dmaax/ladybird
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
ladybird/Libraries/LibSandbox/Seccomp.cpp

1251 lines
45 KiB
C++
Raw Normal View History

LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
/*
* Copyright (c) 2026-present, the Ladybird developers.
*
* SPDX-License-Identifier: BSD-2-Clause
*/
#include <LibSandbox/Seccomp.h>
LibSandbox: Allow TCGETS2 fd queries WebContent is about to stop using the broad GPU device sandbox allowance. That also removes the accidental permission for every ioctl, which exposes ordinary terminal attribute queries made while printing diagnostics. The media decode error path can ask stderr for TCGETS2 while reporting a corrupt video frame. Allow that narrow fd metadata query alongside TCGETS, FIONBIO, and FIONREAD so renderer processes can keep the GPU ioctl denial without crashing the media decode-error coverage.
2026-06-18 04:51:54 -03:00
#include <asm/termbits.h>
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
#include <errno.h>
#include <fcntl.h>
#include <linux/audit.h>
#include <linux/sched.h>
#include <linux/seccomp.h>
WebContent: Sandbox renderer processes on Linux Add opt-in Linux renderer sandbox support to WebContent and WebWorker. Ladybird and test-web pass --enable-sandbox through when requested, and the renderer services only install the shared sandbox when that flag is present. Share one renderer policy for both services. Allow resource, font, shared library, WebGL, Wasm, audio, and local IPC paths needed at runtime, while keeping renderer filesystem writes mediated by Landlock. Allow Mesa and PulseAudio to probe their standard runtime state without escaping the renderer sandbox. Return EPERM for scheduler and priority changes so library initialization can fall back instead of crashing on a seccomp violation.
2026-06-09 08:26:47 -03:00
#include <signal.h>
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
#include <stddef.h>
#include <sys/ioctl.h>
#include <sys/mman.h>
#include <sys/prctl.h>
WebContent: Sandbox renderer processes on Linux Add opt-in Linux renderer sandbox support to WebContent and WebWorker. Ladybird and test-web pass --enable-sandbox through when requested, and the renderer services only install the shared sandbox when that flag is present. Share one renderer policy for both services. Allow resource, font, shared library, WebGL, Wasm, audio, and local IPC paths needed at runtime, while keeping renderer filesystem writes mediated by Landlock. Allow Mesa and PulseAudio to probe their standard runtime state without escaping the renderer sandbox. Return EPERM for scheduler and priority changes so library initialization can fall back instead of crashing on a seccomp violation.
2026-06-09 08:26:47 -03:00
#include <sys/socket.h>
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
#include <sys/syscall.h>
#include <sys/ucontext.h>
#include <unistd.h>
namespace Sandbox {
namespace {
#if defined(__x86_64__)
static constexpr u32 audit_architecture = AUDIT_ARCH_X86_64;
#elif defined(__aarch64__)
static constexpr u32 audit_architecture = AUDIT_ARCH_AARCH64;
#elif defined(__riscv) && __riscv_xlen == 64
static constexpr u32 audit_architecture = AUDIT_ARCH_RISCV64;
#else
# error "Add 64-bit seccomp audit architecture for this Linux architecture"
#endif
static constexpr u32 thread_clone_required_flags = CLONE_VM | CLONE_FS | CLONE_FILES | CLONE_SIGHAND | CLONE_THREAD;
static constexpr u32 thread_clone_allowed_flags = thread_clone_required_flags
| CLONE_SYSVSEM
| CLONE_SETTLS
| CLONE_PARENT_SETTID
| CLONE_CHILD_CLEARTID
| CLONE_DETACHED
| CLONE_CHILD_SETTID;
WebContent: Sandbox renderer processes on Linux Add opt-in Linux renderer sandbox support to WebContent and WebWorker. Ladybird and test-web pass --enable-sandbox through when requested, and the renderer services only install the shared sandbox when that flag is present. Share one renderer policy for both services. Allow resource, font, shared library, WebGL, Wasm, audio, and local IPC paths needed at runtime, while keeping renderer filesystem writes mediated by Landlock. Allow Mesa and PulseAudio to probe their standard runtime state without escaping the renderer sandbox. Return EPERM for scheduler and priority changes so library initialization can fall back instead of crashing on a seccomp violation.
2026-06-09 08:26:47 -03:00
static constexpr u32 vfork_clone_flags = CLONE_VM | CLONE_VFORK | SIGCHLD;
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
#ifdef O_LARGEFILE
static constexpr unsigned read_only_open_flags = O_CLOEXEC | O_LARGEFILE;
#else
static constexpr unsigned read_only_open_flags = O_CLOEXEC;
#endif
#define SECCOMP_LOAD_SYSCALL_NR BPF_STMT(BPF_LD | BPF_W | BPF_ABS, static_cast<unsigned int>(offsetof(seccomp_data, nr)))
#define SECCOMP_LOAD_ARCHITECTURE BPF_STMT(BPF_LD | BPF_W | BPF_ABS, static_cast<unsigned int>(offsetof(seccomp_data, arch)))
#define SECCOMP_LOAD_ARGUMENT(index) BPF_STMT(BPF_LD | BPF_W | BPF_ABS, static_cast<unsigned int>(offsetof(seccomp_data, args[(index)])))
#define SECCOMP_ALLOW BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW)
#define SECCOMP_TRAP BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_TRAP)
#define SECCOMP_ERRNO(error) BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ERRNO | ((error) & SECCOMP_RET_DATA))
#define SECCOMP_ALLOW_NOTHING BPF_STMT(BPF_ALU | BPF_ADD | BPF_K, 0)
#define SECCOMP_APPEND_ALLOW_SYSCALL(policy, name) \
do { \
(policy).append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_##name, 0, 1)); \
(policy).append(SECCOMP_ALLOW); \
} while (0)
#define SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(policy, name) \
IF_DEFINED_##name(SECCOMP_APPEND_ALLOW_SYSCALL(policy, name), (policy).append(SECCOMP_ALLOW_NOTHING))
RequestServer: Sandbox the process on Linux Add opt-in Linux sandbox support to RequestServer. Ladybird and test-web pass --enable-sandbox through when requested, and RequestServer only installs the sandbox when that flag is present. Allow reads for resolver and TLS configuration, plus the configured certificate locations. Create and allow writes to the Ladybird cache root, so libcurl alt-svc files and HTTP disk-cache files stay inside the single writable tree. Also allow the systemd-resolved runtime directory when present, since /etc/resolv.conf can point there. Extend LibSandbox with owned Landlock paths, an add-if-exists helper, read/write Landlock access, and reusable seccomp groups for filesystem writes and network syscalls. Include POSIX file locks and socket byte count ioctls needed by libc resolver and cache paths. Reuse the new Landlock helper from Compositor as well, and allow its Mesa shader cache directory so GPU startup can populate shader cache files after sandboxing.
2026-06-09 06:47:04 -03:00
#define IF_DEFINED_accept(if_defined, if_not_defined) if_defined
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
#define IF_DEFINED_accept4(if_defined, if_not_defined) if_defined
RequestServer: Sandbox the process on Linux Add opt-in Linux sandbox support to RequestServer. Ladybird and test-web pass --enable-sandbox through when requested, and RequestServer only installs the sandbox when that flag is present. Allow reads for resolver and TLS configuration, plus the configured certificate locations. Create and allow writes to the Ladybird cache root, so libcurl alt-svc files and HTTP disk-cache files stay inside the single writable tree. Also allow the systemd-resolved runtime directory when present, since /etc/resolv.conf can point there. Extend LibSandbox with owned Landlock paths, an add-if-exists helper, read/write Landlock access, and reusable seccomp groups for filesystem writes and network syscalls. Include POSIX file locks and socket byte count ioctls needed by libc resolver and cache paths. Reuse the new Landlock helper from Compositor as well, and allow its Mesa shader cache directory so GPU startup can populate shader cache files after sandboxing.
2026-06-09 06:47:04 -03:00
#define IF_DEFINED_access(if_defined, if_not_defined) if_defined
#define IF_DEFINED_bind(if_defined, if_not_defined) if_defined
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
#define IF_DEFINED_brk(if_defined, if_not_defined) if_defined
#define IF_DEFINED_clock_getres(if_defined, if_not_defined) if_defined
#define IF_DEFINED_clock_gettime(if_defined, if_not_defined) if_defined
#define IF_DEFINED_clock_nanosleep(if_defined, if_not_defined) if_defined
#define IF_DEFINED_clone(if_defined, if_not_defined) if_defined
#define IF_DEFINED_clone3(if_defined, if_not_defined) if_defined
#define IF_DEFINED_close(if_defined, if_not_defined) if_defined
RequestServer: Sandbox the process on Linux Add opt-in Linux sandbox support to RequestServer. Ladybird and test-web pass --enable-sandbox through when requested, and RequestServer only installs the sandbox when that flag is present. Allow reads for resolver and TLS configuration, plus the configured certificate locations. Create and allow writes to the Ladybird cache root, so libcurl alt-svc files and HTTP disk-cache files stay inside the single writable tree. Also allow the systemd-resolved runtime directory when present, since /etc/resolv.conf can point there. Extend LibSandbox with owned Landlock paths, an add-if-exists helper, read/write Landlock access, and reusable seccomp groups for filesystem writes and network syscalls. Include POSIX file locks and socket byte count ioctls needed by libc resolver and cache paths. Reuse the new Landlock helper from Compositor as well, and allow its Mesa shader cache directory so GPU startup can populate shader cache files after sandboxing.
2026-06-09 06:47:04 -03:00
#define IF_DEFINED_connect(if_defined, if_not_defined) if_defined
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
#define IF_DEFINED_dup(if_defined, if_not_defined) if_defined
#define IF_DEFINED_dup3(if_defined, if_not_defined) if_defined
Compositor: Sandbox the process on Linux Add opt-in Linux sandbox support to Compositor. Ladybird and test-web pass --enable-sandbox through when requested, and Compositor only installs the sandbox when that flag is present. Install the sandbox after Compositor has initialized platform, font, and GPU state so startup probing can complete before filesystem access is removed. Compose the runtime seccomp policy from LibSandbox building blocks and add an explicit GPU device operations group for driver IPC through already-open descriptors.
2026-06-09 06:08:46 -03:00
#define IF_DEFINED_epoll_create1(if_defined, if_not_defined) if_defined
#define IF_DEFINED_epoll_ctl(if_defined, if_not_defined) if_defined
#define IF_DEFINED_epoll_pwait(if_defined, if_not_defined) if_defined
#define IF_DEFINED_epoll_wait(if_defined, if_not_defined) if_defined
#define IF_DEFINED_eventfd2(if_defined, if_not_defined) if_defined
LibSandbox: Permit `faccessat2`, `faccessat` and `fstatfs` SDL enumerates connected input devices through libudev whenever a device is added or removed, which probes per-device metadata using `faccessat2` and `fstatfs`. These calls run after the seccomp filter is installed, and neither syscall was permitted, so connecting a gamepad killed the WebContent process with SIGSYS. We now permit `faccessat` alongside `faccessat2` because glibc's `faccessat` wrapper falls back to it on kernels without `faccessat2`.
2026-06-12 14:59:34 -03:00
#define IF_DEFINED_faccessat(if_defined, if_not_defined) if_defined
#define IF_DEFINED_faccessat2(if_defined, if_not_defined) if_defined
WebContent: Sandbox renderer processes on Linux Add opt-in Linux renderer sandbox support to WebContent and WebWorker. Ladybird and test-web pass --enable-sandbox through when requested, and the renderer services only install the shared sandbox when that flag is present. Share one renderer policy for both services. Allow resource, font, shared library, WebGL, Wasm, audio, and local IPC paths needed at runtime, while keeping renderer filesystem writes mediated by Landlock. Allow Mesa and PulseAudio to probe their standard runtime state without escaping the renderer sandbox. Return EPERM for scheduler and priority changes so library initialization can fall back instead of crashing on a seccomp violation.
2026-06-09 08:26:47 -03:00
#define IF_DEFINED_execve(if_defined, if_not_defined) if_defined
#define IF_DEFINED_execveat(if_defined, if_not_defined) if_defined
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
#define IF_DEFINED_exit(if_defined, if_not_defined) if_defined
#define IF_DEFINED_exit_group(if_defined, if_not_defined) if_defined
#define IF_DEFINED_fcntl(if_defined, if_not_defined) if_defined
#define IF_DEFINED_fcntl64(if_defined, if_not_defined) if_defined
RequestServer: Sandbox the process on Linux Add opt-in Linux sandbox support to RequestServer. Ladybird and test-web pass --enable-sandbox through when requested, and RequestServer only installs the sandbox when that flag is present. Allow reads for resolver and TLS configuration, plus the configured certificate locations. Create and allow writes to the Ladybird cache root, so libcurl alt-svc files and HTTP disk-cache files stay inside the single writable tree. Also allow the systemd-resolved runtime directory when present, since /etc/resolv.conf can point there. Extend LibSandbox with owned Landlock paths, an add-if-exists helper, read/write Landlock access, and reusable seccomp groups for filesystem writes and network syscalls. Include POSIX file locks and socket byte count ioctls needed by libc resolver and cache paths. Reuse the new Landlock helper from Compositor as well, and allow its Mesa shader cache directory so GPU startup can populate shader cache files after sandboxing.
