Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

landlock: "Invalid argument" error when creating the ruleset #6195

Closed
curiosityseeker opened this issue Feb 5, 2024 · 10 comments · Fixed by #6200
Closed

landlock: "Invalid argument" error when creating the ruleset #6195

curiosityseeker opened this issue Feb 5, 2024 · 10 comments · Fixed by #6200
Labels
bug Something isn't working

Comments

@curiosityseeker
Copy link
Collaborator

Description

After adding several Landlock rules I'm seeing errors after today's update of firejail-git

Steps to Reproduce

Steps to reproduce the behavior

Add the following rules to ~/.config/firejail/firefox:

landlock.enforce

landlock.write ${HOME}/.cache/mozilla/firefox
landlock.write ${HOME}/.mozilla
landlock.write ${HOME}/.local/share/pki
landlock.write ${HOME}/.pki
landlock.write ${DOWNLOADS}
landlock.write /media/Multimedia/Downloads
landlock.write ${RUNUSER}/*firefox*
landlock.write ${RUNUSER}/psd/*firefox*
ignore landlock.write ${HOME}
ignore landlock.execute /opt
ignore landlock.execute /usr/local/sbin
ignore landlock.execute /usr/local/games
include landlock-common.inc

Expected behavior

Until yesterday I haven't seen Landlock-related errors.

Actual behavior

ll_create_full_ruleset: Error: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_write: failed to add Landlock rule (abi=4 fs=11b2) for /home/seeker/.cache/mozilla/firefox: Bad file descriptor
ll_create_full_ruleset: Error: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_write: failed to add Landlock rule (abi=4 fs=11b2) for /home/seeker/.mozilla: Bad file descriptor
ll_create_full_ruleset: Error: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_write: failed to add Landlock rule (abi=4 fs=11b2) for /home/seeker/.local/share/pki: Bad file descriptor
ll_create_full_ruleset: Error: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_write: failed to add Landlock rule (abi=4 fs=11b2) for /home/V/.pki: Bad file descriptor
ll_create_full_ruleset: Error: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_write: failed to add Landlock rule (abi=4 fs=11b2) for /home/V/Downloads: Bad file descriptor
ll_create_full_ruleset: Error: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_write: failed to add Landlock rule (abi=4 fs=11b2) for /media/Multimedia/Downloads: Bad file descriptor
ll_create_full_ruleset: Error: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
ll_create_full_ruleset: Error: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
ll_create_full_ruleset: Error: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_read: failed to add Landlock rule (abi=4 fs=c) for /: Bad file descriptor
ll_create_full_ruleset: Error: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_read: failed to add Landlock rule (abi=4 fs=c) for /proc: Bad file descriptor
ll_create_full_ruleset: Error: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_makeipc: failed to add Landlock rule (abi=4 fs=600) for /: Bad file descriptor
ll_create_full_ruleset: Error: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_write: failed to add Landlock rule (abi=4 fs=11b2) for /run/user/1000: Bad file descriptor
ll_create_full_ruleset: Error: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_write: failed to add Landlock rule (abi=4 fs=11b2) for /dev: Bad file descriptor
ll_create_full_ruleset: Error: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_write: failed to add Landlock rule (abi=4 fs=11b2) for /proc: Bad file descriptor
ll_create_full_ruleset: Error: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
ll_create_full_ruleset: Error: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_write: failed to add Landlock rule (abi=4 fs=11b2) for /tmp: Bad file descriptor
ll_create_full_ruleset: Error: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_exec: failed to add Landlock rule (abi=4 fs=1) for /run/firejail: Bad file descriptor
ll_create_full_ruleset: Error: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_exec: failed to add Landlock rule (abi=4 fs=1) for /bin: Bad file descriptor
ll_create_full_ruleset: Error: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_exec: failed to add Landlock rule (abi=4 fs=1) for /sbin: Bad file descriptor
ll_create_full_ruleset: Error: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_exec: failed to add Landlock rule (abi=4 fs=1) for /usr/bin: Bad file descriptor
ll_create_full_ruleset: Error: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_exec: failed to add Landlock rule (abi=4 fs=1) for /usr/sbin: Bad file descriptor
ll_create_full_ruleset: Error: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
ll_create_full_ruleset: Error: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_exec: failed to add Landlock rule (abi=4 fs=1) for /usr/local/bin: Bad file descriptor
ll_create_full_ruleset: Error: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_exec: failed to add Landlock rule (abi=4 fs=1) for /lib: Bad file descriptor
ll_create_full_ruleset: Error: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
ll_create_full_ruleset: Error: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
ll_create_full_ruleset: Error: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_exec: failed to add Landlock rule (abi=4 fs=1) for /lib64: Bad file descriptor
ll_create_full_ruleset: Error: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_exec: failed to add Landlock rule (abi=4 fs=1) for /usr/lib: Bad file descriptor
ll_create_full_ruleset: Error: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_exec: failed to add Landlock rule (abi=4 fs=1) for /usr/lib32: Bad file descriptor
ll_create_full_ruleset: Error: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
ll_create_full_ruleset: Error: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_exec: failed to add Landlock rule (abi=4 fs=1) for /usr/lib64: Bad file descriptor
ll_create_full_ruleset: Error: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_exec: failed to add Landlock rule (abi=4 fs=1) for /usr/local/lib: Bad file descriptor

