Enforce filesystem policy on guest processes with Landlock

[seanwevans]

Why

#268 stops the guest from making dangerous syscalls, but the sandbox's filesystem policy was still enforced only by the Python open/import guards — which a guest that reaches the real open/openat (native code, or the object-graph escape) bypasses. This PR turns the policy's filesystem allow-list into a real kernel boundary using Landlock. (Builds on #267 and #268, both merged.)

What

New runtime/landlock.py builds and applies a Landlock ruleset to the guest process, wired into confine.apply_confinement():

• ABI-aware. Landlock's access-right set and struct layout depend on the kernel's ABI version. The module queries it (landlock_create_ruleset(NULL, 0, VERSION)) and masks the handled access rights to it — requesting an unsupported right (e.g. TRUNCATE on ABI < 3) makes ruleset creation fail. landlock_supported() is authoritative.
• Keeps the interpreter alive. Landlock is default-deny for every right the ruleset handles, so the guest is granted read+execute on the interpreter's runtime paths (stdlib, shared libs, sys.path) in addition to the policy's paths; otherwise it couldn't import anything.
• Policy translation. Read paths get read; write paths get read+write; everything else the ruleset handles is denied.
• Ordering. no_new_privs first (required by landlock_restrict_self), then rlimits, then Landlock, then seccomp. Landlock is applied only when the policy actually names paths — a default-deny ruleset with no allow-list would just break the interpreter.

ProcessSandbox extracts read-vs-write paths from the policy and passes them in the bootstrap; the confinement report gains landlock / landlock_rules.

A latent bug this fixes

_extract_fs_tcp (from #267) treated getattr(policy, "allow_fs") as a rule collection — but the legacy Policy exposes allow_fs/allow_tcp as methods, so passing a legacy Policy to a process sandbox raised TypeError: 'method' object is not iterable. Extraction now discriminates RuntimePolicy (rule tuples) from Policy (methods + .fs/.tcp attributes) by type. Covered by test_extract_fs_tcp_handles_legacy_policy_methods.

Testing

• New tests/test_landlock.py. Unit tests (always run): ABI access-mask correctness, packed path_beneath struct size, support/ABI consistency, and policy read/write extraction incl. the legacy-Policy regression. Kernel-gated: test_process_sandbox_reports_landlock_applied (needs Landlock) and test_landlock_blocks_disallowed_reads_but_allows_permitted (needs Landlock + PYISOLATE_LIVE_LANDLOCK_TESTS=1) — the enforcement test reads an allowed file via the real open and asserts a read outside the allow-list is denied.
• CI cross-kernel job now runs the process-backend/confinement/Landlock tests, plus the live Landlock test with the env flag set (it runs for real on kernels that support Landlock, e.g. recent Ubuntu images).
• Full suite: 438 passed, 4 environment-gated skips; all pre-commit hooks pass.

Honesty note

Landlock enforcement is unavailable in the dev container this was written in (landlock_create_ruleset → ENOSYS), so the live enforcement path is exercised by CI on capable kernels, not here — same pattern as the repo's existing live BPF test. Everything not requiring the kernel is unit-tested directly.

Next

B-4 wires the eBPF policy maps end-to-end (fixing the map-name/schema disconnect), then B-5 reconciles the threat model now that the boundary is real.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DDSofWX5HwawsrwbN2nSXR

---

Generated by Claude Code