2026-06-09 06:47:04 -03:00
#define IF_DEFINED_fdatasync(if_defined, if_not_defined) if_defined
#define IF_DEFINED_flock(if_defined, if_not_defined) if_defined
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
#define IF_DEFINED_fstat(if_defined, if_not_defined) if_defined
LibSandbox: Permit `faccessat2`, `faccessat` and `fstatfs` SDL enumerates connected input devices through libudev whenever a device is added or removed, which probes per-device metadata using `faccessat2` and `fstatfs`. These calls run after the seccomp filter is installed, and neither syscall was permitted, so connecting a gamepad killed the WebContent process with SIGSYS. We now permit `faccessat` alongside `faccessat2` because glibc's `faccessat` wrapper falls back to it on kernels without `faccessat2`.
2026-06-12 14:59:34 -03:00
#define IF_DEFINED_fstatfs(if_defined, if_not_defined) if_defined
RequestServer: Sandbox the process on Linux Add opt-in Linux sandbox support to RequestServer. Ladybird and test-web pass --enable-sandbox through when requested, and RequestServer only installs the sandbox when that flag is present. Allow reads for resolver and TLS configuration, plus the configured certificate locations. Create and allow writes to the Ladybird cache root, so libcurl alt-svc files and HTTP disk-cache files stay inside the single writable tree. Also allow the systemd-resolved runtime directory when present, since /etc/resolv.conf can point there. Extend LibSandbox with owned Landlock paths, an add-if-exists helper, read/write Landlock access, and reusable seccomp groups for filesystem writes and network syscalls. Include POSIX file locks and socket byte count ioctls needed by libc resolver and cache paths. Reuse the new Landlock helper from Compositor as well, and allow its Mesa shader cache directory so GPU startup can populate shader cache files after sandboxing.
2026-06-09 06:47:04 -03:00
#define IF_DEFINED_fsync(if_defined, if_not_defined) if_defined
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
#define IF_DEFINED_ftruncate(if_defined, if_not_defined) if_defined
#define IF_DEFINED_futex(if_defined, if_not_defined) if_defined
#define IF_DEFINED_futex_time64(if_defined, if_not_defined) if_defined
RequestServer: Sandbox the process on Linux Add opt-in Linux sandbox support to RequestServer. Ladybird and test-web pass --enable-sandbox through when requested, and RequestServer only installs the sandbox when that flag is present. Allow reads for resolver and TLS configuration, plus the configured certificate locations. Create and allow writes to the Ladybird cache root, so libcurl alt-svc files and HTTP disk-cache files stay inside the single writable tree. Also allow the systemd-resolved runtime directory when present, since /etc/resolv.conf can point there. Extend LibSandbox with owned Landlock paths, an add-if-exists helper, read/write Landlock access, and reusable seccomp groups for filesystem writes and network syscalls. Include POSIX file locks and socket byte count ioctls needed by libc resolver and cache paths. Reuse the new Landlock helper from Compositor as well, and allow its Mesa shader cache directory so GPU startup can populate shader cache files after sandboxing.
2026-06-09 06:47:04 -03:00
#define IF_DEFINED_getdents64(if_defined, if_not_defined) if_defined
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
#define IF_DEFINED_getcpu(if_defined, if_not_defined) if_defined
#define IF_DEFINED_getegid(if_defined, if_not_defined) if_defined
#define IF_DEFINED_geteuid(if_defined, if_not_defined) if_defined
#define IF_DEFINED_getgid(if_defined, if_not_defined) if_defined
#define IF_DEFINED_getpeername(if_defined, if_not_defined) if_defined
#define IF_DEFINED_getpid(if_defined, if_not_defined) if_defined
#define IF_DEFINED_getrandom(if_defined, if_not_defined) if_defined
#define IF_DEFINED_getrlimit(if_defined, if_not_defined) if_defined
#define IF_DEFINED_getrusage(if_defined, if_not_defined) if_defined
#define IF_DEFINED_getsockname(if_defined, if_not_defined) if_defined
#define IF_DEFINED_getsockopt(if_defined, if_not_defined) if_defined
#define IF_DEFINED_gettid(if_defined, if_not_defined) if_defined
#define IF_DEFINED_gettimeofday(if_defined, if_not_defined) if_defined
#define IF_DEFINED_getuid(if_defined, if_not_defined) if_defined
#define IF_DEFINED_ioctl(if_defined, if_not_defined) if_defined
RequestServer: Sandbox the process on Linux Add opt-in Linux sandbox support to RequestServer. Ladybird and test-web pass --enable-sandbox through when requested, and RequestServer only installs the sandbox when that flag is present. Allow reads for resolver and TLS configuration, plus the configured certificate locations. Create and allow writes to the Ladybird cache root, so libcurl alt-svc files and HTTP disk-cache files stay inside the single writable tree. Also allow the systemd-resolved runtime directory when present, since /etc/resolv.conf can point there. Extend LibSandbox with owned Landlock paths, an add-if-exists helper, read/write Landlock access, and reusable seccomp groups for filesystem writes and network syscalls. Include POSIX file locks and socket byte count ioctls needed by libc resolver and cache paths. Reuse the new Landlock helper from Compositor as well, and allow its Mesa shader cache directory so GPU startup can populate shader cache files after sandboxing.
2026-06-09 06:47:04 -03:00
#define IF_DEFINED_link(if_defined, if_not_defined) if_defined
#define IF_DEFINED_linkat(if_defined, if_not_defined) if_defined
#define IF_DEFINED_listen(if_defined, if_not_defined) if_defined
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
#define IF_DEFINED_lseek(if_defined, if_not_defined) if_defined
#define IF_DEFINED_madvise(if_defined, if_not_defined) if_defined
#define IF_DEFINED_membarrier(if_defined, if_not_defined) if_defined
#define IF_DEFINED_memfd_create(if_defined, if_not_defined) if_defined
WebContent: Sandbox renderer processes on Linux Add opt-in Linux renderer sandbox support to WebContent and WebWorker. Ladybird and test-web pass --enable-sandbox through when requested, and the renderer services only install the shared sandbox when that flag is present. Share one renderer policy for both services. Allow resource, font, shared library, WebGL, Wasm, audio, and local IPC paths needed at runtime, while keeping renderer filesystem writes mediated by Landlock. Allow Mesa and PulseAudio to probe their standard runtime state without escaping the renderer sandbox. Return EPERM for scheduler and priority changes so library initialization can fall back instead of crashing on a seccomp violation.
2026-06-09 08:26:47 -03:00
#define IF_DEFINED_mkdir(if_defined, if_not_defined) if_defined
#define IF_DEFINED_mkdirat(if_defined, if_not_defined) if_defined
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
#define IF_DEFINED_mmap(if_defined, if_not_defined) if_defined
#define IF_DEFINED_mmap2(if_defined, if_not_defined) if_defined
#define IF_DEFINED_mprotect(if_defined, if_not_defined) if_defined
#define IF_DEFINED_mremap(if_defined, if_not_defined) if_defined
#define IF_DEFINED_munmap(if_defined, if_not_defined) if_defined
#define IF_DEFINED_nanosleep(if_defined, if_not_defined) if_defined
Compositor: Allow sandboxed font resource reads Compositor still needs to decode font resources from display-list IPC after startup. Let its sandbox grant read-only access to configured font directories and bundled resource fonts through Landlock, and allow read-only open plus metadata syscalls in the seccomp policy. Preload the same font directories before installing the sandbox so the Compositor can handle display lists that reference system-backed fonts. The full test-web suite completes without Compositor sandbox crashes.
2026-06-09 06:22:30 -03:00
#define IF_DEFINED_newfstatat(if_defined, if_not_defined) if_defined
RequestServer: Sandbox the process on Linux Add opt-in Linux sandbox support to RequestServer. Ladybird and test-web pass --enable-sandbox through when requested, and RequestServer only installs the sandbox when that flag is present. Allow reads for resolver and TLS configuration, plus the configured certificate locations. Create and allow writes to the Ladybird cache root, so libcurl alt-svc files and HTTP disk-cache files stay inside the single writable tree. Also allow the systemd-resolved runtime directory when present, since /etc/resolv.conf can point there. Extend LibSandbox with owned Landlock paths, an add-if-exists helper, read/write Landlock access, and reusable seccomp groups for filesystem writes and network syscalls. Include POSIX file locks and socket byte count ioctls needed by libc resolver and cache paths. Reuse the new Landlock helper from Compositor as well, and allow its Mesa shader cache directory so GPU startup can populate shader cache files after sandboxing.
2026-06-09 06:47:04 -03:00
#define IF_DEFINED_open(if_defined, if_not_defined) if_defined
#define IF_DEFINED_openat(if_defined, if_not_defined) if_defined
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
#define IF_DEFINED_pipe2(if_defined, if_not_defined) if_defined
#define IF_DEFINED_poll(if_defined, if_not_defined) if_defined
RequestServer: Sandbox the process on Linux Add opt-in Linux sandbox support to RequestServer. Ladybird and test-web pass --enable-sandbox through when requested, and RequestServer only installs the sandbox when that flag is present. Allow reads for resolver and TLS configuration, plus the configured certificate locations. Create and allow writes to the Ladybird cache root, so libcurl alt-svc files and HTTP disk-cache files stay inside the single writable tree. Also allow the systemd-resolved runtime directory when present, since /etc/resolv.conf can point there. Extend LibSandbox with owned Landlock paths, an add-if-exists helper, read/write Landlock access, and reusable seccomp groups for filesystem writes and network syscalls. Include POSIX file locks and socket byte count ioctls needed by libc resolver and cache paths. Reuse the new Landlock helper from Compositor as well, and allow its Mesa shader cache directory so GPU startup can populate shader cache files after sandboxing.
2026-06-09 06:47:04 -03:00
#define IF_DEFINED_pread64(if_defined, if_not_defined) if_defined
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
#define IF_DEFINED_ppoll(if_defined, if_not_defined) if_defined
#define IF_DEFINED_prctl(if_defined, if_not_defined) if_defined
#define IF_DEFINED_prlimit64(if_defined, if_not_defined) if_defined
#define IF_DEFINED_pselect6(if_defined, if_not_defined) if_defined
#define IF_DEFINED_pwrite64(if_defined, if_not_defined) if_defined
#define IF_DEFINED_read(if_defined, if_not_defined) if_defined
RequestServer: Sandbox the process on Linux Add opt-in Linux sandbox support to RequestServer. Ladybird and test-web pass --enable-sandbox through when requested, and RequestServer only installs the sandbox when that flag is present. Allow reads for resolver and TLS configuration, plus the configured certificate locations. Create and allow writes to the Ladybird cache root, so libcurl alt-svc files and HTTP disk-cache files stay inside the single writable tree. Also allow the systemd-resolved runtime directory when present, since /etc/resolv.conf can point there. Extend LibSandbox with owned Landlock paths, an add-if-exists helper, read/write Landlock access, and reusable seccomp groups for filesystem writes and network syscalls. Include POSIX file locks and socket byte count ioctls needed by libc resolver and cache paths. Reuse the new Landlock helper from Compositor as well, and allow its Mesa shader cache directory so GPU startup can populate shader cache files after sandboxing.
2026-06-09 06:47:04 -03:00
#define IF_DEFINED_readlink(if_defined, if_not_defined) if_defined
#define IF_DEFINED_readlinkat(if_defined, if_not_defined) if_defined
#define IF_DEFINED_rename(if_defined, if_not_defined) if_defined
#define IF_DEFINED_renameat(if_defined, if_not_defined) if_defined
#define IF_DEFINED_renameat2(if_defined, if_not_defined) if_defined
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
#define IF_DEFINED_recvfrom(if_defined, if_not_defined) if_defined
#define IF_DEFINED_recvmmsg(if_defined, if_not_defined) if_defined
#define IF_DEFINED_recvmsg(if_defined, if_not_defined) if_defined
#define IF_DEFINED_restart_syscall(if_defined, if_not_defined) if_defined
WebContent: Sandbox renderer processes on Linux Add opt-in Linux renderer sandbox support to WebContent and WebWorker. Ladybird and test-web pass --enable-sandbox through when requested, and the renderer services only install the shared sandbox when that flag is present. Share one renderer policy for both services. Allow resource, font, shared library, WebGL, Wasm, audio, and local IPC paths needed at runtime, while keeping renderer filesystem writes mediated by Landlock. Allow Mesa and PulseAudio to probe their standard runtime state without escaping the renderer sandbox. Return EPERM for scheduler and priority changes so library initialization can fall back instead of crashing on a seccomp violation.
