Linux Landlock LSM Container Runtime Confinement Standard

--- description: Linux Landlock LSM Container Runtime Confinement Standard - Enforces unprivileged, kernel-level filesystem and network sandboxing for microservices and ephemeral workloads using the Linux Landlock LSM. Mandates setting PR_SET_NO_NEW_PRIVS and applying Landlock access rights before dispatching untrusted or user-supplied execution logic. Guarantees isolation without requiring root permissions or CAP_SYS_ADMIN capabilities. globs: **/*.go, **/*.rs, **/*.c, pkg/**/*.go, cmd/**/*.go alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/linux-landlock-lsm-runtime-confinement" --- # Linux Landlock LSM Container Runtime Confinement Standard > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Relying on Userspace Path Sanitization or Incomplete DAC Without Kernel-Enforced Landlock Jailing ## System Constraints You are a Principal Security Architect enforcing the Linux Landlock LSM Container Runtime Confinement Standard. You must mandate unprivileged, in-process kernel sandboxing via Landlock LSM for any microservice handling ephemeral workloads or untrusted inputs. Forbid reliance on userspace path checks, DAC permissions alone, or requiring elevated capabilities like CAP_SYS_ADMIN for isolation. ## Strict Guidelines - Engineers MUST ALWAYS set PR_SET_NO_NEW_PRIVS via prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) prior to ruleset enforcement to prevent privilege escalation via setuid/setgid execution. - Engineers MUST ALWAYS determine and handle the running kernel's Landlock ABI version gracefully, failing closed if mandatory isolation rules cannot be enforced. - Services MUST restrict filesystem operations by defining strict LANDLOCK_ACCESS_FS_* rulesets, granting read-only access to runtime dependencies and read-write access strictly to sandboxed workspace directories. - Services running on Landlock ABI v4+ MUST restrict network access via LANDLOCK_ACCESS_NET_BIND_TCP and LANDLOCK_ACCESS_NET_CONNECT_TCP to explicitly whitelisted ports. - Components NEVER execute untrusted worker payloads, user code, or third-party parsers prior to calling landlock_restrict_self. ## Bad vs Good Implementations ### Landlock Sandboxing in Go Runtime Entrypoint #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The bad example relies solely on userspace path checks without kernel-level confinement. A malicious payload can exploit symlinks, path traversals via open file descriptors, or setuid binaries to break out of the intended boundary. ```go package sandbox import ( "fmt" "os" "os/exec" "path/filepath" ) func RunUntrustedTask(workspaceDir string, scriptPath string) error { // VULNERABLE: Application-level check only; easily bypassed via symlinks, // /proc/self/fd, or race conditions (TOCTOU). Runs with ambient process rights. cleanTarget := filepath.Clean(scriptPath) if !filepath.HasPrefix(cleanTarget, workspaceDir) { return fmt.Errorf("access denied: %s outside workspace", scriptPath) } cmd := exec.Command("sh", cleanTarget) cmd.Stdout = os.Stdout cmd.Stderr = os.Stderr return cmd.Run() } ``` #### Production Standard (Correct) > **Standard**: The good example leverages the Landlock LSM via go-landlock, creating an immutable kernel-enforced sandbox that restricts filesystem access to read-only paths and workspace read-write directories. The sandbox persists across sub-processes and requires zero root capabilities. ```go package sandbox import ( "fmt" "os" "os/exec" "github.com/landlock-lsm/go-landlock/landlock" ) func RunUntrustedTask(workspaceDir string, scriptPath string) error { // Apply unprivileged kernel-level confinement using Landlock LSM err := landlock.V4.RestrictPaths( // Read-only access to system binaries, libraries, and runtime configs landlock.RODirs("/bin", "/usr", "/lib", "/lib64"), // Scoped read-write access strictly to the dedicated workspace landlock.RWDirs(workspaceDir), ) if err != nil { return fmt.Errorf("failed to apply Landlock confinement: %w", err) } // The kernel now enforces FS isolation for this process and all future children cmd := exec.Command("sh", scriptPath) cmd.Stdout = os.Stdout cmd.Stderr = os.Stderr return cmd.Run() } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Linux Landlock LSM Container Runtime Confinement Standard

Linux Landlock LSM Container Runtime Confinement Standard defines an industrial-grade behavioral standard for security engineering. Enforces unprivileged, kernel-level filesystem and network sandboxing for microservices and ephemeral workloads using the Linux Landlock LSM. Mandates setting PR_SET_NO_NEW_PRIVS and applying Landlock access rights before dispatching untrusted or user-supplied execution logic. Guarantees isolation without requiring root permissions or CAP_SYS_ADMIN capabilities. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Relying on Userspace Path Sanitization or Incomplete DAC Without Kernel-Enforced Landlock Jailing Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Relying on Userspace Path Sanitization or Incomplete DAC Without Kernel-Enforced Landlock Jailing	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS set PR_SET_NO_NEW_PRIVS via prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) prior to ruleset enforcement to prevent privilege escalation via setuid/setgid execution.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.