landlock: Support file truncation

Introduce the LANDLOCK_ACCESS_FS_TRUNCATE flag for file truncation. This flag hooks into the path_truncate, file_truncate and file_alloc_security LSM hooks and covers file truncation using truncate(2), ftruncate(2), open(2) with O_TRUNC, as well as creat(). This change also increments the Landlock ABI version, updates corresponding selftests, and updates code documentation to document the flag. In security/security.c, allocate security blobs at pointer-aligned offsets. This fixes the problem where one LSM's security blob can shift another LSM's security blob to an unaligned address (reported by Nathan Chancellor). The following operations are restricted: open(2): requires the LANDLOCK_ACCESS_FS_TRUNCATE right if a file gets implicitly truncated as part of the open() (e.g. using O_TRUNC). Notable special cases: * open(..., O_RDONLY|O_TRUNC) can truncate files as well in Linux * open() with O_TRUNC does *not* need the TRUNCATE right when it creates a new file. truncate(2) (on a path): requires the LANDLOCK_ACCESS_FS_TRUNCATE right. ftruncate(2) (on a file): requires that the file had the TRUNCATE right when it was previously opened. File descriptors acquired by other means than open(2) (e.g. memfd_create(2)) continue to support truncation with ftruncate(2).

Günther Noack committed 4 years ago

Commit b9f5ce21 parent 52a13489 files · +153 −21Browse files

Showing the changes to include/uapi (1 of 9 files). Show all

Unified · Split

include/uapi/linux/landlock.h+16−5

@@ -95,8 +95,19 @@ struct landlock_path_beneath_attr { · 94 unmodified lines
95	95	* A file can only receive these access rights:
96	96	*
97	97	* - %LANDLOCK_ACCESS_FS_EXECUTE: Execute a file.
98		− * - %LANDLOCK_ACCESS_FS_WRITE_FILE: Open a file with write access.
	98	+ * - %LANDLOCK_ACCESS_FS_WRITE_FILE: Open a file with write access. Note that
	99	+ * you might additionally need the %LANDLOCK_ACCESS_FS_TRUNCATE right in order
	100	+ * to overwrite files with :manpage:`open(2)` using ``O_TRUNC`` or
	101	+ * :manpage:`creat(2)`.
99	102	* - %LANDLOCK_ACCESS_FS_READ_FILE: Open a file with read access.
	103	+ * - %LANDLOCK_ACCESS_FS_TRUNCATE: Truncate a file with :manpage:`truncate(2)`,
	104	+ * :manpage:`ftruncate(2)`, :manpage:`creat(2)`, or :manpage:`open(2)` with
	105	+ * ``O_TRUNC``. Whether an opened file can be truncated with
	106	+ * :manpage:`ftruncate(2)` is determined during :manpage:`open(2)`, in the
	107	+ * same way as read and write permissions are checked during
	108	+ * :manpage:`open(2)` using %LANDLOCK_ACCESS_FS_READ_FILE and
	109	+ * %LANDLOCK_ACCESS_FS_WRITE_FILE. This access right is available since the
	110	+ * third version of the Landlock ABI.
100	111	*
101	112	* A directory can receive access rights related to files or directories. The
102	113	* following access right is applied to the directory itself, and the
@@ -139,10 +150,9 @@ struct landlock_path_beneath_attr { · 36 unmodified lines
139	150	*
140	151	* It is currently not possible to restrict some file-related actions
141	152	* accessible through these syscall families: :manpage:`chdir(2)`,
142		− * :manpage:`truncate(2)`, :manpage:`stat(2)`, :manpage:`flock(2)`,
143		− * :manpage:`chmod(2)`, :manpage:`chown(2)`, :manpage:`setxattr(2)`,
144		− * :manpage:`utime(2)`, :manpage:`ioctl(2)`, :manpage:`fcntl(2)`,
145		− * :manpage:`access(2)`.
	153	+ * :manpage:`stat(2)`, :manpage:`flock(2)`, :manpage:`chmod(2)`,
	154	+ * :manpage:`chown(2)`, :manpage:`setxattr(2)`, :manpage:`utime(2)`,
	155	+ * :manpage:`ioctl(2)`, :manpage:`fcntl(2)`, :manpage:`access(2)`.
146	156	* Future Landlock evolutions will enable to restrict them.
147	157	*/
148	158	/* clang-format off */
@@ -160,6 +170,7 @@ struct landlock_path_beneath_attr { · 11 unmodified lines
160	170	#define LANDLOCK_ACCESS_FS_MAKE_BLOCK (1ULL << 11)
161	171	#define LANDLOCK_ACCESS_FS_MAKE_SYM (1ULL << 12)
162	172	#define LANDLOCK_ACCESS_FS_REFER (1ULL << 13)
	173	+#define LANDLOCK_ACCESS_FS_TRUNCATE (1ULL << 14)
163	174	/* clang-format on */
164	175
165	176	#endif /* _UAPI_LINUX_LANDLOCK_H */