--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Commit ad79f1d789207d8b192ae7df81b018d03f9943c0
Parents : 4626a57
Author : Ivan <ivan@quad4.io>
Signature : Invalid signer <e46112d44649266d71fe2193e00a4710>, author is <ivan@quad4.io>
Date : 2026-07-15T12:57:58-05:00
feat: add Android detection to prevent Landlock usage
Changes
3 files changed, 23 insertions(+), 0 deletions(-)
Diff
diff --git a/meshchatx.rsm b/meshchatx.rsm
index 191d2642..46ccf258 100644
Binary files a/meshchatx.rsm and b/meshchatx.rsm differ
diff --git a/meshchatx/src/backend/landlock_sandbox.py b/meshchatx/src/backend/landlock_sandbox.py
index 39e92343..355a6ed1 100644
--- a/meshchatx/src/backend/landlock_sandbox.py
+++ b/meshchatx/src/backend/landlock_sandbox.py
@@ -170,6 +170,15 @@ def _probe_landlock_create_ruleset() -> bool:
return abi >= 1
+def _is_android() -> bool:
+ """Return True when running under Android/Chaquopy.
+
+ Android kernels may expose Landlock, but the app seccomp filter blocks
+ the syscalls and raises SIGSYS. Landlock must never be enabled there.
+ """
+ return hasattr(sys, "getandroidapilevel")
+
+
def landlock_kernel_supported() -> bool:
global _landlock_support_cached
if _landlock_support_cached is not None:
@@ -177,6 +186,10 @@ def landlock_kernel_supported() -> bool:
if sys.platform != "linux":
_landlock_support_cached = False
return False
+ if _is_android():
+ # Android seccomp blocks Landlock syscalls with SIGSYS.
+ _landlock_support_cached = False
+ return False
if not _kernel_version_meets_minimum():
_landlock_support_cached = False
return False
diff --git a/tests/backend/test_landlock_sandbox.py b/tests/backend/test_landlock_sandbox.py
index e65c786f..17dd6174 100644
--- a/tests/backend/test_landlock_sandbox.py
+++ b/tests/backend/test_landlock_sandbox.py
@@ -71,6 +71,16 @@ def test_landlock_auto_off_when_kernel_unsupported(monkeypatch):
assert ll.landlock_auto_enabled() is False
+def test_landlock_kernel_supported_false_on_android(monkeypatch):
+ """Android seccomp blocks Landlock syscalls with SIGSYS."""
+ monkeypatch.delenv("MESHCHAT_LANDLOCK", raising=False)
+ ll._landlock_support_cached = None
+ with patch.object(ll, "sys") as mock_sys:
+ mock_sys.platform = "linux"
+ mock_sys.getandroidapilevel = lambda: 34
+ assert ll.landlock_kernel_supported() is False
+
+
@pytest.mark.skipif(sys.platform != "linux", reason="Landlock probe requires Linux")
def test_landlock_kernel_supported_on_linux():
ll._landlock_support_cached = None
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────