NAME

lockbox — Landlock build isolation for mkpkg

DESCRIPTION

The lockbox restricts what a build can see of the file system, using the Linux Landlock security module. A build in the lockbox can read only the files that the package database lists for its declared dependencies and for a fixed set of base packages. A library or header that is installed but not declared is invisible: configure scripts and linkers do not find it, so the build either leaves the feature out or fails. It never links an undeclared dependency silently.

The lockbox needs Linux 5.13 or later with CONFIG_SECURITY_LANDLOCK=y. It needs no container runtime, overlay file system or extra privileges.

There are two forms, which may be combined.

Full lockbox

The whole build runs in the lockbox: unpacking, patch(), build() and post_build(), and the packaging steps after them. mkpkg(8) runs this part in a child process that restricts itself and then builds; the rest of mkpkg(8) is not restricted, so the footprint check, signing, the second shell() hook and installing with -r work as usual. The first shell() hook runs before the lockbox is entered.

The build can read the files of:

the base packages, see BASE PACKAGES;
the packages in depends and makedeps. Every one of them must be installed.

It can read and write the work directory, the source directory, the package directory, the port directory, the directory named by MKPKG_TMP_DIR, /tmp and /dev. It can read /proc and /etc.

The full lockbox is turned on by lockbox=(yes) in the recipe, or for one build by mkpkg -b.

Per-command lockbox

Only chosen commands run in a lockbox:

lockbox=(make ninja cargo)

Every line of build() whose first word is one of the listed names is run through lbexec(8), which restricts itself and then runs the command. The shell around it is not restricted. Only lines that start with the command are wrapped: in ‘cd src && make’ nothing is. Other hooks are never wrapped. The name cargo selects the cargo profile of lbexec(8), every other name the standard profile.

Turning it off

mkpkg -ib builds without either form, whatever the recipe says, and overrides -b.

BASE PACKAGES

These packages are readable in every lockbox, whether declared or not. A missing one is reported but is not an error.

`llvm`	clang, lld and the LLVM tools
`libffi`, `libedit`, `ncurses`, `libxml2`	libraries LLVM links
`musl`	C library and headers
`linux-headers`	kernel headers
`bash`, `dash`, `readline`	shells for the hooks
`mawk`	awk for configure scripts
`coreutils`, `gmp`, `libcap2`	basic commands
`tar`, `acl`, `attr`	unpacking sources
`gzip`, `xz`, `bzip2`, `zstd`	decompressors
`grep`, `pcre2`, `sed`	configure scripts
`findutils`, `diffutils`, `file`	configure and make
`patch`	the `patch`(`hook`)
`make`	GNU make
`autoconf`, `automake`, `libtool`, `m4`, `perl`	autotools
`pkgconf`	pkg-config
`mkpkg`, `libressl`, `zlib`	the package tools
`signify-openbsd`	signing

FILES

/var/lib/pkg/db: Package database, source of the read rules.

DIAGNOSTICS

mkpkg: lockbox: Landlock ABI vN: The lockbox is being set up with Landlock ABI version N.
mkpkg: lockbox: N rules added from mkpkg db: Read access was granted to N files and directories.
mkpkg: lockbox: filesystem restricted to declared deps + build paths: The build now runs in the lockbox.
mkpkg: error: lockbox: dep 'X' not installed: X is declared in depends or makedeps but is not in the package database. The build does not start.
mkpkg: warning: lockbox: base package 'X' not in db: A base package is missing; the build continues without it.
mkpkg: warning: lockbox: dep 'X' missing: path: The database lists a file of a declared dependency that does not exist.
mkpkg: error: lockbox: Landlock not available: The kernel has no Landlock support.