Introduce a new "scoped" member to landlock_ruleset_attr that can specify LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET to restrict connection to abstract UNIX sockets from a process outside of the socket's domain. Two hooks are implemented to enforce these restrictions: unix_stream_connect and unix_may_send.
Showing the changes to include/uapi/linux (1 of 7 files). Show all
Unified · Split
| @@ -44,6 +44,12 @@ struct landlock_ruleset_attr { · 43 unmodified lines | ||
| 44 | 44 | * flags`_). |
| 45 | 45 | */ |
| 46 | 46 | __u64 handled_access_net; |
| 47 | + /** | |
| 48 | + * @scoped: Bitmask of scopes (cf. `Scope flags`_) | |
| 49 | + * restricting a Landlock domain from accessing outside | |
| 50 | + * resources (e.g. IPCs). | |
| 51 | + */ | |
| 52 | + __u64 scoped; | |
| 47 | 53 | }; |
| 48 | 54 | |
| 49 | 55 | /* |
| @@ -274,4 +280,25 @@ struct landlock_net_port_attr { · 224 unmodified lines | ||
| 274 | 280 | #define LANDLOCK_ACCESS_NET_BIND_TCP (1ULL << 0) |
| 275 | 281 | #define LANDLOCK_ACCESS_NET_CONNECT_TCP (1ULL << 1) |
| 276 | 282 | /* clang-format on */ |
| 283 | + | |
| 284 | +/** | |
| 285 | + * DOC: scope | |
| 286 | + * | |
| 287 | + * Scope flags | |
| 288 | + * ~~~~~~~~~~~ | |
| 289 | + * | |
| 290 | + * These flags enable to isolate a sandboxed process from a set of IPC actions. | |
| 291 | + * Setting a flag for a ruleset will isolate the Landlock domain to forbid | |
| 292 | + * connections to resources outside the domain. | |
| 293 | + * | |
| 294 | + * Scopes: | |
| 295 | + * | |
| 296 | + * - %LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET: Restrict a sandboxed process from | |
| 297 | + * connecting to an abstract UNIX socket created by a process outside the | |
| 298 | + * related Landlock domain (e.g. a parent domain or a non-sandboxed process). | |
| 299 | + */ | |
| 300 | +/* clang-format off */ | |
| 301 | +#define LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET (1ULL << 0) | |
| 302 | +/* clang-format on*/ | |
| 303 | + | |
| 277 | 304 | #endif /* _UAPI_LINUX_LANDLOCK_H */ |