Commit 86b405ad authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'landlock-6.11-rc1-houdini-fix' of... 

Merge tag 'landlock-6.11-rc1-houdini-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux

Pull landlock fix from Mickaël Salaün:
 "Jann Horn reported a sandbox bypass for Landlock. This includes the
  fix and new tests. This should be backported"

* tag 'landlock-6.11-rc1-houdini-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux:
  selftests/landlock: Add cred_transfer test
  landlock: Don't lose track of restrictions on cred_transfer
parents 8e333791 cc374782

security/landlock/cred.c

+9 −2
Original line number Diff line number Diff line
@@ -14,8 +14,8 @@ 
#include "ruleset.h"

#include "setup.h"



static int hook_cred_prepare(struct cred *const new,

			     const struct cred *const old, const gfp_t gfp)

static void hook_cred_transfer(struct cred *const new,

			       const struct cred *const old)

{

	struct landlock_ruleset *const old_dom = landlock_cred(old)->domain;
@@ -23,6 +23,12 @@ static int hook_cred_prepare(struct cred *const new, 
		landlock_get_ruleset(old_dom);

		landlock_cred(new)->domain = old_dom;

	}

}



static int hook_cred_prepare(struct cred *const new,

			     const struct cred *const old, const gfp_t gfp)

{

	hook_cred_transfer(new, old);

	return 0;

}
@@ -36,6 +42,7 @@ static void hook_cred_free(struct cred *const cred) 


static struct security_hook_list landlock_hooks[] __ro_after_init = {

	LSM_HOOK_INIT(cred_prepare, hook_cred_prepare),

	LSM_HOOK_INIT(cred_transfer, hook_cred_transfer),

	LSM_HOOK_INIT(cred_free, hook_cred_free),

};

tools/testing/selftests/landlock/base_test.c

+74 −0
Original line number Diff line number Diff line
@@ -9,6 +9,7 @@ 
#define _GNU_SOURCE

#include <errno.h>

#include <fcntl.h>

#include <linux/keyctl.h>

#include <linux/landlock.h>

#include <string.h>

#include <sys/prctl.h>
@@ -326,4 +327,77 @@ TEST(ruleset_fd_transfer) 
	ASSERT_EQ(EXIT_SUCCESS, WEXITSTATUS(status));

}



TEST(cred_transfer)

{

	struct landlock_ruleset_attr ruleset_attr = {

		.handled_access_fs = LANDLOCK_ACCESS_FS_READ_DIR,

	};

	int ruleset_fd, dir_fd;

	pid_t child;

	int status;



	drop_caps(_metadata);



	dir_fd = open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC);

	EXPECT_LE(0, dir_fd);

	EXPECT_EQ(0, close(dir_fd));



	/* Denies opening directories. */

	ruleset_fd =

		landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);

	ASSERT_LE(0, ruleset_fd);

	EXPECT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0));

	ASSERT_EQ(0, landlock_restrict_self(ruleset_fd, 0));

	EXPECT_EQ(0, close(ruleset_fd));



	/* Checks ruleset enforcement. */

	EXPECT_EQ(-1, open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC));

	EXPECT_EQ(EACCES, errno);



	/* Needed for KEYCTL_SESSION_TO_PARENT permission checks */

	EXPECT_NE(-1, syscall(__NR_keyctl, KEYCTL_JOIN_SESSION_KEYRING, NULL, 0,

			      0, 0))

	{

		TH_LOG("Failed to join session keyring: %s", strerror(errno));

	}



	child = fork();

	ASSERT_LE(0, child);

	if (child == 0) {

		/* Checks ruleset enforcement. */

		EXPECT_EQ(-1, open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC));

		EXPECT_EQ(EACCES, errno);



		/*

		 * KEYCTL_SESSION_TO_PARENT is a no-op unless we have a

		 * different session keyring in the child, so make that happen.

		 */

		EXPECT_NE(-1, syscall(__NR_keyctl, KEYCTL_JOIN_SESSION_KEYRING,

				      NULL, 0, 0, 0));



		/*

		 * KEYCTL_SESSION_TO_PARENT installs credentials on the parent

		 * that never go through the cred_prepare hook, this path uses

		 * cred_transfer instead.

		 */

		EXPECT_EQ(0, syscall(__NR_keyctl, KEYCTL_SESSION_TO_PARENT, 0,

				     0, 0, 0));



		/* Re-checks ruleset enforcement. */

		EXPECT_EQ(-1, open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC));

		EXPECT_EQ(EACCES, errno);



		_exit(_metadata->exit_code);

		return;

	}



	EXPECT_EQ(child, waitpid(child, &status, 0));

	EXPECT_EQ(1, WIFEXITED(status));

	EXPECT_EQ(EXIT_SUCCESS, WEXITSTATUS(status));



	/* Re-checks ruleset enforcement. */

	EXPECT_EQ(-1, open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC));

	EXPECT_EQ(EACCES, errno);

}



TEST_HARNESS_MAIN

tools/testing/selftests/landlock/config

+1 −0
Original line number Diff line number Diff line
@@ -2,6 +2,7 @@ CONFIG_CGROUPS=y 
CONFIG_CGROUP_SCHED=y

CONFIG_INET=y

CONFIG_IPV6=y

CONFIG_KEYS=y

CONFIG_NET=y

CONFIG_NET_NS=y

CONFIG_OVERLAY_FS=y