Conversation
Jarkko Sakkinen
jarkko
Edited 29 days ago
For the time being I will disable io_uring in Landstrip, as I'm not yet sure if/how io_uring_setup() ought to be managed securely with seccomp for behalf of the agent.
Workaround will be that I synthesize appropriate errnos so that any sane software knows how to fall back to other ways of doing file I/O.
I have some actual fix ideas in my mind but what I don't see yet is what is the "full closure" of this topic. Will be revisited in future.
What a relieft that I caught such a big fish myself and can do a precautious fix.
I'll release 1.0 once I believe that there's nothing I can do except being the SRE for other peoples lemmings. Up until that it will be minor and patch versions (i.e. 0.y.z's), and Landstrip is labeled as insecure :-)
Workaround will be that I synthesize appropriate errnos so that any sane software knows how to fall back to other ways of doing file I/O.
I have some actual fix ideas in my mind but what I don't see yet is what is the "full closure" of this topic. Will be revisited in future.
What a relieft that I caught such a big fish myself and can do a precautious fix.
I'll release 1.0 once I believe that there's nothing I can do except being the SRE for other peoples lemmings. Up until that it will be minor and patch versions (i.e. 0.y.z's), and Landstrip is labeled as insecure :-)
1
0
0
Mickaël Salaün
l0kod@mastodon.social@jarkko yep, io_uring doesn't align with the seccomp model, and it's a common trap for sandboxers. Landlock handles that natively, but I guess you were bitten by the Landstrip's deny-listing access control emulation? You might be interested by https://github.com/landlock-lsm/linux/issues/28 (I'll suggest an alternative design soon)
1
0
1