returns/raises with `result.timed_out?` true.
 - `max_output_bytes:` — combined stdout+stderr byte limit. With `truncate_output: false`, exceeding the limit raises `Landlock::CommandError` with the partial output captured before termination. With `truncate_output: true`, output is truncated and `result.output_truncated?` is true.
@@ -144,7 +145,8 @@ result = Landlock.fork(
   read: [input_path],
   timeout: 5,
   rlimits: { cpu_seconds: 5, memory_bytes: 512 * 1024 * 1024 },
-  seccomp_deny_network: true
+  seccomp_deny_network: true,
+  seccomp_deny_child_processes: true
 ) do |stdout, _stderr|
   stdout.write(calculate_dominant_color(input_path))
 end
@@ -154,7 +156,7 @@ color = result.stdout if result.success?
 
 The block receives its child-side stdout and stderr streams. Write response data to stdout and diagnostics to stderr, then inspect them through the capture result in the parent. The block's return value is discarded. An exception makes the child exit with status 1 and writes a diagnostic to stderr. `fork` accepts the capture options listed above except `success_status_codes:` and `failure_message:`, which only apply to `capture!`.
 
-By default, `Landlock.fork` requires Linux Landlock support and raises `Landlock::UnsupportedError` before forking when the Landlock ABI is unavailable. A Linux caller that explicitly accepts running without Landlock filesystem, TCP, and scope enforcement can opt in to the fallback:
+By default, `Landlock.fork` requires Linux Landlock support and raises `Landlock::UnsupportedError` before forking when the Landlock ABI is unavailable. A caller that explicitly accepts running without Landlock filesystem, TCP, and scope enforcement can opt in to the fallback:
 
 ```ruby
 result = Landlock.fork(
@@ -165,7 +167,9 @@ result = Landlock.fork(
 ) { |stdout, _stderr| stdout.write(run_plugin) }
 ```
 
-This fallback is used only when the Linux kernel has no Landlock ABI. It skips only Landlock policy enforcement; fork supervision, timeout handling, environment changes, descriptor closing, rlimits, output capture, and seccomp remain active. It is never selected implicitly, and non-Linux systems still raise `Landlock::UnsupportedError`. When fallback is active, the call must include `seccomp_deny_network: true` or at least one `rlimits:` entry because Landlock rules are not effective restrictions in that mode. Timeout, environment handling, descriptor closing, and output limits do not satisfy this requirement. `Landlock.fork` requires an actual restriction. By default, the child closes inherited Ruby `IO` objects other than stdin, stdout, and stderr, then closes every other application descriptor numbered 3 or higher while preserving Ruby VM-reserved descriptors. It enumerates `/proc/self/fd` for this sweep and fails closed with setup status 127 if enumeration is unavailable or fails. Pass `close_others: false` only when the child intentionally needs an inherited descriptor. Child setup failures exit 127.
+This fallback is used when the Landlock ABI is unavailable, including when the capability probe fails or the platform does not support Landlock. Errors applying a policy after Landlock is detected still fail closed. Timeout handling, environment changes, descriptor closing, rlimits, and output capture remain active. Linux also retains parent-death cleanup and any requested seccomp restrictions. Non-Linux systems cannot provide parent-death cleanup and reject `seccomp_deny_network: true`; callers must omit that option and supply at least one `rlimits:` entry.
+
+Fallback is never selected implicitly. When active, the call must include `seccomp_deny_network: true`, `seccomp_deny_child_processes: true`, or at least one `rlimits:` entry because Landlock rules are not effective restrictions in that mode. Timeout, environment handling, descriptor closing, and output limits do not satisfy this requirement. By default, the child closes inherited Ruby `IO` objects other than stdin, stdout, and stderr, then closes every other application descriptor numbered 3 or higher while preserving Ruby VM-reserved descriptors. It enumerates `/proc/self/fd` on Linux and `/dev/fd` elsewhere, including macOS, and fails closed with setup status 127 if enumeration is unavailable or fails. Pass `close_others: false` only when the child intentionally needs an inherited descriptor. Child setup failures exit 127.
 