2026-06-09 08:26:47 -03:00
#define IF_DEFINED_rmdir(if_defined, if_not_defined) if_defined
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
#define IF_DEFINED_rseq(if_defined, if_not_defined) if_defined
#define IF_DEFINED_rt_sigaction(if_defined, if_not_defined) if_defined
#define IF_DEFINED_rt_sigprocmask(if_defined, if_not_defined) if_defined
#define IF_DEFINED_rt_sigreturn(if_defined, if_not_defined) if_defined
#define IF_DEFINED_sched_getaffinity(if_defined, if_not_defined) if_defined
#define IF_DEFINED_sched_yield(if_defined, if_not_defined) if_defined
RequestServer: Sandbox the process on Linux Add opt-in Linux sandbox support to RequestServer. Ladybird and test-web pass --enable-sandbox through when requested, and RequestServer only installs the sandbox when that flag is present. Allow reads for resolver and TLS configuration, plus the configured certificate locations. Create and allow writes to the Ladybird cache root, so libcurl alt-svc files and HTTP disk-cache files stay inside the single writable tree. Also allow the systemd-resolved runtime directory when present, since /etc/resolv.conf can point there. Extend LibSandbox with owned Landlock paths, an add-if-exists helper, read/write Landlock access, and reusable seccomp groups for filesystem writes and network syscalls. Include POSIX file locks and socket byte count ioctls needed by libc resolver and cache paths. Reuse the new Landlock helper from Compositor as well, and allow its Mesa shader cache directory so GPU startup can populate shader cache files after sandboxing.
2026-06-09 06:47:04 -03:00
#define IF_DEFINED_sendfile(if_defined, if_not_defined) if_defined
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
#define IF_DEFINED_sendmmsg(if_defined, if_not_defined) if_defined
#define IF_DEFINED_sendmsg(if_defined, if_not_defined) if_defined
#define IF_DEFINED_sendto(if_defined, if_not_defined) if_defined
#define IF_DEFINED_set_robust_list(if_defined, if_not_defined) if_defined
#define IF_DEFINED_set_tid_address(if_defined, if_not_defined) if_defined
#define IF_DEFINED_setsockopt(if_defined, if_not_defined) if_defined
#define IF_DEFINED_sigaltstack(if_defined, if_not_defined) if_defined
RequestServer: Sandbox the process on Linux Add opt-in Linux sandbox support to RequestServer. Ladybird and test-web pass --enable-sandbox through when requested, and RequestServer only installs the sandbox when that flag is present. Allow reads for resolver and TLS configuration, plus the configured certificate locations. Create and allow writes to the Ladybird cache root, so libcurl alt-svc files and HTTP disk-cache files stay inside the single writable tree. Also allow the systemd-resolved runtime directory when present, since /etc/resolv.conf can point there. Extend LibSandbox with owned Landlock paths, an add-if-exists helper, read/write Landlock access, and reusable seccomp groups for filesystem writes and network syscalls. Include POSIX file locks and socket byte count ioctls needed by libc resolver and cache paths. Reuse the new Landlock helper from Compositor as well, and allow its Mesa shader cache directory so GPU startup can populate shader cache files after sandboxing.
2026-06-09 06:47:04 -03:00
#define IF_DEFINED_shutdown(if_defined, if_not_defined) if_defined
#define IF_DEFINED_socket(if_defined, if_not_defined) if_defined
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
#define IF_DEFINED_socketpair(if_defined, if_not_defined) if_defined
Compositor: Allow sandboxed font resource reads Compositor still needs to decode font resources from display-list IPC after startup. Let its sandbox grant read-only access to configured font directories and bundled resource fonts through Landlock, and allow read-only open plus metadata syscalls in the seccomp policy. Preload the same font directories before installing the sandbox so the Compositor can handle display lists that reference system-backed fonts. The full test-web suite completes without Compositor sandbox crashes.
2026-06-09 06:22:30 -03:00
#define IF_DEFINED_statx(if_defined, if_not_defined) if_defined
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
#define IF_DEFINED_sysinfo(if_defined, if_not_defined) if_defined
#define IF_DEFINED_tgkill(if_defined, if_not_defined) if_defined
RequestServer: Sandbox the process on Linux Add opt-in Linux sandbox support to RequestServer. Ladybird and test-web pass --enable-sandbox through when requested, and RequestServer only installs the sandbox when that flag is present. Allow reads for resolver and TLS configuration, plus the configured certificate locations. Create and allow writes to the Ladybird cache root, so libcurl alt-svc files and HTTP disk-cache files stay inside the single writable tree. Also allow the systemd-resolved runtime directory when present, since /etc/resolv.conf can point there. Extend LibSandbox with owned Landlock paths, an add-if-exists helper, read/write Landlock access, and reusable seccomp groups for filesystem writes and network syscalls. Include POSIX file locks and socket byte count ioctls needed by libc resolver and cache paths. Reuse the new Landlock helper from Compositor as well, and allow its Mesa shader cache directory so GPU startup can populate shader cache files after sandboxing.
2026-06-09 06:47:04 -03:00
#define IF_DEFINED_unlink(if_defined, if_not_defined) if_defined
#define IF_DEFINED_unlinkat(if_defined, if_not_defined) if_defined
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
#define IF_DEFINED_umask(if_defined, if_not_defined) if_defined
#define IF_DEFINED_uname(if_defined, if_not_defined) if_defined
WebContent: Sandbox renderer processes on Linux Add opt-in Linux renderer sandbox support to WebContent and WebWorker. Ladybird and test-web pass --enable-sandbox through when requested, and the renderer services only install the shared sandbox when that flag is present. Share one renderer policy for both services. Allow resource, font, shared library, WebGL, Wasm, audio, and local IPC paths needed at runtime, while keeping renderer filesystem writes mediated by Landlock. Allow Mesa and PulseAudio to probe their standard runtime state without escaping the renderer sandbox. Return EPERM for scheduler and priority changes so library initialization can fall back instead of crashing on a seccomp violation.
2026-06-09 08:26:47 -03:00
#define IF_DEFINED_wait4(if_defined, if_not_defined) if_defined
#define IF_DEFINED_waitid(if_defined, if_not_defined) if_defined
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
#define IF_DEFINED_write(if_defined, if_not_defined) if_defined
RequestServer: Sandbox the process on Linux Add opt-in Linux sandbox support to RequestServer. Ladybird and test-web pass --enable-sandbox through when requested, and RequestServer only installs the sandbox when that flag is present. Allow reads for resolver and TLS configuration, plus the configured certificate locations. Create and allow writes to the Ladybird cache root, so libcurl alt-svc files and HTTP disk-cache files stay inside the single writable tree. Also allow the systemd-resolved runtime directory when present, since /etc/resolv.conf can point there. Extend LibSandbox with owned Landlock paths, an add-if-exists helper, read/write Landlock access, and reusable seccomp groups for filesystem writes and network syscalls. Include POSIX file locks and socket byte count ioctls needed by libc resolver and cache paths. Reuse the new Landlock helper from Compositor as well, and allow its Mesa shader cache directory so GPU startup can populate shader cache files after sandboxing.
2026-06-09 06:47:04 -03:00
#ifndef __NR_accept
# undef IF_DEFINED_accept
# define IF_DEFINED_accept(if_defined, if_not_defined) if_not_defined
#endif
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
#ifndef __NR_accept4
# undef IF_DEFINED_accept4
# define IF_DEFINED_accept4(if_defined, if_not_defined) if_not_defined
#endif
RequestServer: Sandbox the process on Linux Add opt-in Linux sandbox support to RequestServer. Ladybird and test-web pass --enable-sandbox through when requested, and RequestServer only installs the sandbox when that flag is present. Allow reads for resolver and TLS configuration, plus the configured certificate locations. Create and allow writes to the Ladybird cache root, so libcurl alt-svc files and HTTP disk-cache files stay inside the single writable tree. Also allow the systemd-resolved runtime directory when present, since /etc/resolv.conf can point there. Extend LibSandbox with owned Landlock paths, an add-if-exists helper, read/write Landlock access, and reusable seccomp groups for filesystem writes and network syscalls. Include POSIX file locks and socket byte count ioctls needed by libc resolver and cache paths. Reuse the new Landlock helper from Compositor as well, and allow its Mesa shader cache directory so GPU startup can populate shader cache files after sandboxing.
2026-06-09 06:47:04 -03:00
#ifndef __NR_access
# undef IF_DEFINED_access
# define IF_DEFINED_access(if_defined, if_not_defined) if_not_defined
#endif
#ifndef __NR_bind
# undef IF_DEFINED_bind
# define IF_DEFINED_bind(if_defined, if_not_defined) if_not_defined
#endif
#ifndef __NR_connect
# undef IF_DEFINED_connect
# define IF_DEFINED_connect(if_defined, if_not_defined) if_not_defined
#endif
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
#ifndef __NR_clock_getres
# undef IF_DEFINED_clock_getres
# define IF_DEFINED_clock_getres(if_defined, if_not_defined) if_not_defined
#endif
#ifndef __NR_clock_gettime
# undef IF_DEFINED_clock_gettime
# define IF_DEFINED_clock_gettime(if_defined, if_not_defined) if_not_defined
#endif
#ifndef __NR_clock_nanosleep
# undef IF_DEFINED_clock_nanosleep
# define IF_DEFINED_clock_nanosleep(if_defined, if_not_defined) if_not_defined
#endif
#ifndef __NR_clone3
# undef IF_DEFINED_clone3
# define IF_DEFINED_clone3(if_defined, if_not_defined) if_not_defined
#endif
#ifndef __NR_dup3
# undef IF_DEFINED_dup3
# define IF_DEFINED_dup3(if_defined, if_not_defined) if_not_defined
#endif
Compositor: Sandbox the process on Linux Add opt-in Linux sandbox support to Compositor. Ladybird and test-web pass --enable-sandbox through when requested, and Compositor only installs the sandbox when that flag is present. Install the sandbox after Compositor has initialized platform, font, and GPU state so startup probing can complete before filesystem access is removed. Compose the runtime seccomp policy from LibSandbox building blocks and add an explicit GPU device operations group for driver IPC through already-open descriptors.
2026-06-09 06:08:46 -03:00
#ifndef __NR_epoll_create1
# undef IF_DEFINED_epoll_create1
# define IF_DEFINED_epoll_create1(if_defined, if_not_defined) if_not_defined
#endif
#ifndef __NR_epoll_ctl
# undef IF_DEFINED_epoll_ctl
# define IF_DEFINED_epoll_ctl(if_defined, if_not_defined) if_not_defined
#endif
#ifndef __NR_epoll_pwait
# undef IF_DEFINED_epoll_pwait
# define IF_DEFINED_epoll_pwait(if_defined, if_not_defined) if_not_defined
#endif
#ifndef __NR_epoll_wait
# undef IF_DEFINED_epoll_wait
# define IF_DEFINED_epoll_wait(if_defined, if_not_defined) if_not_defined
#endif
#ifndef __NR_eventfd2
# undef IF_DEFINED_eventfd2
# define IF_DEFINED_eventfd2(if_defined, if_not_defined) if_not_defined
#endif
LibSandbox: Permit `faccessat2`, `faccessat` and `fstatfs` SDL enumerates connected input devices through libudev whenever a device is added or removed, which probes per-device metadata using `faccessat2` and `fstatfs`. These calls run after the seccomp filter is installed, and neither syscall was permitted, so connecting a gamepad killed the WebContent process with SIGSYS. We now permit `faccessat` alongside `faccessat2` because glibc's `faccessat` wrapper falls back to it on kernels without `faccessat2`.
2026-06-12 14:59:34 -03:00
#ifndef __NR_faccessat
# undef IF_DEFINED_faccessat
# define IF_DEFINED_faccessat(if_defined, if_not_defined) if_not_defined
#endif
#ifndef __NR_faccessat2
# undef IF_DEFINED_faccessat2
# define IF_DEFINED_faccessat2(if_defined, if_not_defined) if_not_defined
#endif
WebContent: Sandbox renderer processes on Linux Add opt-in Linux renderer sandbox support to WebContent and WebWorker. Ladybird and test-web pass --enable-sandbox through when requested, and the renderer services only install the shared sandbox when that flag is present. Share one renderer policy for both services. Allow resource, font, shared library, WebGL, Wasm, audio, and local IPC paths needed at runtime, while keeping renderer filesystem writes mediated by Landlock. Allow Mesa and PulseAudio to probe their standard runtime state without escaping the renderer sandbox. Return EPERM for scheduler and priority changes so library initialization can fall back instead of crashing on a seccomp violation.
