Skip to content

Conversation

@nevun
Copy link

@nevun nevun commented Dec 3, 2025

If you had 32 bits libraries in /lib, landrun --ldd would pick those before the 64 bit library in /lib64.

This MR just changes the lookup order if the binary we are running is 64 bit.

before:

$ ./landrun --log-level debug  --ldd --add-exec /bin/nc
[landrun:debug] 2025/12/03 11:33:45 Added executable path: /bin/nc
[landrun:debug] 2025/12/03 11:33:45 Added library paths: [/etc/ld.so.cache /lib64/ld-linux-x86-64.so.2 /lib64/libssl.so.3 /lib64/libpcap.so.1 /lib64/libibverbs.so.1 /lib64/libnl-3.so.200 /lib/libm.so.6 /lib/libc.so.6 /lib64/libcrypto.so.3 /lib/ld-linux.so.2 /lib/libz.so.1 /lib64/libnl-route-3.so.200 /lib/libgcc_s.so.1]
[landrun] 2025/12/03 11:33:45 Sandbox config: {ReadOnlyPaths:[] ReadWritePaths:[] ReadOnlyExecutablePaths:[/bin/nc /etc/ld.so.cache /lib64/ld-linux-x86-64.so.2 /lib64/libssl.so.3 /lib64/libpcap.so.1 /lib64/libibverbs.so.1 /lib64/libnl-3.so.200 /lib/libm.so.6 /lib/libc.so.6 /lib64/libcrypto.so.3 /lib/ld-linux.so.2 /lib/libz.so.1 /lib64/libnl-route-3.so.200 /lib/libgcc_s.so.1] ReadWriteExecutablePaths:[] BindTCPPorts:[] ConnectTCPPorts:[] BestEffort:false UnrestrictedFilesystem:false UnrestrictedNetwork:false}
[landrun:debug] 2025/12/03 11:33:45 Adding read-only executable path: /bin/nc
[landrun:debug] 2025/12/03 11:33:45 Adding read-only executable path: /etc/ld.so.cache
[landrun:debug] 2025/12/03 11:33:45 Adding read-only executable path: /lib64/ld-linux-x86-64.so.2
[landrun:debug] 2025/12/03 11:33:45 Adding read-only executable path: /lib64/libssl.so.3
[landrun:debug] 2025/12/03 11:33:45 Adding read-only executable path: /lib64/libpcap.so.1
[landrun:debug] 2025/12/03 11:33:45 Adding read-only executable path: /lib64/libibverbs.so.1
[landrun:debug] 2025/12/03 11:33:45 Adding read-only executable path: /lib64/libnl-3.so.200
[landrun:debug] 2025/12/03 11:33:45 Adding read-only executable path: /lib/libm.so.6
[landrun:debug] 2025/12/03 11:33:45 Adding read-only executable path: /lib/libc.so.6
[landrun:debug] 2025/12/03 11:33:45 Adding read-only executable path: /lib64/libcrypto.so.3
[landrun:debug] 2025/12/03 11:33:45 Adding read-only executable path: /lib/ld-linux.so.2
[landrun:debug] 2025/12/03 11:33:45 Adding read-only executable path: /lib/libz.so.1
[landrun:debug] 2025/12/03 11:33:45 Adding read-only executable path: /lib64/libnl-route-3.so.200
[landrun:debug] 2025/12/03 11:33:45 Adding read-only executable path: /lib/libgcc_s.so.1
[landrun:debug] 2025/12/03 11:33:45 Applying Landlock restrictions
[landrun] 2025/12/03 11:33:45 Landlock restrictions applied successfully
[landrun] 2025/12/03 11:33:45 Executing: [/bin/nc]
/bin/nc: error while loading shared libraries: libm.so.6: cannot open shared object file: Permission denied

Notice it resolves four deps to their 32 bit version in /lib

After this MR:

$ ./landrun --log-level debug  --ldd --add-exec /bin/nc
[landrun:debug] 2025/12/03 12:04:28 Added executable path: /bin/nc
[landrun:debug] 2025/12/03 12:04:28 Added library paths: [/etc/ld.so.cache /lib64/libm.so.6 /lib64/libc.so.6 /lib64/libcrypto.so.3 /lib64/libpcap.so.1 /lib64/libibverbs.so.1 /lib64/ld-linux-x86-64.so.2 /lib64/libssl.so.3 /lib64/libz.so.1 /lib64/libnl-route-3.so.200 /lib64/libnl-3.so.200 /lib64/libgcc_s.so.1]
[landrun] 2025/12/03 12:04:28 Sandbox config: {ReadOnlyPaths:[] ReadWritePaths:[] ReadOnlyExecutablePaths:[/bin/nc /etc/ld.so.cache /lib64/libm.so.6 /lib64/libc.so.6 /lib64/libcrypto.so.3 /lib64/libpcap.so.1 /lib64/libibverbs.so.1 /lib64/ld-linux-x86-64.so.2 /lib64/libssl.so.3 /lib64/libz.so.1 /lib64/libnl-route-3.so.200 /lib64/libnl-3.so.200 /lib64/libgcc_s.so.1] ReadWriteExecutablePaths:[] BindTCPPorts:[] ConnectTCPPorts:[] BestEffort:false UnrestrictedFilesystem:false UnrestrictedNetwork:false}
[landrun:debug] 2025/12/03 12:04:28 Adding read-only executable path: /bin/nc
[landrun:debug] 2025/12/03 12:04:28 Adding read-only executable path: /etc/ld.so.cache
[landrun:debug] 2025/12/03 12:04:28 Adding read-only executable path: /lib64/libm.so.6
[landrun:debug] 2025/12/03 12:04:28 Adding read-only executable path: /lib64/libc.so.6
[landrun:debug] 2025/12/03 12:04:28 Adding read-only executable path: /lib64/libcrypto.so.3
[landrun:debug] 2025/12/03 12:04:28 Adding read-only executable path: /lib64/libpcap.so.1
[landrun:debug] 2025/12/03 12:04:28 Adding read-only executable path: /lib64/libibverbs.so.1
[landrun:debug] 2025/12/03 12:04:28 Adding read-only executable path: /lib64/ld-linux-x86-64.so.2
[landrun:debug] 2025/12/03 12:04:28 Adding read-only executable path: /lib64/libssl.so.3
[landrun:debug] 2025/12/03 12:04:28 Adding read-only executable path: /lib64/libz.so.1
[landrun:debug] 2025/12/03 12:04:28 Adding read-only executable path: /lib64/libnl-route-3.so.200
[landrun:debug] 2025/12/03 12:04:28 Adding read-only executable path: /lib64/libnl-3.so.200
[landrun:debug] 2025/12/03 12:04:28 Adding read-only executable path: /lib64/libgcc_s.so.1
[landrun:debug] 2025/12/03 12:04:28 Applying Landlock restrictions
[landrun] 2025/12/03 12:04:28 Landlock restrictions applied successfully
[landrun] 2025/12/03 12:04:28 Executing: [/bin/nc]
Ncat: You must specify a host to connect to. QUITTING.

Now it works

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant