diff mbox series

mountkernfs: Mount securityfs

Message ID 20261112140526.3332669-1-antonio@mandelbit.com
State New
Headers
Series mountkernfs: Mount securityfs |

Commit Message

Antonio Quartulli 12 Nov 2026, 2:05 p.m. UTC 
Without securityfs, /sys/kernel/security/lsm and the lockdown state are
not available, so there is no easy way to check which security modules
(e.g. Landlock) are active. This led to the wrong conclusion in #13782
that Landlock is not initialised.

Signed-off-by: Antonio Quartulli <antonio@mandelbit.com>
---
Notes:
- /etc/rc.d/init.d/mountkernfs needs to be shipped with the next Core
  Update; I left the filelists to you.
- Landlock itself works: on Core 189 and 205 a Landlock-restricted
  process gets EACCES, /sys/kernel/security/lsm lists landlock, and
  Suricata is confined (a rule reload of a yaml outside its sandbox
  fails with "Permission denied"). Details are in #13782.

 src/initscripts/system/mountkernfs | 5 +++++
 1 file changed, 5 insertions(+)
diff mbox series

Patch

diff --git a/src/initscripts/system/mountkernfs b/src/initscripts/system/mountkernfs
index b660083ec..73e9ad03b 100644
--- a/src/initscripts/system/mountkernfs
+++ b/src/initscripts/system/mountkernfs
@@ -51,6 +51,11 @@  case "${1}" in
 			mount -t efivarfs efivarfs /sys/firmware/efi/efivars || failed=1
 		fi
 
+		if ! mountpoint /sys/kernel/security &>/dev/null && [ -d "/sys/kernel/security" ]; then
+			boot_mesg -n " /sys/kernel/security" ${NORMAL}
+			mount -n -t securityfs -o nosuid,nodev,noexec securityfs /sys/kernel/security || failed=1
+		fi
+
 		# create folder for dhcpcd changeroot
 		mkdir -p /run/dhcpcd/chroot
 		chown dhcpcd:dhcpcd /run/dhcpcd/chroot