[WIP PATCH v2] Landlock supervise

.dev/.gitignore

@@ -0,0 +1,2 @@
+initramfs.cpio.gz
+.qemu.pid

.dev/_experimental_passthrough_rootfs.sh

@@ -0,0 +1,46 @@
+echo Too hard to ensure security. Don\'t use.
+exit 1
+
+if [ `id -u` -ne 0 ]; then
+    echo "This script must be run as root"
+    exit 1
+fi
+
+set -xe
+cd $(dirname $0)
+
+ROROOT_PARENT_DIR=/tmp/roroot
+mkdir -p "$ROROOT_PARENT_DIR"
+chmod go-rwx "$ROROOT_PARENT_DIR"
+ROROOT_DIR="$ROROOT_PARENT_DIR/roroot"
+mkdir -p "$ROROOT_DIR"
+echo "Using $ROROOT_DIR as read-only root directory"
+mount -t tmpfs tmpfs "$ROROOT_DIR"
+mount --make-private "$ROROOT_DIR"
+
+pushd "$ROROOT_DIR"
+LINUX_SOURCE_DIR=`realpath ../`
+mkdir -p "$ROROOT_DIR$LINUX_SOURCE_DIR"
+chmod go+rX -R "$ROROOT_DIR"
+for dir in etc bin sbin lib lib64 usr opt srv; do
+    if [ ! -e "/$dir" ]; then
+        continue
+    fi
+    if [ -L "/$dir" ]; then
+        target=`readlink "/$dir"`
+        target=`echo "$target" | sed 's/^\/?//'`
+        ln -s "$target" "$dir"
+        continue
+    fi
+    mkdir -p "$ROROOT_DIR/$dir"
+    mount --bind -o ro "/$dir" "$ROROOT_DIR/$dir"
+done
+mount --bind -o ro "$LINUX_SOURCE_DIR" "$ROROOT_DIR$LINUX_SOURCE_DIR"
+echo "$LINUX_SOURCE_DIR" | tee "$ROROOT_DIR/.cwd"
+popd
+
+# ...
+
+umount -R "$ROROOT_DIR"
+rmdir "$ROROOT_DIR"
+rmdir "$ROROOT_PARENT_DIR"

.dev/gdb.py

@@ -0,0 +1,23 @@
+import gdb
+from linux import utils, cpus
+
+def on_stop_update_thread_names(event: gdb.StopEvent):
+    # we only do this for qemu gdb, since kgdb has individual threads for each task anyway (they're just named badly)
+    if utils.get_gdbserver_type() == utils.GDBSERVER_QEMU:
+        if utils.is_target_arch("x86"):
+            threads = gdb.selected_inferior().threads()
+            for t in threads:
+                cpu = t.num - 1
+                task = cpus.get_current_task(cpu)
+                if task:
+                    t.name = f"{task['comm'].string()}[{int(task['pid'])}]"
+        return
+
+def on_cont_clear_thread_names(event: gdb.ContinueEvent):
+    if utils.get_gdbserver_type() == utils.GDBSERVER_QEMU:
+        threads = gdb.selected_inferior().threads()
+        for t in threads:
+            t.name = None
+
+gdb.events.stop.connect(on_stop_update_thread_names)
+gdb.events.cont.connect(on_cont_clear_thread_names)

