Landlock error on /dev/null prevents running packages (NixOS)

[danrobi11]

Tested with Firefox fails with a Landlock error:

Error: add landlock rule for /dev/null: invalid argument
Error: an error occurred while running cpak: container failed before readiness: EOF

Steps to reproduce:

cpak install github.com/containerpak/firefox
cpak run github.com/containerpak/firefox firefox

Environment:

• OS: NixOS
• Architecture: linux/amd64
• cpak version: v2.0.0 (cpak-linux-amd64)

cpak doctor output:

[OK] Linux: linux/amd64
[OK] unprivileged user namespaces: user, mount, PID, IPC, UTS, network and cgroup namespaces can be created
[OK] rootless OverlayFS: overlay mount with userxattr succeeded in a user namespace
[OK] mount_setattr: mount_setattr is available
[OK] seccomp: seccomp filter actions are available
[OK] Landlock: Landlock ABI 7
[WARN] cgroup v2 delegation: /sys/fs/cgroup/user.slice/user-1000.slice/session-2.scope is not delegated to the current user
[OK] host init: systemd
[OK] desktop display: X11 display :0.0
[OK] desktop audio: PipeWire socket /run/user/1000/pipewire-0
[OK] host command bridge: built into cpak and restricted by each application policy

Additional notes:

• Landlock ABI 7 is reported as available by cpak doctor.
• The error happens during sandbox setup, before the application even starts.
• Verbose mode is also broken (unknown flag: --debug).
• This issue was debugged and written with the help of Grok.

Happy to provide more info if needed.

[mirkobrombin]

Good to see the first issue, thanks! I am investigating it.

[mirkobrombin]

Fixed in 8816a69.

Landlock grants now remove directory-only access rights when the target is a file or device such as /dev/null, which is the combination rejected by the kernel on NixOS. I also removed the unsupported internal --debug flag used by verbose runs.

The full test suite passes and a fresh container starts correctly with cpak run -v. I cannot exercise Landlock itself inside my current outer sandbox, so please retest Firefox on NixOS with the next build and reopen this if the device rule still fails.

[Docmine17]

Same on archlinux:
cpak run github.com/bottlesdevs/bottles
ℹ Running cpak from remote:github.com/bottlesdevs/bottles
ℹ Container created:40db0d26-d0c3-4c43-a808-9a511771fd84
ℹ Spawning a new cpak namespace...
Error: add landlock rule for /dev/null: invalid argument
Error: an error occurred while running cpak: container failed before readiness: EOF

[mirkobrombin]

This was fixed in 8816a69. The current continuous build containing the fix was published after your test. Please update cpak and retry. cpak --version should report 0.0.0-4993fbc. If it still fails, post the new output and I will reopen the issue.

[Docmine17]

Problem solved.