History

Merge tag 'landlock-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux

Pull landlock updates from Mickaël Salaün: "This adds new Landlock access rights to control UDP bind and connect/send operations, and a new "quiet" feature to mute specific specific audit logs (and other future observability events). A few commits also fix Landlock issues" * tag 'landlock-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux: (24 commits) selftests/landlock: Add tests for invalid use of quiet flag selftests/landlock: Add tests for quiet flag with scope selftests/landlock: Add tests for quiet flag with net rules selftests/landlock: Add tests for quiet flag with fs rules selftests/landlock: Replace hard-coded 16 with a constant samples/landlock: Add quiet flag support to sandboxer landlock: Suppress logging when quiet flag is present landlock: Add API support and docs for the quiet flags landlock: Add a place for flags to layer rules landlock: Add documentation for UDP support samples/landlock: Add sandboxer UDP access control selftests/landlock: Add tests for UDP send selftests/landlock: Add tests for UDP bind/connect landlock: Add UDP send+connect access control landlock: Add UDP bind() access control landlock: Fix unmarked concurrent access to socket family selftests/landlock: Explicitly disable audit in teardowns selftests/landlock: Test SCOPE_SIGNAL on the SIGIO/fowner pgid path landlock: Fix LANDLOCK_SCOPE_SIGNAL bypass on the SIGIO path landlock: Demonstrate best-effort allowed_access filtering ...