 The worker is a process-group leader and reserves Linux real-time signal `SIGRTMIN+2` for parent-death handling while the block runs. If the Ruby thread supervising the synchronous `Landlock.fork` call terminates, a native signal handler sends `SIGKILL` to the worker's process group. This terminates the worker and ordinary descendants that remain in that group. It does not cover descendants that create another process group or session, and the group-wide guarantee can be disabled by code that replaces or blocks the reserved signal, clears the parent-death signal, changes credentials in a way that clears it, or replaces the worker with `exec`. After `exec`, the reserved signal still terminates the worker by default, but the reset handler no longer kills its process group. This is process-lifecycle hardening, not a cgroup, PID namespace, or hostile-process containment boundary.
 

data/ext/landlock/bin/safe_exec_helper.c

@@ -1,5 +1,6 @@
 #include "../landlock_native.h"
 #include "../seccomp_deny_network.h"
+#include "../seccomp_deny_child_processes.h"
 
 #include <stdio.h>
 #include <stdlib.h>
@@ -549,6 +550,7 @@ int main(int argc, char **argv) {
   string_list read_paths = {0}, write_paths = {0}, execute_paths = {0}, rlimit_specs = {0};
   path_rule_list path_rules = {0};
   ull_list connect_ports = {0}, bind_ports = {0};
+  int seccomp_deny_child_processes = 0;
   int seccomp_deny_network = 0, allow_all_known = 0, close_others = 1;
   int handled_read = 0, handled_write = 0, handled_execute = 0;
   int handled_connect = 0, handled_bind = 0;
@@ -582,6 +584,8 @@ int main(int argc, char **argv) {
       chdir_path = require_arg(argc, argv, &i);
     } else if (strcmp(argv[i], "--rlimit") == 0) {
       string_list_push(&rlimit_specs, require_arg(argc, argv, &i));
+    } else if (strcmp(argv[i], "--seccomp-deny-child-processes") == 0) {
+      seccomp_deny_child_processes = 1;
     } else if (strcmp(argv[i], "--seccomp-deny-network") == 0) {
       seccomp_deny_network = 1;
     } else if (strcmp(argv[i], "--allow-all-known") == 0) {
@@ -616,6 +620,13 @@ int main(int argc, char **argv) {
     apply_rlimit(rlimit_specs.items[i]);
   }
 
+  if (seccomp_deny_child_processes) {
+    const char *error_message;
+    if (rb_landlock_seccomp_deny_child_processes(&error_message) != 0) {
+      die(error_message);
+    }
+  }
+
   execvp(command_argv[0], command_argv);
   perror("execvp");
   _exit(127);

data/ext/landlock/extconf.rb

@@ -19,7 +19,7 @@ create_makefile("landlock/landlock")
 if RUBY_PLATFORM.include?("linux")
   helper = "landlock-safe-exec"
   helper_src = "$(srcdir)/bin/safe_exec_helper.c"
-  helper_headers = "$(srcdir)/landlock_native.h $(srcdir)/seccomp_deny_network.h"
+  helper_headers = "$(srcdir)/landlock_native.h $(srcdir)/seccomp_deny_network.h $(srcdir)/seccomp_deny_child_processes.h"
   helper_dest = "$(RUBYARCHDIR)/#{helper}"
 
   File.open("Makefile", "a") do |makefile|
@@ -27,7 +27,7 @@ if RUBY_PLATFORM.include?("linux")
 
       all: #{helper}
 
-      #{helper}: #{helper_src}
+      #{helper}: #{helper_src} #{helper_headers}
       \t$(CC) $(INCFLAGS) $(CPPFLAGS) $(CFLAGS) #{helper_src} -o #{helper}
 
       install: install-#{helper}

data/ext/landlock/landlock.c

@@ -1,14 +1,14 @@
 #include "ruby.h"
 #include "landlock_native.h"
 #include "seccomp_deny_network.h"
+#include "seccomp_deny_child_processes.h"
 
 #include <signal.h>
 #include <string.h>
+#include <sys/wait.h>
 
-#ifdef __linux__
 #include <dirent.h>
 #include <stdlib.h>
-#endif
 
 static VALUE mLandlock;
 static VALUE eLandlockError;
@@ -127,13 +127,18 @@ static VALUE rb_ll_close_fd(VALUE self, VALUE fd_value) {
   return Qnil;
 }
 
