Introduce a new "scoped" member to landlock_ruleset_attr that can specify LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET to restrict connection to abstract UNIX sockets from a process outside of the socket's domain. Two hooks are implemented to enforce these restrictions: unix_stream_connect and unix_may_send.
Showing the changes to include/uapi/linux (1 of 7 files). Show all
Unified · Split
| @@ -44,6 +44,12 @@ struct landlock_ruleset_attr { · 43 unmodified lines | |||
| 44 | * flags`_). | 44 | * flags`_). |
| 45 | */ | 45 | */ |
| 46 | __u64 handled_access_net; | 46 | __u64 handled_access_net; |
| 47 | /** | ||
| 48 | * @scoped: Bitmask of scopes (cf. `Scope flags`_) | ||
| 49 | * restricting a Landlock domain from accessing outside | ||
| 50 | * resources (e.g. IPCs). | ||
| 51 | */ | ||
| 52 | __u64 scoped; | ||
| 47 | }; | 53 | }; |
| 48 | 54 | ||
| 49 | /* | 55 | /* |
| @@ -274,4 +280,25 @@ struct landlock_net_port_attr { · 224 unmodified lines | |||
| 274 | #define LANDLOCK_ACCESS_NET_BIND_TCP (1ULL << 0) | 280 | #define LANDLOCK_ACCESS_NET_BIND_TCP (1ULL << 0) |
| 275 | #define LANDLOCK_ACCESS_NET_CONNECT_TCP (1ULL << 1) | 281 | #define LANDLOCK_ACCESS_NET_CONNECT_TCP (1ULL << 1) |
| 276 | /* clang-format on */ | 282 | /* clang-format on */ |
| 283 | |||
| 284 | /** | ||
| 285 | * DOC: scope | ||
| 286 | * | ||
| 287 | * Scope flags | ||
| 288 | * ~~~~~~~~~~~ | ||
| 289 | * | ||
| 290 | * These flags enable to isolate a sandboxed process from a set of IPC actions. | ||
| 291 | * Setting a flag for a ruleset will isolate the Landlock domain to forbid | ||
| 292 | * connections to resources outside the domain. | ||
| 293 | * | ||
| 294 | * Scopes: | ||
| 295 | * | ||
| 296 | * - %LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET: Restrict a sandboxed process from | ||
| 297 | * connecting to an abstract UNIX socket created by a process outside the | ||
| 298 | * related Landlock domain (e.g. a parent domain or a non-sandboxed process). | ||
| 299 | */ | ||
| 300 | /* clang-format off */ | ||
| 301 | #define LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET (1ULL << 0) | ||
| 302 | /* clang-format on*/ | ||
| 303 | |||
| 277 | #endif /* _UAPI_LINUX_LANDLOCK_H */ | 304 | #endif /* _UAPI_LINUX_LANDLOCK_H */ |