2026-06-09 08:26:47 -03:00
#ifndef __NR_execve
# undef IF_DEFINED_execve
# define IF_DEFINED_execve(if_defined, if_not_defined) if_not_defined
#endif
#ifndef __NR_execveat
# undef IF_DEFINED_execveat
# define IF_DEFINED_execveat(if_defined, if_not_defined) if_not_defined
#endif
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
#ifndef __NR_fcntl64
# undef IF_DEFINED_fcntl64
# define IF_DEFINED_fcntl64(if_defined, if_not_defined) if_not_defined
#endif
RequestServer: Sandbox the process on Linux Add opt-in Linux sandbox support to RequestServer. Ladybird and test-web pass --enable-sandbox through when requested, and RequestServer only installs the sandbox when that flag is present. Allow reads for resolver and TLS configuration, plus the configured certificate locations. Create and allow writes to the Ladybird cache root, so libcurl alt-svc files and HTTP disk-cache files stay inside the single writable tree. Also allow the systemd-resolved runtime directory when present, since /etc/resolv.conf can point there. Extend LibSandbox with owned Landlock paths, an add-if-exists helper, read/write Landlock access, and reusable seccomp groups for filesystem writes and network syscalls. Include POSIX file locks and socket byte count ioctls needed by libc resolver and cache paths. Reuse the new Landlock helper from Compositor as well, and allow its Mesa shader cache directory so GPU startup can populate shader cache files after sandboxing.
2026-06-09 06:47:04 -03:00
#ifndef __NR_fdatasync
# undef IF_DEFINED_fdatasync
# define IF_DEFINED_fdatasync(if_defined, if_not_defined) if_not_defined
#endif
#ifndef __NR_flock
# undef IF_DEFINED_flock
# define IF_DEFINED_flock(if_defined, if_not_defined) if_not_defined
#endif
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
#ifndef __NR_fstat
# undef IF_DEFINED_fstat
# define IF_DEFINED_fstat(if_defined, if_not_defined) if_not_defined
#endif
LibSandbox: Permit `faccessat2`, `faccessat` and `fstatfs` SDL enumerates connected input devices through libudev whenever a device is added or removed, which probes per-device metadata using `faccessat2` and `fstatfs`. These calls run after the seccomp filter is installed, and neither syscall was permitted, so connecting a gamepad killed the WebContent process with SIGSYS. We now permit `faccessat` alongside `faccessat2` because glibc's `faccessat` wrapper falls back to it on kernels without `faccessat2`.
2026-06-12 14:59:34 -03:00
#ifndef __NR_fstatfs
# undef IF_DEFINED_fstatfs
# define IF_DEFINED_fstatfs(if_defined, if_not_defined) if_not_defined
#endif
RequestServer: Sandbox the process on Linux Add opt-in Linux sandbox support to RequestServer. Ladybird and test-web pass --enable-sandbox through when requested, and RequestServer only installs the sandbox when that flag is present. Allow reads for resolver and TLS configuration, plus the configured certificate locations. Create and allow writes to the Ladybird cache root, so libcurl alt-svc files and HTTP disk-cache files stay inside the single writable tree. Also allow the systemd-resolved runtime directory when present, since /etc/resolv.conf can point there. Extend LibSandbox with owned Landlock paths, an add-if-exists helper, read/write Landlock access, and reusable seccomp groups for filesystem writes and network syscalls. Include POSIX file locks and socket byte count ioctls needed by libc resolver and cache paths. Reuse the new Landlock helper from Compositor as well, and allow its Mesa shader cache directory so GPU startup can populate shader cache files after sandboxing.
2026-06-09 06:47:04 -03:00
#ifndef __NR_fsync
# undef IF_DEFINED_fsync
# define IF_DEFINED_fsync(if_defined, if_not_defined) if_not_defined
#endif
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
#ifndef __NR_futex_time64
# undef IF_DEFINED_futex_time64
# define IF_DEFINED_futex_time64(if_defined, if_not_defined) if_not_defined
#endif
RequestServer: Sandbox the process on Linux Add opt-in Linux sandbox support to RequestServer. Ladybird and test-web pass --enable-sandbox through when requested, and RequestServer only installs the sandbox when that flag is present. Allow reads for resolver and TLS configuration, plus the configured certificate locations. Create and allow writes to the Ladybird cache root, so libcurl alt-svc files and HTTP disk-cache files stay inside the single writable tree. Also allow the systemd-resolved runtime directory when present, since /etc/resolv.conf can point there. Extend LibSandbox with owned Landlock paths, an add-if-exists helper, read/write Landlock access, and reusable seccomp groups for filesystem writes and network syscalls. Include POSIX file locks and socket byte count ioctls needed by libc resolver and cache paths. Reuse the new Landlock helper from Compositor as well, and allow its Mesa shader cache directory so GPU startup can populate shader cache files after sandboxing.
2026-06-09 06:47:04 -03:00
#ifndef __NR_getdents64
# undef IF_DEFINED_getdents64
# define IF_DEFINED_getdents64(if_defined, if_not_defined) if_not_defined
#endif
#ifndef __NR_link
# undef IF_DEFINED_link
# define IF_DEFINED_link(if_defined, if_not_defined) if_not_defined
#endif
#ifndef __NR_linkat
# undef IF_DEFINED_linkat
# define IF_DEFINED_linkat(if_defined, if_not_defined) if_not_defined
#endif
#ifndef __NR_listen
# undef IF_DEFINED_listen
# define IF_DEFINED_listen(if_defined, if_not_defined) if_not_defined
#endif
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
#ifndef __NR_getcpu
# undef IF_DEFINED_getcpu
# define IF_DEFINED_getcpu(if_defined, if_not_defined) if_not_defined
#endif
#ifndef __NR_getrandom
# undef IF_DEFINED_getrandom
# define IF_DEFINED_getrandom(if_defined, if_not_defined) if_not_defined
#endif
#ifndef __NR_membarrier
# undef IF_DEFINED_membarrier
# define IF_DEFINED_membarrier(if_defined, if_not_defined) if_not_defined
#endif
#ifndef __NR_memfd_create
# undef IF_DEFINED_memfd_create
# define IF_DEFINED_memfd_create(if_defined, if_not_defined) if_not_defined
#endif
WebContent: Sandbox renderer processes on Linux Add opt-in Linux renderer sandbox support to WebContent and WebWorker. Ladybird and test-web pass --enable-sandbox through when requested, and the renderer services only install the shared sandbox when that flag is present. Share one renderer policy for both services. Allow resource, font, shared library, WebGL, Wasm, audio, and local IPC paths needed at runtime, while keeping renderer filesystem writes mediated by Landlock. Allow Mesa and PulseAudio to probe their standard runtime state without escaping the renderer sandbox. Return EPERM for scheduler and priority changes so library initialization can fall back instead of crashing on a seccomp violation.
2026-06-09 08:26:47 -03:00
#ifndef __NR_mkdir
# undef IF_DEFINED_mkdir
# define IF_DEFINED_mkdir(if_defined, if_not_defined) if_not_defined
#endif
#ifndef __NR_mkdirat
# undef IF_DEFINED_mkdirat
# define IF_DEFINED_mkdirat(if_defined, if_not_defined) if_not_defined
#endif
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
#ifndef __NR_mmap2
# undef IF_DEFINED_mmap2
# define IF_DEFINED_mmap2(if_defined, if_not_defined) if_not_defined
#endif
#ifndef __NR_pipe2
# undef IF_DEFINED_pipe2
# define IF_DEFINED_pipe2(if_defined, if_not_defined) if_not_defined
#endif
Compositor: Allow sandboxed font resource reads Compositor still needs to decode font resources from display-list IPC after startup. Let its sandbox grant read-only access to configured font directories and bundled resource fonts through Landlock, and allow read-only open plus metadata syscalls in the seccomp policy. Preload the same font directories before installing the sandbox so the Compositor can handle display lists that reference system-backed fonts. The full test-web suite completes without Compositor sandbox crashes.
2026-06-09 06:22:30 -03:00
#ifndef __NR_newfstatat
# undef IF_DEFINED_newfstatat
# define IF_DEFINED_newfstatat(if_defined, if_not_defined) if_not_defined
#endif
RequestServer: Sandbox the process on Linux Add opt-in Linux sandbox support to RequestServer. Ladybird and test-web pass --enable-sandbox through when requested, and RequestServer only installs the sandbox when that flag is present. Allow reads for resolver and TLS configuration, plus the configured certificate locations. Create and allow writes to the Ladybird cache root, so libcurl alt-svc files and HTTP disk-cache files stay inside the single writable tree. Also allow the systemd-resolved runtime directory when present, since /etc/resolv.conf can point there. Extend LibSandbox with owned Landlock paths, an add-if-exists helper, read/write Landlock access, and reusable seccomp groups for filesystem writes and network syscalls. Include POSIX file locks and socket byte count ioctls needed by libc resolver and cache paths. Reuse the new Landlock helper from Compositor as well, and allow its Mesa shader cache directory so GPU startup can populate shader cache files after sandboxing.
2026-06-09 06:47:04 -03:00
#ifndef __NR_open
# undef IF_DEFINED_open
# define IF_DEFINED_open(if_defined, if_not_defined) if_not_defined
#endif
#ifndef __NR_openat
# undef IF_DEFINED_openat
# define IF_DEFINED_openat(if_defined, if_not_defined) if_not_defined
#endif
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
#ifndef __NR_poll
# undef IF_DEFINED_poll
# define IF_DEFINED_poll(if_defined, if_not_defined) if_not_defined
#endif
RequestServer: Sandbox the process on Linux Add opt-in Linux sandbox support to RequestServer. Ladybird and test-web pass --enable-sandbox through when requested, and RequestServer only installs the sandbox when that flag is present. Allow reads for resolver and TLS configuration, plus the configured certificate locations. Create and allow writes to the Ladybird cache root, so libcurl alt-svc files and HTTP disk-cache files stay inside the single writable tree. Also allow the systemd-resolved runtime directory when present, since /etc/resolv.conf can point there. Extend LibSandbox with owned Landlock paths, an add-if-exists helper, read/write Landlock access, and reusable seccomp groups for filesystem writes and network syscalls. Include POSIX file locks and socket byte count ioctls needed by libc resolver and cache paths. Reuse the new Landlock helper from Compositor as well, and allow its Mesa shader cache directory so GPU startup can populate shader cache files after sandboxing.
2026-06-09 06:47:04 -03:00
#ifndef __NR_pread64
# undef IF_DEFINED_pread64
# define IF_DEFINED_pread64(if_defined, if_not_defined) if_not_defined
#endif
#ifndef __NR_readlink
# undef IF_DEFINED_readlink
# define IF_DEFINED_readlink(if_defined, if_not_defined) if_not_defined
#endif
#ifndef __NR_readlinkat
# undef IF_DEFINED_readlinkat
# define IF_DEFINED_readlinkat(if_defined, if_not_defined) if_not_defined
#endif
#ifndef __NR_rename
# undef IF_DEFINED_rename
# define IF_DEFINED_rename(if_defined, if_not_defined) if_not_defined
#endif
#ifndef __NR_renameat
# undef IF_DEFINED_renameat
# define IF_DEFINED_renameat(if_defined, if_not_defined) if_not_defined
#endif
#ifndef __NR_renameat2
# undef IF_DEFINED_renameat2
# define IF_DEFINED_renameat2(if_defined, if_not_defined) if_not_defined
#endif
WebContent: Sandbox renderer processes on Linux Add opt-in Linux renderer sandbox support to WebContent and WebWorker. Ladybird and test-web pass --enable-sandbox through when requested, and the renderer services only install the shared sandbox when that flag is present. Share one renderer policy for both services. Allow resource, font, shared library, WebGL, Wasm, audio, and local IPC paths needed at runtime, while keeping renderer filesystem writes mediated by Landlock. Allow Mesa and PulseAudio to probe their standard runtime state without escaping the renderer sandbox. Return EPERM for scheduler and priority changes so library initialization can fall back instead of crashing on a seccomp violation.
