Loading...
Note: File does not exist in v5.4.
1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * Landlock LSM - System call implementations and user space interfaces
4 *
5 * Copyright © 2016-2020 Mickaël Salaün <mic@digikod.net>
6 * Copyright © 2018-2020 ANSSI
7 */
8
9#include <asm/current.h>
10#include <linux/anon_inodes.h>
11#include <linux/build_bug.h>
12#include <linux/capability.h>
13#include <linux/compiler_types.h>
14#include <linux/dcache.h>
15#include <linux/err.h>
16#include <linux/errno.h>
17#include <linux/fs.h>
18#include <linux/limits.h>
19#include <linux/mount.h>
20#include <linux/path.h>
21#include <linux/sched.h>
22#include <linux/security.h>
23#include <linux/stddef.h>
24#include <linux/syscalls.h>
25#include <linux/types.h>
26#include <linux/uaccess.h>
27#include <uapi/linux/landlock.h>
28
29#include "cred.h"
30#include "fs.h"
31#include "limits.h"
32#include "net.h"
33#include "ruleset.h"
34#include "setup.h"
35
36/**
37 * copy_min_struct_from_user - Safe future-proof argument copying
38 *
39 * Extend copy_struct_from_user() to check for consistent user buffer.
40 *
41 * @dst: Kernel space pointer or NULL.
42 * @ksize: Actual size of the data pointed to by @dst.
43 * @ksize_min: Minimal required size to be copied.
44 * @src: User space pointer or NULL.
45 * @usize: (Alleged) size of the data pointed to by @src.
46 */
47static __always_inline int
48copy_min_struct_from_user(void *const dst, const size_t ksize,
49 const size_t ksize_min, const void __user *const src,
50 const size_t usize)
51{
52 /* Checks buffer inconsistencies. */
53 BUILD_BUG_ON(!dst);
54 if (!src)
55 return -EFAULT;
56
57 /* Checks size ranges. */
58 BUILD_BUG_ON(ksize <= 0);
59 BUILD_BUG_ON(ksize < ksize_min);
60 if (usize < ksize_min)
61 return -EINVAL;
62 if (usize > PAGE_SIZE)
63 return -E2BIG;
64
65 /* Copies user buffer and fills with zeros. */
66 return copy_struct_from_user(dst, ksize, src, usize);
67}
68
69/*
70 * This function only contains arithmetic operations with constants, leading to
71 * BUILD_BUG_ON(). The related code is evaluated and checked at build time,
72 * but it is then ignored thanks to compiler optimizations.
73 */
74static void build_check_abi(void)
75{
76 struct landlock_ruleset_attr ruleset_attr;
77 struct landlock_path_beneath_attr path_beneath_attr;
78 struct landlock_net_port_attr net_port_attr;
79 size_t ruleset_size, path_beneath_size, net_port_size;
80
81 /*
82 * For each user space ABI structures, first checks that there is no
83 * hole in them, then checks that all architectures have the same
84 * struct size.
85 */
86 ruleset_size = sizeof(ruleset_attr.handled_access_fs);
87 ruleset_size += sizeof(ruleset_attr.handled_access_net);
88 BUILD_BUG_ON(sizeof(ruleset_attr) != ruleset_size);
89 BUILD_BUG_ON(sizeof(ruleset_attr) != 16);
90
91 path_beneath_size = sizeof(path_beneath_attr.allowed_access);
92 path_beneath_size += sizeof(path_beneath_attr.parent_fd);
93 BUILD_BUG_ON(sizeof(path_beneath_attr) != path_beneath_size);
94 BUILD_BUG_ON(sizeof(path_beneath_attr) != 12);
95
96 net_port_size = sizeof(net_port_attr.allowed_access);
97 net_port_size += sizeof(net_port_attr.port);
98 BUILD_BUG_ON(sizeof(net_port_attr) != net_port_size);
99 BUILD_BUG_ON(sizeof(net_port_attr) != 16);
100}
101
102/* Ruleset handling */
103
104static int fop_ruleset_release(struct inode *const inode,
105 struct file *const filp)
106{
107 struct landlock_ruleset *ruleset = filp->private_data;
108
109 landlock_put_ruleset(ruleset);
110 return 0;
111}
112
113static ssize_t fop_dummy_read(struct file *const filp, char __user *const buf,
114 const size_t size, loff_t *const ppos)
115{
116 /* Dummy handler to enable FMODE_CAN_READ. */
117 return -EINVAL;
118}
119
120static ssize_t fop_dummy_write(struct file *const filp,
121 const char __user *const buf, const size_t size,
122 loff_t *const ppos)
123{
124 /* Dummy handler to enable FMODE_CAN_WRITE. */
125 return -EINVAL;
126}
127
128/*
129 * A ruleset file descriptor enables to build a ruleset by adding (i.e.