+#ifdef __linux__
+#define LL_DESCRIPTOR_DIRECTORY "/proc/self/fd"
+#else
+#define LL_DESCRIPTOR_DIRECTORY "/dev/fd"
+#endif
+
 static VALUE rb_ll_close_inherited_fds(VALUE self) {
   /* The forked child keeps running Ruby, so interpreter-reserved descriptors
    * must survive. This rules out close_range across the entire descriptor table. */
-#ifdef __linux__
-  DIR *dir = opendir("/proc/self/fd");
+  DIR *dir = opendir(LL_DESCRIPTOR_DIRECTORY);
   if (!dir) {
-    raise_syscall_error("opendir(/proc/self/fd)");
+    raise_syscall_error("opendir(" LL_DESCRIPTOR_DIRECTORY ")");
   }
 
   int dir_fd = dirfd(dir);
@@ -146,7 +151,7 @@ static VALUE rb_ll_close_inherited_fds(VALUE self) {
         int saved_errno = errno;
         closedir(dir);
         errno = saved_errno;
-        raise_syscall_error("readdir(/proc/self/fd)");
+        raise_syscall_error("readdir(" LL_DESCRIPTOR_DIRECTORY ")");
       }
       break;
     }
@@ -160,14 +165,24 @@ static VALUE rb_ll_close_inherited_fds(VALUE self) {
     }
   }
   if (closedir(dir) != 0) {
-    raise_syscall_error("closedir(/proc/self/fd)");
+    raise_syscall_error("closedir(" LL_DESCRIPTOR_DIRECTORY ")");
   }
   return Qtrue;
-#else
-  errno = ENOSYS;
-  raise_syscall_error("opendir(/proc/self/fd)");
-  return Qnil;
-#endif
+}
+
+static VALUE rb_ll_child_exited(VALUE self, VALUE pid_value) {
+  siginfo_t info = {0};
+  int result;
+  do {
+    result = waitid(P_PID, NUM2PIDT(pid_value), &info, WEXITED | WNOHANG | WNOWAIT);
+  } while (result < 0 && errno == EINTR);
+  if (result < 0 && errno == ECHILD) {
+    return Qnil;
+  }
+  if (result < 0) {
+    raise_syscall_error("waitid");
+  }
+  return info.si_pid == 0 ? Qfalse : Qtrue;
 }
 
 static VALUE rb_ll_pidfd_open(VALUE self, VALUE pid_value) {
@@ -248,6 +263,14 @@ static VALUE rb_ll_seccomp_deny_network(VALUE self) {
   return Qtrue;
 }
 
+static VALUE rb_ll_seccomp_deny_child_processes(VALUE self) {
+  const char *error_message;
+  if (rb_landlock_seccomp_deny_child_processes(&error_message) != 0) {
+    raise_syscall_error(error_message);
+  }
+  return Qtrue;
+}
+
 void Init_landlock(void) {
   mLandlock = rb_define_module("Landlock");
 
@@ -271,11 +294,14 @@ void Init_landlock(void) {
   rb_define_singleton_method(mLandlock, "_close_fd", rb_ll_close_fd, 1);
   rb_define_singleton_method(mLandlock, "_close_inherited_fds", rb_ll_close_inherited_fds, 0);
   rb_define_singleton_method(mLandlock, "_pidfd_open", rb_ll_pidfd_open, 1);
+  rb_define_singleton_method(mLandlock, "_child_exited", rb_ll_child_exited, 1);
   rb_define_singleton_method(mLandlock, "_arm_parent_death_process_group",
                              rb_ll_arm_parent_death_process_group, 1);
   rb_define_singleton_method(mLandlock, "_set_parent_death_signal", rb_ll_set_parent_death_signal,
                              0);
   rb_define_singleton_method(mLandlock, "seccomp_deny_network!", rb_ll_seccomp_deny_network, 0);
+  rb_define_singleton_method(mLandlock, "seccomp_deny_child_processes!",
+                             rb_ll_seccomp_deny_child_processes, 0);
 
   rb_define_const(mLandlock, "ACCESS_FS_EXECUTE", ULL2NUM(LANDLOCK_ACCESS_FS_EXECUTE));
   rb_define_const(mLandlock, "ACCESS_FS_WRITE_FILE", ULL2NUM(LANDLOCK_ACCESS_FS_WRITE_FILE));

