bug(policy): invalid `landlock.compatibility` values silently fall back to `best_effort`

[cdiddy77]

Agent Diagnostic

• Skills loaded: create-github-issue
• OpenShell version tested: source-level review of main at 8cf2673c (local CLI on PATH is 0.0.72, but the finding is read from current main, not from a running sandbox)
• Latest release checked: v0.0.86 (gh release list) — the code path below is unchanged on main as of this commit
• Known fixes reviewed: searched main for every hard_requirement reference (16 hits); the only string comparison is the one below, and no validation exists in openshell-policy or openshell-server/src/grpc/validation.rs
• Possible duplicates reviewed: searched open/closed issues for landlock and for compatibility validation policy. Closest is supervisor: Landlock hard_requirement aborts with "incompatible directory-only access-rights: ReadDir" for real directories on RHEL 9.6 (kernel 5.14) ABI #2218 (Landlock hard_requirement aborting on RHEL 9.6 kernel 5.14 ABI), which is about ABI compatibility, not value parsing. No duplicate found.
• Findings: LandlockDef.compatibility is deserialized as a bare String with no value validation. The proto→runtime conversion is a single equality check against "hard_requirement", with everything else falling through to BestEffort.
• Remaining reason for filing: the failure direction is always toward less enforcement. A typo in a security-relevant field produces a sandbox that reads as strictly configured but runs permissively, with no error, warning, or log line.

Description

Actual behavior: Any value of landlock.compatibility other than the exact string hard_requirement is silently treated as best_effort. A policy containing compatibility: hard-requirement (hyphen), compatibility: strict, or compatibility: HARD_REQUIREMENT is accepted without complaint and runs in best_effort mode — meaning Landlock failures degrade to no filesystem restriction instead of aborting startup.

#[serde(deny_unknown_fields)] catches unknown keys, so landlock: { compatibilty: ... } is rejected. It does nothing for unknown values.

Expected behavior: An unrecognized compatibility value is rejected at policy parse/validation time with an error naming the field and the accepted values. Fail closed on a security control, or at minimum emit a warning — never silently downgrade enforcement.

Reproduction Steps

1. Write a sandbox policy containing:

   filesystem_policy:
    read_only: [/usr, /lib]
    read_write: [/sandbox, /tmp]
   
   landlock:
    compatibility: hard-requirement # hyphen instead of underscore

2. Create a sandbox with this policy.
3. Observe it is accepted with no error or warning.
4. On a host where Landlock is unavailable or a listed path cannot be opened, the sandbox starts anyway with reduced (or zero) filesystem restriction, rather than aborting as hard_requirement would.

Environment

• OS: Linux 6.17 (x86_64)
• Docker: n/a — source-level finding, reproducible on any driver
• OpenShell: main @ 8cf2673c
• Latest release checked: yes — v0.0.86; code path unchanged
• Possible duplicates checked: yes — searched landlock and compatibility validation policy; supervisor: Landlock hard_requirement aborts with "incompatible directory-only access-rights: ReadDir" for real directories on RHEL 9.6 (kernel 5.14) ABI #2218 is related but distinct (ABI compatibility, not value parsing)

Logs

Parsing accepts any string:

// crates/openshell-policy/src/lib.rs:73-76
#[derive(Debug, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
struct LandlockDef {
 #[serde(default, skip_serializing_if = "String::is_empty")]
 compatibility: String,
}

The only place the value is interpreted — everything that is not an exact match falls through to BestEffort:

// crates/openshell-core/src/policy.rs:141-150
impl From<ProtoLandlockPolicy> for LandlockPolicy {
 fn from(proto: ProtoLandlockPolicy) -> Self {
 let compatibility = if proto.compatibility == "hard_requirement" {
 LandlockCompatibility::HardRequirement
 } else {
 LandlockCompatibility::BestEffort
 };
 Self { compatibility }
 }
}

Suggested Fix

Parse into the existing LandlockCompatibility enum rather than a String, either via #[serde(rename_all = "snake_case")] on the enum or a TryFrom<&str> that errors on unrecognized input, and surface that error through gateway policy validation. Docs enumerate exactly two accepted values (docs/reference/policy-schema.mdx:92), so tightening the parser matches documented behavior rather than changing it.

Related

• A second, separate gap found alongside this one: when both filesystem_policy.read_only and read_write are empty, prepare() returns Ok(None) and Landlock is a complete no-op even under hard_requirement (crates/openshell-supervisor-process/src/sandbox/linux/landlock.rs:145-147). Arguably hard_requirement with no paths should be a configuration error. Filing separately if maintainers agree it is distinct.

[letv1nnn]

📋 triage-agent

Triage Assessment

Classification: bug-confirmed

Summary

The reported behavior is confirmed on current main (v0.0.88 is the latest release; the code path is unchanged). LandlockDef.compatibility is deserialized as a raw String with no validation, and the proto→runtime conversion at openshell-core/src/policy.rs:141-150 silently falls through to BestEffort for any value that does not exactly match "hard_requirement". A typo in a security-critical field causes the sandbox to run with no filesystem enforcement and emit no error, warning, or log line.

Investigation

Verified directly in the codebase at main:

• crates/openshell-policy/src/lib.rs:73-76: LandlockDef.compatibility is String; #[serde(deny_unknown_fields)] only rejects unknown keys, not unknown values.
• crates/openshell-core/src/policy.rs:141-150: From<ProtoLandlockPolicy> is a single string equality check — everything other than "hard_requirement" silently becomes BestEffort.
• No validation exists in openshell-server/src/grpc/validation.rs for the compatibility string value.
• Searched all merged PRs and commits for landlock and compatibility — no fix has been merged. The closest related commit (6828e146) added a warn-level log when Landlock degrades at runtime, but does not catch the parse-time misconfiguration this issue describes.
• The secondary gap (empty path lists + hard_requirement = silent no-op) is independently verifiable at crates/openshell-supervisor-process/src/sandbox/linux/landlock.rs:145-147 and is worth tracking as a follow-on.

Failure direction is always toward less enforcement. The accepted values are documented (docs/reference/policy-schema.mdx:92), making this a divergence between documented behavior and runtime behavior.

Recommendation

Ready for a spike or direct implementation. The fix is narrow:

1. Replace LandlockDef.compatibility: String with a serde-validated enum (or a TryFrom<&str> that errors on unrecognized input).
2. Convert From<ProtoLandlockPolicy> to TryFrom and surface the error through policy validation.
3. Update the hardcoded "best_effort".into() strings in openshell-server/src/grpc/validation.rs and openshell-policy/src/lib.rs to use the typed enum.

The secondary empty-paths gap noted by the reporter is a distinct behavior and should be filed as a separate issue.

[letv1nnn]

I'd like to work on this, unless @cdiddy77 have already digged into it.