amadan
Fixed on main as 09814f7 (tenant-iso-hardening): PrivateIPC=yes with a private /dev/mqueue, and abstract unix sockets scoped with Landlock (ABI 6) by the trampoline, which refuses to exec if the scope can't be applied. Residual: a sibling can still bind an abstract name first, which blocks the owner but never connects to it. Box check before rollout: Landlock must be in the booted kernel's lsm= list.
isolated exec: POSIX mqueues and abstract unix sockets are still shared between instances Issue closed
On branch tenant-iso-hardening
Follow-up from #126 (branch isolated-exec-probe-fixes, spec R15).
The isolated-exec templates now give each instance unit its own /dev/shm. Two IPC surfaces are still box-wide, and every instance is uid carlos:
- POSIX message queues. No
PrivateIPC=in the namespace block. A queue one instance creates can be opened, read and unlinked by a sibling.PrivateIPC=yeswould give each unit its own IPC namespace (SysV and mqueue). Check that/dev/mqueueinside the unit reflects the new namespace on systemd 257 before relying on it. - Abstract unix sockets. These are scoped to the network namespace, and instances share the host's, because they need outbound TCP. A sibling can connect to, or squat, any abstract name another instance binds.
RestrictAddressFamilies=cannot tell abstract from path sockets. The options are a per-unit network namespace with egress (a larger change: the edge dials instances over path sockets, which survive a netns, but outbound needs a veth or a proxy), or seccomp onbind/connectwith a leading NUL byte (not expressible inSystemCallFilter=).
Neither is a regression; both predate the design. Before layout migrate is trusted for hostile tenants, decide whether to close them or record them as accepted residuals in §11. The probe could check mqueue cheaply once PrivateIPC= lands.