.dev/init.sh

@@ -0,0 +1,72 @@
+#!/bin/bash
+
+if [ `id -u` -ne 0 ]; then
+    echo "Don't run this outside the VM..."
+    exit 1
+fi
+
+set -xe
+export PATH=/usr/local/bin:/usr/local/sbin:/usr/bin:/usr/sbin:/bin:/sbin
+export HOME=/
+export LC_CTYPE=en_US.UTF-8
+export LANG=en_US.UTF-8
+export USER=root
+mkdir -p /dev /proc /sys /tmp /sys /mnt
+mount -t devtmpfs dev /dev
+mount -t proc proc /proc
+mount -t sysfs sys /sys
+mount -t tmpfs tmp /tmp
+mkdir -p /dev/pts /dev/shm /dev/hugepages /dev/mqueue
+mount -t devpts devpts /dev/pts
+mount -t tmpfs shm /dev/shm
+mount -t hugetlbfs hugetlbfs /dev/hugepages
+mount -t mqueue mqueue /dev/mqueue
+mkdir -p /sys/kernel/security /sys/fs/cgroup /sys/fs/bpf /sys/kernel/tracing
+mount -t securityfs none /sys/kernel/security
+mount -t cgroup2 none /sys/fs/cgroup
+mount -t bpf none /sys/fs/bpf
+mount -t tracefs none /sys/kernel/tracing
+pushd /sys/kernel/tracing
+echo 1 > events/printk/enable
+popd
+mkdir /tmp/run_
+mount -t tmpfs none /tmp/run_
+cp -a /run/* /tmp/run_
+mount --move /tmp/run_ /run
+rmdir /tmp/run_
+ln -s /proc/self/fd /dev/fd
+ln -s /proc/self/fd/0 /dev/stdin
+ln -s /proc/self/fd/1 /dev/stdout
+ln -s /proc/self/fd/2 /dev/stderr
+hostname -F /etc/hostname
+. /_runtime_init.sh
+uname -a
+ethName=eth0
+if [ -e "/sys/class/net/$ethName" ]; then
+    # Set up network - because dhcpcd is quite slow we just use static IP (hard-coded in startvm.sh)
+    ip link set dev $ethName up
+    ip addr add 10.0.0.2/24 dev $ethName
+    ip route add default via 10.0.0.1 dev $ethName
+    mkdir -p /run/sshd
+    /usr/sbin/sshd
+fi
+if [ -e /dev/vda ]; then
+    mount /dev/vda /mnt
+fi
+set +ex
+exec_args="${@:2}" # Remove the `-`
+if [ -z "$exec_args" ]; then
+    /bin/bash || true
+else
+    eval "$exec_args"
+    ret=$?
+    if [ $ret -ne 0 ]; then
+        echo "Command exited with code $ret"
+    fi
+    /bin/bash || true
+fi
+set -ex
+umount /mnt
+sync
+echo o > /proc/sysrq-trigger
+sleep infinity

.dev/kgdb.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/bash
+cd $(dirname $0)
+
+extra_args=()
+
+target_cmd='target remote kgdb.sock'
+
+function show_help () {
+    echo "Usage: kgdb.sh [OPTIONS]"
+    echo "Options:"
+    echo "  -t: Enable TUI mode"
+    echo "  -s: Connect to QEMU GDB server instead of KGDB"
+    echo ""
+    exit 1
+}
+
+while [ "${1:-}" != '' ]; do
+    case $1 in
+        -t)
+            termsize=(`stty size`)
+            termheight=${termsize[0]}
+            termwidth=${termsize[1]}
+            half_height=$((termheight / 2))
+            extra_args+=(
+                # don't enable tui if we failed to connect
+                -ex "python gdb.selected_inferior() and gdb.selected_inferior().connection and gdb.selected_inferior().connection.is_valid() and (gdb.execute('tui enable'), gdb.execute('tui window height cmd $half_height'))"
+            )
+            ;;
+        -s)
+            target_cmd='target remote localhost:1234'
+            ;;
+        -h|--help)
+            show_help
+            ;;
+        *)
+            echo "Unknown argument: $1"
+            show_help
+            ;;
+    esac
+    shift
+done
+
+gdb \
+  -ex "add-auto-load-safe-path ../scripts/gdb/vmlinux-gdb.py" \
+  -ex "file ../vmlinux" \
+  -ex "source ./gdb.py" \
+  -ex "$target_cmd" \
+  -ex 'bt' \
+  "${extra_args[@]}"

.dev/rootfs.Dockerfile

@@ -0,0 +1,11 @@
+FROM debian:stable
+
+# echo ... | string replace -a ' ' \n | sort | string join ' '
+RUN dpkg --add-architecture i386 && apt update && apt install -y \
+    bash binutils bpftrace curl dhcpcd fio fish g++ gcc gdb git htop iproute2 kitty-terminfo linux-perf ltrace make net-tools ssh strace sysbench tcpdump tmux trace-cmd vim wget \
+    libc6:i386 libstdc++6:i386
+
+RUN passwd -d root && chsh -s /usr/bin/fish root
+
+COPY --chown=0:0 ./init.sh /init.sh
+COPY --chown=0:0 ./sshd_config /etc/ssh/sshd_config

.dev/sshd_config

@@ -0,0 +1,6 @@
+Port 22
+ListenAddress 0.0.0.0
+PermitRootLogin yes
+PasswordAuthentication yes
+PermitEmptyPasswords yes
+UsePAM no