Currently, a sandbox process is not restricted to sending a signal (e.g. SIGKILL) to a process outside the sandbox environment. The ability to send a signal for a sandboxed process should be scoped the same way abstract UNIX sockets are scoped. Therefore, we extend the "scoped" field in a ruleset with LANDLOCK_SCOPE_SIGNAL to specify that a ruleset will deny sending any signal from within a sandbox process to its parent (i.e. any parent sandbox or non-sandboxed processes). This patch adds file_set_fowner and file_free_security hooks to set and release a pointer to the file owner's domain. This pointer, fown_domain in landlock_file_security will be used in file_send_sigiotask to check if the process can send a signal. The ruleset_with_unknown_scope test is updated to support LANDLOCK_SCOPE_SIGNAL. This depends on two new changes: - commit 1934b212615d ("file: reclaim 24 bytes from f_owner"): replace container_of(fown, struct file, f_owner) with fown->file . - commit 26f204380a3c ("fs: Fix file_set_fowner LSM hook inconsistencies"): lock before calling the hook.
Showing the changes to include/uapi (1 of 7 files). Show all
Unified · Split
| @@ -296,9 +296,12 @@ struct landlock_net_port_attr { · 295 unmodified lines | ||
| 296 | 296 | * - %LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET: Restrict a sandboxed process from |
| 297 | 297 | * connecting to an abstract UNIX socket created by a process outside the |
| 298 | 298 | * related Landlock domain (e.g. a parent domain or a non-sandboxed process). |
| 299 | + * - %LANDLOCK_SCOPE_SIGNAL: Restrict a sandboxed process from sending a signal | |
| 300 | + * to another process outside the domain. | |
| 299 | 301 | */ |
| 300 | 302 | /* clang-format off */ |
| 301 | 303 | #define LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET (1ULL << 0) |
| 304 | +#define LANDLOCK_SCOPE_SIGNAL (1ULL << 1) | |
| 302 | 305 | /* clang-format on*/ |
| 303 | 306 | |
| 304 | 307 | #endif /* _UAPI_LINUX_LANDLOCK_H */ |