opensource/dify
2
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-19 16:38:31 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: downgrade to landlock v1 (#39139)

Browse Source
This commit is contained in:
Yunlu Wen 2026-07-16 18:04:01 +08:00 committed by GitHub
parent 752af8a270
commit 8a33161080
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 5 additions and 31 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
dify-agent-runtime/cmd/runner/main.go
View File

@ -16,7 +16,6 @@ package main
import (
"encoding/json"
"errors"
"fmt"
"os"
"os/exec"
@ -174,11 +173,8 @@ func childMode() {
jobDir := filepath.Dir(scriptPath)
cfg := landlock.ConfigFromEnv(home, cwd, jobDir)
if err := landlock.Restrict(cfg); err != nil {
if errors.Is(err, landlock.ErrNotSupported) {
fmt.Fprintf(os.Stderr, "shellctl-runner: WARNING: %v — running without filesystem isolation\n", err)
} else {
cmdutil.HandleError(err, 125, "landlock restrict")
}
// the landlock is best-effort, so we just log the error whatever it is
fmt.Fprintf(os.Stderr, "shellctl-runner: WARNING: %v — running without filesystem isolation\n", err)
}
}

28
dify-agent-runtime/internal/landlock/landlock_linux.go
View File

@ -3,33 +3,17 @@
package landlock
import (
"errors"
"fmt"
"os"
"syscall"
golandlock "github.com/landlock-lsm/go-landlock/landlock"
)
// ErrNotSupported is returned when the kernel does not support Landlock.
var ErrNotSupported = errors.New("landlock: not supported by kernel")
// Restrict applies Landlock filesystem restrictions for the current process.
//
// It first tries strict enforcement. If the kernel lacks Landlock support,
// it falls back to BestEffort (which may silently degrade) and returns
// ErrNotSupported so callers can log a warning.
// Restrict applies Landlock V1 filesystem restrictions for the current process.
func Restrict(cfg *Config) error {
rules := buildRules(cfg)
if err := golandlock.V5.RestrictPaths(rules...); err != nil {
if !isNotSupported(err) {
return fmt.Errorf("landlock: restrict paths: %w", err)
}
if err2 := golandlock.V5.BestEffort().RestrictPaths(rules...); err2 != nil {
return fmt.Errorf("landlock: best-effort restrict paths: %w", err2)
}
return ErrNotSupported
if err := golandlock.V1.RestrictPaths(rules...); err != nil {
return err
}
return nil
}
@ -63,12 +47,6 @@ func buildRules(cfg *Config) []golandlock.Rule {
return rules
}
// isNotSupported reports whether err indicates the kernel does not support
// Landlock (ENOSYS = syscall absent, EOPNOTSUPP = feature disabled).
func isNotSupported(err error) bool {
return errors.Is(err, syscall.ENOSYS) || errors.Is(err, syscall.EOPNOTSUPP)
}
func filterExisting(paths []string) []string {
var out []string
for _, p := range paths {