data/ext/landlock/seccomp_deny_child_processes.h

@@ -0,0 +1,52 @@
+#ifndef RB_LANDLOCK_SECCOMP_DENY_CHILD_PROCESSES_H
+#define RB_LANDLOCK_SECCOMP_DENY_CHILD_PROCESSES_H
+
+#include "seccomp_deny_network.h"
+#ifdef __linux__
+#include <sched.h>
+#endif
+
+static int rb_landlock_seccomp_deny_child_processes(const char **error_message) {
+#if defined(__linux__) && defined(RB_LANDLOCK_EXPECTED_AUDIT_ARCH) && defined(__NR_clone3) &&      \
+    !(defined(__x86_64__) && defined(__ILP32__))
+  struct sock_filter filter[] = {
+      BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offsetof(struct seccomp_data, arch)),
+      BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, RB_LANDLOCK_EXPECTED_AUDIT_ARCH, 1, 0),
+      BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_KILL_PROCESS),
+      BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offsetof(struct seccomp_data, nr)),
+#ifdef RB_LANDLOCK_DENY_X32_SYSCALLS
+      BPF_JUMP(BPF_JMP | BPF_JGE | BPF_K, __X32_SYSCALL_BIT, 0, 1),
+      BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ERRNO | EPERM),
+#endif
+#ifdef __NR_fork
+      BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_fork, 0, 1),
+      BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ERRNO | EPERM),
+#endif
+#ifdef __NR_vfork
+      BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_vfork, 0, 1),
+      BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ERRNO | EPERM),
+#endif
+      BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_clone3, 0, 1),
+      BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ERRNO | ENOSYS),
+      BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_clone, 1, 0),
+      BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),
+      BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offsetof(struct seccomp_data, args[0])),
+      BPF_JUMP(BPF_JMP | BPF_JSET | BPF_K, CLONE_THREAD, 1, 0),
+      BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ERRNO | EPERM),
+      BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),
+  };
+  struct sock_fprog program = {.len = sizeof(filter) / sizeof(filter[0]), .filter = filter};
+  *error_message = "prctl(PR_SET_NO_NEW_PRIVS)";
+  if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) != 0) {
+    return -1;
+  }
+  *error_message = "seccomp deny child processes";
+  return prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &program);
+#else
+  *error_message = "seccomp deny child processes unsupported architecture or syscall headers";
+  errno = ENOSYS;
+  return -1;
+#endif
+}
+
+#endif

data/lib/landlock/execution.rb

@@ -86,19 +86,13 @@ module Landlock
         raise ArgumentError, "on_unsupported must be :raise or :run_without_landlock"
       end
 
-      enforce_landlock = Native.abi_version.positive?
-      if !enforce_landlock && (on_unsupported == :raise || !RUBY_PLATFORM.include?("linux"))
-        raise UnsupportedError, "Linux Landlock is unavailable"
-      end
+      enforce_landlock = Landlock.supported?
+      raise UnsupportedError, "Linux Landlock is unavailable" if !enforce_landlock && on_unsupported == :raise
 
       capture_options = prepare_capture_options(**options, require_landlock: enforce_landlock)
       validate_fallback_restriction!(**capture_options) if !enforce_landlock
 
-      Runner::Fork.call_block(
-        **capture_options,
-        enforce_landlock:,
-        &block
-      )
+      Runner::Fork.call_block(**capture_options, enforce_landlock:, &block)
     rescue OutputTooLargeError => error
       result = error.result
       raise CommandError.new(
@@ -128,6 +122,7 @@ module Landlock
       stdin: nil,
       rlimits: {},
       seccomp_deny_network: false,
+      seccomp_deny_child_processes: false,
       max_output_bytes: nil,
       truncate_output: false,
       success_status_codes: [0],
@@ -153,6 +148,7 @@ module Landlock
           stdin:,
           rlimits:,
           seccomp_deny_network:,
+          seccomp_deny_child_processes:,
           max_output_bytes:,
           truncate_output:
         )
@@ -195,18 +191,33 @@ module Landlock
       stdin: nil,
       rlimits: {},
       seccomp_deny_network: false,
+      seccomp_deny_child_processes: false,
       max_output_bytes: nil,
       truncate_output: false,
       require_landlock: true
     )
       ensure_landlock_supported! if require_landlock
+      if seccomp_deny_child_processes && !RUBY_PLATFORM.include?("linux")
+        raise UnsupportedError, "seccomp_deny_child_processes requires Linux"
+      end
       max_output_bytes = Validation.validate_output_limit!(max_output_bytes)
       timeout = Validation.validate_timeout!(timeout)
       rlimits = Rlimits.normalize(rlimits)
       env = Env.normalize(env)
       policy =
-        prepare_policy(read:, write:, execute:, connect_tcp:, bind_tcp:, paths:, scope:, chdir:, allow_all_known:)
-      validate_capture_restriction!(**policy, seccomp_deny_network:, rlimits:)
+        prepare_policy(
+          read:,
+          write:,
+          execute:,
+          connect_tcp:,
+          bind_tcp:,
+          paths:,
+          scope:,
+          chdir:,
+          allow_all_known:,
+          abi: require_landlock ? Native.abi_version : 0
+        )
+      validate_capture_restriction!(**policy, seccomp_deny_network:, seccomp_deny_child_processes:, rlimits:)
 
