sandlock_core/sys/
structs.rs

1// Kernel struct definitions matching ABI exactly for x86_64
2
3// ============================================================
4// Landlock structs
5// ============================================================
6
7/// Ruleset attributes for landlock_create_ruleset (24 bytes)
8#[repr(C)]
9pub struct LandlockRulesetAttr {
10    pub handled_access_fs: u64,
11    pub handled_access_net: u64,
12    pub scoped: u64,
13}
14
15/// Path beneath attribute for landlock_add_rule (12 bytes, packed)
16#[repr(C, packed)]
17pub struct LandlockPathBeneathAttr {
18    pub allowed_access: u64,
19    pub parent_fd: i32,
20}
21
22/// Network port attribute for landlock_add_rule (16 bytes)
23#[repr(C)]
24pub struct LandlockNetPortAttr {
25    pub allowed_access: u64,
26    pub port: u64,
27}
28
29// ============================================================
30// Seccomp structs
31// ============================================================
32
33/// Seccomp BPF data passed to filters (64 bytes)
34#[derive(Clone, Copy)]
35#[repr(C)]
36pub struct SeccompData {
37    pub nr: i32,
38    pub arch: u32,
39    pub instruction_pointer: u64,
40    pub args: [u64; 6],
41}
42
43/// Seccomp user notification (80 bytes)
44#[derive(Clone, Copy)]
45#[repr(C)]
46pub struct SeccompNotif {
47    pub id: u64,
48    pub pid: u32,
49    pub flags: u32,
50    pub data: SeccompData,
51}
52
53/// Seccomp user notification response (24 bytes)
54#[repr(C)]
55pub struct SeccompNotifResp {
56    pub id: u64,
57    pub val: i64,
58    pub error: i32,
59    pub flags: u32,
60}
61
62/// Seccomp add file descriptor (24 bytes)
63#[repr(C)]
64pub struct SeccompNotifAddfd {
65    pub id: u64,
66    pub flags: u32,
67    pub srcfd: u32,
68    pub newfd: u32,
69    pub newfd_flags: u32,
70}
71
72/// BPF filter instruction
73#[derive(Clone, Copy)]
74#[repr(C)]
75pub struct SockFilter {
76    pub code: u16,
77    pub jt: u8,
78    pub jf: u8,
79    pub k: u32,
80}
81
82/// BPF filter program
83#[repr(C)]
84pub struct SockFprog {
85    pub len: u16,
86    pub filter: *const SockFilter,
87}
88
89// SAFETY: SockFprog is only used in single-threaded syscall context
90unsafe impl Send for SockFprog {}
91unsafe impl Sync for SockFprog {}
92
93// ============================================================
94// Landlock syscall numbers
95// ============================================================
96
97pub const SYS_LANDLOCK_CREATE_RULESET: i64 = 444;
98pub const SYS_LANDLOCK_ADD_RULE: i64 = 445;
99pub const SYS_LANDLOCK_RESTRICT_SELF: i64 = 446;
100pub const LANDLOCK_CREATE_RULESET_VERSION: u32 = 1;
101
102// ============================================================
103// Landlock FS access flags (bits 0-15)
104// ============================================================
105
106pub const LANDLOCK_ACCESS_FS_EXECUTE: u64 = 1 << 0;
107pub const LANDLOCK_ACCESS_FS_WRITE_FILE: u64 = 1 << 1;
108pub const LANDLOCK_ACCESS_FS_READ_FILE: u64 = 1 << 2;
109pub const LANDLOCK_ACCESS_FS_READ_DIR: u64 = 1 << 3;
110pub const LANDLOCK_ACCESS_FS_REMOVE_DIR: u64 = 1 << 4;
111pub const LANDLOCK_ACCESS_FS_REMOVE_FILE: u64 = 1 << 5;
112pub const LANDLOCK_ACCESS_FS_MAKE_CHAR: u64 = 1 << 6;
113pub const LANDLOCK_ACCESS_FS_MAKE_DIR: u64 = 1 << 7;
114pub const LANDLOCK_ACCESS_FS_MAKE_REG: u64 = 1 << 8;
115pub const LANDLOCK_ACCESS_FS_MAKE_SOCK: u64 = 1 << 9;
116pub const LANDLOCK_ACCESS_FS_MAKE_FIFO: u64 = 1 << 10;
117pub const LANDLOCK_ACCESS_FS_MAKE_BLOCK: u64 = 1 << 11;
118pub const LANDLOCK_ACCESS_FS_MAKE_SYM: u64 = 1 << 12;
119pub const LANDLOCK_ACCESS_FS_REFER: u64 = 1 << 13;
120pub const LANDLOCK_ACCESS_FS_TRUNCATE: u64 = 1 << 14;
121pub const LANDLOCK_ACCESS_FS_IOCTL_DEV: u64 = 1 << 15;
122
123// ============================================================
124// Landlock net access flags
125// ============================================================
126
127pub const LANDLOCK_ACCESS_NET_BIND_TCP: u64 = 1 << 0;
128pub const LANDLOCK_ACCESS_NET_CONNECT_TCP: u64 = 1 << 1;