Linus Torvalds committed 4 months ago

Commit 5e2e1472 parents e2c0595 1c236e727 files · +5368 −435Browse files

Showing the changes to include/uapi/linux (1 of 27 files). Show all

Unified · Split

include/uapi/linux/landlock.h+93−4
@@ -32,6 +32,19 @@ · 31 unmodified lines
3232 * *handle* a wide range or all access rights that they know about at build time
3333 * (and that they have tested with a kernel that supported them all).
3434 *
35+ * @quiet_access_fs and @quiet_access_net are bitmasks of actions for which a
36+ * denial by this layer will not trigger a log if the corresponding object (or
37+ * its children, for filesystem rules) is marked with the "quiet" bit via
38+ * %LANDLOCK_ADD_RULE_QUIET, even if logging would normally take place per
39+ * landlock_restrict_self() flags. @quiet_scoped is similar, except that it
40+ * does not require marking any objects as quiet - if the ruleset is created
41+ * with any bits set in @quiet_scoped, then denial of such scoped resources will
42+ * not trigger any log. These 3 fields are available since Landlock ABI version
43+ * 10.
44+ *
45+ * @quiet_access_fs, @quiet_access_net and @quiet_scoped must be a subset of
46+ * @handled_access_fs, @handled_access_net and @scoped respectively.
47+ *
3548 * This structure can grow in future Landlock versions.
3649 */
3750 struct landlock_ruleset_attr {
@@ -51,6 +64,20 @@ struct landlock_ruleset_attr { · 13 unmodified lines
5164 * resources (e.g. IPCs).
5265 */
5366 __u64 scoped;
67+ /**
68+ * @quiet_access_fs: Bitmask of filesystem actions which should not be
69+ * logged if per-object quiet flag is set.
70+ */
71+ __u64 quiet_access_fs;
72+ /**
73+ * @quiet_access_net: Bitmask of network actions which should not be
74+ * logged if per-object quiet flag is set.
75+ */
76+ __u64 quiet_access_net;
77+ /**
78+ * @quiet_scoped: Bitmask of scoped actions which should not be logged.
79+ */
80+ __u64 quiet_scoped;
5481 };
5582
5683 /**
@@ -69,6 +96,39 @@ struct landlock_ruleset_attr { · 12 unmodified lines
6996 #define LANDLOCK_CREATE_RULESET_ERRATA (1U << 1)
7097 /* clang-format on */
7198
99+/**
100+ * DOC: landlock_add_rule_flags
101+ *
102+ * **Flags**
103+ *
104+ * %LANDLOCK_ADD_RULE_QUIET
105+ * Together with the quiet_* fields in struct landlock_ruleset_attr,
106+ * this flag controls whether Landlock will log audit messages when
107+ * access to the objects covered by this rule is denied by this layer.
108+ *
109+ * If logging is enabled, when Landlock denies an access, it will
110+ * suppress the log if all of the following are true:
111+ *
112+ * - this layer is the innermost layer that denied the access;
113+ * - all accesses denied by this layer are part of the quiet_* fields
114+ * in the related struct landlock_ruleset_attr;
115+ * - the object (or one of its parents, for filesystem rules) is
116+ * marked as "quiet" via %LANDLOCK_ADD_RULE_QUIET.
117+ *
118+ * Because logging is only suppressed by a layer if the layer denies
119+ * access, a sandboxed program cannot use this flag to "hide" access
120+ * denials, without denying itself the access in the first place.
121+ *
122+ * The effect of this flag does not depend on the value of
123+ * allowed_access in the passed in rule_attr. When this flag is
124+ * present, the caller is also allowed to pass in an empty
125+ * allowed_access.
126+ */
127+
128+/* clang-format off */
129+#define LANDLOCK_ADD_RULE_QUIET (1U << 0)
130+/* clang-format on */
131+
72132 /**
73133 * DOC: landlock_restrict_self_flags
74134 *
@@ -200,10 +260,10 @@ struct landlock_net_port_attr { · 125 unmodified lines
200260 * (also used for IPv6), and within that range, on a per-socket basis
201261 * with ``setsockopt(IP_LOCAL_PORT_RANGE)``.
202262 *
203− * A Landlock rule with port 0 and the %LANDLOCK_ACCESS_NET_BIND_TCP
204− * right means that requesting to bind on port 0 is allowed and it will
205− * automatically translate to binding on a kernel-assigned ephemeral
206− * port.
263+ * A Landlock rule with port 0 and the %LANDLOCK_ACCESS_NET_BIND_TCP or
264+ * %LANDLOCK_ACCESS_NET_BIND_UDP right means that requesting to bind on
265+ * port 0 is allowed and it will automatically translate to binding on a
266+ * kernel-assigned ephemeral port.
207267 */
208268 __u64 port;
209269 };
@@ -373,10 +433,39 @@ struct landlock_net_port_attr { · 163 unmodified lines
373433 * port. Support added in Landlock ABI version 4.
374434 * - %LANDLOCK_ACCESS_NET_CONNECT_TCP: Connect TCP sockets to the given
375435 * remote port. Support added in Landlock ABI version 4.
436+ *
437+ * And similarly for UDP port numbers:
438+ *
439+ * - %LANDLOCK_ACCESS_NET_BIND_UDP: Bind UDP sockets to the given local
440+ * port. Support added in Landlock ABI version 10.
441+ * - %LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP: Set the remote port of UDP
442+ * sockets to the given port, or send datagrams to the given remote port
443+ * ignoring any destination pre-set on a socket. Support added in
444+ * Landlock ABI version 10.
445+ *
446+ * .. note:: Setting a remote address or sending a first datagram
447+ * auto-binds UDP sockets to an ephemeral local source port if not
448+ * already bound. To allow this if both %LANDLOCK_ACCESS_NET_BIND_UDP
449+ * and %LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP are handled, you need to
450+ * either:
451+ *
452+ * - use a socket already bound to a port before the ruleset started
453+ * being enforced;
454+ * - or grant %LANDLOCK_ACCESS_NET_BIND_UDP on port 0, meaning "any
455+ * port in the ephemeral port range";
456+ * - or grant %LANDLOCK_ACCESS_NET_BIND_UDP on a specific port, and
457+ * call :manpage:`bind(2)` on that port before trying to
458+ * :manpage:`connect(2)` or send datagrams.
459+ *
460+ * .. note:: Sending datagrams to an ``AF_UNSPEC`` destination address
461+ * family is not supported for IPv6 UDP sockets: you will need to use a
462+ * ``NULL`` address instead.
376463 */
377464 /* clang-format off */
378465 #define LANDLOCK_ACCESS_NET_BIND_TCP (1ULL << 0)
379466 #define LANDLOCK_ACCESS_NET_CONNECT_TCP (1ULL << 1)
467+#define LANDLOCK_ACCESS_NET_BIND_UDP (1ULL << 2)
468+#define LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP (1ULL << 3)
380469 /* clang-format on */
381470
382471 /**