Environment
@kmk3
Copy link
Collaborator

kmk3 commented Feb 6, 2024

Add the following rules to ~/.config/firejail/firefox:

ll_create_full_ruleset: Error: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument

Cannot reproduce it on Artix with:

firejail --profile=firefox true

What is the command-line used?

What is the kernel version?

PR #6187 has Landlock-related changes but it did not change the full ruleset.

Can you try to bisect?

@kmk3 kmk3 added the needinfo More information is needed from the issue author label Feb 6, 2024
kmk3 added a commit that referenced this issue Feb 6, 2024
@kmk3
landlock: fix inconsistent error msg format in create
2281082 
Make the error message format in `ll_create_full_ruleset` match the
other ones in landlock.c.

This amends commit 01a9ddb ("landlock: improve logs for debugging",
2023-11-08).

Misc: This was noticed on #6195.

Relates to #6078.
@glitsj16
Copy link
Collaborator

glitsj16 commented Feb 6, 2024

I can (fully) reproduce on my Arch Linux. Will try to find some time to bisect.

@curiosityseeker
Copy link
Collaborator Author

What is the command-line used?

Nothing special. Just firefox with the default profile and the additions to the local profile as mentioned above.

What is the kernel version?

6.7.3-arch1-2

The latest 2 commits didn't change anything:

