Pull landlock updates from Mickaël Salaün: "This adds new Landlock access rights to control UDP bind and connect/send operations, and a new "quiet" feature to mute specific specific audit logs (and other future observability events). A few commits also fix Landlock issues" * tag 'landlock-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux: (24 commits) selftests/landlock: Add tests for invalid use of quiet flag selftests/landlock: Add tests for quiet flag with scope selftests/landlock: Add tests for quiet flag with net rules selftests/landlock: Add tests for quiet flag with fs rules selftests/landlock: Replace hard-coded 16 with a constant samples/landlock: Add quiet flag support to sandboxer landlock: Suppress logging when quiet flag is present landlock: Add API support and docs for the quiet flags landlock: Add a place for flags to layer rules landlock: Add documentation for UDP support samples/landlock: Add sandboxer UDP access control selftests/landlock: Add tests for UDP send selftests/landlock: Add tests for UDP bind/connect landlock: Add UDP send+connect access control landlock: Add UDP bind() access control landlock: Fix unmarked concurrent access to socket family selftests/landlock: Explicitly disable audit in teardowns selftests/landlock: Test SCOPE_SIGNAL on the SIGIO/fowner pgid path landlock: Fix LANDLOCK_SCOPE_SIGNAL bypass on the SIGIO path landlock: Demonstrate best-effort allowed_access filtering ...
Showing the changes to include/uapi/linux (1 of 27 files). Show all
Unified · Split
| @@ -32,6 +32,19 @@ · 31 unmodified lines | |||
| 32 | * *handle* a wide range or all access rights that they know about at build time | 32 | * *handle* a wide range or all access rights that they know about at build time |
| 33 | * (and that they have tested with a kernel that supported them all). | 33 | * (and that they have tested with a kernel that supported them all). |
| 34 | * | 34 | * |
| 35 | * @quiet_access_fs and @quiet_access_net are bitmasks of actions for which a | ||
| 36 | * denial by this layer will not trigger a log if the corresponding object (or | ||
| 37 | * its children, for filesystem rules) is marked with the "quiet" bit via | ||
| 38 | * %LANDLOCK_ADD_RULE_QUIET, even if logging would normally take place per | ||
| 39 | * landlock_restrict_self() flags. @quiet_scoped is similar, except that it | ||
| 40 | * does not require marking any objects as quiet - if the ruleset is created | ||
| 41 | * with any bits set in @quiet_scoped, then denial of such scoped resources will | ||
| 42 | * not trigger any log. These 3 fields are available since Landlock ABI version | ||
| 43 | * 10. | ||
| 44 | * | ||
| 45 | * @quiet_access_fs, @quiet_access_net and @quiet_scoped must be a subset of | ||
| 46 | * @handled_access_fs, @handled_access_net and @scoped respectively. | ||
| 47 | * | ||
| 35 | * This structure can grow in future Landlock versions. | 48 | * This structure can grow in future Landlock versions. |
| 36 | */ | 49 | */ |
| 37 | struct landlock_ruleset_attr { | 50 | struct landlock_ruleset_attr { |
| @@ -51,6 +64,20 @@ struct landlock_ruleset_attr { · 13 unmodified lines | |||
| 51 | * resources (e.g. IPCs). | 64 | * resources (e.g. IPCs). |
| 52 | */ | 65 | */ |
| 53 | __u64 scoped; | 66 | __u64 scoped; |
| 67 | /** | ||
| 68 | * @quiet_access_fs: Bitmask of filesystem actions which should not be | ||
| 69 | * logged if per-object quiet flag is set. | ||
| 70 | */ | ||
| 71 | __u64 quiet_access_fs; | ||
| 72 | /** | ||
| 73 | * @quiet_access_net: Bitmask of network actions which should not be | ||
| 74 | * logged if per-object quiet flag is set. | ||
| 75 | */ | ||
| 76 | __u64 quiet_access_net; | ||
| 77 | /** | ||
| 78 | * @quiet_scoped: Bitmask of scoped actions which should not be logged. | ||
| 79 | */ | ||
| 80 | __u64 quiet_scoped; | ||
| 54 | }; | 81 | }; |
| 55 | 82 | ||
| 56 | /** | 83 | /** |
| @@ -69,6 +96,39 @@ struct landlock_ruleset_attr { · 12 unmodified lines | |||
| 69 | #define LANDLOCK_CREATE_RULESET_ERRATA (1U << 1) | 96 | #define LANDLOCK_CREATE_RULESET_ERRATA (1U << 1) |
| 70 | /* clang-format on */ | 97 | /* clang-format on */ |
| 71 | 98 | ||
| 99 | /** | ||
| 100 | * DOC: landlock_add_rule_flags | ||
| 101 | * | ||
| 102 | * **Flags** | ||
| 103 | * | ||
| 104 | * %LANDLOCK_ADD_RULE_QUIET | ||
| 105 | * Together with the quiet_* fields in struct landlock_ruleset_attr, | ||
| 106 | * this flag controls whether Landlock will log audit messages when | ||
| 107 | * access to the objects covered by this rule is denied by this layer. | ||
| 108 | * | ||
| 109 | * If logging is enabled, when Landlock denies an access, it will | ||
| 110 | * suppress the log if all of the following are true: | ||
| 111 | * | ||
| 112 | * - this layer is the innermost layer that denied the access; | ||