130 * writing) rule after rule, without relying on the task's context. This
131 * reentrant design is also used in a read way to enforce the ruleset on the
132 * current task.
133 */
134static const struct file_operations ruleset_fops = {
135 .release = fop_ruleset_release,
136 .read = fop_dummy_read,
137 .write = fop_dummy_write,
138};
139
140#define LANDLOCK_ABI_VERSION 4
141
142/**
143 * sys_landlock_create_ruleset - Create a new ruleset
144 *
145 * @attr: Pointer to a &struct landlock_ruleset_attr identifying the scope of
146 * the new ruleset.
147 * @size: Size of the pointed &struct landlock_ruleset_attr (needed for
148 * backward and forward compatibility).
149 * @flags: Supported value: %LANDLOCK_CREATE_RULESET_VERSION.
150 *
151 * This system call enables to create a new Landlock ruleset, and returns the
152 * related file descriptor on success.
153 *
154 * If @flags is %LANDLOCK_CREATE_RULESET_VERSION and @attr is NULL and @size is
155 * 0, then the returned value is the highest supported Landlock ABI version
156 * (starting at 1).
157 *
158 * Possible returned errors are:
159 *
160 * - %EOPNOTSUPP: Landlock is supported by the kernel but disabled at boot time;
161 * - %EINVAL: unknown @flags, or unknown access, or too small @size;
162 * - %E2BIG or %EFAULT: @attr or @size inconsistencies;
163 * - %ENOMSG: empty &landlock_ruleset_attr.handled_access_fs.
164 */
165SYSCALL_DEFINE3(landlock_create_ruleset,
166 const struct landlock_ruleset_attr __user *const, attr,
167 const size_t, size, const __u32, flags)
168{
169 struct landlock_ruleset_attr ruleset_attr;
170 struct landlock_ruleset *ruleset;
171 int err, ruleset_fd;
172
173 /* Build-time checks. */
174 build_check_abi();
175
176 if (!landlock_initialized)
177 return -EOPNOTSUPP;
178
179 if (flags) {
180 if ((flags == LANDLOCK_CREATE_RULESET_VERSION) && !attr &&
181 !size)
182 return LANDLOCK_ABI_VERSION;
183 return -EINVAL;
184 }
185
186 /* Copies raw user space buffer. */
187 err = copy_min_struct_from_user(&ruleset_attr, sizeof(ruleset_attr),
188 offsetofend(typeof(ruleset_attr),
189 handled_access_fs),
190 attr, size);
191 if (err)
192 return err;
193
194 /* Checks content (and 32-bits cast). */
195 if ((ruleset_attr.handled_access_fs | LANDLOCK_MASK_ACCESS_FS) !=
196 LANDLOCK_MASK_ACCESS_FS)
197 return -EINVAL;
198
199 /* Checks network content (and 32-bits cast). */
200 if ((ruleset_attr.handled_access_net | LANDLOCK_MASK_ACCESS_NET) !=
201 LANDLOCK_MASK_ACCESS_NET)
202 return -EINVAL;
203
204 /* Checks arguments and transforms to kernel struct. */
205 ruleset = landlock_create_ruleset(ruleset_attr.handled_access_fs,
206 ruleset_attr.handled_access_net);
207 if (IS_ERR(ruleset))
208 return PTR_ERR(ruleset);
209
210 /* Creates anonymous FD referring to the ruleset. */
211 ruleset_fd = anon_inode_getfd("[landlock-ruleset]", &ruleset_fops,
212 ruleset, O_RDWR | O_CLOEXEC);
213 if (ruleset_fd < 0)
214 landlock_put_ruleset(ruleset);
215 return ruleset_fd;
216}
217
218/*
219 * Returns an owned ruleset from a FD. It is thus needed to call
220 * landlock_put_ruleset() on the return value.