       {
         **policy,
@@ -218,6 +229,7 @@ module Landlock
         stdin:,
         rlimits:,
         seccomp_deny_network:,
+        seccomp_deny_child_processes:,
         max_output_bytes:,
         truncate_output:
       }
@@ -251,10 +263,21 @@ module Landlock
       raise UnsupportedError, "Linux Landlock is unavailable" unless Native.abi_version.positive?
     end
 
-    def prepare_policy(read:, write:, execute:, connect_tcp:, bind_tcp:, paths:, scope:, chdir:, allow_all_known:)
+    def prepare_policy(
+      read:,
+      write:,
+      execute:,
+      connect_tcp:,
+      bind_tcp:,
+      paths:,
+      scope:,
+      chdir:,
+      allow_all_known:,
+      abi: Native.abi_version
+    )
       connect_tcp = connect_tcp.nil? ? nil : Validation.normalize_ports(connect_tcp, :connect_tcp)
       bind_tcp = bind_tcp.nil? ? nil : Validation.normalize_ports(bind_tcp, :bind_tcp)
-      read, write, execute, paths = validate_policy_paths!(read:, write:, execute:, paths:, chdir:)
+      read, write, execute, paths = validate_policy_paths!(read:, write:, execute:, paths:, chdir:, abi:)
       { read:, write:, execute:, connect_tcp:, bind_tcp:, paths:, scope:, allow_all_known: }
     end
 
@@ -273,10 +296,14 @@ module Landlock
       raise ArgumentError, "empty Landlock policy: provide filesystem paths, TCP ports, or scopes"
     end
 
-    def validate_fallback_restriction!(seccomp_deny_network:, rlimits:, **)
-      return if seccomp_deny_network || rlimits.any?
+    def validate_fallback_restriction!(seccomp_deny_network:, seccomp_deny_child_processes:, rlimits:, **)
+      if seccomp_deny_network && !RUBY_PLATFORM.include?("linux")
+        raise UnsupportedError, "seccomp_deny_network requires Linux"
+      end
+
+      return if seccomp_deny_network || seccomp_deny_child_processes || rlimits.any?
 
-      raise ArgumentError, "Landlock fallback requires seccomp_deny_network or rlimits"
+      raise ArgumentError, "Landlock fallback requires seccomp_deny_network, seccomp_deny_child_processes, or rlimits"
     end
 
     def validate_capture_restriction!(
@@ -289,18 +316,18 @@ module Landlock
       scope:,
       allow_all_known:,
       seccomp_deny_network:,
+      seccomp_deny_child_processes:,
       rlimits:
     )
       return if Policy.requested?(read:, write:, execute:, connect_tcp:, bind_tcp:, paths:, scope:, allow_all_known:)
-      return if seccomp_deny_network
+      return if seccomp_deny_network || seccomp_deny_child_processes
       return if Array(rlimits).any?
 
-      raise ArgumentError, "empty capture policy: provide Landlock rules, seccomp_deny_network, or rlimits"
+      raise ArgumentError, "empty capture policy: provide Landlock rules, seccomp_deny_network, seccomp_deny_child_processes, or rlimits"
     end
 
-    def validate_policy_paths!(read:, write:, execute:, paths:, chdir:)
+    def validate_policy_paths!(read:, write:, execute:, paths:, chdir:, abi:)
       base = chdir ? File.expand_path(chdir) : Dir.pwd
-      abi = Native.abi_version
       read = read.nil? ? nil : Validation.validate_existing_paths(read, :read, chdir:)
       write = write.nil? ? nil : Validation.validate_existing_paths(write, :write, chdir:)
       execute = execute.nil? ? nil : Validation.validate_existing_paths(execute, :execute, chdir:)

data/lib/landlock/native.rb

@@ -35,6 +35,10 @@ module Landlock
       Landlock.__send__(:_close_inherited_fds)
     end
 
