Pull landlock updates from Mickaël Salaün: "A Landlock ruleset can now handle two new access rights: LANDLOCK_ACCESS_NET_BIND_TCP and LANDLOCK_ACCESS_NET_CONNECT_TCP. When handled, the related actions are denied unless explicitly allowed by a Landlock network rule for a specific port. The related patch series has been reviewed for almost two years, it has evolved a lot and we now have reached a decent design, code and testing. The refactored kernel code and the new test helpers also bring the foundation to support more network protocols. Test coverage for security/landlock is 92.4% of 710 lines according to gcc/gcov-13, and it was 93.1% of 597 lines before this series. The decrease in coverage is due to code refactoring to make the ruleset management more generic (i.e. dealing with inodes and ports) that also added new WARN_ON_ONCE() checks not possible to test from user space. syzkaller has been updated accordingly [4], and such patched instance (tailored to Landlock) has been running for a month, covering all the new network-related code [5]" Link: https://lore.kernel.org/r/20231026014751.414649-1-konstantin.meskhidze@huawei.com [1] Link: https://lore.kernel.org/r/CAHC9VhS1wwgH6NNd+cJz4MYogPiRV8NyPDd1yj5SpaxeUB4UVg@mail.gmail.com [2] Link: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next-history.git/commit/?id=c8dc5ee69d3a [3] Link: https://github.com/google/syzkaller/pull/4266 [4] Link: https://storage.googleapis.com/syzbot-assets/82e8608dec36/ci-upstream-linux-next-kasan-gce-root-ab577164.html#security%2flandlock%2fnet.c [5] * tag 'landlock-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux: selftests/landlock: Add tests for FS topology changes with network rules landlock: Document network support samples/landlock: Support TCP restrictions selftests/landlock: Add network tests selftests/landlock: Share enforce_ruleset() helper landlock: Support network rules with TCP bind and connect landlock: Refactor landlock_add_rule() syscall landlock: Refactor layer helpers landlock: Move and rename layer helpers landlock: Refactor merge/inherit_ruleset helpers landlock: Refactor landlock_find_rule/insert_rule helpers landlock: Allow FS topology changes for domains without such rule type landlock: Make ruleset's access masks more generic
Showing the changes to include/uapi/linux (1 of 18 files). Show all
Unified · Split
| @@ -31,6 +31,12 @@ struct landlock_ruleset_attr { · 30 unmodified lines | |||
| 31 | * this access right. | 31 | * this access right. |
| 32 | */ | 32 | */ |
| 33 | __u64 handled_access_fs; | 33 | __u64 handled_access_fs; |
| 34 | /** | ||
| 35 | * @handled_access_net: Bitmask of actions (cf. `Network flags`_) | ||
| 36 | * that is handled by this ruleset and should then be forbidden if no | ||
| 37 | * rule explicitly allow them. | ||
| 38 | */ | ||
| 39 | __u64 handled_access_net; | ||
| 34 | }; | 40 | }; |
| 35 | 41 | ||
| 36 | /* | 42 | /* |
| @@ -54,6 +60,11 @@ enum landlock_rule_type { · 17 unmodified lines | |||
| 54 | * landlock_path_beneath_attr . | 60 | * landlock_path_beneath_attr . |
| 55 | */ | 61 | */ |
| 56 | LANDLOCK_RULE_PATH_BENEATH = 1, | 62 | LANDLOCK_RULE_PATH_BENEATH = 1, |
| 63 | /** | ||
| 64 | * @LANDLOCK_RULE_NET_PORT: Type of a &struct | ||
| 65 | * landlock_net_port_attr . | ||
| 66 | */ | ||
| 67 | LANDLOCK_RULE_NET_PORT, | ||
| 57 | }; | 68 | }; |
| 58 | 69 | ||
| 59 | /** | 70 | /** |
| @@ -79,6 +90,31 @@ struct landlock_path_beneath_attr { · 19 unmodified lines | |||
| 79 | */ | 90 | */ |
| 80 | } __attribute__((packed)); | 91 | } __attribute__((packed)); |
| 81 | 92 | ||
| 93 | /** | ||
| 94 | * struct landlock_net_port_attr - Network port definition | ||
| 95 | * | ||
| 96 | * Argument of sys_landlock_add_rule(). | ||
| 97 | */ | ||
| 98 | struct landlock_net_port_attr { | ||
| 99 | /** | ||
| 100 | * @allowed_access: Bitmask of allowed access network for a port | ||
| 101 | * (cf. `Network flags`_). | ||
| 102 | */ | ||
| 103 | __u64 allowed_access; | ||
| 104 | /** | ||
| 105 | * @port: Network port in host endianness. | ||
| 106 | * | ||
| 107 | * It should be noted that port 0 passed to :manpage:`bind(2)` will | ||
| 108 | * bind to an available port from a specific port range. This can be | ||
| 109 | * configured thanks to the ``/proc/sys/net/ipv4/ip_local_port_range`` | ||
| 110 | * sysctl (also used for IPv6). A Landlock rule with port 0 and the | ||
| 111 | * ``LANDLOCK_ACCESS_NET_BIND_TCP`` right means that requesting to bind | ||
| 112 | * on port 0 is allowed and it will automatically translate to binding | ||
| 113 | * on the related port range. | ||
| 114 | */ | ||
| 115 | __u64 port; | ||
| 116 | }; | ||
| 117 | |||
| 82 | /** | 118 | /** |
| 83 | * DOC: fs_access | 119 | * DOC: fs_access |
| 84 | * | 120 | * |
| @@ -189,4 +225,23 @@ struct landlock_path_beneath_attr { · 104 unmodified lines | |||
| 189 | #define LANDLOCK_ACCESS_FS_TRUNCATE (1ULL << 14) | 225 | #define LANDLOCK_ACCESS_FS_TRUNCATE (1ULL << 14) |
| 190 | /* clang-format on */ | 226 | /* clang-format on */ |
| 191 | 227 | ||
| 228 | /** | ||
| 229 | * DOC: net_access | ||
| 230 | * | ||
| 231 | * Network flags | ||
| 232 | * ~~~~~~~~~~~~~~~~ | ||
| 233 | * | ||
| 234 | * These flags enable to restrict a sandboxed process to a set of network | ||
| 235 | * actions. This is supported since the Landlock ABI version 4. | ||
| 236 | * | ||
| 237 | * TCP sockets with allowed actions: | ||
| 238 | * | ||
| 239 | * - %LANDLOCK_ACCESS_NET_BIND_TCP: Bind a TCP socket to a local port. | ||
| 240 | * - %LANDLOCK_ACCESS_NET_CONNECT_TCP: Connect an active TCP socket to | ||
| 241 | * a remote port. | ||
| 242 | */ | ||
| 243 | /* clang-format off */ | ||
| 244 | #define LANDLOCK_ACCESS_NET_BIND_TCP (1ULL << 0) | ||
| 245 | #define LANDLOCK_ACCESS_NET_CONNECT_TCP (1ULL << 1) | ||
| 246 | /* clang-format on */ | ||
| 192 | #endif /* _UAPI_LINUX_LANDLOCK_H */ | 247 | #endif /* _UAPI_LINUX_LANDLOCK_H */ |