Unverified Commit fff69fb0 authored by Konstantin Meskhidze's avatar Konstantin Meskhidze Committed by Mickaël Salaün
Browse files

landlock: Support network rules with TCP bind and connect 

Add network rules support in the ruleset management helpers and the
landlock_create_ruleset() syscall. Extend user space API to support
network actions:
* Add new network access rights: LANDLOCK_ACCESS_NET_BIND_TCP and
  LANDLOCK_ACCESS_NET_CONNECT_TCP.
* Add a new network rule type: LANDLOCK_RULE_NET_PORT tied to struct
  landlock_net_port_attr. The allowed_access field contains the network
  access rights, and the port field contains the port value according to
  the controlled protocol. This field can take up to a 64-bit value
  but the maximum value depends on the related protocol (e.g. 16-bit
  value for TCP). Network port is in host endianness [1].
* Add a new handled_access_net field to struct landlock_ruleset_attr
  that contains network access rights.
* Increment the Landlock ABI version to 4.

Implement socket_bind() and socket_connect() LSM hooks, which enable
to control TCP socket binding and connection to specific ports.

Expand access_masks_t from u16 to u32 to be able to store network access
rights alongside filesystem access rights for rulesets' handled access
rights.

Access rights are not tied to socket file descriptors but checked at
bind() or connect() call time against the caller's Landlock domain. For
the filesystem, a file descriptor is a direct access to a file/data.
However, for network sockets, we cannot identify for which data or peer
a newly created socket will give access to. Indeed, we need to wait for
a connect or bind request to identify the use case for this socket.
Likewise a directory file descriptor may enable to open another file
(i.e. a new data item), but this opening is also restricted by the
caller's domain, not the file descriptor's access rights [2].

[1] https://lore.kernel.org/r/278ab07f-7583-a4e0-3d37-1bacd091531d@digikod.net
[2] https://lore.kernel.org/r/263c1eb3-602f-57fe-8450-3f138581bee7@digikod.net



Signed-off-by: default avatarKonstantin Meskhidze <konstantin.meskhidze@huawei.com>
Link: https://lore.kernel.org/r/20231026014751.414649-9-konstantin.meskhidze@huawei.com


[mic: Extend commit message, fix typo in comments, and specify
endianness in the documentation]
Co-developed-by: default avatarMickaël Salaün <mic@digikod.net>
Signed-off-by: default avatarMickaël Salaün <mic@digikod.net>
parent 0e0fc7e8

include/uapi/linux/landlock.h

+55 −0
Original line number Diff line number Diff line
@@ -31,6 +31,12 @@ struct landlock_ruleset_attr { 
	 * this access right.

	 */

	__u64 handled_access_fs;

	/**

	 * @handled_access_net: Bitmask of actions (cf. `Network flags`_)

	 * that is handled by this ruleset and should then be forbidden if no

	 * rule explicitly allow them.

	 */

	__u64 handled_access_net;

};



/*
@@ -54,6 +60,11 @@ enum landlock_rule_type { 
	 * landlock_path_beneath_attr .

	 */

	LANDLOCK_RULE_PATH_BENEATH = 1,

	/**

	 * @LANDLOCK_RULE_NET_PORT: Type of a &struct

	 * landlock_net_port_attr .

	 */

	LANDLOCK_RULE_NET_PORT,

};



/**
@@ -79,6 +90,31 @@ struct landlock_path_beneath_attr { 
	 */

} __attribute__((packed));



/**

 * struct landlock_net_port_attr - Network port definition

 *

 * Argument of sys_landlock_add_rule().

 */

struct landlock_net_port_attr {

	/**

	 * @allowed_access: Bitmask of allowed access network for a port

	 * (cf. `Network flags`_).

	 */

	__u64 allowed_access;

	/**

	 * @port: Network port in host endianness.

	 *

	 * It should be noted that port 0 passed to :manpage:`bind(2)` will

	 * bind to an available port from a specific port range. This can be

	 * configured thanks to the ``/proc/sys/net/ipv4/ip_local_port_range``

	 * sysctl (also used for IPv6). A Landlock rule with port 0 and the

	 * ``LANDLOCK_ACCESS_NET_BIND_TCP`` right means that requesting to bind

	 * on port 0 is allowed and it will automatically translate to binding

	 * on the related port range.