+    def child_exited?(pid)
+      Landlock.__send__(:_child_exited, pid)
+    end
+
     def pidfd_open(pid)
       Landlock.__send__(:_pidfd_open, pid)
     end
@@ -50,5 +54,9 @@ module Landlock
     def seccomp_deny_network!
       Landlock.seccomp_deny_network!
     end
+
+    def seccomp_deny_child_processes!
+      Landlock.seccomp_deny_child_processes!
+    end
   end
 end

data/lib/landlock/process_io.rb

@@ -116,11 +116,7 @@ module Landlock
         end
       end
 
-      if deadline
-        status, timed_out = wait_for_pid_until(pid, deadline:)
-      else
-        status = wait_for_pid(pid)
-      end
+      status, timed_out = wait_for_pid_until(pid, deadline:)
 
       if timed_out
         drain_streams_until(
@@ -138,8 +134,8 @@ module Landlock
     end
 
     def wait_for_pid_until(pid, deadline:)
-      remaining = deadline - monotonic_time
-      if remaining <= 0
+      remaining = deadline ? deadline - monotonic_time : nil
+      if remaining && remaining <= 0
         terminate_process(pid)
         return wait_for_pid(pid), true
       end
@@ -147,11 +143,12 @@ module Landlock
       pidfd = Native.pidfd_open(pid)
       pid_monitor = IO.for_fd(pidfd, autoclose: false)
       readable, = IO.select([pid_monitor], nil, nil, remaining)
-      if !readable || monotonic_time >= deadline
+      if !readable || (deadline && monotonic_time >= deadline)
         terminate_process(pid)
         return wait_for_pid(pid), true
       end
 
+      terminate_process_group(pid) unless Native.child_exited?(pid).nil?
       [wait_for_pid(pid), false]
     rescue Landlock::SyscallError
       wait_for_pid_until_by_polling(pid, deadline:)
@@ -163,27 +160,22 @@ module Landlock
 
     def wait_for_pid_until_by_polling(pid, deadline:)
       loop do
-        remaining = deadline - monotonic_time
-        if remaining <= 0
+        remaining = deadline ? deadline - monotonic_time : nil
+        if remaining && remaining <= 0
           terminate_process(pid)
           return wait_for_pid(pid), true
         end
 
-        result = ::Process.wait2(pid, ::Process::WNOHANG)
-        if result
-          status = result.last
-          if monotonic_time >= deadline
-            terminate_process_group(pid)
-            return status, true
-          end
-
-          return status, false
+        exited = Native.child_exited?(pid)
+        return nil, false if exited.nil?
+        if exited
+          timed_out = deadline && monotonic_time >= deadline
+          terminate_process_group(pid)
+          return wait_for_pid(pid), !!timed_out
         end
 
-        IO.select(nil, nil, nil, [remaining, PID_WAIT_FALLBACK_INTERVAL_SECONDS].min)
+        IO.select(nil, nil, nil, [remaining, PID_WAIT_FALLBACK_INTERVAL_SECONDS].compact.min)
       end
-    rescue Errno::ECHILD
-      [nil, false]
     end
     private_class_method :wait_for_pid_until_by_polling
 

