diff --git a/src/main.rs b/src/main.rs index 8fffa7464..4008177a3 100644 --- a/src/main.rs +++ b/src/main.rs @@ -749,6 +749,7 @@ fn start_vmm(cmd_arguments: ArgMatches) -> Result, Error> { exit_evt.try_clone().unwrap(), &seccomp_action, hypervisor, + landlock_enable, ) .map_err(Error::StartVmmThread)?; diff --git a/vmm/src/lib.rs b/vmm/src/lib.rs index 584e781d1..c4ed48fc4 100644 --- a/vmm/src/lib.rs +++ b/vmm/src/lib.rs @@ -412,6 +412,7 @@ pub fn start_vmm_thread( exit_event: EventFd, seccomp_action: &SeccompAction, hypervisor: Arc, + landlock_enable: bool, ) -> Result { #[cfg(feature = "guest_debug")] let gdb_hw_breakpoints = hypervisor.get_guest_debug_hw_bps(); @@ -452,7 +453,7 @@ pub fn start_vmm_thread( exit_event, )?; - vmm.setup_signal_handler()?; + vmm.setup_signal_handler(landlock_enable)?; vmm.control_loop( Rc::new(api_receiver), @@ -613,7 +614,7 @@ impl Vmm { } } - fn setup_signal_handler(&mut self) -> Result<()> { + fn setup_signal_handler(&mut self, landlock_enable: bool) -> Result<()> { let signals = Signals::new(Self::HANDLED_SIGNALS); match signals { Ok(signals) => { @@ -640,6 +641,21 @@ impl Vmm { return; } } + if landlock_enable{ + match Landlock::new() { + Ok(landlock) => { + let _ = landlock.restrict_self().map_err(Error::ApplyLandlock).map_err(|e| { + error!("Error applying Landlock to signal handler thread: {:?}", e); + exit_evt.write(1).ok(); + }); + } + Err(e) => { + error!("Error creating Landlock object: {:?}", e); + exit_evt.write(1).ok(); + } + }; + } + std::panic::catch_unwind(AssertUnwindSafe(|| { Vmm::signal_handler(signals, original_termios_opt, &exit_evt); }))