129
130// ============================================================
131// Landlock rule types
132// ============================================================
133
134pub const LANDLOCK_RULE_PATH_BENEATH: u32 = 1;
135pub const LANDLOCK_RULE_NET_PORT: u32 = 2;
136
137// ============================================================
138// Landlock scope flags
139// ============================================================
140
141pub const LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET: u64 = 1 << 0;
142pub const LANDLOCK_SCOPE_SIGNAL: u64 = 1 << 1;
143
144// ============================================================
145// Seccomp constants
146// ============================================================
147
148pub const SECCOMP_SET_MODE_FILTER: u32 = 1;
149pub const SECCOMP_FILTER_FLAG_NEW_LISTENER: u64 = 1 << 3;
150pub const SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV: u64 = 1 << 5;
151pub const SECCOMP_RET_ALLOW: u32 = 0x7FFF_0000;
152pub const SECCOMP_RET_USER_NOTIF: u32 = 0x7FC0_0000;
153pub const SECCOMP_RET_ERRNO: u32 = 0x0005_0000;
154pub const SECCOMP_RET_KILL_PROCESS: u32 = 0x8000_0000;
155pub const SECCOMP_USER_NOTIF_FLAG_CONTINUE: u32 = 1;
156pub const SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP: u32 = 1;
157/// Atomically install the fd and respond to the syscall (Linux 5.14+).
158pub const SECCOMP_ADDFD_FLAG_SEND: u32 = 1 << 1;
159
160// ============================================================
161// Seccomp ioctl commands
162// ============================================================
163
164pub const SECCOMP_IOCTL_NOTIF_RECV: u64 = 0xc050_2100;
165pub const SECCOMP_IOCTL_NOTIF_SEND: u64 = 0xc018_2101;
166pub const SECCOMP_IOCTL_NOTIF_ID_VALID: u64 = 0x4008_2102;
167pub const SECCOMP_IOCTL_NOTIF_ADDFD: u64 = 0xc018_2103;
168pub const SECCOMP_IOCTL_NOTIF_SET_FLAGS: u64 = 0x4008_2104;
169
170// ============================================================
171// BPF opcodes
172// ============================================================
173
174pub const BPF_LD: u16 = 0x00;
175pub const BPF_W: u16 = 0x00;
176pub const BPF_ABS: u16 = 0x20;
177pub const BPF_JMP: u16 = 0x05;
178pub const BPF_JEQ: u16 = 0x10;
179pub const BPF_JSET: u16 = 0x40;
180pub const BPF_K: u16 = 0x00;
181pub const BPF_RET: u16 = 0x06;
182pub const BPF_ALU: u16 = 0x04;
183pub const BPF_AND: u16 = 0x50;
184
185// ============================================================
186// seccomp_data field offsets
187// ============================================================
188
189pub const OFFSET_NR: u32 = 0;
190pub const OFFSET_ARCH: u32 = 4;
191pub const OFFSET_ARGS0_LO: u32 = 16;
192pub const OFFSET_ARGS1_LO: u32 = 24;
193pub const OFFSET_ARGS2_LO: u32 = 32;
194pub const OFFSET_ARGS3_LO: u32 = 40;
195
196// ============================================================
197// Clone namespace flags
198// ============================================================
199
200pub const CLONE_NEWNS: u64 = 0x0002_0000;
201pub const CLONE_NEWCGROUP: u64 = 0x0200_0000;
202pub const CLONE_NEWUTS: u64 = 0x0400_0000;
203pub const CLONE_NEWIPC: u64 = 0x0800_0000;
204pub const CLONE_NEWUSER: u64 = 0x1000_0000;
205pub const CLONE_NEWPID: u64 = 0x2000_0000;
206pub const CLONE_NEWNET: u64 = 0x4000_0000;
207
208pub const CLONE_NS_FLAGS: u64 = CLONE_NEWNS
209    | CLONE_NEWCGROUP
210    | CLONE_NEWUTS
211    | CLONE_NEWIPC
212    | CLONE_NEWUSER
213    | CLONE_NEWPID
214    | CLONE_NEWNET;
215
216// ============================================================
217// Dangerous ioctls
218// ============================================================
219
220pub const TIOCSTI: u64 = 0x5412;
221pub const TIOCLINUX: u64 = 0x541C;
222
223// Network interface ioctls (linux/sockios.h)
224pub const SIOCGIFNAME: u64 = 0x8910;
225pub const SIOCGIFCONF: u64 = 0x8912;
226pub const SIOCGIFFLAGS: u64 = 0x8913;
227pub const SIOCGIFADDR: u64 = 0x8915;
228pub const SIOCGIFDSTADDR: u64 = 0x8917;