	 */

	__u64 port;

};



/**

 * DOC: fs_access

 *
@@ -189,4 +225,23 @@ struct landlock_path_beneath_attr { 
#define LANDLOCK_ACCESS_FS_TRUNCATE			(1ULL << 14)

/* clang-format on */



/**

 * DOC: net_access

 *

 * Network flags

 * ~~~~~~~~~~~~~~~~

 *

 * These flags enable to restrict a sandboxed process to a set of network

 * actions. This is supported since the Landlock ABI version 4.

 *

 * TCP sockets with allowed actions:

 *

 * - %LANDLOCK_ACCESS_NET_BIND_TCP: Bind a TCP socket to a local port.

 * - %LANDLOCK_ACCESS_NET_CONNECT_TCP: Connect an active TCP socket to

 *   a remote port.

 */

/* clang-format off */

#define LANDLOCK_ACCESS_NET_BIND_TCP			(1ULL << 0)

#define LANDLOCK_ACCESS_NET_CONNECT_TCP			(1ULL << 1)

/* clang-format on */

#endif /* _UAPI_LINUX_LANDLOCK_H */

security/landlock/Kconfig

+1 −0
Original line number Diff line number Diff line
@@ -3,6 +3,7 @@ 
config SECURITY_LANDLOCK

	bool "Landlock support"

	depends on SECURITY

	select SECURITY_NETWORK

	select SECURITY_PATH

	help

	  Landlock is a sandboxing mechanism that enables processes to restrict

security/landlock/Makefile

+2 −0
Original line number Diff line number Diff line
@@ -2,3 +2,5 @@ obj-$(CONFIG_SECURITY_LANDLOCK) := landlock.o 


landlock-y := setup.o syscalls.o object.o ruleset.o \

	cred.o ptrace.o fs.o



landlock-$(CONFIG_INET) += net.o

security/landlock/limits.h

+5 −0
Original line number Diff line number Diff line
@@ -23,6 +23,11 @@ 
#define LANDLOCK_NUM_ACCESS_FS		__const_hweight64(LANDLOCK_MASK_ACCESS_FS)

#define LANDLOCK_SHIFT_ACCESS_FS	0



#define LANDLOCK_LAST_ACCESS_NET	LANDLOCK_ACCESS_NET_CONNECT_TCP

#define LANDLOCK_MASK_ACCESS_NET	((LANDLOCK_LAST_ACCESS_NET << 1) - 1)

#define LANDLOCK_NUM_ACCESS_NET		__const_hweight64(LANDLOCK_MASK_ACCESS_NET)

#define LANDLOCK_SHIFT_ACCESS_NET	LANDLOCK_NUM_ACCESS_FS



/* clang-format on */



#endif /* _SECURITY_LANDLOCK_LIMITS_H */

security/landlock/net.c

0 → 100644
+200 −0
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

/*

 * Landlock LSM - Network management and hooks

 *

 * Copyright © 2022-2023 Huawei Tech. Co., Ltd.

 * Copyright © 2022-2023 Microsoft Corporation

 */



#include <linux/in.h>

#include <linux/net.h>

#include <linux/socket.h>

#include <net/ipv6.h>



#include "common.h"

#include "cred.h"

#include "limits.h"

#include "net.h"

#include "ruleset.h"



int landlock_append_net_rule(struct landlock_ruleset *const ruleset,

			     const u16 port, access_mask_t access_rights)

{

	int err;

	const struct landlock_id id = {

		.key.data = (__force uintptr_t)htons(port),

		.type = LANDLOCK_KEY_NET_PORT,

	};



	BUILD_BUG_ON(sizeof(port) > sizeof(id.key.data));



	/* Transforms relative access rights to absolute ones. */

	access_rights |= LANDLOCK_MASK_ACCESS_NET &

			 ~landlock_get_net_access_mask(ruleset, 0);



	mutex_lock(&ruleset->lock);

	err = landlock_insert_rule(ruleset, id, access_rights);

	mutex_unlock(&ruleset->lock);



	return err;

}



static access_mask_t

get_raw_handled_net_accesses(const struct landlock_ruleset *const domain)

{

	access_mask_t access_dom = 0;

	size_t layer_level;



	for (layer_level = 0; layer_level < domain->num_layers; layer_level++)

		access_dom |= landlock_get_net_access_mask(domain, layer_level);

	return access_dom;

}



static const struct landlock_ruleset *get_current_net_domain(void)

{

	const struct landlock_ruleset *const dom =

		landlock_get_current_domain();



	if (!dom || !get_raw_handled_net_accesses(dom))

		return NULL;



	return dom;

}



static int current_check_access_socket(struct socket *const sock,

				       struct sockaddr *const address,

				       const int addrlen,

				       const access_mask_t access_request)

{

	__be16 port;

	layer_mask_t layer_masks[LANDLOCK_NUM_ACCESS_NET] = {};

	const struct landlock_rule *rule;

	access_mask_t handled_access;

	struct landlock_id id = {