Error: ll_create_full_ruleset: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_write: failed to add Landlock rule (abi=4 fs=11b2) for /home/seeker/.cache/mozilla/firefox: Bad file descriptor
Error: ll_create_full_ruleset: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_write: failed to add Landlock rule (abi=4 fs=11b2) for /home/seeker/.mozilla: Bad file descriptor
Error: ll_create_full_ruleset: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_write: failed to add Landlock rule (abi=4 fs=11b2) for /home/seeker/.local/share/pki: Bad file descriptor
Error: ll_create_full_ruleset: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_write: failed to add Landlock rule (abi=4 fs=11b2) for /home/seeker/.pki: Bad file descriptor
Error: ll_create_full_ruleset: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_create_full_ruleset: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_create_full_ruleset: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_create_full_ruleset: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_create_full_ruleset: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_read: failed to add Landlock rule (abi=4 fs=c) for /: Bad file descriptor
Error: ll_create_full_ruleset: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_read: failed to add Landlock rule (abi=4 fs=c) for /proc: Bad file descriptor
Error: ll_create_full_ruleset: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_makeipc: failed to add Landlock rule (abi=4 fs=600) for /: Bad file descriptor
Error: ll_create_full_ruleset: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_write: failed to add Landlock rule (abi=4 fs=11b2) for /run/user/1000: Bad file descriptor
Error: ll_create_full_ruleset: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_write: failed to add Landlock rule (abi=4 fs=11b2) for /dev: Bad file descriptor
Error: ll_create_full_ruleset: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_write: failed to add Landlock rule (abi=4 fs=11b2) for /proc: Bad file descriptor
Error: ll_create_full_ruleset: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_create_full_ruleset: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_write: failed to add Landlock rule (abi=4 fs=11b2) for /tmp: Bad file descriptor
Error: ll_create_full_ruleset: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_exec: failed to add Landlock rule (abi=4 fs=1) for /run/firejail: Bad file descriptor
Error: ll_create_full_ruleset: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_exec: failed to add Landlock rule (abi=4 fs=1) for /bin: Bad file descriptor
Error: ll_create_full_ruleset: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_exec: failed to add Landlock rule (abi=4 fs=1) for /sbin: Bad file descriptor
Error: ll_create_full_ruleset: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_exec: failed to add Landlock rule (abi=4 fs=1) for /usr/bin: Bad file descriptor
Error: ll_create_full_ruleset: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_exec: failed to add Landlock rule (abi=4 fs=1) for /usr/sbin: Bad file descriptor
Error: ll_create_full_ruleset: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_create_full_ruleset: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_exec: failed to add Landlock rule (abi=4 fs=1) for /usr/local/bin: Bad file descriptor
Error: ll_create_full_ruleset: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_exec: failed to add Landlock rule (abi=4 fs=1) for /lib: Bad file descriptor
Error: ll_create_full_ruleset: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_create_full_ruleset: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_create_full_ruleset: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_exec: failed to add Landlock rule (abi=4 fs=1) for /lib64: Bad file descriptor
Error: ll_create_full_ruleset: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_exec: failed to add Landlock rule (abi=4 fs=1) for /usr/lib: Bad file descriptor
Error: ll_create_full_ruleset: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_exec: failed to add Landlock rule (abi=4 fs=1) for /usr/lib32: Bad file descriptor
Error: ll_create_full_ruleset: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_create_full_ruleset: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_exec: failed to add Landlock rule (abi=4 fs=1) for /usr/lib64: Bad file descriptor
Error: ll_create_full_ruleset: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
Error: ll_exec: failed to add Landlock rule (abi=4 fs=1) for /usr/local/lib: Bad file descriptor

@glitsj16
Copy link
Collaborator

glitsj16 commented Feb 6, 2024

Bisecting shows 760f50f as the first commit where this starts to show. As it happens that is the commit that introduced landlock.enforce. Anything after that doesn't affect this (up and including latest git build).

@kmk3
Copy link
Collaborator

kmk3 commented Feb 6, 2024 •
edited
Loading

@glitsj16 on Feb 6:

Bisecting shows
760f50f
as the first commit where this starts to show. As it happens that is the
commit that introduced landlock.enforce. Anything after that doesn't affect
this (up and including latest git build).

Are the firefox profile changes needed to reproduce the errors (other than
landlock.enforce / landlock)? If so, which line(s) seem to cause them?

Could you run the following in 760f50f and post the output?

firejail --debug --profile=firefox --landlock true

@kmk3
Copy link
Collaborator

kmk3 commented Feb 6, 2024 •
edited
Loading

@curiosityseeker on Feb 6:

What is the command-line used?

Nothing special. Just firefox with the default profile and the additions to
the local profile as mentioned above.

Does it work without the profile changes (but with landlock.enforce)?

Could you run the following and post the output in a gist?

firejail --debug --profile=firefox --landlock.enforce true

At least from the Active seccomp files: line until the end.

@glitsj16
Copy link
Collaborator

glitsj16 commented Feb 6, 2024

@kmk3

Are the firefox profile changes needed to reproduce the errors (other than
landlock.enforce / landlock)? If so, which line(s) seem to cause them?

Negative. The errors show, even when there's only one line in the firefox.local: include landlock-common.inc.

Could you run the following in 760f50f and post the output?