221 */
222static struct landlock_ruleset *get_ruleset_from_fd(const int fd,
223 const fmode_t mode)
224{
225 struct fd ruleset_f;
226 struct landlock_ruleset *ruleset;
227
228 ruleset_f = fdget(fd);
229 if (!ruleset_f.file)
230 return ERR_PTR(-EBADF);
231
232 /* Checks FD type and access right. */
233 if (ruleset_f.file->f_op != &ruleset_fops) {
234 ruleset = ERR_PTR(-EBADFD);
235 goto out_fdput;
236 }
237 if (!(ruleset_f.file->f_mode & mode)) {
238 ruleset = ERR_PTR(-EPERM);
239 goto out_fdput;
240 }
241 ruleset = ruleset_f.file->private_data;
242 if (WARN_ON_ONCE(ruleset->num_layers != 1)) {
243 ruleset = ERR_PTR(-EINVAL);
244 goto out_fdput;
245 }
246 landlock_get_ruleset(ruleset);
247
248out_fdput:
249 fdput(ruleset_f);
250 return ruleset;
251}
252
253/* Path handling */
254
255/*
256 * @path: Must call put_path(@path) after the call if it succeeded.
257 */
258static int get_path_from_fd(const s32 fd, struct path *const path)
259{
260 struct fd f;
261 int err = 0;
262
263 BUILD_BUG_ON(!__same_type(
264 fd, ((struct landlock_path_beneath_attr *)NULL)->parent_fd));
265
266 /* Handles O_PATH. */
267 f = fdget_raw(fd);
268 if (!f.file)
269 return -EBADF;
270 /*
271 * Forbids ruleset FDs, internal filesystems (e.g. nsfs), including
272 * pseudo filesystems that will never be mountable (e.g. sockfs,
273 * pipefs).
274 */
275 if ((f.file->f_op == &ruleset_fops) ||
276 (f.file->f_path.mnt->mnt_flags & MNT_INTERNAL) ||
277 (f.file->f_path.dentry->d_sb->s_flags & SB_NOUSER) ||
278 d_is_negative(f.file->f_path.dentry) ||
279 IS_PRIVATE(d_backing_inode(f.file->f_path.dentry))) {
280 err = -EBADFD;
281 goto out_fdput;
282 }
283 *path = f.file->f_path;
284 path_get(path);
285
286out_fdput:
287 fdput(f);
288 return err;
289}
290
291static int add_rule_path_beneath(struct landlock_ruleset *const ruleset,
292 const void __user *const rule_attr)
293{
294 struct landlock_path_beneath_attr path_beneath_attr;
295 struct path path;
296 int res, err;
297 access_mask_t mask;
298
299 /* Copies raw user space buffer. */
300 res = copy_from_user(&path_beneath_attr, rule_attr,
301 sizeof(path_beneath_attr));
302 if (res)
303 return -EFAULT;
304
305 /*
306 * Informs about useless rule: empty allowed_access (i.e. deny rules)
307 * are ignored in path walks.
