Unverified Commit 369b48b4 authored by Tahera Fahimi's avatar Tahera Fahimi Committed by Mickaël Salaün
Browse files

samples/landlock: Add support for abstract UNIX socket scoping 



The sandboxer can receive the character "a" as input from the
environment variable LL_SCOPE to restrict sandboxed processes from
connecting to an abstract UNIX socket created by a process outside of
the sandbox.

Example
=======

Create an abstract UNIX socket to listen with socat(1):
  socat abstract-listen:mysocket -

Create a sandboxed shell and pass the character "a" to LL_SCOPED:
  LL_FS_RO=/ LL_FS_RW=. LL_SCOPED="a" ./sandboxer /bin/bash

Note that any other form of input (e.g. "a:a", "aa", etc) is not
acceptable.

If the sandboxed process tries to connect to the listening socket, the
connection will fail:
  socat - abstract-connect:mysocket

Signed-off-by: default avatarTahera Fahimi <fahimitahera@gmail.com>
Link: https://lore.kernel.org/r/d8af908f00b77415caa3eb0f4de631c3794e4909.1725494372.git.fahimitahera@gmail.com


[mic: Improve commit message, simplify check_ruleset_scope() with
inverted error code and only one scoped change, always unset environment
variable]
Signed-off-by: default avatarMickaël Salaün <mic@digikod.net>
parent 644a7285

samples/landlock/sandboxer.c

+60 −4
Original line number Diff line number Diff line
@@ -14,6 +14,7 @@ 
#include <fcntl.h>

#include <linux/landlock.h>

#include <linux/prctl.h>

#include <linux/socket.h>

#include <stddef.h>

#include <stdio.h>

#include <stdlib.h>
@@ -22,6 +23,7 @@ 
#include <sys/stat.h>

#include <sys/syscall.h>

#include <unistd.h>

#include <stdbool.h>



#ifndef landlock_create_ruleset

static inline int
@@ -55,6 +57,7 @@ static inline int landlock_restrict_self(const int ruleset_fd, 
#define ENV_FS_RW_NAME "LL_FS_RW"

#define ENV_TCP_BIND_NAME "LL_TCP_BIND"

#define ENV_TCP_CONNECT_NAME "LL_TCP_CONNECT"

#define ENV_SCOPED_NAME "LL_SCOPED"

#define ENV_DELIMITER ":"



static int parse_path(char *env_path, const char ***const path_list)
@@ -184,6 +187,48 @@ static int populate_ruleset_net(const char *const env_var, const int ruleset_fd, 
	return ret;

}



/* Returns true on error, false otherwise. */

static bool check_ruleset_scope(const char *const env_var,

				struct landlock_ruleset_attr *ruleset_attr)

{

	char *env_type_scope, *env_type_scope_next, *ipc_scoping_name;

	bool error = false;

	bool abstract_scoping = false;



	/* Scoping is not supported by Landlock ABI */

	if (!(ruleset_attr->scoped & LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET))

		goto out_unset;



	env_type_scope = getenv(env_var);

	/* Scoping is not supported by the user */

	if (!env_type_scope || strcmp("", env_type_scope) == 0)

		goto out_unset;



	env_type_scope = strdup(env_type_scope);

	env_type_scope_next = env_type_scope;

	while ((ipc_scoping_name =

			strsep(&env_type_scope_next, ENV_DELIMITER))) {

		if (strcmp("a", ipc_scoping_name) == 0 && !abstract_scoping) {

			abstract_scoping = true;

		} else {

			fprintf(stderr, "Unknown or duplicate scope \"%s\"\n",

				ipc_scoping_name);

			error = true;

			goto out_free_name;

		}

	}



out_free_name:

	free(env_type_scope);



out_unset:

	if (!abstract_scoping)

		ruleset_attr->scoped &= ~LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET;



	unsetenv(env_var);

	return error;

}



/* clang-format off */



#define ACCESS_FS_ROUGHLY_READ ( \
@@ -208,7 +253,7 @@ static int populate_ruleset_net(const char *const env_var, const int ruleset_fd, 


/* clang-format on */



#define LANDLOCK_ABI_LAST 5

#define LANDLOCK_ABI_LAST 6



int main(const int argc, char *const argv[], char *const *const envp)

{
@@ -223,14 +268,15 @@ int main(const int argc, char *const argv[], char *const *const envp) 
		.handled_access_fs = access_fs_rw,

		.handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP |

				      LANDLOCK_ACCESS_NET_CONNECT_TCP,

		.scoped = LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET,

	};



	if (argc < 2) {

		fprintf(stderr,

			"usage: %s=\"...\" %s=\"...\" %s=\"...\" %s=\"...\"%s "

			"usage: %s=\"...\" %s=\"...\" %s=\"...\" %s=\"...\" %s=\"...\" %s "

			"<cmd> [args]...\n\n",

			ENV_FS_RO_NAME, ENV_FS_RW_NAME, ENV_TCP_BIND_NAME,

			ENV_TCP_CONNECT_NAME, argv[0]);

			ENV_TCP_CONNECT_NAME, ENV_SCOPED_NAME, argv[0]);

		fprintf(stderr,

			"Execute a command in a restricted environment.\n\n");

		fprintf(stderr,
@@ -251,15 +297,18 @@ int main(const int argc, char *const argv[], char *const *const envp) 
		fprintf(stderr,

			"* %s: list of ports allowed to connect (client).\n",

			ENV_TCP_CONNECT_NAME);

		fprintf(stderr, "* %s: list of scoped IPCs.\n",

			ENV_SCOPED_NAME);

		fprintf(stderr,

			"\nexample:\n"

			"%s=\"${PATH}:/lib:/usr:/proc:/etc:/dev/urandom\" "

			"%s=\"/dev/null:/dev/full:/dev/zero:/dev/pts:/tmp\" "

			"%s=\"9418\" "

			"%s=\"80:443\" "

			"%s=\"a\" "

			"%s bash -i\n\n",

			ENV_FS_RO_NAME, ENV_FS_RW_NAME, ENV_TCP_BIND_NAME,

			ENV_TCP_CONNECT_NAME, argv[0]);

			ENV_TCP_CONNECT_NAME, ENV_SCOPED_NAME, argv[0]);

		fprintf(stderr,

			"This sandboxer can use Landlock features "

			"up to ABI version %d.\n",
@@ -327,6 +376,10 @@ int main(const int argc, char *const argv[], char *const *const envp) 
		/* Removes LANDLOCK_ACCESS_FS_IOCTL_DEV for ABI < 5 */

		ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_IOCTL_DEV;



		__attribute__((fallthrough));

	case 5:

		/* Removes LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET for ABI < 6 */

		ruleset_attr.scoped &= ~LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET;

		fprintf(stderr,

			"Hint: You should update the running kernel "

			"to leverage Landlock features "
@@ -358,6 +411,9 @@ int main(const int argc, char *const argv[], char *const *const envp) 
			~LANDLOCK_ACCESS_NET_CONNECT_TCP;

	}



	if (check_ruleset_scope(ENV_SCOPED_NAME, &ruleset_attr))

		return 1;



	ruleset_fd =

		landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);

	if (ruleset_fd < 0) {