Introduce the LANDLOCK_ACCESS_FS_TRUNCATE flag for file truncation. This flag hooks into the path_truncate, file_truncate and file_alloc_security LSM hooks and covers file truncation using truncate(2), ftruncate(2), open(2) with O_TRUNC, as well as creat(). This change also increments the Landlock ABI version, updates corresponding selftests, and updates code documentation to document the flag. In security/security.c, allocate security blobs at pointer-aligned offsets. This fixes the problem where one LSM's security blob can shift another LSM's security blob to an unaligned address (reported by Nathan Chancellor). The following operations are restricted: open(2): requires the LANDLOCK_ACCESS_FS_TRUNCATE right if a file gets implicitly truncated as part of the open() (e.g. using O_TRUNC). Notable special cases: * open(..., O_RDONLY|O_TRUNC) can truncate files as well in Linux * open() with O_TRUNC does *not* need the TRUNCATE right when it creates a new file. truncate(2) (on a path): requires the LANDLOCK_ACCESS_FS_TRUNCATE right. ftruncate(2) (on a file): requires that the file had the TRUNCATE right when it was previously opened. File descriptors acquired by other means than open(2) (e.g. memfd_create(2)) continue to support truncation with ftruncate(2).
Showing the changes to include/uapi (1 of 9 files). Show all
Unified · Split
| @@ -95,8 +95,19 @@ struct landlock_path_beneath_attr { · 94 unmodified lines | |||
| 95 | * A file can only receive these access rights: | 95 | * A file can only receive these access rights: |
| 96 | * | 96 | * |
| 97 | * - %LANDLOCK_ACCESS_FS_EXECUTE: Execute a file. | 97 | * - %LANDLOCK_ACCESS_FS_EXECUTE: Execute a file. |
| 98 | * - %LANDLOCK_ACCESS_FS_WRITE_FILE: Open a file with write access. | 98 | * - %LANDLOCK_ACCESS_FS_WRITE_FILE: Open a file with write access. Note that |
| 99 | * you might additionally need the %LANDLOCK_ACCESS_FS_TRUNCATE right in order | ||
| 100 | * to overwrite files with :manpage:`open(2)` using ``O_TRUNC`` or | ||
| 101 | * :manpage:`creat(2)`. | ||
| 99 | * - %LANDLOCK_ACCESS_FS_READ_FILE: Open a file with read access. | 102 | * - %LANDLOCK_ACCESS_FS_READ_FILE: Open a file with read access. |
| 103 | * - %LANDLOCK_ACCESS_FS_TRUNCATE: Truncate a file with :manpage:`truncate(2)`, | ||
| 104 | * :manpage:`ftruncate(2)`, :manpage:`creat(2)`, or :manpage:`open(2)` with | ||
| 105 | * ``O_TRUNC``. Whether an opened file can be truncated with | ||
| 106 | * :manpage:`ftruncate(2)` is determined during :manpage:`open(2)`, in the | ||
| 107 | * same way as read and write permissions are checked during | ||
| 108 | * :manpage:`open(2)` using %LANDLOCK_ACCESS_FS_READ_FILE and | ||
| 109 | * %LANDLOCK_ACCESS_FS_WRITE_FILE. This access right is available since the | ||
| 110 | * third version of the Landlock ABI. | ||
| 100 | * | 111 | * |
| 101 | * A directory can receive access rights related to files or directories. The | 112 | * A directory can receive access rights related to files or directories. The |
| 102 | * following access right is applied to the directory itself, and the | 113 | * following access right is applied to the directory itself, and the |
| @@ -139,10 +150,9 @@ struct landlock_path_beneath_attr { · 36 unmodified lines | |||
| 139 | * | 150 | * |
| 140 | * It is currently not possible to restrict some file-related actions | 151 | * It is currently not possible to restrict some file-related actions |
| 141 | * accessible through these syscall families: :manpage:`chdir(2)`, | 152 | * accessible through these syscall families: :manpage:`chdir(2)`, |
| 142 | * :manpage:`truncate(2)`, :manpage:`stat(2)`, :manpage:`flock(2)`, | 153 | * :manpage:`stat(2)`, :manpage:`flock(2)`, :manpage:`chmod(2)`, |
| 143 | * :manpage:`chmod(2)`, :manpage:`chown(2)`, :manpage:`setxattr(2)`, | 154 | * :manpage:`chown(2)`, :manpage:`setxattr(2)`, :manpage:`utime(2)`, |
| 144 | * :manpage:`utime(2)`, :manpage:`ioctl(2)`, :manpage:`fcntl(2)`, | 155 | * :manpage:`ioctl(2)`, :manpage:`fcntl(2)`, :manpage:`access(2)`. |
| 145 | * :manpage:`access(2)`. | ||
| 146 | * Future Landlock evolutions will enable to restrict them. | 156 | * Future Landlock evolutions will enable to restrict them. |
| 147 | */ | 157 | */ |
| 148 | /* clang-format off */ | 158 | /* clang-format off */ |
| @@ -160,6 +170,7 @@ struct landlock_path_beneath_attr { · 11 unmodified lines | |||
| 160 | #define LANDLOCK_ACCESS_FS_MAKE_BLOCK (1ULL << 11) | 170 | #define LANDLOCK_ACCESS_FS_MAKE_BLOCK (1ULL << 11) |
| 161 | #define LANDLOCK_ACCESS_FS_MAKE_SYM (1ULL << 12) | 171 | #define LANDLOCK_ACCESS_FS_MAKE_SYM (1ULL << 12) |
| 162 | #define LANDLOCK_ACCESS_FS_REFER (1ULL << 13) | 172 | #define LANDLOCK_ACCESS_FS_REFER (1ULL << 13) |
| 173 | #define LANDLOCK_ACCESS_FS_TRUNCATE (1ULL << 14) | ||
| 163 | /* clang-format on */ | 174 | /* clang-format on */ |
| 164 | 175 | ||
| 165 | #endif /* _UAPI_LINUX_LANDLOCK_H */ | 176 | #endif /* _UAPI_LINUX_LANDLOCK_H */ |