Here are the logs.

kmk3 added a commit to kmk3/firejail that referenced this issue Feb 7, 2024
@kmk3
landlock: fix struct initialization
7a13d84 
Recently (as of Landlock ABI 4), the `handled_access_net` field was
added to the `landlock_ruleset_attr` struct in the Linux kernel (in
linux/landlock.h).  In src/firejail/landlock.c, that field is not being
set in the struct (as we currently do not use it) before passing it to
the `landlock_create_full_ruleset` syscall, so it may contain random
garbage when used, resulting in the syscall sometimes returning EINVAL
(depending on whether the garbage is valid)[1]:

    ll_is_supported: Detected Landlock ABI version 4
    ll_restrict: Starting Landlock restrict
    ll_create_full_ruleset: Creating Landlock ruleset (abi=4 fs=1fff)
    ll_create_full_ruleset: Error: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
    ll_read: Adding Landlock rule (abi=4 fs=c) for /
    Error: ll_read: failed to add Landlock rule (abi=4 fs=c) for /: Bad file descriptor
    ll_create_full_ruleset: Creating Landlock ruleset (abi=4 fs=1fff)
    ll_create_full_ruleset: Error: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
    ll_read: Adding Landlock rule (abi=4 fs=c) for /proc
    Error: ll_read: failed to add Landlock rule (abi=4 fs=c) for /proc: Bad file descriptor
    [...]

So ensure that all structs in landlock.c are initialized to 0 before
using them.

Note: This currently affects Arch but not Artix, as the former packages
a more recent version of the Linux headers (linux-api-headers 6.7-1 vs
6.4-1).

Fixes netblue30#6195.

Relates to netblue30#6078.

[1] netblue30#6195 (comment)
kmk3 added a commit to kmk3/firejail that referenced this issue Feb 7, 2024
@kmk3
landlock: fix struct initialization
d664abf 
Recently (as of Landlock ABI 4), the `handled_access_net` field was
added to the `landlock_ruleset_attr` struct in the Linux kernel (in
linux/landlock.h).  In src/firejail/landlock.c, that field is not being
set in the struct (as we currently do not use it) before passing it to
the `landlock_create_full_ruleset` syscall, so it may contain random
garbage when used, resulting in the syscall sometimes returning EINVAL
(depending on whether the garbage is valid)[1]:

    ll_is_supported: Detected Landlock ABI version 4
    ll_restrict: Starting Landlock restrict
    ll_create_full_ruleset: Creating Landlock ruleset (abi=4 fs=1fff)
    ll_create_full_ruleset: Error: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
    ll_read: Adding Landlock rule (abi=4 fs=c) for /
    Error: ll_read: failed to add Landlock rule (abi=4 fs=c) for /: Bad file descriptor
    ll_create_full_ruleset: Creating Landlock ruleset (abi=4 fs=1fff)
    ll_create_full_ruleset: Error: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
    ll_read: Adding Landlock rule (abi=4 fs=c) for /proc
    Error: ll_read: failed to add Landlock rule (abi=4 fs=c) for /proc: Bad file descriptor
    [...]

So ensure that all structs in landlock.c are initialized to 0 before
using them.

Note: Arch has recently (2024-01-31) updated the linux-api-headers
package from version 6.4-1 to 6.7-1[2].  The former version is not affected
(as it does not contain the extra struct field in linux/landlock.h),
while the latter is.

Fixes netblue30#6195.

Relates to netblue30#6078.

[1] netblue30#6195 (comment)
[2] https://gitlab.archlinux.org/archlinux/packaging/packages/linux-api-headers/-/commit/b4223b0c2bfba54c26acc4dc289415b81b15989f
@kmk3 kmk3 added bug Something isn't working and removed needinfo More information is needed from the issue author labels Feb 7, 2024
kmk3 added a commit to kmk3/firejail that referenced this issue Feb 7, 2024
@kmk3
landlock: fix struct initialization
07163dd 
Recently (as of Landlock ABI 4), the `handled_access_net` field was
added to the `landlock_ruleset_attr` struct in the Linux kernel (in
linux/landlock.h).  In src/firejail/landlock.c, that field is not being
set in the struct (as we currently do not use it) before passing it to
the `landlock_create_full_ruleset` syscall, so it is likely to contain
random garbage when used, resulting in the syscall returning EINVAL:

    $ firejail --debug --profile=/etc/firejail/landlock-common.inc \
      --landlock.enforce true
    [...]
    ll_is_supported: Detected Landlock ABI version 4
    ll_restrict: Starting Landlock restrict
    ll_create_full_ruleset: Creating Landlock ruleset (abi=4 fs=1fff)
    Error: ll_create_full_ruleset: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
    ll_read: Adding Landlock rule (abi=4 fs=c) for /
    Error: ll_read: failed to add Landlock rule (abi=4 fs=c) for /: Bad file descriptor
    [...]
    Not enforcing Landlock

So ensure that all structs in src/firejail/landlock.c are initialized to
0 before using them.

