Add network rules support in the ruleset management helpers and the landlock_create_ruleset() syscall. Extend user space API to support network actions: * Add new network access rights: LANDLOCK_ACCESS_NET_BIND_TCP and LANDLOCK_ACCESS_NET_CONNECT_TCP. * Add a new network rule type: LANDLOCK_RULE_NET_PORT tied to struct landlock_net_port_attr. The allowed_access field contains the network access rights, and the port field contains the port value according to the controlled protocol. This field can take up to a 64-bit value but the maximum value depends on the related protocol (e.g. 16-bit value for TCP). Network port is in host endianness [1]. * Add a new handled_access_net field to struct landlock_ruleset_attr that contains network access rights. * Increment the Landlock ABI version to 4. Implement socket_bind() and socket_connect() LSM hooks, which enable to control TCP socket binding and connection to specific ports. Expand access_masks_t from u16 to u32 to be able to store network access rights alongside filesystem access rights for rulesets' handled access rights. Access rights are not tied to socket file descriptors but checked at bind() or connect() call time against the caller's Landlock domain. For the filesystem, a file descriptor is a direct access to a file/data. However, for network sockets, we cannot identify for which data or peer a newly created socket will give access to. Indeed, we need to wait for a connect or bind request to identify the use case for this socket. Likewise a directory file descriptor may enable to open another file (i.e. a new data item), but this opening is also restricted by the caller's domain, not the file descriptor's access rights [2]. [1] https://lore.kernel.org/r/278ab07f-7583-a4e0-3d37-1bacd091531d@digikod.net [2] https://lore.kernel.org/r/263c1eb3-602f-57fe-8450-3f138581bee7@digikod.net
Showing the changes to include/uapi (1 of 11 files). Show all
Unified · Split
| @@ -31,6 +31,12 @@ struct landlock_ruleset_attr { · 30 unmodified lines | ||
| 31 | 31 | * this access right. |
| 32 | 32 | */ |
| 33 | 33 | __u64 handled_access_fs; |
| 34 | + /** | |
| 35 | + * @handled_access_net: Bitmask of actions (cf. `Network flags`_) | |
| 36 | + * that is handled by this ruleset and should then be forbidden if no | |
| 37 | + * rule explicitly allow them. | |
| 38 | + */ | |
| 39 | + __u64 handled_access_net; | |
| 34 | 40 | }; |
| 35 | 41 | |
| 36 | 42 | /* |
| @@ -54,6 +60,11 @@ enum landlock_rule_type { · 17 unmodified lines | ||
| 54 | 60 | * landlock_path_beneath_attr . |
| 55 | 61 | */ |
| 56 | 62 | LANDLOCK_RULE_PATH_BENEATH = 1, |
| 63 | + /** | |
| 64 | + * @LANDLOCK_RULE_NET_PORT: Type of a &struct | |
| 65 | + * landlock_net_port_attr . | |
| 66 | + */ | |
| 67 | + LANDLOCK_RULE_NET_PORT, | |
| 57 | 68 | }; |
| 58 | 69 | |
| 59 | 70 | /** |
| @@ -79,6 +90,31 @@ struct landlock_path_beneath_attr { · 19 unmodified lines | ||
| 79 | 90 | */ |
| 80 | 91 | } __attribute__((packed)); |
| 81 | 92 | |
| 93 | +/** | |
| 94 | + * struct landlock_net_port_attr - Network port definition | |
| 95 | + * | |
| 96 | + * Argument of sys_landlock_add_rule(). | |
| 97 | + */ | |
| 98 | +struct landlock_net_port_attr { | |
| 99 | + /** | |
| 100 | + * @allowed_access: Bitmask of allowed access network for a port | |
| 101 | + * (cf. `Network flags`_). | |
| 102 | + */ | |
| 103 | + __u64 allowed_access; | |
| 104 | + /** | |
| 105 | + * @port: Network port in host endianness. | |
| 106 | + * | |
| 107 | + * It should be noted that port 0 passed to :manpage:`bind(2)` will | |
| 108 | + * bind to an available port from a specific port range. This can be | |
| 109 | + * configured thanks to the ``/proc/sys/net/ipv4/ip_local_port_range`` | |
| 110 | + * sysctl (also used for IPv6). A Landlock rule with port 0 and the | |
| 111 | + * ``LANDLOCK_ACCESS_NET_BIND_TCP`` right means that requesting to bind | |
| 112 | + * on port 0 is allowed and it will automatically translate to binding | |
| 113 | + * on the related port range. | |
| 114 | + */ | |
| 115 | + __u64 port; | |
| 116 | +}; | |
| 117 | + | |
| 82 | 118 | /** |
| 83 | 119 | * DOC: fs_access |
| 84 | 120 | * |
| @@ -189,4 +225,23 @@ struct landlock_path_beneath_attr { · 104 unmodified lines | ||
| 189 | 225 | #define LANDLOCK_ACCESS_FS_TRUNCATE (1ULL << 14) |
| 190 | 226 | /* clang-format on */ |
| 191 | 227 | |
| 228 | +/** | |
| 229 | + * DOC: net_access | |
| 230 | + * | |
| 231 | + * Network flags | |
| 232 | + * ~~~~~~~~~~~~~~~~ | |
| 233 | + * | |
| 234 | + * These flags enable to restrict a sandboxed process to a set of network | |
| 235 | + * actions. This is supported since the Landlock ABI version 4. | |
| 236 | + * | |
| 237 | + * TCP sockets with allowed actions: | |
| 238 | + * | |
| 239 | + * - %LANDLOCK_ACCESS_NET_BIND_TCP: Bind a TCP socket to a local port. | |
| 240 | + * - %LANDLOCK_ACCESS_NET_CONNECT_TCP: Connect an active TCP socket to | |
| 241 | + * a remote port. | |
| 242 | + */ | |
| 243 | +/* clang-format off */ | |
| 244 | +#define LANDLOCK_ACCESS_NET_BIND_TCP (1ULL << 0) | |
| 245 | +#define LANDLOCK_ACCESS_NET_CONNECT_TCP (1ULL << 1) | |
| 246 | +/* clang-format on */ | |
| 192 | 247 | #endif /* _UAPI_LINUX_LANDLOCK_H */ |