data/lib/landlock/runner/fork.rb

@@ -69,6 +69,7 @@ module Landlock
         stdin:,
         rlimits:,
         seccomp_deny_network:,
+        seccomp_deny_child_processes: false,
         max_output_bytes:,
         truncate_output:
       )
@@ -88,7 +89,8 @@ module Landlock
             close_others:,
             allow_all_known:,
             rlimits:,
-            seccomp_deny_network:
+            seccomp_deny_network:,
+            seccomp_deny_child_processes:
           )
         rescue Exception => error
           Runner.exit_child!(error)
@@ -139,9 +141,9 @@ module Landlock
             begin
               # Arm group cleanup only after leaving the supervisor's process group.
               ::Process.setpgrp
-              if kill_process_group_on_parent_death
+              if kill_process_group_on_parent_death && RUBY_PLATFORM.include?("linux")
                 Landlock::Native.arm_parent_death_process_group!(parent_pid)
-              else
+              elsif RUBY_PLATFORM.include?("linux")
                 Landlock::Native.set_parent_death_signal!
                 exit! 1 if ::Process.ppid != parent_pid
               end
@@ -215,13 +217,15 @@ module Landlock
         close_others:,
         allow_all_known:,
         rlimits:,
-        seccomp_deny_network:
+        seccomp_deny_network:,
+        seccomp_deny_child_processes: false
       )
         Dir.chdir(chdir) if chdir # rubocop:disable Discourse/NoChdir
         if Policy.requested?(read:, write:, execute:, connect_tcp:, bind_tcp:, paths:, scope:, allow_all_known:)
           Landlock.restrict!(read:, write:, execute:, connect_tcp:, bind_tcp:, paths:, scope:, allow_all_known:)
         end
         Landlock::Native.seccomp_deny_network! if seccomp_deny_network
+        Landlock::Native.seccomp_deny_child_processes! if seccomp_deny_child_processes
         Rlimits.apply!(rlimits)
         Kernel.exec(*Runner.kernel_exec_args(argv, env, unsetenv_others:, close_others:))
       end
@@ -233,6 +237,7 @@ module Landlock
         close_others:,
         rlimits:,
         seccomp_deny_network:,
+        seccomp_deny_child_processes: false,
         enforce_landlock:,
         **policy
       )
@@ -242,6 +247,7 @@ module Landlock
         env&.each { |key, value| value.nil? ? ENV.delete(key) : ENV[key] = value }
         Landlock.restrict!(**policy) if enforce_landlock && Policy.requested?(**policy)
         Landlock::Native.seccomp_deny_network! if seccomp_deny_network
+        Landlock::Native.seccomp_deny_child_processes! if seccomp_deny_child_processes
         Rlimits.apply!(rlimits)
       end
 

data/lib/landlock/runner/native.rb

@@ -81,6 +81,7 @@ module Landlock
         stdin:,
         rlimits:,
         seccomp_deny_network:,
+        seccomp_deny_child_processes: false,
         max_output_bytes:,
         truncate_output:
       )
@@ -105,6 +106,7 @@ module Landlock
             allow_all_known:,
             rlimits:,
             seccomp_deny_network:,
+            seccomp_deny_child_processes:,
             stdin_reader:,
             stdout_writer:,
             stderr_writer:,
@@ -156,6 +158,7 @@ module Landlock
         allow_all_known:,
         rlimits:,
         seccomp_deny_network:,
+        seccomp_deny_child_processes: false,
         stdin_reader: nil,
         stdout_writer: nil,
         stderr_writer: nil,
@@ -182,6 +185,7 @@ module Landlock
             allow_all_known:,
             rlimits:,
             seccomp_deny_network:,
+            seccomp_deny_child_processes:,
             close_others:
           )
         env ? ::Process.spawn(env, *spawn_args, spawn_options) : ::Process.spawn(*spawn_args, spawn_options)
@@ -199,6 +203,7 @@ module Landlock
         allow_all_known:,
         rlimits:,
         seccomp_deny_network:,
+        seccomp_deny_child_processes: false,
         close_others:
       )
         args = [helper_path]
@@ -215,6 +220,7 @@ module Landlock
         Array(rlimits).each { |key, value| args << "--rlimit" << "#{key}=#{value}" }
         args << "--allow-all-known" if allow_all_known
         args << "--seccomp-deny-network" if seccomp_deny_network
+        args << "--seccomp-deny-child-processes" if seccomp_deny_child_processes
         args << "--keep-fds" unless close_others
         args << "--"
         args.concat(argv.map(&:to_s))

data/lib/landlock/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Landlock
-  VERSION = "0.5"
+  VERSION = "0.6.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: landlock
 version: !ruby/object:Gem::Version
-  version: '0.5'
+  version: 0.6.0
 platform: ruby
 authors:
 - Sam Saffron
@@ -110,6 +110,7 @@ files:
 - ext/landlock/extconf.rb
 - ext/landlock/landlock.c
 - ext/landlock/landlock_native.h
+- ext/landlock/seccomp_deny_child_processes.h
 - ext/landlock/seccomp_deny_network.h
 - lib/landlock.rb
 - lib/landlock/env.rb