Unverified Commit 6146b614 authored by Konstantin Meskhidze's avatar Konstantin Meskhidze Committed by Mickaël Salaün
Browse files

landlock: Refactor merge/inherit_ruleset helpers 



Refactor merge_ruleset() and inherit_ruleset() functions to support new
rule types. Add merge_tree() and inherit_tree() helpers.  They use a
specific ruleset's red-black tree according to a key type argument.

Signed-off-by: default avatarKonstantin Meskhidze <konstantin.meskhidze@huawei.com>
Link: https://lore.kernel.org/r/20231026014751.414649-5-konstantin.meskhidze@huawei.com


Signed-off-by: default avatarMickaël Salaün <mic@digikod.net>
parent a4ac404b

security/landlock/ruleset.c

+74 −42
Original line number Diff line number Diff line
@@ -300,36 +300,22 @@ static void put_hierarchy(struct landlock_hierarchy *hierarchy) 
	}

}



static int merge_ruleset(struct landlock_ruleset *const dst,

			 struct landlock_ruleset *const src)

static int merge_tree(struct landlock_ruleset *const dst,

		      struct landlock_ruleset *const src,

		      const enum landlock_key_type key_type)

{

	struct landlock_rule *walker_rule, *next_rule;

	struct rb_root *src_root;

	int err = 0;



	might_sleep();

	/* Should already be checked by landlock_merge_ruleset() */

	if (WARN_ON_ONCE(!src))

		return 0;

	/* Only merge into a domain. */

	if (WARN_ON_ONCE(!dst || !dst->hierarchy))

		return -EINVAL;

	lockdep_assert_held(&dst->lock);

	lockdep_assert_held(&src->lock);



	src_root = get_root(src, LANDLOCK_KEY_INODE);

	src_root = get_root(src, key_type);

	if (IS_ERR(src_root))

		return PTR_ERR(src_root);



	/* Locks @dst first because we are its only owner. */

	mutex_lock(&dst->lock);

	mutex_lock_nested(&src->lock, SINGLE_DEPTH_NESTING);



	/* Stacks the new layer. */

	if (WARN_ON_ONCE(src->num_layers != 1 || dst->num_layers < 1)) {

		err = -EINVAL;

		goto out_unlock;

	}

	dst->access_masks[dst->num_layers - 1] = src->access_masks[0];



	/* Merges the @src tree. */

	rbtree_postorder_for_each_entry_safe(walker_rule, next_rule, src_root,

					     node) {
@@ -338,23 +324,52 @@ static int merge_ruleset(struct landlock_ruleset *const dst, 
		} };

		const struct landlock_id id = {

			.key = walker_rule->key,

			.type = LANDLOCK_KEY_INODE,

			.type = key_type,

		};



		if (WARN_ON_ONCE(walker_rule->num_layers != 1)) {

			err = -EINVAL;

			goto out_unlock;

		if (WARN_ON_ONCE(walker_rule->num_layers != 1))

			return -EINVAL;



		if (WARN_ON_ONCE(walker_rule->layers[0].level != 0))

			return -EINVAL;



		layers[0].access = walker_rule->layers[0].access;



		err = insert_rule(dst, id, &layers, ARRAY_SIZE(layers));

		if (err)

			return err;

	}

	return err;

}

		if (WARN_ON_ONCE(walker_rule->layers[0].level != 0)) {



static int merge_ruleset(struct landlock_ruleset *const dst,

			 struct landlock_ruleset *const src)

{

	int err = 0;



	might_sleep();

	/* Should already be checked by landlock_merge_ruleset() */

	if (WARN_ON_ONCE(!src))

		return 0;

	/* Only merge into a domain. */

	if (WARN_ON_ONCE(!dst || !dst->hierarchy))

		return -EINVAL;



	/* Locks @dst first because we are its only owner. */

	mutex_lock(&dst->lock);

	mutex_lock_nested(&src->lock, SINGLE_DEPTH_NESTING);



	/* Stacks the new layer. */

	if (WARN_ON_ONCE(src->num_layers != 1 || dst->num_layers < 1)) {

		err = -EINVAL;

		goto out_unlock;

	}

		layers[0].access = walker_rule->layers[0].access;

	dst->access_masks[dst->num_layers - 1] = src->access_masks[0];



		err = insert_rule(dst, id, &layers, ARRAY_SIZE(layers));

	/* Merges the @src inode tree. */

	err = merge_tree(dst, src, LANDLOCK_KEY_INODE);

	if (err)

		goto out_unlock;

	}



out_unlock:

	mutex_unlock(&src->lock);
@@ -362,38 +377,55 @@ static int merge_ruleset(struct landlock_ruleset *const dst, 
	return err;

}



static int inherit_ruleset(struct landlock_ruleset *const parent,

			   struct landlock_ruleset *const child)

static int inherit_tree(struct landlock_ruleset *const parent,

			struct landlock_ruleset *const child,

			const enum landlock_key_type key_type)

{

	struct landlock_rule *walker_rule, *next_rule;

	struct rb_root *parent_root;

	int err = 0;



	might_sleep();

	if (!parent)

		return 0;

	lockdep_assert_held(&parent->lock);

	lockdep_assert_held(&child->lock);



	parent_root = get_root(parent, LANDLOCK_KEY_INODE);

	parent_root = get_root(parent, key_type);

	if (IS_ERR(parent_root))

		return PTR_ERR(parent_root);



	/* Locks @child first because we are its only owner. */

	mutex_lock(&child->lock);

	mutex_lock_nested(&parent->lock, SINGLE_DEPTH_NESTING);



	/* Copies the @parent tree. */

	/* Copies the @parent inode or network tree. */

	rbtree_postorder_for_each_entry_safe(walker_rule, next_rule,

					     parent_root, node) {

		const struct landlock_id id = {

			.key = walker_rule->key,

			.type = LANDLOCK_KEY_INODE,

			.type = key_type,

		};



		err = insert_rule(child, id, &walker_rule->layers,

				  walker_rule->num_layers);

		if (err)

			goto out_unlock;

			return err;

	}

	return err;

}



static int inherit_ruleset(struct landlock_ruleset *const parent,

			   struct landlock_ruleset *const child)

{

	int err = 0;



	might_sleep();

	if (!parent)

		return 0;



	/* Locks @child first because we are its only owner. */

	mutex_lock(&child->lock);

	mutex_lock_nested(&parent->lock, SINGLE_DEPTH_NESTING);



	/* Copies the @parent inode tree. */

	err = inherit_tree(parent, child, LANDLOCK_KEY_INODE);

	if (err)

		goto out_unlock;



	if (WARN_ON_ONCE(child->num_layers <= parent->num_layers)) {

		err = -EINVAL;