229pub const SIOCGIFBRDADDR: u64 = 0x8919;
230pub const SIOCGIFNETMASK: u64 = 0x891B;
231pub const SIOCGIFHWADDR: u64 = 0x8927;
232pub const SIOCGIFINDEX: u64 = 0x8933;
233pub const SIOCETHTOOL: u64 = 0x8946;
234
235// ============================================================
236// Dangerous prctl options
237// ============================================================
238
239pub const PR_SET_DUMPABLE: u32 = 4;
240pub const PR_SET_SECUREBITS: u32 = 28;
241pub const PR_SET_PTRACER: u32 = 0x5961_6d61;
242
243// ============================================================
244// Socket constants
245// ============================================================
246
247pub const AF_INET: u32 = 2;
248pub const AF_INET6: u32 = 10;
249pub const SOCK_RAW: u32 = 3;
250pub const SOCK_DGRAM: u32 = 2;
251pub const SOCK_TYPE_MASK: u32 = 0xFF;
252
253// ============================================================
254// Errno values
255// ============================================================
256
257pub const EPERM: i32 = 1;
258pub const EACCES: i32 = 13;
259pub const ENOMEM: i32 = 12;
260pub const EAGAIN: i32 = 11;
261pub const ECONNREFUSED: i32 = 111;
262
263// ============================================================
264// Default blocklisted syscall list
265// ============================================================
266
267/// SysV IPC syscalls. Appended to the kernel-level blocklist when
268/// `policy.allows_sysv_ipc()` is false. Sandlock does not use an IPC
269/// namespace, so without these denials two sandboxes on the same host
270/// share a SysV keyspace and can rendezvous via a well-known key.
271///
272/// POSIX shared memory (`shm_open`) is intentionally not here — it is
273/// just `open("/dev/shm/<name>")`, gated by Landlock filesystem rules.
274/// POSIX message queues (`mq_open` and friends) are also out of scope
275/// for this flag.
276pub const SYSV_IPC_BLOCKLIST_SYSCALLS: &[&str] = &[
277    "shmget",
278    "shmat",
279    "shmdt",
280    "shmctl",
281    "msgget",
282    "msgsnd",
283    "msgrcv",
284    "msgctl",
285    "semget",
286    "semop",
287    "semctl",
288    "semtimedop",
289];
290
291pub const DEFAULT_BLOCKLIST_SYSCALLS: &[&str] = &[
292    "mount",
293    "umount2",
294    "pivot_root",
295    "swapon",
296    "swapoff",
297    "reboot",
298    "sethostname",
299    "setdomainname",
300    "kexec_load",
301    "init_module",
302    "finit_module",
303    "delete_module",
304    "unshare",
305    "setns",
306    "perf_event_open",
307    "bpf",
308    "userfaultfd",
309    "keyctl",
310    "add_key",
311    "request_key",
312    "ptrace",
313    "process_vm_readv",
314    "process_vm_writev",
315    "open_by_handle_at",
316    "name_to_handle_at",
317    "ioperm",
318    "iopl",
319    "quotactl",
320    "acct",
321    "lookup_dcookie",
322    "nfsservctl",
323    "io_uring_setup",
324    "io_uring_enter",
325    "io_uring_register",
326    "personality",
327];
328
329/// Deny list for --no-supervisor mode.
330///
331/// More relaxed than DEFAULT_BLOCKLIST_SYSCALLS because a full sandbox supervisor
332/// may run inside the outer no-supervisor sandbox and needs syscalls like
333/// ptrace, process_vm_readv/writev, unshare, mount, and setns.
334///
335/// Only blocks syscalls that could damage the host or escape all containment.
336pub const NO_SUPERVISOR_BLOCKLIST_SYSCALLS: &[&str] = &[
337    // Swap / reboot / shutdown — host-wide damage
338    "swapon",
339    "swapoff",
340    "reboot",
341    "kexec_load",
342    // Kernel modules — arbitrary kernel code execution
343    "init_module",
344    "finit_module",
345    "delete_module",
346    // Kernel introspection / attack surface
347    "perf_event_open",
348    "bpf",
349    // Direct hardware access
350    "ioperm",
351    "iopl",
352    // io_uring bypasses seccomp for I/O operations
353    "io_uring_setup",
354    "io_uring_enter",
355    "io_uring_register",
356];
sandlock_core/sys/structs.rs

sandlock_core/sys/
structs.rs