2026-06-09 08:26:47 -03:00
#ifndef __NR_rmdir
# undef IF_DEFINED_rmdir
# define IF_DEFINED_rmdir(if_defined, if_not_defined) if_not_defined
#endif
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
#ifndef __NR_ppoll
# undef IF_DEFINED_ppoll
# define IF_DEFINED_ppoll(if_defined, if_not_defined) if_not_defined
#endif
#ifndef __NR_prlimit64
# undef IF_DEFINED_prlimit64
# define IF_DEFINED_prlimit64(if_defined, if_not_defined) if_not_defined
#endif
#ifndef __NR_pselect6
# undef IF_DEFINED_pselect6
# define IF_DEFINED_pselect6(if_defined, if_not_defined) if_not_defined
#endif
#ifndef __NR_pwrite64
# undef IF_DEFINED_pwrite64
# define IF_DEFINED_pwrite64(if_defined, if_not_defined) if_not_defined
#endif
#ifndef __NR_recvmmsg
# undef IF_DEFINED_recvmmsg
# define IF_DEFINED_recvmmsg(if_defined, if_not_defined) if_not_defined
#endif
#ifndef __NR_restart_syscall
# undef IF_DEFINED_restart_syscall
# define IF_DEFINED_restart_syscall(if_defined, if_not_defined) if_not_defined
#endif
#ifndef __NR_rseq
# undef IF_DEFINED_rseq
# define IF_DEFINED_rseq(if_defined, if_not_defined) if_not_defined
#endif
#ifndef __NR_sendmmsg
# undef IF_DEFINED_sendmmsg
# define IF_DEFINED_sendmmsg(if_defined, if_not_defined) if_not_defined
#endif
RequestServer: Sandbox the process on Linux Add opt-in Linux sandbox support to RequestServer. Ladybird and test-web pass --enable-sandbox through when requested, and RequestServer only installs the sandbox when that flag is present. Allow reads for resolver and TLS configuration, plus the configured certificate locations. Create and allow writes to the Ladybird cache root, so libcurl alt-svc files and HTTP disk-cache files stay inside the single writable tree. Also allow the systemd-resolved runtime directory when present, since /etc/resolv.conf can point there. Extend LibSandbox with owned Landlock paths, an add-if-exists helper, read/write Landlock access, and reusable seccomp groups for filesystem writes and network syscalls. Include POSIX file locks and socket byte count ioctls needed by libc resolver and cache paths. Reuse the new Landlock helper from Compositor as well, and allow its Mesa shader cache directory so GPU startup can populate shader cache files after sandboxing.
2026-06-09 06:47:04 -03:00
#ifndef __NR_sendfile
# undef IF_DEFINED_sendfile
# define IF_DEFINED_sendfile(if_defined, if_not_defined) if_not_defined
#endif
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
#ifndef __NR_sigaltstack
# undef IF_DEFINED_sigaltstack
# define IF_DEFINED_sigaltstack(if_defined, if_not_defined) if_not_defined
#endif
RequestServer: Sandbox the process on Linux Add opt-in Linux sandbox support to RequestServer. Ladybird and test-web pass --enable-sandbox through when requested, and RequestServer only installs the sandbox when that flag is present. Allow reads for resolver and TLS configuration, plus the configured certificate locations. Create and allow writes to the Ladybird cache root, so libcurl alt-svc files and HTTP disk-cache files stay inside the single writable tree. Also allow the systemd-resolved runtime directory when present, since /etc/resolv.conf can point there. Extend LibSandbox with owned Landlock paths, an add-if-exists helper, read/write Landlock access, and reusable seccomp groups for filesystem writes and network syscalls. Include POSIX file locks and socket byte count ioctls needed by libc resolver and cache paths. Reuse the new Landlock helper from Compositor as well, and allow its Mesa shader cache directory so GPU startup can populate shader cache files after sandboxing.
2026-06-09 06:47:04 -03:00
#ifndef __NR_socket
# undef IF_DEFINED_socket
# define IF_DEFINED_socket(if_defined, if_not_defined) if_not_defined
#endif
#ifndef __NR_shutdown
# undef IF_DEFINED_shutdown
# define IF_DEFINED_shutdown(if_defined, if_not_defined) if_not_defined
#endif
Compositor: Allow sandboxed font resource reads Compositor still needs to decode font resources from display-list IPC after startup. Let its sandbox grant read-only access to configured font directories and bundled resource fonts through Landlock, and allow read-only open plus metadata syscalls in the seccomp policy. Preload the same font directories before installing the sandbox so the Compositor can handle display lists that reference system-backed fonts. The full test-web suite completes without Compositor sandbox crashes.
2026-06-09 06:22:30 -03:00
#ifndef __NR_statx
# undef IF_DEFINED_statx
# define IF_DEFINED_statx(if_defined, if_not_defined) if_not_defined
#endif
RequestServer: Sandbox the process on Linux Add opt-in Linux sandbox support to RequestServer. Ladybird and test-web pass --enable-sandbox through when requested, and RequestServer only installs the sandbox when that flag is present. Allow reads for resolver and TLS configuration, plus the configured certificate locations. Create and allow writes to the Ladybird cache root, so libcurl alt-svc files and HTTP disk-cache files stay inside the single writable tree. Also allow the systemd-resolved runtime directory when present, since /etc/resolv.conf can point there. Extend LibSandbox with owned Landlock paths, an add-if-exists helper, read/write Landlock access, and reusable seccomp groups for filesystem writes and network syscalls. Include POSIX file locks and socket byte count ioctls needed by libc resolver and cache paths. Reuse the new Landlock helper from Compositor as well, and allow its Mesa shader cache directory so GPU startup can populate shader cache files after sandboxing.
2026-06-09 06:47:04 -03:00
#ifndef __NR_unlink
# undef IF_DEFINED_unlink
# define IF_DEFINED_unlink(if_defined, if_not_defined) if_not_defined
#endif
#ifndef __NR_unlinkat
# undef IF_DEFINED_unlinkat
# define IF_DEFINED_unlinkat(if_defined, if_not_defined) if_not_defined
#endif
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
#ifndef __NR_sysinfo
# undef IF_DEFINED_sysinfo
# define IF_DEFINED_sysinfo(if_defined, if_not_defined) if_not_defined
#endif
#ifndef __NR_umask
# undef IF_DEFINED_umask
# define IF_DEFINED_umask(if_defined, if_not_defined) if_not_defined
#endif
WebContent: Sandbox renderer processes on Linux Add opt-in Linux renderer sandbox support to WebContent and WebWorker. Ladybird and test-web pass --enable-sandbox through when requested, and the renderer services only install the shared sandbox when that flag is present. Share one renderer policy for both services. Allow resource, font, shared library, WebGL, Wasm, audio, and local IPC paths needed at runtime, while keeping renderer filesystem writes mediated by Landlock. Allow Mesa and PulseAudio to probe their standard runtime state without escaping the renderer sandbox. Return EPERM for scheduler and priority changes so library initialization can fall back instead of crashing on a seccomp violation.
2026-06-09 08:26:47 -03:00
#ifndef __NR_wait4
# undef IF_DEFINED_wait4
# define IF_DEFINED_wait4(if_defined, if_not_defined) if_not_defined
#endif
#ifndef __NR_waitid
# undef IF_DEFINED_waitid
# define IF_DEFINED_waitid(if_defined, if_not_defined) if_not_defined
#endif
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
static size_t safe_string_length(char const* string)
{
size_t length = 0;
while (string[length] != '\0')
++length;
return length;
}
static void write_bytes(char const* string, size_t length)
{
while (length > 0) {
auto written = write(STDERR_FILENO, string, length);
if (written <= 0)
return;
string += written;
length -= static_cast<size_t>(written);
}
}
static void write_string(char const* string)
{
write_bytes(string, safe_string_length(string));
}
static void write_unsigned(u64 value)
{
char buffer[20];
size_t index = sizeof(buffer);
do {
buffer[--index] = static_cast<char>('0' + (value % 10));
value /= 10;
} while (value > 0);
write_bytes(buffer + index, sizeof(buffer) - index);
}
static void write_hex(u64 value)
{
constexpr char const* digits = "0123456789abcdef";
char buffer[16];
size_t index = sizeof(buffer);
do {
buffer[--index] = digits[value & 0xf];
value >>= 4;
} while (value > 0);
write_string("0x");
write_bytes(buffer + index, sizeof(buffer) - index);
}
#define CASE_SYSCALL_NAME(name) \
case __NR_##name: \
return #name
static char const* syscall_name(long syscall_number)
{
switch (syscall_number) {
#ifdef __NR_accept
CASE_SYSCALL_NAME(accept);
#endif
#ifdef __NR_accept4
CASE_SYSCALL_NAME(accept4);
#endif
#ifdef __NR_access
CASE_SYSCALL_NAME(access);
#endif
#ifdef __NR_bind
CASE_SYSCALL_NAME(bind);
#endif
#ifdef __NR_clone
CASE_SYSCALL_NAME(clone);
#endif
#ifdef __NR_clone3
CASE_SYSCALL_NAME(clone3);
#endif
#ifdef __NR_connect
CASE_SYSCALL_NAME(connect);
#endif
#ifdef __NR_execve
CASE_SYSCALL_NAME(execve);
#endif
#ifdef __NR_execveat
CASE_SYSCALL_NAME(execveat);
#endif
LibSandbox: Permit `faccessat2`, `faccessat` and `fstatfs` SDL enumerates connected input devices through libudev whenever a device is added or removed, which probes per-device metadata using `faccessat2` and `fstatfs`. These calls run after the seccomp filter is installed, and neither syscall was permitted, so connecting a gamepad killed the WebContent process with SIGSYS. We now permit `faccessat` alongside `faccessat2` because glibc's `faccessat` wrapper falls back to it on kernels without `faccessat2`.
2026-06-12 14:59:34 -03:00
#ifdef __NR_faccessat
CASE_SYSCALL_NAME(faccessat);
#endif
#ifdef __NR_faccessat2
CASE_SYSCALL_NAME(faccessat2);
#endif
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
#ifdef __NR_fcntl
CASE_SYSCALL_NAME(fcntl);
#endif
#ifdef __NR_fcntl64
CASE_SYSCALL_NAME(fcntl64);
#endif
#ifdef __NR_fstat
CASE_SYSCALL_NAME(fstat);
#endif
LibSandbox: Permit `faccessat2`, `faccessat` and `fstatfs` SDL enumerates connected input devices through libudev whenever a device is added or removed, which probes per-device metadata using `faccessat2` and `fstatfs`. These calls run after the seccomp filter is installed, and neither syscall was permitted, so connecting a gamepad killed the WebContent process with SIGSYS. We now permit `faccessat` alongside `faccessat2` because glibc's `faccessat` wrapper falls back to it on kernels without `faccessat2`.