308 */
309 if (!path_beneath_attr.allowed_access)
310 return -ENOMSG;
311
312 /* Checks that allowed_access matches the @ruleset constraints. */
313 mask = landlock_get_raw_fs_access_mask(ruleset, 0);
314 if ((path_beneath_attr.allowed_access | mask) != mask)
315 return -EINVAL;
316
317 /* Gets and checks the new rule. */
318 err = get_path_from_fd(path_beneath_attr.parent_fd, &path);
319 if (err)
320 return err;
321
322 /* Imports the new rule. */
323 err = landlock_append_fs_rule(ruleset, &path,
324 path_beneath_attr.allowed_access);
325 path_put(&path);
326 return err;
327}
328
329static int add_rule_net_port(struct landlock_ruleset *ruleset,
330 const void __user *const rule_attr)
331{
332 struct landlock_net_port_attr net_port_attr;
333 int res;
334 access_mask_t mask;
335
336 /* Copies raw user space buffer. */
337 res = copy_from_user(&net_port_attr, rule_attr, sizeof(net_port_attr));
338 if (res)
339 return -EFAULT;
340
341 /*
342 * Informs about useless rule: empty allowed_access (i.e. deny rules)
343 * are ignored by network actions.
344 */
345 if (!net_port_attr.allowed_access)
346 return -ENOMSG;
347
348 /* Checks that allowed_access matches the @ruleset constraints. */
349 mask = landlock_get_net_access_mask(ruleset, 0);
350 if ((net_port_attr.allowed_access | mask) != mask)
351 return -EINVAL;
352
353 /* Denies inserting a rule with port greater than 65535. */
354 if (net_port_attr.port > U16_MAX)
355 return -EINVAL;
356
357 /* Imports the new rule. */
358 return landlock_append_net_rule(ruleset, net_port_attr.port,
359 net_port_attr.allowed_access);
360}
361
362/**
363 * sys_landlock_add_rule - Add a new rule to a ruleset
364 *
365 * @ruleset_fd: File descriptor tied to the ruleset that should be extended
366 * with the new rule.
367 * @rule_type: Identify the structure type pointed to by @rule_attr:
368 * %LANDLOCK_RULE_PATH_BENEATH or %LANDLOCK_RULE_NET_PORT.
369 * @rule_attr: Pointer to a rule (only of type &struct
370 * landlock_path_beneath_attr for now).
371 * @flags: Must be 0.
372 *
373 * This system call enables to define a new rule and add it to an existing
374 * ruleset.
375 *
376 * Possible returned errors are:
377 *
378 * - %EOPNOTSUPP: Landlock is supported by the kernel but disabled at boot time;
379 * - %EAFNOSUPPORT: @rule_type is %LANDLOCK_RULE_NET_PORT but TCP/IP is not
380 * supported by the running kernel;
381 * - %EINVAL: @flags is not 0, or inconsistent access in the rule (i.e.
382 * &landlock_path_beneath_attr.allowed_access or
383 * &landlock_net_port_attr.allowed_access is not a subset of the
384 * ruleset handled accesses), or &landlock_net_port_attr.port is
385 * greater than 65535;
386 * - %ENOMSG: Empty accesses (e.g. &landlock_path_beneath_attr.allowed_access);
387 * - %EBADF: @ruleset_fd is not a file descriptor for the current thread, or a
388 * member of @rule_attr is not a file descriptor as expected;
389 * - %EBADFD: @ruleset_fd is not a ruleset file descriptor, or a member of
390 * @rule_attr is not the expected file descriptor type;
391 * - %EPERM: @ruleset_fd has no write access to the underlying ruleset;
392 * - %EFAULT: @rule_attr inconsistency.
