Is "Not enforcing Landlock" message normal?

[osevan]

I want know if this landlock message below normal and active?

i want start my container with landlock.enforce inside profile..

Jul 01 21:19:32 OOO firejail[144296]: AppArmor enabled
Jul 01 21:19:32 OOO firejail[144296]: Closing non-standard file descriptors
Jul 01 21:19:32 OOO firejail[144296]: ll_is_supported: Detected Landlock ABI version 6
Jul 01 21:19:32 OOO firejail[144296]: ll_restrict: Starting Landlock restrict
Jul 01 21:19:32 OOO firejail[144296]: ll_create_full_ruleset: Creating Landlock ruleset (abi=6 fs=1fff)
Jul 01 21:19:32 OOO firejail[144296]: ll_fs_read: Adding Landlock rule (abi=6 fs=c) for /
Jul 01 21:19:32 OOO firejail[144296]: ll_fs_read: Adding Landlock rule (abi=6 fs=c) for /proc
Jul 01 21:19:32 OOO firejail[144296]: ll_fs_makeipc: Adding Landlock rule (abi=6 fs=600) for /
Jul 01 21:19:32 OOO firejail[144296]: ll_fs_write: Adding Landlock rule (abi=6 fs=11b2) for /nonexistent
Jul 01 21:19:32 OOO firejail[144296]: ll_fs_write: failed to open /nonexistent: No such file or directory
Jul 01 21:19:32 OOO firejail[144296]: ll_fs_write: Adding Landlock rule (abi=6 fs=11b2) for /run/user/111
Jul 01 21:19:32 OOO firejail[144296]: ll_fs_write: failed to open /run/user/111: No such file or directory
Jul 01 21:19:32 OOO firejail[144296]: ll_fs_write: Adding Landlock rule (abi=6 fs=11b2) for /dev
Jul 01 21:19:32 OOO firejail[144296]: ll_fs_write: Adding Landlock rule (abi=6 fs=11b2) for /proc
Jul 01 21:19:32 OOO firejail[144296]: ll_fs_write: Adding Landlock rule (abi=6 fs=11b2) for /run/shm
Jul 01 21:19:32 OOO firejail[144296]: ll_fs_write: Adding Landlock rule (abi=6 fs=11b2) for /tmp
Jul 01 21:19:32 OOO firejail[144296]: landlock expand path /usr/local/sbin
Jul 01 21:19:32 OOO firejail[144296]: ll_fs_exec: Adding Landlock rule (abi=6 fs=1) for /usr/local/sbin
Jul 01 21:19:32 OOO firejail[144296]: landlock expand path /usr/local/bin
Jul 01 21:19:32 OOO firejail[144296]: ll_fs_exec: Adding Landlock rule (abi=6 fs=1) for /usr/local/bin
Jul 01 21:19:32 OOO firejail[144296]: landlock expand path /usr/sbin
Jul 01 21:19:32 OOO firejail[144296]: ll_fs_exec: Adding Landlock rule (abi=6 fs=1) for /usr/sbin
Jul 01 21:19:32 OOO firejail[144296]: landlock expand path /usr/bin
Jul 01 21:19:32 OOO firejail[144296]: ll_fs_exec: Adding Landlock rule (abi=6 fs=1) for /usr/bin
Jul 01 21:19:32 OOO firejail[144296]: ll_fs_exec: Adding Landlock rule (abi=6 fs=1) for /opt
Jul 01 21:19:32 OOO firejail[144296]: ll_fs_exec: Adding Landlock rule (abi=6 fs=1) for /run/firejail
Jul 01 21:19:32 OOO firejail[144296]: ll_fs_exec: Adding Landlock rule (abi=6 fs=1) for /lib
Jul 01 21:19:32 OOO firejail[144296]: ll_fs_exec: Adding Landlock rule (abi=6 fs=1) for /lib32
Jul 01 21:19:32 OOO firejail[144296]: ll_fs_exec: failed to open /lib32: No such file or directory
Jul 01 21:19:32 OOO firejail[144296]: ll_fs_exec: Adding Landlock rule (abi=6 fs=1) for /libx32
Jul 01 21:19:32 OOO firejail[144296]: ll_fs_exec: failed to open /libx32: No such file or directory
Jul 01 21:19:32 OOO firejail[144296]: ll_fs_exec: Adding Landlock rule (abi=6 fs=1) for /lib64
Jul 01 21:19:32 OOO firejail[144296]: ll_fs_exec: Adding Landlock rule (abi=6 fs=1) for /usr/lib
Jul 01 21:19:32 OOO firejail[144296]: ll_fs_exec: Adding Landlock rule (abi=6 fs=1) for /usr/lib32
Jul 01 21:19:32 OOO firejail[144296]: ll_fs_exec: failed to open /usr/lib32: No such file or directory
Jul 01 21:19:32 OOO firejail[144296]: ll_fs_exec: Adding Landlock rule (abi=6 fs=1) for /usr/libx32
Jul 01 21:19:32 OOO firejail[144296]: ll_fs_exec: failed to open /usr/libx32: No such file or directory
Jul 01 21:19:32 OOO firejail[144296]: ll_fs_exec: Adding Landlock rule (abi=6 fs=1) for /usr/lib64
Jul 01 21:19:32 OOO firejail[144296]: ll_fs_exec: Adding Landlock rule (abi=6 fs=1) for /usr/local/lib
Jul 01 21:19:32 OOO firejail[144296]: ll_fs_exec: Adding Landlock rule (abi=6 fs=1) for /usr/local/sbin/nsd
Jul 01 21:19:32 OOO firejail[144296]: ll_fs_write: Adding Landlock rule (abi=6 fs=11b2) for /etc/nsd/db/
Jul 01 21:19:32 OOO firejail[144296]: ll_fs_write: Adding Landlock rule (abi=6 fs=11b2) for /var/log/
Jul 01 21:19:32 OOO firejail[144296]: 24 Landlock rules initialized in 0.07 ms
Jul 01 21:19:32 OOO firejail[144296]: Starting application
Jul 01 21:19:32 OOO firejail[144296]: LD_PRELOAD=(null)
############################################################################### HERE IS OUTPUT
 Jul 01 21:19:32 OOO firejail[144296]: Not enforcing Landlock
###############################################################################################
Jul 01 21:19:32 OOO firejail[144296]: Child process initialized in 54.26 ms
Jul 01 21:19:32 OOO firejail[144296]: execvp argument 0: /usr/local/sbin/nsd
Jul 01 21:19:32 OOO firejail[144296]: execvp argument 1: -d
Jul 01 21:19:32 OOO firejail[144296]: execvp argument 2: -P
Jul 01 21:19:32 OOO firejail[144296]: execvp argument 3:
Jul 01 21:19:32 OOO firejail[144267]: monitoring pid 27

