Unverified Commit 0e0fc7e8 authored by Konstantin Meskhidze's avatar Konstantin Meskhidze Committed by Mickaël Salaün
Browse files

landlock: Refactor landlock_add_rule() syscall 



Change the landlock_add_rule() syscall to support new rule types with
next commits. Add the add_rule_path_beneath() helper to support current
filesystem rules.

Signed-off-by: default avatarKonstantin Meskhidze <konstantin.meskhidze@huawei.com>
Link: https://lore.kernel.org/r/20231026014751.414649-8-konstantin.meskhidze@huawei.com


Signed-off-by: default avatarMickaël Salaün <mic@digikod.net>
parent 7a11275c

security/landlock/syscalls.c

+45 −44
Original line number Diff line number Diff line
@@ -274,6 +274,44 @@ static int get_path_from_fd(const s32 fd, struct path *const path) 
	return err;

}



static int add_rule_path_beneath(struct landlock_ruleset *const ruleset,

				 const void __user *const rule_attr)

{

	struct landlock_path_beneath_attr path_beneath_attr;

	struct path path;

	int res, err;

	access_mask_t mask;



	/* Copies raw user space buffer, only one type for now. */

	res = copy_from_user(&path_beneath_attr, rule_attr,

			     sizeof(path_beneath_attr));

	if (res)

		return -EFAULT;



	/*

	 * Informs about useless rule: empty allowed_access (i.e. deny rules)

	 * are ignored in path walks.

	 */

	if (!path_beneath_attr.allowed_access)

		return -ENOMSG;



	/* Checks that allowed_access matches the @ruleset constraints. */

	mask = landlock_get_raw_fs_access_mask(ruleset, 0);

	if ((path_beneath_attr.allowed_access | mask) != mask)

		return -EINVAL;



	/* Gets and checks the new rule. */

	err = get_path_from_fd(path_beneath_attr.parent_fd, &path);

	if (err)

		return err;



	/* Imports the new rule. */

	err = landlock_append_fs_rule(ruleset, &path,

				      path_beneath_attr.allowed_access);

	path_put(&path);

	return err;

}



/**

 * sys_landlock_add_rule - Add a new rule to a ruleset

 *
@@ -306,11 +344,8 @@ SYSCALL_DEFINE4(landlock_add_rule, const int, ruleset_fd, 
		const enum landlock_rule_type, rule_type,

		const void __user *const, rule_attr, const __u32, flags)

{

	struct landlock_path_beneath_attr path_beneath_attr;

	struct path path;

	struct landlock_ruleset *ruleset;

	int res, err;

	access_mask_t mask;

	int err;



	if (!landlock_initialized)

		return -EOPNOTSUPP;
@@ -324,48 +359,14 @@ SYSCALL_DEFINE4(landlock_add_rule, const int, ruleset_fd, 
	if (IS_ERR(ruleset))

		return PTR_ERR(ruleset);



	if (rule_type != LANDLOCK_RULE_PATH_BENEATH) {

		err = -EINVAL;

		goto out_put_ruleset;

	}



	/* Copies raw user space buffer, only one type for now. */

	res = copy_from_user(&path_beneath_attr, rule_attr,

			     sizeof(path_beneath_attr));

	if (res) {

		err = -EFAULT;

		goto out_put_ruleset;

	}



	/*

	 * Informs about useless rule: empty allowed_access (i.e. deny rules)

	 * are ignored in path walks.

	 */

	if (!path_beneath_attr.allowed_access) {

		err = -ENOMSG;

		goto out_put_ruleset;

	}

	/*

	 * Checks that allowed_access matches the @ruleset constraints

	 * (ruleset->access_masks[0] is automatically upgraded to 64-bits).

	 */

	mask = landlock_get_raw_fs_access_mask(ruleset, 0);

	if ((path_beneath_attr.allowed_access | mask) != mask) {

	switch (rule_type) {

	case LANDLOCK_RULE_PATH_BENEATH:

		err = add_rule_path_beneath(ruleset, rule_attr);

		break;

	default:

		err = -EINVAL;

		goto out_put_ruleset;

		break;

	}



	/* Gets and checks the new rule. */

	err = get_path_from_fd(path_beneath_attr.parent_fd, &path);

	if (err)

		goto out_put_ruleset;



	/* Imports the new rule. */

	err = landlock_append_fs_rule(ruleset, &path,

				      path_beneath_attr.allowed_access);

	path_put(&path);



out_put_ruleset:

	landlock_put_ruleset(ruleset);

	return err;

}