393 */
394SYSCALL_DEFINE4(landlock_add_rule, const int, ruleset_fd,
395 const enum landlock_rule_type, rule_type,
396 const void __user *const, rule_attr, const __u32, flags)
397{
398 struct landlock_ruleset *ruleset;
399 int err;
400
401 if (!landlock_initialized)
402 return -EOPNOTSUPP;
403
404 /* No flag for now. */
405 if (flags)
406 return -EINVAL;
407
408 /* Gets and checks the ruleset. */
409 ruleset = get_ruleset_from_fd(ruleset_fd, FMODE_CAN_WRITE);
410 if (IS_ERR(ruleset))
411 return PTR_ERR(ruleset);
412
413 switch (rule_type) {
414 case LANDLOCK_RULE_PATH_BENEATH:
415 err = add_rule_path_beneath(ruleset, rule_attr);
416 break;
417 case LANDLOCK_RULE_NET_PORT:
418 err = add_rule_net_port(ruleset, rule_attr);
419 break;
420 default:
421 err = -EINVAL;
422 break;
423 }
424 landlock_put_ruleset(ruleset);
425 return err;
426}
427
428/* Enforcement */
429
430/**
431 * sys_landlock_restrict_self - Enforce a ruleset on the calling thread
432 *
433 * @ruleset_fd: File descriptor tied to the ruleset to merge with the target.
434 * @flags: Must be 0.
435 *
436 * This system call enables to enforce a Landlock ruleset on the current
437 * thread. Enforcing a ruleset requires that the task has %CAP_SYS_ADMIN in its
438 * namespace or is running with no_new_privs. This avoids scenarios where
439 * unprivileged tasks can affect the behavior of privileged children.
440 *
441 * Possible returned errors are:
442 *
443 * - %EOPNOTSUPP: Landlock is supported by the kernel but disabled at boot time;
444 * - %EINVAL: @flags is not 0.
445 * - %EBADF: @ruleset_fd is not a file descriptor for the current thread;
446 * - %EBADFD: @ruleset_fd is not a ruleset file descriptor;
447 * - %EPERM: @ruleset_fd has no read access to the underlying ruleset, or the
448 * current thread is not running with no_new_privs, or it doesn't have
449 * %CAP_SYS_ADMIN in its namespace.
450 * - %E2BIG: The maximum number of stacked rulesets is reached for the current
451 * thread.
452 */
453SYSCALL_DEFINE2(landlock_restrict_self, const int, ruleset_fd, const __u32,
454 flags)
455{
456 struct landlock_ruleset *new_dom, *ruleset;
457 struct cred *new_cred;
458 struct landlock_cred_security *new_llcred;
459 int err;
460
461 if (!landlock_initialized)
462 return -EOPNOTSUPP;
463
464 /*
465 * Similar checks as for seccomp(2), except that an -EPERM may be
466 * returned.
467 */
468 if (!task_no_new_privs(current) &&
469 !ns_capable_noaudit(current_user_ns(), CAP_SYS_ADMIN))
470 return -EPERM;
471
472 /* No flag for now. */
473 if (flags)
474 return -EINVAL;
475
476 /* Gets and checks the ruleset. */
477 ruleset = get_ruleset_from_fd(ruleset_fd, FMODE_CAN_READ);
478 if (IS_ERR(ruleset))
479 return PTR_ERR(ruleset);
480
481 /* Prepares new credentials. */
482 new_cred = prepare_creds();
483 if (!new_cred) {
484 err = -ENOMEM;
485 goto out_put_ruleset;
486 }
487 new_llcred = landlock_cred(new_cred);
488
489 /*
490 * There is no possible race condition while copying and manipulating
491 * the current credentials because they are dedicated per thread.
492 */
493 new_dom = landlock_merge_ruleset(new_llcred->domain, ruleset);
494 if (IS_ERR(new_dom)) {
495 err = PTR_ERR(new_dom);
496 goto out_put_creds;
497 }
498
499 /* Replaces the old (prepared) domain. */
500 landlock_put_ruleset(new_llcred->domain);
501 new_llcred->domain = new_dom;
502
503 landlock_put_ruleset(ruleset);
504 return commit_creds(new_cred);
505
506out_put_creds:
507 abort_creds(new_cred);
508
509out_put_ruleset:
510 landlock_put_ruleset(ruleset);
511 return err;
512}