supervisor: Landlock hard_requirement aborts with "incompatible directory-only access-rights: ReadDir" for real directories on RHEL 9.6 (kernel 5.14) ABI

[flg77]

Description

On a Kubernetes (OpenShift) deployment backed by RHCOS = RHEL 9.6, kernel 5.14.0, openshell sandbox create with a policy whose landlock.compatibility: hard_requirement fails at sandbox preparation:

Failed to prepare sandbox: incompatible directory-only access-rights: BitFlags<AccessFs>(0b1000, ReadDir)

This happens even when the policy's filesystem_policy lists only real directories (no device files, no symlinks). ReadDir (0b1000 = LANDLOCK_ACCESS_FS_READ_DIR) is a standard directory-only access right that has existed since Landlock ABI v1 (kernel 5.13), yet the supervisor rejects it as incompatible on this kernel's (RHEL-backported) Landlock ABI instead of applying it — or gracefully restricting to the supported subset.

Setting landlock.compatibility: best_effort brings the workspace up cleanly. This confirms the issue is specific to the hard_requirement ABI/access-right compatibility check.

Environment

• OpenShell: 0.0.76
• Platform: OpenShift 4.21, RHCOS 9.6, kernel 5.14.0-570.112.1.el9_6.x86_64

(full draft in the saved file)

[TaylorMutch]

Agent Diagnostic

Loaded the create-github-issue and debug-openshell-cluster skills and traced this error through current OpenShell main and the pinned landlock crate (0.4.4).

Finding

This is a real OpenShell bug, but the primary cause is path-type handling rather than the RHEL kernel rejecting ReadDir as an ABI feature.

OpenShell currently builds one access mask per policy class:

• read-only paths receive AccessFs::from_read(ABI::V2), which contains Execute | ReadFile | ReadDir;
• read-write paths receive AccessFs::from_all(ABI::V2), which also contains directory-only rights.

Those masks are passed unchanged to PathBeneath::new() for every path in crates/openshell-supervisor-process/src/sandbox/linux/landlock.rs, regardless of whether the opened path is a directory or a regular/device file.

The effective policy contains non-directory paths even when the user-authored filesystem policy lists only directories:

• proxy baseline enrichment adds /dev/urandom as read-only;
• the restrictive default also includes /dev/urandom and /dev/null;
• GPU enrichment may add /dev/nvidia* or /dev/dxg device nodes.

The landlock crate calls fstat() on each PathFd. When the target is not a directory, ReadDir and other directory-only bits are incompatible. In BestEffort mode the crate removes those superfluous bits; in HardRequirement mode it returns exactly:

incompatible directory-only access-rights: BitFlags<AccessFs>(0b1000, ReadDir)

That explains why changing only landlock.compatibility makes the sandbox start. It does not indicate that RHEL's Landlock ABI lacks ReadDir; it indicates that a directory-only permission was attached to a non-directory PathFd.

Recommended fix

OpenShell should determine each opened path's file type before constructing the rule and tailor the allowed mask explicitly:

• directories retain AccessFs::from_read() or AccessFs::from_all();
• non-directories intersect the intended mask with AccessFs::from_file(abi).

This preserves hard_requirement semantics for kernel/ABI support while removing rights that are nonsensical for the target file type. Relying on per-rule best-effort compatibility would be less precise because it could also hide genuinely unsupported access rights.

Regression coverage should include, in hard-requirement mode:

1. a read-only regular/device file such as /dev/urandom;
2. a read-write file such as /dev/null;
3. ordinary read-only and read-write directories;
4. mixed directory and device-node baseline paths;
5. verification that truly unsupported ABI rights still fail closed.

The current best_effort setting is a functional workaround, but it weakens the operator's requested fail-closed guarantee and should not be treated as the resolution. No duplicate issue or active implementation PR was found.

[TaylorMutch]

📋 triage-agent

Triage Assessment

Classification: bug-confirmed

Summary

The failure is reproducible from the current implementation and is not a RHEL Landlock ABI deficiency. OpenShell applies directory-only access rights to non-directory baseline paths, which the landlock crate correctly rejects under hard_requirement.

Investigation

openshell-supervisor-process constructs one read-only and one read-write AccessFs mask, then applies each mask unchanged to every PathBeneath. Effective policies include non-directories such as /dev/urandom, /dev/null, and optional GPU device nodes. landlock 0.4.4 uses fstat() and returns DirectoryAccess { incompatible: ReadDir } for these rules in hard-requirement mode; best-effort mode silently removes the nonsensical bits, explaining the reported workaround.

Recommendation

Keep the issue open as a confirmed supervisor compatibility bug. Tailor each rule from the already-opened file descriptor: retain directory masks for directories and intersect non-directory masks with AccessFs::from_file(abi). Add hard-requirement regression coverage for read-only/read-write files, directories, mixed baseline paths, and genuinely unsupported ABI rights. The GitHub issue is already typed as Bug; implementation still requires the human state:agent-ready decision.