2026-06-12 14:59:34 -03:00
#ifdef __NR_fstatfs
CASE_SYSCALL_NAME(fstatfs);
#endif
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
#ifdef __NR_futex
CASE_SYSCALL_NAME(futex);
#endif
#ifdef __NR_getdents64
CASE_SYSCALL_NAME(getdents64);
#endif
#ifdef __NR_ioctl
CASE_SYSCALL_NAME(ioctl);
#endif
#ifdef __NR_link
CASE_SYSCALL_NAME(link);
#endif
#ifdef __NR_linkat
CASE_SYSCALL_NAME(linkat);
#endif
#ifdef __NR_memfd_create
CASE_SYSCALL_NAME(memfd_create);
#endif
#ifdef __NR_mkdir
CASE_SYSCALL_NAME(mkdir);
#endif
#ifdef __NR_mkdirat
CASE_SYSCALL_NAME(mkdirat);
#endif
#ifdef __NR_mmap
CASE_SYSCALL_NAME(mmap);
#endif
#ifdef __NR_mmap2
CASE_SYSCALL_NAME(mmap2);
#endif
#ifdef __NR_mprotect
CASE_SYSCALL_NAME(mprotect);
#endif
#ifdef __NR_newfstatat
CASE_SYSCALL_NAME(newfstatat);
#endif
#ifdef __NR_open
CASE_SYSCALL_NAME(open);
#endif
#ifdef __NR_openat
CASE_SYSCALL_NAME(openat);
#endif
#ifdef __NR_prctl
CASE_SYSCALL_NAME(prctl);
#endif
#ifdef __NR_readlink
CASE_SYSCALL_NAME(readlink);
#endif
#ifdef __NR_readlinkat
CASE_SYSCALL_NAME(readlinkat);
#endif
#ifdef __NR_rename
CASE_SYSCALL_NAME(rename);
#endif
#ifdef __NR_renameat
CASE_SYSCALL_NAME(renameat);
#endif
#ifdef __NR_renameat2
CASE_SYSCALL_NAME(renameat2);
#endif
#ifdef __NR_rmdir
CASE_SYSCALL_NAME(rmdir);
#endif
#ifdef __NR_sched_setaffinity
CASE_SYSCALL_NAME(sched_setaffinity);
#endif
#ifdef __NR_sched_setparam
CASE_SYSCALL_NAME(sched_setparam);
#endif
#ifdef __NR_sched_setscheduler
CASE_SYSCALL_NAME(sched_setscheduler);
#endif
#ifdef __NR_seccomp
CASE_SYSCALL_NAME(seccomp);
#endif
#ifdef __NR_socket
CASE_SYSCALL_NAME(socket);
#endif
#ifdef __NR_statx
CASE_SYSCALL_NAME(statx);
#endif
#ifdef __NR_unlink
CASE_SYSCALL_NAME(unlink);
#endif
#ifdef __NR_unlinkat
CASE_SYSCALL_NAME(unlinkat);
#endif
default:
return "unknown";
}
}
#undef CASE_SYSCALL_NAME
static void handle_sigsys(int, siginfo_t* info, void* context)
{
write_string("Sandbox violation: disallowed syscall ");
write_string(syscall_name(info->si_syscall));
write_string(" (");
write_unsigned(static_cast<u64>(info->si_syscall));
write_string("), architecture ");
write_hex(info->si_arch);
write_string(", instruction pointer ");
write_hex(reinterpret_cast<FlatPtr>(info->si_call_addr));
#if defined(__x86_64__)
auto* machine_context = &static_cast<ucontext_t*>(context)->uc_mcontext;
write_string(", args [");
write_hex(static_cast<u64>(machine_context->gregs[REG_RDI]));
write_string(", ");
write_hex(static_cast<u64>(machine_context->gregs[REG_RSI]));
write_string(", ");
write_hex(static_cast<u64>(machine_context->gregs[REG_RDX]));
write_string(", ");
write_hex(static_cast<u64>(machine_context->gregs[REG_R10]));
write_string(", ");
write_hex(static_cast<u64>(machine_context->gregs[REG_R8]));
write_string(", ");
write_hex(static_cast<u64>(machine_context->gregs[REG_R9]));
write_string("]");
#elif defined(__aarch64__)
auto* machine_context = &static_cast<ucontext_t*>(context)->uc_mcontext;
write_string(", args [");
for (size_t i = 0; i < 6; ++i) {
if (i != 0)
write_string(", ");
write_hex(static_cast<u64>(machine_context->regs[i]));
}
write_string("]");
#endif
write_string("\n");
struct sigaction action {};
action.sa_handler = SIG_DFL;
sigemptyset(&action.sa_mask);
sigaction(SIGSYS, &action, nullptr);
raise(SIGSYS);
_exit(128 + SIGSYS);
}
static ErrorOr<void> install_sigsys_handler()
{
struct sigaction action {};
action.sa_sigaction = handle_sigsys;
action.sa_flags = SA_SIGINFO;
if (sigemptyset(&action.sa_mask) < 0)
return Error::from_syscall("sigemptyset"sv, errno);
if (sigaction(SIGSYS, &action, nullptr) < 0)
return Error::from_syscall("sigaction(SIGSYS)"sv, errno);
return {};
}
}
SeccompPolicy::SeccompPolicy()
{
append_architecture_check();
append_load_syscall_number();
}
void SeccompPolicy::append(sock_filter filter)
{
MUST(m_filter.try_append(filter));
}
void SeccompPolicy::append_architecture_check()
{
append(SECCOMP_LOAD_ARCHITECTURE);
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, audit_architecture, 1, 0));
append(SECCOMP_TRAP);
}
void SeccompPolicy::append_load_syscall_number()
{
append(SECCOMP_LOAD_SYSCALL_NR);
}
void SeccompPolicy::append_kill()
{
append(SECCOMP_TRAP);
}
void SeccompPolicy::deny_readonly_filesystem_probes()
{
#ifdef __NR_open
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_open, 0, 5));
append(SECCOMP_LOAD_ARGUMENT(1));
append(BPF_STMT(BPF_ALU | BPF_AND | BPF_K, ~read_only_open_flags));
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0, 0, 1));
append(SECCOMP_ERRNO(EACCES));
append(SECCOMP_LOAD_SYSCALL_NR);
#endif
#ifdef __NR_openat
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_openat, 0, 5));
append(SECCOMP_LOAD_ARGUMENT(2));
append(BPF_STMT(BPF_ALU | BPF_AND | BPF_K, ~read_only_open_flags));
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0, 0, 1));
append(SECCOMP_ERRNO(EACCES));
append(SECCOMP_LOAD_SYSCALL_NR);
#endif
}
Compositor: Allow sandboxed font resource reads Compositor still needs to decode font resources from display-list IPC after startup. Let its sandbox grant read-only access to configured font directories and bundled resource fonts through Landlock, and allow read-only open plus metadata syscalls in the seccomp policy. Preload the same font directories before installing the sandbox so the Compositor can handle display lists that reference system-backed fonts. The full test-web suite completes without Compositor sandbox crashes.
2026-06-09 06:22:30 -03:00
void SeccompPolicy::allow_readonly_file_opens()
{
#ifdef __NR_open
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_open, 0, 5));
append(SECCOMP_LOAD_ARGUMENT(1));
append(BPF_STMT(BPF_ALU | BPF_AND | BPF_K, ~read_only_open_flags));
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0, 0, 1));
append(SECCOMP_ALLOW);
append(SECCOMP_LOAD_SYSCALL_NR);
#endif
#ifdef __NR_openat
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_openat, 0, 5));
append(SECCOMP_LOAD_ARGUMENT(2));
append(BPF_STMT(BPF_ALU | BPF_AND | BPF_K, ~read_only_open_flags));
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0, 0, 1));
append(SECCOMP_ALLOW);
append(SECCOMP_LOAD_SYSCALL_NR);
#endif
}
void SeccompPolicy::allow_filesystem_metadata_queries()
{
RequestServer: Sandbox the process on Linux Add opt-in Linux sandbox support to RequestServer. Ladybird and test-web pass --enable-sandbox through when requested, and RequestServer only installs the sandbox when that flag is present. Allow reads for resolver and TLS configuration, plus the configured certificate locations. Create and allow writes to the Ladybird cache root, so libcurl alt-svc files and HTTP disk-cache files stay inside the single writable tree. Also allow the systemd-resolved runtime directory when present, since /etc/resolv.conf can point there. Extend LibSandbox with owned Landlock paths, an add-if-exists helper, read/write Landlock access, and reusable seccomp groups for filesystem writes and network syscalls. Include POSIX file locks and socket byte count ioctls needed by libc resolver and cache paths. Reuse the new Landlock helper from Compositor as well, and allow its Mesa shader cache directory so GPU startup can populate shader cache files after sandboxing.
2026-06-09 06:47:04 -03:00
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, access);
LibSandbox: Permit `faccessat2`, `faccessat` and `fstatfs` SDL enumerates connected input devices through libudev whenever a device is added or removed, which probes per-device metadata using `faccessat2` and `fstatfs`. These calls run after the seccomp filter is installed, and neither syscall was permitted, so connecting a gamepad killed the WebContent process with SIGSYS. We now permit `faccessat` alongside `faccessat2` because glibc's `faccessat` wrapper falls back to it on kernels without `faccessat2`.
2026-06-12 14:59:34 -03:00
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, faccessat);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, faccessat2);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, fstatfs);
RequestServer: Sandbox the process on Linux Add opt-in Linux sandbox support to RequestServer. Ladybird and test-web pass --enable-sandbox through when requested, and RequestServer only installs the sandbox when that flag is present. Allow reads for resolver and TLS configuration, plus the configured certificate locations. Create and allow writes to the Ladybird cache root, so libcurl alt-svc files and HTTP disk-cache files stay inside the single writable tree. Also allow the systemd-resolved runtime directory when present, since /etc/resolv.conf can point there. Extend LibSandbox with owned Landlock paths, an add-if-exists helper, read/write Landlock access, and reusable seccomp groups for filesystem writes and network syscalls. Include POSIX file locks and socket byte count ioctls needed by libc resolver and cache paths. Reuse the new Landlock helper from Compositor as well, and allow its Mesa shader cache directory so GPU startup can populate shader cache files after sandboxing.
2026-06-09 06:47:04 -03:00
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, getdents64);
Compositor: Allow sandboxed font resource reads Compositor still needs to decode font resources from display-list IPC after startup. Let its sandbox grant read-only access to configured font directories and bundled resource fonts through Landlock, and allow read-only open plus metadata syscalls in the seccomp policy. Preload the same font directories before installing the sandbox so the Compositor can handle display lists that reference system-backed fonts. The full test-web suite completes without Compositor sandbox crashes.
2026-06-09 06:22:30 -03:00
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, newfstatat);
RequestServer: Sandbox the process on Linux Add opt-in Linux sandbox support to RequestServer. Ladybird and test-web pass --enable-sandbox through when requested, and RequestServer only installs the sandbox when that flag is present. Allow reads for resolver and TLS configuration, plus the configured certificate locations. Create and allow writes to the Ladybird cache root, so libcurl alt-svc files and HTTP disk-cache files stay inside the single writable tree. Also allow the systemd-resolved runtime directory when present, since /etc/resolv.conf can point there. Extend LibSandbox with owned Landlock paths, an add-if-exists helper, read/write Landlock access, and reusable seccomp groups for filesystem writes and network syscalls. Include POSIX file locks and socket byte count ioctls needed by libc resolver and cache paths. Reuse the new Landlock helper from Compositor as well, and allow its Mesa shader cache directory so GPU startup can populate shader cache files after sandboxing.
2026-06-09 06:47:04 -03:00
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, readlink);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, readlinkat);
Compositor: Allow sandboxed font resource reads Compositor still needs to decode font resources from display-list IPC after startup. Let its sandbox grant read-only access to configured font directories and bundled resource fonts through Landlock, and allow read-only open plus metadata syscalls in the seccomp policy. Preload the same font directories before installing the sandbox so the Compositor can handle display lists that reference system-backed fonts. The full test-web suite completes without Compositor sandbox crashes.
2026-06-09 06:22:30 -03:00
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, statx);
}
RequestServer: Sandbox the process on Linux Add opt-in Linux sandbox support to RequestServer. Ladybird and test-web pass --enable-sandbox through when requested, and RequestServer only installs the sandbox when that flag is present. Allow reads for resolver and TLS configuration, plus the configured certificate locations. Create and allow writes to the Ladybird cache root, so libcurl alt-svc files and HTTP disk-cache files stay inside the single writable tree. Also allow the systemd-resolved runtime directory when present, since /etc/resolv.conf can point there. Extend LibSandbox with owned Landlock paths, an add-if-exists helper, read/write Landlock access, and reusable seccomp groups for filesystem writes and network syscalls. Include POSIX file locks and socket byte count ioctls needed by libc resolver and cache paths. Reuse the new Landlock helper from Compositor as well, and allow its Mesa shader cache directory so GPU startup can populate shader cache files after sandboxing.
2026-06-09 06:47:04 -03:00
void SeccompPolicy::allow_filesystem_writes()
{
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, open);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, openat);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, unlink);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, unlinkat);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, link);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, linkat);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, rename);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, renameat);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, renameat2);
WebContent: Sandbox renderer processes on Linux Add opt-in Linux renderer sandbox support to WebContent and WebWorker. Ladybird and test-web pass --enable-sandbox through when requested, and the renderer services only install the shared sandbox when that flag is present. Share one renderer policy for both services. Allow resource, font, shared library, WebGL, Wasm, audio, and local IPC paths needed at runtime, while keeping renderer filesystem writes mediated by Landlock. Allow Mesa and PulseAudio to probe their standard runtime state without escaping the renderer sandbox. Return EPERM for scheduler and priority changes so library initialization can fall back instead of crashing on a seccomp violation.
2026-06-09 08:26:47 -03:00
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, mkdir);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, mkdirat);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, rmdir);
RequestServer: Sandbox the process on Linux Add opt-in Linux sandbox support to RequestServer. Ladybird and test-web pass --enable-sandbox through when requested, and RequestServer only installs the sandbox when that flag is present. Allow reads for resolver and TLS configuration, plus the configured certificate locations. Create and allow writes to the Ladybird cache root, so libcurl alt-svc files and HTTP disk-cache files stay inside the single writable tree. Also allow the systemd-resolved runtime directory when present, since /etc/resolv.conf can point there. Extend LibSandbox with owned Landlock paths, an add-if-exists helper, read/write Landlock access, and reusable seccomp groups for filesystem writes and network syscalls. Include POSIX file locks and socket byte count ioctls needed by libc resolver and cache paths. Reuse the new Landlock helper from Compositor as well, and allow its Mesa shader cache directory so GPU startup can populate shader cache files after sandboxing.
