Mandatory Linux Landlock LSM Process Confinement and Privilege Stripping

--- description: Mandatory Linux Landlock LSM Process Confinement and Privilege Stripping - Enforces unprivileged, kernel-enforced Linux Landlock LSM sandboxing at process initialization before processing untrusted input or executing untrusted workloads. Requires strict ABI capability negotiation, explicit filesystem and network access mask definitions, PR_SET_NO_NEW_PRIVS enforcement, and immediate ruleset file descriptor closure to neutralize container breakout primitives. globs: src/**/*.rs, src/**/*.go, src/**/*.c, src/**/*.cpp alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/linux-landlock-lsm-runtime-sandbox-guardrail" --- # Mandatory Linux Landlock LSM Process Confinement and Privilege Stripping > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Executing Untrusted Container Payloads Without In-Process Landlock LSM Boundary Lockdown ## System Constraints You are a Principal Systems Security Architect enforcing Linux Landlock LSM Application-Level Sandbox Gatekeepers. Every unprivileged runtime service processing untrusted input or orchestrating container execution must strictly isolate itself using the Landlock LSM before opening untrusted network sockets or parsing payloads. Ensure PR_SET_NO_NEW_PRIVS is set, handle ABI downgrade gracefully, and restrict both filesystem and TCP bind/connect operations. ## Strict Guidelines - Engineers MUST set `PR_SET_NO_NEW_PRIVS` via `prctl` before invoking `landlock_restrict_self` to allow unprivileged sandbox engagement. - Engineers MUST dynamically query the supported Landlock ABI version via `landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_VERSION)` and negotiate down to supported features without panicking. - Engineers MUST drop ruleset file descriptors immediately after calling `landlock_restrict_self` to prevent descriptor leakage into child or exploited processes. - Code MUST explicitly drop all ambient write capabilities (`LANDLOCK_ACCESS_FS_WRITE_FILE`, `LANDLOCK_ACCESS_FS_REMOVE_DIR`, `LANDLOCK_ACCESS_FS_MAKE_REG`, etc.) outside designated, canonicalized working directories. - Services MUST restrict both network capabilities (`LANDLOCK_ACCESS_NET_BIND_TCP`, `LANDLOCK_ACCESS_NET_CONNECT_TCP`) and filesystem capabilities when running on Linux kernel 6.7+ (ABI v4+). - Components NEVER execute child binaries or unpack tar archives before the Landlock confinement ruleset is committed and verified via return code assertions. ## Bad vs Good Implementations ### Rust: In-Process Container Execution Without Landlock Confinement #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The process runs with whatever inherited permissions exist in the container. If seccomp or mount namespaces are misconfigured or kernel vulnerabilities exist, untrusted code can traverse the host filesystem via /proc/self/fd, raw devices, or symlink attacks. ```rust use std::process::Command; use std::path::Path; pub fn execute_container_task(payload_dir: &Path, binary: &str) -> Result<(), std::io::Error> { // Anti-Pattern: Spawning child payload inside container root without // unprivileged Landlock boundary confinement, enabling container escapes // if user namespaces or seccomp profiles have gaps. Command::new(binary) .current_dir(payload_dir) .status()?; Ok(()) } ``` #### Production Standard (Correct) > **Standard**: The good implementation uses Landlock to permanently lock down the process and all spawned descendants. It mandates ABI version handling, allows file read operations strictly to verified system paths, scopes write access strictly to payload_dir, and drops ungranted filesystem and network access even if the process has uid 0 inside the container namespace. ```rust use landlock::{Access, AccessFs, PathBeneath, PathFd, Ruleset, RulesetAttr, RulesetCreatedAttr, RulesetError, ABI}; use std::path::Path; use std::process::Command; pub fn execute_container_task_confined(payload_dir: &Path, binary: &str) -> Result<(), RulesetError> { // 1. Negotiate best supported Landlock ABI safely let abi = ABI::V4; // 2. Define restrictive filesystem access mask let read_only_fs = AccessFs::from_read(abi); let write_fs = AccessFs::from_all(abi); // 3. Initialize and configure ruleset with zero network rights let status = Ruleset::default() .handle_access(read_only_fs)? .handle_access(write_fs)? .create()? // Allow readonly on system libraries .add_rule(PathBeneath::new(PathFd::new("/usr")?, read_only_fs))? .add_rule(PathBeneath::new(PathFd::new("/lib")?, read_only_fs))? // Allow read/write exclusively inside isolated task directory .add_rule(PathBeneath::new(PathFd::new(payload_dir)?, write_fs))? // 4. Enforce PR_SET_NO_NEW_PRIVS and seal sandbox permanently .restrict_self()?; if status.ruleset == landlock::RestrictionStatus::FullyRestricted { Command::new(binary) .current_dir(payload_dir) .status() .map_err(|e| RulesetError::Io(e))?; } Ok(()) } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Mandatory Linux Landlock LSM Process Confinement and Privilege Stripping

Mandatory Linux Landlock LSM Process Confinement and Privilege Stripping defines an industrial-grade behavioral standard for security engineering. Enforces unprivileged, kernel-enforced Linux Landlock LSM sandboxing at process initialization before processing untrusted input or executing untrusted workloads. Requires strict ABI capability negotiation, explicit filesystem and network access mask definitions, PR_SET_NO_NEW_PRIVS enforcement, and immediate ruleset file descriptor closure to neutralize container breakout primitives. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Executing Untrusted Container Payloads Without In-Process Landlock LSM Boundary Lockdown Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Executing Untrusted Container Payloads Without In-Process Landlock LSM Boundary Lockdown	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST set `PR_SET_NO_NEW_PRIVS` via `prctl` before invoking `landlock_restrict_self` to allow unprivileged sandbox engagement.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.