When a profile contains /proc/self/maps, Landlock grants the inode of /proc/<top-level-pid>/maps at rule-apply time. Any subprocess the workload forks has a different /proc/<child-pid>/maps inode and is denied.
The fix is in sandlock run: when the profile's read list contains /proc/self/X and a child opens /proc/self/X, the supervisor opens /proc/<notif.pid>/X and injects the fd via SECCOMP_IOCTL_NOTIF_ADDFD. The hook already exists in procfs::handle_proc_open. The injection should be scoped to the caller's own pid and to paths the policy explicitly lists.
Needs a test with a workload that forks a child reading /proc/self/maps.
Noted in PR #209 review.
When a profile contains
/proc/self/maps, Landlock grants the inode of/proc/<top-level-pid>/mapsat rule-apply time. Any subprocess the workload forks has a different/proc/<child-pid>/mapsinode and is denied.The fix is in
sandlock run: when the profile's read list contains/proc/self/Xand a child opens/proc/self/X, the supervisor opens/proc/<notif.pid>/Xand injects the fd viaSECCOMP_IOCTL_NOTIF_ADDFD. The hook already exists inprocfs::handle_proc_open. The injection should be scoped to the caller's own pid and to paths the policy explicitly lists.Needs a test with a workload that forks a child reading
/proc/self/maps.Noted in PR #209 review.