2026-06-09 06:47:04 -03:00
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, fsync);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, fdatasync);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, flock);
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_fcntl, 0, 5));
append(SECCOMP_LOAD_ARGUMENT(1));
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, F_GETLK, 0, 1));
append(SECCOMP_ALLOW);
append(SECCOMP_LOAD_SYSCALL_NR);
append(BPF_STMT(BPF_ALU | BPF_ADD | BPF_K, 0));
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_fcntl, 0, 5));
append(SECCOMP_LOAD_ARGUMENT(1));
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, F_SETLK, 0, 1));
append(SECCOMP_ALLOW);
append(SECCOMP_LOAD_SYSCALL_NR);
append(BPF_STMT(BPF_ALU | BPF_ADD | BPF_K, 0));
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_fcntl, 0, 5));
append(SECCOMP_LOAD_ARGUMENT(1));
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, F_SETLKW, 0, 1));
append(SECCOMP_ALLOW);
append(SECCOMP_LOAD_SYSCALL_NR);
append(BPF_STMT(BPF_ALU | BPF_ADD | BPF_K, 0));
}
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
void SeccompPolicy::allow_file_descriptor_operations()
{
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, read);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, write);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, close);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, fstat);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, dup);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, dup3);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, pipe2);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, ftruncate);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, lseek);
RequestServer: Sandbox the process on Linux Add opt-in Linux sandbox support to RequestServer. Ladybird and test-web pass --enable-sandbox through when requested, and RequestServer only installs the sandbox when that flag is present. Allow reads for resolver and TLS configuration, plus the configured certificate locations. Create and allow writes to the Ladybird cache root, so libcurl alt-svc files and HTTP disk-cache files stay inside the single writable tree. Also allow the systemd-resolved runtime directory when present, since /etc/resolv.conf can point there. Extend LibSandbox with owned Landlock paths, an add-if-exists helper, read/write Landlock access, and reusable seccomp groups for filesystem writes and network syscalls. Include POSIX file locks and socket byte count ioctls needed by libc resolver and cache paths. Reuse the new Landlock helper from Compositor as well, and allow its Mesa shader cache directory so GPU startup can populate shader cache files after sandboxing.
2026-06-09 06:47:04 -03:00
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, pread64);
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, pwrite64);
RequestServer: Sandbox the process on Linux Add opt-in Linux sandbox support to RequestServer. Ladybird and test-web pass --enable-sandbox through when requested, and RequestServer only installs the sandbox when that flag is present. Allow reads for resolver and TLS configuration, plus the configured certificate locations. Create and allow writes to the Ladybird cache root, so libcurl alt-svc files and HTTP disk-cache files stay inside the single writable tree. Also allow the systemd-resolved runtime directory when present, since /etc/resolv.conf can point there. Extend LibSandbox with owned Landlock paths, an add-if-exists helper, read/write Landlock access, and reusable seccomp groups for filesystem writes and network syscalls. Include POSIX file locks and socket byte count ioctls needed by libc resolver and cache paths. Reuse the new Landlock helper from Compositor as well, and allow its Mesa shader cache directory so GPU startup can populate shader cache files after sandboxing.
2026-06-09 06:47:04 -03:00
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, sendfile);
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, memfd_create);
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_fcntl, 0, 5));
append(SECCOMP_LOAD_ARGUMENT(1));
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, F_GETFD, 0, 1));
append(SECCOMP_ALLOW);
append(SECCOMP_LOAD_SYSCALL_NR);
append(BPF_STMT(BPF_ALU | BPF_ADD | BPF_K, 0));
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_fcntl, 0, 5));
append(SECCOMP_LOAD_ARGUMENT(1));
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, F_SETFD, 0, 1));
append(SECCOMP_ALLOW);
append(SECCOMP_LOAD_SYSCALL_NR);
append(BPF_STMT(BPF_ALU | BPF_ADD | BPF_K, 0));
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_fcntl, 0, 5));
append(SECCOMP_LOAD_ARGUMENT(1));
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, F_GETFL, 0, 1));
append(SECCOMP_ALLOW);
append(SECCOMP_LOAD_SYSCALL_NR);
append(BPF_STMT(BPF_ALU | BPF_ADD | BPF_K, 0));
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_fcntl, 0, 5));
append(SECCOMP_LOAD_ARGUMENT(1));
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, F_SETFL, 0, 1));
append(SECCOMP_ALLOW);
append(SECCOMP_LOAD_SYSCALL_NR);
append(BPF_STMT(BPF_ALU | BPF_ADD | BPF_K, 0));
WebContent: Sandbox renderer processes on Linux Add opt-in Linux renderer sandbox support to WebContent and WebWorker. Ladybird and test-web pass --enable-sandbox through when requested, and the renderer services only install the shared sandbox when that flag is present. Share one renderer policy for both services. Allow resource, font, shared library, WebGL, Wasm, audio, and local IPC paths needed at runtime, while keeping renderer filesystem writes mediated by Landlock. Allow Mesa and PulseAudio to probe their standard runtime state without escaping the renderer sandbox. Return EPERM for scheduler and priority changes so library initialization can fall back instead of crashing on a seccomp violation.
2026-06-09 08:26:47 -03:00
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_fcntl, 0, 5));
append(SECCOMP_LOAD_ARGUMENT(1));
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, F_DUPFD_CLOEXEC, 0, 1));
append(SECCOMP_ALLOW);
append(SECCOMP_LOAD_SYSCALL_NR);
append(BPF_STMT(BPF_ALU | BPF_ADD | BPF_K, 0));
LibSandbox: Allow fcntl F_DUPFD_QUERY in seccomp policy Mesa uses F_DUPFD_QUERY during AMD winsys initialization to check if two DRM file descriptors refer to the same open file description. This happens while creating WebGL contexts through ANGLE/EGL, and was being trapped by the renderer sandbox on sites such as YouTube.
2026-06-09 17:29:08 -03:00
#ifdef F_DUPFD_QUERY
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_fcntl, 0, 5));
append(SECCOMP_LOAD_ARGUMENT(1));
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, F_DUPFD_QUERY, 0, 1));
append(SECCOMP_ALLOW);
append(SECCOMP_LOAD_SYSCALL_NR);
append(BPF_STMT(BPF_ALU | BPF_ADD | BPF_K, 0));
#endif
WebContent: Sandbox renderer processes on Linux Add opt-in Linux renderer sandbox support to WebContent and WebWorker. Ladybird and test-web pass --enable-sandbox through when requested, and the renderer services only install the shared sandbox when that flag is present. Share one renderer policy for both services. Allow resource, font, shared library, WebGL, Wasm, audio, and local IPC paths needed at runtime, while keeping renderer filesystem writes mediated by Landlock. Allow Mesa and PulseAudio to probe their standard runtime state without escaping the renderer sandbox. Return EPERM for scheduler and priority changes so library initialization can fall back instead of crashing on a seccomp violation.
2026-06-09 08:26:47 -03:00
#ifdef F_ADD_SEALS
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_fcntl, 0, 5));
append(SECCOMP_LOAD_ARGUMENT(1));
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, F_ADD_SEALS, 0, 1));
append(SECCOMP_ALLOW);
append(SECCOMP_LOAD_SYSCALL_NR);
append(BPF_STMT(BPF_ALU | BPF_ADD | BPF_K, 0));
#endif
#ifdef F_GET_SEALS
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_fcntl, 0, 5));
append(SECCOMP_LOAD_ARGUMENT(1));
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, F_GET_SEALS, 0, 1));
append(SECCOMP_ALLOW);
append(SECCOMP_LOAD_SYSCALL_NR);
append(BPF_STMT(BPF_ALU | BPF_ADD | BPF_K, 0));
#endif
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_ioctl, 0, 5));
append(SECCOMP_LOAD_ARGUMENT(1));
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, FIONBIO, 0, 1));
append(SECCOMP_ALLOW);
append(SECCOMP_LOAD_SYSCALL_NR);
append(BPF_STMT(BPF_ALU | BPF_ADD | BPF_K, 0));
RequestServer: Sandbox the process on Linux Add opt-in Linux sandbox support to RequestServer. Ladybird and test-web pass --enable-sandbox through when requested, and RequestServer only installs the sandbox when that flag is present. Allow reads for resolver and TLS configuration, plus the configured certificate locations. Create and allow writes to the Ladybird cache root, so libcurl alt-svc files and HTTP disk-cache files stay inside the single writable tree. Also allow the systemd-resolved runtime directory when present, since /etc/resolv.conf can point there. Extend LibSandbox with owned Landlock paths, an add-if-exists helper, read/write Landlock access, and reusable seccomp groups for filesystem writes and network syscalls. Include POSIX file locks and socket byte count ioctls needed by libc resolver and cache paths. Reuse the new Landlock helper from Compositor as well, and allow its Mesa shader cache directory so GPU startup can populate shader cache files after sandboxing.
2026-06-09 06:47:04 -03:00
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_ioctl, 0, 5));
append(SECCOMP_LOAD_ARGUMENT(1));
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, FIONREAD, 0, 1));
append(SECCOMP_ALLOW);
append(SECCOMP_LOAD_SYSCALL_NR);
append(BPF_STMT(BPF_ALU | BPF_ADD | BPF_K, 0));
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_ioctl, 0, 5));
append(SECCOMP_LOAD_ARGUMENT(1));
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, TCGETS, 0, 1));
append(SECCOMP_ALLOW);
append(SECCOMP_LOAD_SYSCALL_NR);
append(BPF_STMT(BPF_ALU | BPF_ADD | BPF_K, 0));
LibSandbox: Allow TCGETS2 fd queries WebContent is about to stop using the broad GPU device sandbox allowance. That also removes the accidental permission for every ioctl, which exposes ordinary terminal attribute queries made while printing diagnostics. The media decode error path can ask stderr for TCGETS2 while reporting a corrupt video frame. Allow that narrow fd metadata query alongside TCGETS, FIONBIO, and FIONREAD so renderer processes can keep the GPU ioctl denial without crashing the media decode-error coverage.
2026-06-18 04:51:54 -03:00
#ifdef TCGETS2
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_ioctl, 0, 5));
append(SECCOMP_LOAD_ARGUMENT(1));
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, TCGETS2, 0, 1));
append(SECCOMP_ALLOW);
append(SECCOMP_LOAD_SYSCALL_NR);
append(BPF_STMT(BPF_ALU | BPF_ADD | BPF_K, 0));
#endif
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
}
WebContent: Sandbox renderer processes on Linux Add opt-in Linux renderer sandbox support to WebContent and WebWorker. Ladybird and test-web pass --enable-sandbox through when requested, and the renderer services only install the shared sandbox when that flag is present. Share one renderer policy for both services. Allow resource, font, shared library, WebGL, Wasm, audio, and local IPC paths needed at runtime, while keeping renderer filesystem writes mediated by Landlock. Allow Mesa and PulseAudio to probe their standard runtime state without escaping the renderer sandbox. Return EPERM for scheduler and priority changes so library initialization can fall back instead of crashing on a seccomp violation.
2026-06-09 08:26:47 -03:00
void SeccompPolicy::allow_process_creation()
{
#ifdef __NR_clone
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_clone, 0, 5));
append(SECCOMP_LOAD_ARGUMENT(0));
append(BPF_STMT(BPF_ALU | BPF_AND | BPF_K, ~vfork_clone_flags));
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0, 0, 1));
append(SECCOMP_ALLOW);
append(SECCOMP_LOAD_SYSCALL_NR);
#endif
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, execve);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, execveat);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, wait4);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, waitid);
}
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
void SeccompPolicy::allow_ipc()
{
RequestServer: Sandbox the process on Linux Add opt-in Linux sandbox support to RequestServer. Ladybird and test-web pass --enable-sandbox through when requested, and RequestServer only installs the sandbox when that flag is present. Allow reads for resolver and TLS configuration, plus the configured certificate locations. Create and allow writes to the Ladybird cache root, so libcurl alt-svc files and HTTP disk-cache files stay inside the single writable tree. Also allow the systemd-resolved runtime directory when present, since /etc/resolv.conf can point there. Extend LibSandbox with owned Landlock paths, an add-if-exists helper, read/write Landlock access, and reusable seccomp groups for filesystem writes and network syscalls. Include POSIX file locks and socket byte count ioctls needed by libc resolver and cache paths. Reuse the new Landlock helper from Compositor as well, and allow its Mesa shader cache directory so GPU startup can populate shader cache files after sandboxing.
2026-06-09 06:47:04 -03:00
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, eventfd2);
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, poll);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, ppoll);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, pselect6);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, recvmsg);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, recvfrom);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, recvmmsg);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, sendmsg);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, sendto);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, sendmmsg);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, socketpair);
WebContent: Sandbox renderer processes on Linux Add opt-in Linux renderer sandbox support to WebContent and WebWorker. Ladybird and test-web pass --enable-sandbox through when requested, and the renderer services only install the shared sandbox when that flag is present. Share one renderer policy for both services. Allow resource, font, shared library, WebGL, Wasm, audio, and local IPC paths needed at runtime, while keeping renderer filesystem writes mediated by Landlock. Allow Mesa and PulseAudio to probe their standard runtime state without escaping the renderer sandbox. Return EPERM for scheduler and priority changes so library initialization can fall back instead of crashing on a seccomp violation.
