Description

A binding to Linux's Landlock security module for node.js.

Supports Landlock ABI versions 1-7.

Information on feature availability per ABI version can be found here.

Requirements

• Linux kernel v5.13+
  • CONFIG_SECURITY_LANDLOCK=y
  • One or both of:
    • CONFIG_LSM contains the value: landlock
    • The kernel command line parameter lsm contains the value: landlock
• node.js -- v10.x or newer
• An appropriate build environment -- see node-gyp's documentation

Installation

npm install landlock

Examples

• Disallow reading or writing of any file (note: files can still be created if the filesystem allows, but they will not be able to be written to)

const fs = require('fs');

const landlock = require('landlock');

const fd = landlock.createRuleset(
  landlock.constants.LANDLOCK_ACCESS_FS_READ_FILE
    | landlock.constants.LANDLOCK_ACCESS_FS_WRITE_FILE
    | landlock.constants.LANDLOCK_ACCESS_FS_TRUNCATE_FILE
);
landlock.setNoNewPrivs();
landlock.restrictSelf(fd);
landlock.close(fd);

// Throws
fs.readFileSync(__filename);

// Throws, but creates a zero-length file
fs.writeFileSync('test.txt', 'foo');

• Disallow execution of any file outside of /usr/bin

const { execFileSync } = require('child_process');

const landlock = require('landlock');

const fd = landlock.createRuleset(
  landlock.constants.LANDLOCK_ACCESS_FS_EXECUTE
);
landlock.addRule(
  fd,
  landlock.constants.LANDLOCK_RULE_PATH_BENEATH,
  landlock.constants.LANDLOCK_ACCESS_FS_EXECUTE,
  '/usr/bin'
);
landlock.setNoNewPrivs();
landlock.restrictSelf(fd);
landlock.close(fd);

// Throws
console.log(
  execFileSync('/usr/local/bin/node', [ '-v' ], { encoding: 'utf8' })
);

API

Exports

• addRule(< integer >fd, < mixed >ruleType[, ...ruleTypeArgs]) - (void) - Adds a new rule to a ruleset. ruleType can be an integer or bigint. ...ruleTypeArgs depends on ruleType:

  • LANDLOCK_RULE_PATH_BENEATH: < mixed >allowedAccess, < mixed >parent - allowedAccess is an integer or bigint bitmask of allowed actions for this file hierarchy. parent is either a string path or a integer file descriptor which identifies the parent directory of a file hierarchy, or just a file.

  • LANDLOCK_RULE_NET_PORT: < integer >allowedAccess, < integer >port - allowedAccess is an integer or bigint bitmask of allowed actions for this file hierarchy. port is a network port.

• close(< integer >fd) - (void) - Closes the given file descriptor.

• constants - object - Contains useful Landlock constants, all named the same as the original C macros. All values are of type bigint.

• createRuleset(< mixed >fsAccess[, < mixed >netAccess[, < mixed >scoped]]) - integer - Creates a new ruleset and returns the resulting file descriptor. All values can be either an integer or bigint.

• getABI() - integer - Returns the highest supported Landlock ABI version (starting at 1).

• getErrata() - bigint - Returns a bitmask of fixed issues for the current Landlock ABI version.

• restrictSelf(< integer >fd[, < mixed >flags]) - (void) - Enforce a ruleset on the calling thread. flags can be an integer or bigint.

• setNoNewPrivs() - (void) - Enables no_new_privs mode.