From 5db07140726e6e1bf615ed075e9a8b653508c2a7 Mon Sep 17 00:00:00 2001
From: Clayton Gilmer <netadr_t@outlook.com>
Date: Mon, 18 Aug 2025 12:00:52 +0900
Subject: container: optionally isolate host abstract UNIX domain sockets via
 landlock

---
 internal/app/app_pd_linux_test.go | 2 ++
 internal/app/container_linux.go   | 1 +
 internal/app/seal_linux.go        | 9 +++++----
 3 files changed, 8 insertions(+), 4 deletions(-)

(limited to 'internal')

diff --git a/internal/app/app_pd_linux_test.go b/internal/app/app_pd_linux_test.go
index 109e8816..96182d31 100644
--- a/internal/app/app_pd_linux_test.go
+++ b/internal/app/app_pd_linux_test.go
@@ -62,6 +62,7 @@ var testCasesPd = []sealTestCase{
 				Remount(m("/"), syscall.MS_RDONLY),
 			SeccompPresets: seccomp.PresetExt | seccomp.PresetDenyDevel,
 			HostNet:        true,
+			HostAbstract:   true,
 			RetainSession:  true,
 			ForwardCancel:  true,
 		},
@@ -203,6 +204,7 @@ var testCasesPd = []sealTestCase{
 				Remount(m("/"), syscall.MS_RDONLY),
 			SeccompPresets: seccomp.PresetExt | seccomp.PresetDenyDevel,
 			HostNet:        true,
+			HostAbstract:   true,
 			RetainSession:  true,
 			ForwardCancel:  true,
 		},
diff --git a/internal/app/container_linux.go b/internal/app/container_linux.go
index 3f1259fd..7f088192 100644
--- a/internal/app/container_linux.go
+++ b/internal/app/container_linux.go
@@ -33,6 +33,7 @@ func newContainer(s *hst.ContainerConfig, os sys.State, prefix string, uid, gid
 		SeccompPresets: s.SeccompPresets,
 		RetainSession:  s.Tty,
 		HostNet:        s.Net,
+		HostAbstract:   s.Abstract,
 
 		// the container is canceled when shim is requested to exit or receives an interrupt or termination signal;
 		// this behaviour is implemented in the shim
diff --git a/internal/app/seal_linux.go b/internal/app/seal_linux.go
index c7293720..0ae121fb 100644
--- a/internal/app/seal_linux.go
+++ b/internal/app/seal_linux.go
@@ -238,10 +238,11 @@ func (seal *outcome) finalise(ctx context.Context, sys sys.State, config *hst.Co
 		}
 
 		conf := &hst.ContainerConfig{
-			Userns:  true,
-			Net:     true,
-			Tty:     true,
-			AutoEtc: true,
+			Userns:   true,
+			Net:      true,
+			Abstract: true,
+			Tty:      true,
+			AutoEtc:  true,
 
 			AutoRoot:  container.AbsFHSRoot,
 			RootFlags: container.BindWritable,
-- 
cgit v1.3.1