		.type = LANDLOCK_KEY_NET_PORT,

	};

	const struct landlock_ruleset *const dom = get_current_net_domain();



	if (!dom)

		return 0;

	if (WARN_ON_ONCE(dom->num_layers < 1))

		return -EACCES;



	/* Checks if it's a (potential) TCP socket. */

	if (sock->type != SOCK_STREAM)

		return 0;



	/* Checks for minimal header length to safely read sa_family. */

	if (addrlen < offsetofend(typeof(*address), sa_family))

		return -EINVAL;



	switch (address->sa_family) {

	case AF_UNSPEC:

	case AF_INET:

		if (addrlen < sizeof(struct sockaddr_in))

			return -EINVAL;

		port = ((struct sockaddr_in *)address)->sin_port;

		break;



#if IS_ENABLED(CONFIG_IPV6)

	case AF_INET6:

		if (addrlen < SIN6_LEN_RFC2133)

			return -EINVAL;

		port = ((struct sockaddr_in6 *)address)->sin6_port;

		break;

#endif /* IS_ENABLED(CONFIG_IPV6) */



	default:

		return 0;

	}



	/* Specific AF_UNSPEC handling. */

	if (address->sa_family == AF_UNSPEC) {

		/*

		 * Connecting to an address with AF_UNSPEC dissolves the TCP

		 * association, which have the same effect as closing the

		 * connection while retaining the socket object (i.e., the file

		 * descriptor).  As for dropping privileges, closing

		 * connections is always allowed.

		 *

		 * For a TCP access control system, this request is legitimate.

		 * Let the network stack handle potential inconsistencies and

		 * return -EINVAL if needed.

		 */

		if (access_request == LANDLOCK_ACCESS_NET_CONNECT_TCP)

			return 0;



		/*

		 * For compatibility reason, accept AF_UNSPEC for bind

		 * accesses (mapped to AF_INET) only if the address is

		 * INADDR_ANY (cf. __inet_bind).  Checking the address is

		 * required to not wrongfully return -EACCES instead of

		 * -EAFNOSUPPORT.

		 *

		 * We could return 0 and let the network stack handle these

		 * checks, but it is safer to return a proper error and test

		 * consistency thanks to kselftest.

		 */

		if (access_request == LANDLOCK_ACCESS_NET_BIND_TCP) {

			/* addrlen has already been checked for AF_UNSPEC. */

			const struct sockaddr_in *const sockaddr =

				(struct sockaddr_in *)address;



			if (sock->sk->__sk_common.skc_family != AF_INET)

				return -EINVAL;



			if (sockaddr->sin_addr.s_addr != htonl(INADDR_ANY))

				return -EAFNOSUPPORT;

		}

	} else {

		/*

		 * Checks sa_family consistency to not wrongfully return

		 * -EACCES instead of -EINVAL.  Valid sa_family changes are

		 * only (from AF_INET or AF_INET6) to AF_UNSPEC.

		 *

		 * We could return 0 and let the network stack handle this

		 * check, but it is safer to return a proper error and test

		 * consistency thanks to kselftest.

		 */

		if (address->sa_family != sock->sk->__sk_common.skc_family)

			return -EINVAL;

	}



	id.key.data = (__force uintptr_t)port;

	BUILD_BUG_ON(sizeof(port) > sizeof(id.key.data));



	rule = landlock_find_rule(dom, id);

	handled_access = landlock_init_layer_masks(

		dom, access_request, &layer_masks, LANDLOCK_KEY_NET_PORT);

	if (landlock_unmask_layers(rule, handled_access, &layer_masks,

				   ARRAY_SIZE(layer_masks)))

		return 0;



	return -EACCES;

}



static int hook_socket_bind(struct socket *const sock,

			    struct sockaddr *const address, const int addrlen)

{

	return current_check_access_socket(sock, address, addrlen,

					   LANDLOCK_ACCESS_NET_BIND_TCP);

}



static int hook_socket_connect(struct socket *const sock,

			       struct sockaddr *const address,

			       const int addrlen)

{

	return current_check_access_socket(sock, address, addrlen,

					   LANDLOCK_ACCESS_NET_CONNECT_TCP);

}



static struct security_hook_list landlock_hooks[] __ro_after_init = {

	LSM_HOOK_INIT(socket_bind, hook_socket_bind),

	LSM_HOOK_INIT(socket_connect, hook_socket_connect),

};



__init void landlock_add_net_hooks(void)

{

	security_add_hooks(landlock_hooks, ARRAY_SIZE(landlock_hooks),

			   LANDLOCK_NAME);

}