[Feature Request] Use landlock for sandboxing VM process

[arch-hash]

Feature Request

Jailer could use Landlock to confine guest VM's processes further, restricting fine-grained file system access than what current chroot can provide. This would be a defense in depth mechanism if the VM escape or host compromise is attempted.

Describe the desired solution

Landlock would allows apps inside guest VM to have nested sandboxing for file paths.

Describe possible alternatives

Keep using existing chroot trick. But that's not ideal.

Additional context

I'm working on an OS similar to QubesOS where every app is a microVM.

Checks

• Have you searched the Firecracker Issues database for similar requests?
• Have you read all the existing relevant Firecracker documentation?
• Have you read and understood Firecracker's core tenets?

[xmarcalx]

Hi @arch-hash ,

Thank you very much for your interesting proposal.

We do not have currently an usecase for having more fine grained file system access, however this is an interesting concept.
Would you be willing to do a mini prototype with our jailer using Landlock and showcase the benefits which we may have in converting our current solution into Landlock (for example, are performance going to be better?)?

[Jebrano]

any problem taking this issue as my graduation project?

[JamesC1305]

Hi @Jebrano,

Thanks for your interest in Firecracker.

You are of course welcome to take this on as your graduation project, but as we stated before, we do not currently have an appropriate use case that would justify us merging and maintaining this. It would be an interesting piece of research, and we would be keen to hear about your findings if you do decide to go ahead with it, but I would stress that we likely would not accept the contribution.

If that sounds acceptable to you and you're still interested, go for it!

Thanks,
James

[pavitrabhalla]

I implemented this feature on our fork https://github.com/superserve-ai/firecracker that we intend to maintain actively. I have created a PR here as well, but it may not be accepted as @JamesC1305 mentioned.

@arch-hash Let me know if this is helpful and if you have any feedback.