2026-06-09 08:26:47 -03:00
#ifdef __NR_socket
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_socket, 0, 3));
append(SECCOMP_LOAD_ARGUMENT(0));
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, AF_UNIX, 0, 1));
append(SECCOMP_ALLOW);
append(SECCOMP_LOAD_SYSCALL_NR);
#endif
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, connect);
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, getsockopt);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, setsockopt);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, getsockname);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, getpeername);
}
RequestServer: Sandbox the process on Linux Add opt-in Linux sandbox support to RequestServer. Ladybird and test-web pass --enable-sandbox through when requested, and RequestServer only installs the sandbox when that flag is present. Allow reads for resolver and TLS configuration, plus the configured certificate locations. Create and allow writes to the Ladybird cache root, so libcurl alt-svc files and HTTP disk-cache files stay inside the single writable tree. Also allow the systemd-resolved runtime directory when present, since /etc/resolv.conf can point there. Extend LibSandbox with owned Landlock paths, an add-if-exists helper, read/write Landlock access, and reusable seccomp groups for filesystem writes and network syscalls. Include POSIX file locks and socket byte count ioctls needed by libc resolver and cache paths. Reuse the new Landlock helper from Compositor as well, and allow its Mesa shader cache directory so GPU startup can populate shader cache files after sandboxing.
2026-06-09 06:47:04 -03:00
void SeccompPolicy::allow_network()
{
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, socket);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, connect);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, bind);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, listen);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, accept);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, accept4);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, shutdown);
}
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
void SeccompPolicy::allow_memory_without_executable_mappings()
{
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_mmap, 0, 5));
append(SECCOMP_LOAD_ARGUMENT(2));
append(BPF_STMT(BPF_ALU | BPF_AND | BPF_K, PROT_EXEC));
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0, 0, 1));
append(SECCOMP_ALLOW);
append(SECCOMP_LOAD_SYSCALL_NR);
#ifdef __NR_mmap2
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_mmap2, 0, 5));
append(SECCOMP_LOAD_ARGUMENT(2));
append(BPF_STMT(BPF_ALU | BPF_AND | BPF_K, PROT_EXEC));
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0, 0, 1));
append(SECCOMP_ALLOW);
append(SECCOMP_LOAD_SYSCALL_NR);
#endif
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_mprotect, 0, 5));
append(SECCOMP_LOAD_ARGUMENT(2));
append(BPF_STMT(BPF_ALU | BPF_AND | BPF_K, PROT_EXEC));
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0, 0, 1));
append(SECCOMP_ALLOW);
append(SECCOMP_LOAD_SYSCALL_NR);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, mremap);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, munmap);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, madvise);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, brk);
}
WebContent: Sandbox renderer processes on Linux Add opt-in Linux renderer sandbox support to WebContent and WebWorker. Ladybird and test-web pass --enable-sandbox through when requested, and the renderer services only install the shared sandbox when that flag is present. Share one renderer policy for both services. Allow resource, font, shared library, WebGL, Wasm, audio, and local IPC paths needed at runtime, while keeping renderer filesystem writes mediated by Landlock. Allow Mesa and PulseAudio to probe their standard runtime state without escaping the renderer sandbox. Return EPERM for scheduler and priority changes so library initialization can fall back instead of crashing on a seccomp violation.
2026-06-09 08:26:47 -03:00
void SeccompPolicy::allow_executable_memory_mappings()
{
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_mmap, 0, 8));
append(SECCOMP_LOAD_ARGUMENT(2));
append(BPF_STMT(BPF_ALU | BPF_AND | BPF_K, PROT_EXEC));
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0, 4, 0));
append(SECCOMP_LOAD_ARGUMENT(2));
append(BPF_STMT(BPF_ALU | BPF_AND | BPF_K, PROT_WRITE));
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0, 0, 1));
append(SECCOMP_ALLOW);
append(SECCOMP_LOAD_SYSCALL_NR);
#ifdef __NR_mmap2
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_mmap2, 0, 8));
append(SECCOMP_LOAD_ARGUMENT(2));
append(BPF_STMT(BPF_ALU | BPF_AND | BPF_K, PROT_EXEC));
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0, 4, 0));
append(SECCOMP_LOAD_ARGUMENT(2));
append(BPF_STMT(BPF_ALU | BPF_AND | BPF_K, PROT_WRITE));
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0, 0, 1));
append(SECCOMP_ALLOW);
append(SECCOMP_LOAD_SYSCALL_NR);
#endif
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_mprotect, 0, 8));
append(SECCOMP_LOAD_ARGUMENT(2));
append(BPF_STMT(BPF_ALU | BPF_AND | BPF_K, PROT_EXEC));
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0, 4, 0));
append(SECCOMP_LOAD_ARGUMENT(2));
append(BPF_STMT(BPF_ALU | BPF_AND | BPF_K, PROT_WRITE));
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0, 0, 1));
append(SECCOMP_ALLOW);
append(SECCOMP_LOAD_SYSCALL_NR);
}
Compositor: Allow GPU driver executable mappings on Linux Let the Linux Compositor sandbox permit writable executable mappings used lazily by GPU drivers after WebGL context creation. Keep this allowance scoped to the Compositor process so WebContent retains the existing memory mapping restrictions.
2026-06-19 12:01:21 -03:00
void SeccompPolicy::allow_writable_executable_memory_mappings()
{
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_mmap, 0, 5));
append(SECCOMP_LOAD_ARGUMENT(2));
append(BPF_STMT(BPF_ALU | BPF_AND | BPF_K, PROT_WRITE | PROT_EXEC));
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, PROT_WRITE | PROT_EXEC, 0, 1));
append(SECCOMP_ALLOW);
append(SECCOMP_LOAD_SYSCALL_NR);
#ifdef __NR_mmap2
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_mmap2, 0, 5));
append(SECCOMP_LOAD_ARGUMENT(2));
append(BPF_STMT(BPF_ALU | BPF_AND | BPF_K, PROT_WRITE | PROT_EXEC));
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, PROT_WRITE | PROT_EXEC, 0, 1));
append(SECCOMP_ALLOW);
append(SECCOMP_LOAD_SYSCALL_NR);
#endif
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_mprotect, 0, 5));
append(SECCOMP_LOAD_ARGUMENT(2));
append(BPF_STMT(BPF_ALU | BPF_AND | BPF_K, PROT_WRITE | PROT_EXEC));
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, PROT_WRITE | PROT_EXEC, 0, 1));
append(SECCOMP_ALLOW);
append(SECCOMP_LOAD_SYSCALL_NR);
}
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
void SeccompPolicy::allow_threads()
{
#ifdef __NR_clone
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_clone, 0, 8));
append(SECCOMP_LOAD_ARGUMENT(0));
append(BPF_STMT(BPF_ALU | BPF_AND | BPF_K, thread_clone_required_flags));
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, thread_clone_required_flags, 0, 4));
append(SECCOMP_LOAD_ARGUMENT(0));
append(BPF_STMT(BPF_ALU | BPF_AND | BPF_K, ~thread_clone_allowed_flags));
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0, 0, 1));
append(SECCOMP_ALLOW);
append(SECCOMP_LOAD_SYSCALL_NR);
#endif
#ifdef __NR_clone3
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_clone3, 0, 1));
append(SECCOMP_ERRNO(ENOSYS));
#endif
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, futex);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, futex_time64);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, set_tid_address);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, set_robust_list);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, rseq);
}
void SeccompPolicy::allow_signals()
{
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, rt_sigaction);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, rt_sigprocmask);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, rt_sigreturn);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, sigaltstack);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, tgkill);
}
void SeccompPolicy::allow_clocks()
{
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, clock_gettime);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, clock_getres);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, clock_nanosleep);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, nanosleep);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, restart_syscall);
}
Compositor: Sandbox the process on Linux Add opt-in Linux sandbox support to Compositor. Ladybird and test-web pass --enable-sandbox through when requested, and Compositor only installs the sandbox when that flag is present. Install the sandbox after Compositor has initialized platform, font, and GPU state so startup probing can complete before filesystem access is removed. Compose the runtime seccomp policy from LibSandbox building blocks and add an explicit GPU device operations group for driver IPC through already-open descriptors.
2026-06-09 06:08:46 -03:00
void SeccompPolicy::allow_gpu_device_operations()
{
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, ioctl);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, eventfd2);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, epoll_create1);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, epoll_ctl);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, epoll_wait);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, epoll_pwait);
}
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
void SeccompPolicy::allow_process_metadata()
{
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, getpid);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, gettid);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, getuid);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, geteuid);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, getgid);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, getegid);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, getrandom);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, gettimeofday);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, getrlimit);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, prlimit64);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, getrusage);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, sched_getaffinity);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, sched_yield);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, getcpu);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, membarrier);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, sysinfo);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, uname);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, umask);
WebContent: Sandbox renderer processes on Linux Add opt-in Linux renderer sandbox support to WebContent and WebWorker. Ladybird and test-web pass --enable-sandbox through when requested, and the renderer services only install the shared sandbox when that flag is present. Share one renderer policy for both services. Allow resource, font, shared library, WebGL, Wasm, audio, and local IPC paths needed at runtime, while keeping renderer filesystem writes mediated by Landlock. Allow Mesa and PulseAudio to probe their standard runtime state without escaping the renderer sandbox. Return EPERM for scheduler and priority changes so library initialization can fall back instead of crashing on a seccomp violation.
2026-06-09 08:26:47 -03:00
#ifdef __NR_sched_getscheduler
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_sched_getscheduler, 0, 1));
append(SECCOMP_ALLOW);
#endif
#ifdef __NR_sched_get_priority_max
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_sched_get_priority_max, 0, 1));
append(SECCOMP_ALLOW);
#endif
#ifdef __NR_sched_get_priority_min
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_sched_get_priority_min, 0, 1));
append(SECCOMP_ALLOW);
#endif
#ifdef __NR_getpriority
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_getpriority, 0, 1));
append(SECCOMP_ALLOW);
#endif
#ifdef __NR_setpriority
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_setpriority, 0, 1));
append(SECCOMP_ERRNO(EPERM));
#endif
#ifdef __NR_sched_setscheduler
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_sched_setscheduler, 0, 1));
append(SECCOMP_ERRNO(EPERM));
#endif
#ifdef __NR_sched_setparam
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_sched_setparam, 0, 1));
append(SECCOMP_ERRNO(EPERM));
#endif
#ifdef __NR_sched_setaffinity
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_sched_setaffinity, 0, 1));
append(SECCOMP_ERRNO(EPERM));
#endif
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
}
void SeccompPolicy::allow_common_runtime()
{
allow_memory_without_executable_mappings();
allow_threads();
allow_signals();
allow_clocks();
allow_process_metadata();
allow_prctl();
allow_exit();
LibSandbox: Return ENOENT for `getcwd()` instead of trapping Previously, passing a certificate using `--certificate` that had a relative path would cause a sandbox violation on the first https connection.
2026-06-15 19:16:05 -03:00
deny_current_directory_queries();
}
void SeccompPolicy::deny_current_directory_queries()
{
#ifdef __NR_getcwd
append(BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_getcwd, 0, 1));
append(SECCOMP_ERRNO(ENOENT));
#endif
LibSandbox: Add reusable sandbox building blocks Move the Linux no_new_privs, Landlock, and seccomp policy plumbing into LibSandbox so individual services can describe the privileges they need without copying the BPF and kernel feature detection machinery. Keep ImageDecoder's sandbox policy service-local by composing the new building blocks in SandboxLinux.cpp. This preserves the existing syscall allowlist while making the policy easier to audit and reuse.
2026-06-09 06:00:24 -03:00
}
void SeccompPolicy::allow_prctl()
{
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, prctl);
}
void SeccompPolicy::allow_exit()
{
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, exit);
SECCOMP_APPEND_ALLOW_SYSCALL_IF_DEFINED(*this, exit_group);
}
ErrorOr<void> SeccompPolicy::install()
{
TRY(install_sigsys_handler());
append_kill();
sock_fprog program {
.len = static_cast<unsigned short>(m_filter.size()),
.filter = m_filter.data(),
};
#ifdef __NR_seccomp
if (syscall(__NR_seccomp, SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC, &program) < 0)
return Error::from_syscall("seccomp(SECCOMP_SET_MODE_FILTER)"sv, errno);
#else
if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &program) < 0)
return Error::from_syscall("prctl(PR_SET_SECCOMP)"sv, errno);
#endif
return {};
}
}
Reference in a new issue Copy permalink