[kmk3]

I want know if this landlock message below [is] normal

############################################################################### HERE IS OUTPUT
 Jul 01 21:19:32 OOO firejail[144296]: Not enforcing Landlock
###############################################################################################

Yes; see --landlock.enforce and LANDLOCK in man firejail.

[osevan]

maybe my question is not clear enough: is this now active or not ?

[osevan]

  --landlock.enforce (experimental)
              Enforce the Landlock ruleset.  Without it, the  other  Landlock  commands
              have no effect.  See the LANDLOCK section for more information.

but i have landlock.enforce inside profile name... is this not enough?

i tried both: with firejail --landlock.enforce and once with landlock.enforce inside profile, both answering me this output above

this is the order of landlock rules

include disable-common.inc
include disable-devel.inc
include disable-exec.inc
include disable-interpreters.inc
include disable-programs.inc
include disable-write-mnt.inc
include disable-xdg.inc
include disable-proc.inc
include disable-X11.inc
include disable-shell.inc
include landlock-common.inc

landlock.fs.execute /usr/local/sbin/nsd
landlock.fs.write /etc/nsd/db/
landlock.fs.write /var/log/
landlock.enforce

[kmk3]

but i have landlock.enforce inside profile name... is this not enough?

It should be enough.

I see now that the "Not enforcing Landlock" message is always being printed
even when Landlock is being enforced.

Thanks for the report.

I'll try to fix it later; disregard that message for now.

As of 0.9.74, the most relevant message is the following:

Landlock rules initialized in [...]

If you see that message, then Landlock is being enforced.

[kmk3]

PR created:

• bugfix: fix "Not enforcing Landlock" message always being printed #6806