Note: Arch has recently (2024-01-31) updated the linux-api-headers
package from version 6.4-1 to 6.7-1[1].  The former version is not affected
(as it does not contain the extra struct field in linux/landlock.h),
while the latter is.

Fixes netblue30#6195.

Relates to netblue30#6078.

[1] https://gitlab.archlinux.org/archlinux/packaging/packages/linux-api-headers/-/commit/b4223b0c2bfba54c26acc4dc289415b81b15989f

Reported-by: @curiosityseeker
@kmk3 kmk3 mentioned this issue Feb 7, 2024
Merged
@kmk3 kmk3 changed the title Landlock errors Landlock: "Invalid argument" error when creating the ruleset Feb 7, 2024
@kmk3
Copy link
Collaborator

kmk3 commented Feb 7, 2024

The only thing that I could imagine being an invalid argument in that syscall
was if a struct had some wrong value/uninitialized field. And indeed, after
looking at linux/landlock.h I noticed that there was a new field. I was able
to reproduce it after upgrading linux-api-headers and initializing the structs
to 0 fixed the issue.

It should be fixed in #6200.

@curiosityseeker @glitsj16

Thanks for reporting/testing/bisecting.

@glitsj16
Copy link
Collaborator

glitsj16 commented Feb 7, 2024

@kmk3

It should be fixed in #6200.

Confirmed, just checked with a firejail build carrying the patch from #6200. All fine now. Thanks for your speedy and intense detective-work on this issue!

@kmk3 kmk3 closed this as completed in #6200 Feb 8, 2024
kmk3 added a commit that referenced this issue Feb 8, 2024
@kmk3
landlock: fix struct initialization (#6200)
5f33d8e 
Recently (as of Landlock ABI 4), the `handled_access_net` field was
added to the `landlock_ruleset_attr` struct in the Linux kernel (in
linux/landlock.h).  In src/firejail/landlock.c, that field is not being
set in the struct (as we currently do not use it) before passing it to
the `landlock_create_full_ruleset` syscall, so it is likely to contain
random garbage when used, resulting in the syscall returning EINVAL:

    $ firejail --debug --profile=/etc/firejail/landlock-common.inc \
      --landlock.enforce true
    [...]
    ll_is_supported: Detected Landlock ABI version 4
    ll_restrict: Starting Landlock restrict
    ll_create_full_ruleset: Creating Landlock ruleset (abi=4 fs=1fff)
    Error: ll_create_full_ruleset: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
    ll_read: Adding Landlock rule (abi=4 fs=c) for /
    Error: ll_read: failed to add Landlock rule (abi=4 fs=c) for /: Bad file descriptor
    [...]
    Not enforcing Landlock

So ensure that all structs in src/firejail/landlock.c are initialized to
0 before using them.

Note: Arch has recently (2024-01-31) updated the linux-api-headers
package from version 6.4-1 to 6.7-1[1].  The former version is not affected
(as it does not contain the extra struct field in linux/landlock.h),
while the latter is.

Fixes #6195.

Relates to #6078.

[1] https://gitlab.archlinux.org/archlinux/packaging/packages/linux-api-headers/-/commit/b4223b0c2bfba54c26acc4dc289415b81b15989f

Reported-by: @curiosityseeker
kmk3 added a commit that referenced this issue Feb 8, 2024
@kmk3
RELNOTES: add feature and build items
9492e59 
Relates to #6195 #6196 #6200.
@curiosityseeker
Copy link
Collaborator Author

Cool! I can confirm that that commit fixed the Issue:

32 Landlock rules initialized in 0.23 ms

Thanks a lot, @kmk3 !

@kmk3 kmk3 changed the title Landlock: "Invalid argument" error when creating the ruleset landlock: "Invalid argument" error when creating the ruleset Sep 7, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working
Projects
Release 0.9.74
Status: Done (on RELNOTES)
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

landlock: fix struct initialization kmk3/firejail
3 participants
@glitsj16 @kmk3 @curiosityseeker