| 113 | * - all accesses denied by this layer are part of the quiet_* fields | ||
| 114 | * in the related struct landlock_ruleset_attr; | ||
| 115 | * - the object (or one of its parents, for filesystem rules) is | ||
| 116 | * marked as "quiet" via %LANDLOCK_ADD_RULE_QUIET. | ||
| 117 | * | ||
| 118 | * Because logging is only suppressed by a layer if the layer denies | ||
| 119 | * access, a sandboxed program cannot use this flag to "hide" access | ||
| 120 | * denials, without denying itself the access in the first place. | ||
| 121 | * | ||
| 122 | * The effect of this flag does not depend on the value of | ||
| 123 | * allowed_access in the passed in rule_attr. When this flag is | ||
| 124 | * present, the caller is also allowed to pass in an empty | ||
| 125 | * allowed_access. | ||
| 126 | */ | ||
| 127 | |||
| 128 | /* clang-format off */ | ||
| 129 | #define LANDLOCK_ADD_RULE_QUIET (1U << 0) | ||
| 130 | /* clang-format on */ | ||
| 131 | |||
| 72 | /** | 132 | /** |
| 73 | * DOC: landlock_restrict_self_flags | 133 | * DOC: landlock_restrict_self_flags |
| 74 | * | 134 | * |
| @@ -200,10 +260,10 @@ struct landlock_net_port_attr { · 125 unmodified lines | |||
| 200 | * (also used for IPv6), and within that range, on a per-socket basis | 260 | * (also used for IPv6), and within that range, on a per-socket basis |
| 201 | * with ``setsockopt(IP_LOCAL_PORT_RANGE)``. | 261 | * with ``setsockopt(IP_LOCAL_PORT_RANGE)``. |
| 202 | * | 262 | * |
| 203 | * A Landlock rule with port 0 and the %LANDLOCK_ACCESS_NET_BIND_TCP | 263 | * A Landlock rule with port 0 and the %LANDLOCK_ACCESS_NET_BIND_TCP or |
| 204 | * right means that requesting to bind on port 0 is allowed and it will | 264 | * %LANDLOCK_ACCESS_NET_BIND_UDP right means that requesting to bind on |
| 205 | * automatically translate to binding on a kernel-assigned ephemeral | 265 | * port 0 is allowed and it will automatically translate to binding on a |
| 206 | * port. | 266 | * kernel-assigned ephemeral port. |
| 207 | */ | 267 | */ |
| 208 | __u64 port; | 268 | __u64 port; |
| 209 | }; | 269 | }; |
| @@ -373,10 +433,39 @@ struct landlock_net_port_attr { · 163 unmodified lines | |||
| 373 | * port. Support added in Landlock ABI version 4. | 433 | * port. Support added in Landlock ABI version 4. |
| 374 | * - %LANDLOCK_ACCESS_NET_CONNECT_TCP: Connect TCP sockets to the given | 434 | * - %LANDLOCK_ACCESS_NET_CONNECT_TCP: Connect TCP sockets to the given |
| 375 | * remote port. Support added in Landlock ABI version 4. | 435 | * remote port. Support added in Landlock ABI version 4. |
| 436 | * | ||
| 437 | * And similarly for UDP port numbers: | ||
| 438 | * | ||
| 439 | * - %LANDLOCK_ACCESS_NET_BIND_UDP: Bind UDP sockets to the given local | ||
| 440 | * port. Support added in Landlock ABI version 10. | ||
| 441 | * - %LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP: Set the remote port of UDP | ||
| 442 | * sockets to the given port, or send datagrams to the given remote port | ||
| 443 | * ignoring any destination pre-set on a socket. Support added in | ||
| 444 | * Landlock ABI version 10. | ||
| 445 | * | ||
| 446 | * .. note:: Setting a remote address or sending a first datagram | ||
| 447 | * auto-binds UDP sockets to an ephemeral local source port if not | ||
| 448 | * already bound. To allow this if both %LANDLOCK_ACCESS_NET_BIND_UDP | ||
| 449 | * and %LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP are handled, you need to | ||
| 450 | * either: | ||
| 451 | * | ||
| 452 | * - use a socket already bound to a port before the ruleset started | ||
| 453 | * being enforced; | ||
| 454 | * - or grant %LANDLOCK_ACCESS_NET_BIND_UDP on port 0, meaning "any | ||
| 455 | * port in the ephemeral port range"; | ||
| 456 | * - or grant %LANDLOCK_ACCESS_NET_BIND_UDP on a specific port, and | ||
| 457 | * call :manpage:`bind(2)` on that port before trying to | ||
| 458 | * :manpage:`connect(2)` or send datagrams. | ||
| 459 | * | ||
| 460 | * .. note:: Sending datagrams to an ``AF_UNSPEC`` destination address | ||
| 461 | * family is not supported for IPv6 UDP sockets: you will need to use a | ||
| 462 | * ``NULL`` address instead. | ||
| 376 | */ | 463 | */ |
| 377 | /* clang-format off */ | 464 | /* clang-format off */ |
| 378 | #define LANDLOCK_ACCESS_NET_BIND_TCP (1ULL << 0) | 465 | #define LANDLOCK_ACCESS_NET_BIND_TCP (1ULL << 0) |
| 379 | #define LANDLOCK_ACCESS_NET_CONNECT_TCP (1ULL << 1) | 466 | #define LANDLOCK_ACCESS_NET_CONNECT_TCP (1ULL << 1) |
| 467 | #define LANDLOCK_ACCESS_NET_BIND_UDP (1ULL << 2) | ||
| 468 | #define LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP (1ULL << 3) | ||
| 380 | /* clang-format on */ | 469 | /* clang-format on */ |
| 381 | 470 | ||
| 382 | /** | 471 | /** |