| Message ID | 20220124080215.265538-1-konstantin.meskhidze@huawei.com (mailing list archive) |
|---|---|
| Headers | show |
| Series | landlock network implementation cover letter | expand |
On 24/01/2022 09:02, Konstantin Meskhidze wrote: > Hi, all! > > This is a new bunch of RFC patches related to Landlock LSM network confinement. > Here are previous discussions: > 1. https://lore.kernel.org/linux-security-module/20211210072123.386713-1-konstantin.meskhidze@huawei.com/ > 2. https://lore.kernel.org/linux-security-module/20211228115212.703084-1-konstantin.meskhidze@huawei.com/ > > As in previous RFCs, 2 hooks are supported: > - hook_socket_bind() > - hook_socket_connect() > > Selftest are provided in tools/testing/selftests/landlock/network_test.c; > Implementation was tested in QEMU invironment with 5.13 kernel version: Again, you need to base your work on the latest kernel version. > 1. base_test - passed all tests > 2. fs_test - passed 44/46 tests. 2 tests related to overlayfs failed. > Probably, I have wrong config options for overlayfs. The minimal required configuration is listed in the "config" file. You need to update it for the network tests as well. You missed the ptrace_test. To test everything you can run: fakeroot make -C tools/testing/selftests TARGETS=landlock gen_tar and then extract tools/testing/selftests/kselftest_install/kselftest-packages/kselftest.tar.gz and execute run_kselftest.sh on your VM. > 3. network_test - passed all tests. > Please give your suggestions about test cover in network_test.c > > Implementation related issues > ============================= It is more a changelog than issues. ;) > > 1. Access masks array refactored into 1D one and changed > to 32 bits. Filesystem masks occupy 16 lower bits and network > masks reside in 16 upper bits. > > struct landlock_ruleset { > ... > ... > u32 access_masks[]; > } > > 2. Refactor API functions in ruleset.c: > 1. Add (void *)object argument. > 2. Add u16 rule_type argument. > > - In filesystem case the "object" is defined by underlying inode. > In network case the "object" is defined by a port. There is > a union containing either a struct landlock_object pointer or a > raw data (here a u16 port): > union { > struct landlock_object *ptr; > uintptr_t data; > } object; > > - Everytime when a rule is inserted it's needed to provide a rule type: > > landlock_insert_rule(ruleset, (void *)object, access, rule_type) > 1. A rule_type could be or LANDLOCK_RULE_NET_SERVICE or > LANDLOCK_RULE_PATH_BENEATH; > 2. (void *) object - is either landlock_object *ptr or port value; > > 3. Use two rb_trees in ruleset structure: > 1. root_inode - for filesystem objects (inodes). > 2. root_net_port - for network port objects. Thanks for these explanations! > > Konstantin Meskhidze (2): > landlock: TCP network hooks implementation > landlock: selftests for bind and connect hooks > > include/uapi/linux/landlock.h | 52 +++ > security/landlock/Makefile | 2 +- > security/landlock/fs.c | 12 +- > security/landlock/limits.h | 6 + > security/landlock/net.c | 175 +++++++++ > security/landlock/net.h | 21 ++ > security/landlock/ruleset.c | 167 ++++++--- > security/landlock/ruleset.h | 40 +- > security/landlock/setup.c | 3 + > security/landlock/syscalls.c | 142 ++++--- > .../testing/selftests/landlock/network_test.c | 346 ++++++++++++++++++ > 11 files changed, 860 insertions(+), 106 deletions(-) > create mode 100644 security/landlock/net.c > create mode 100644 security/landlock/net.h > create mode 100644 tools/testing/selftests/landlock/network_test.c > > -- > 2.25.1 >
2/1/2022 8:53 PM, Mickaël Salaün пишет: > > On 24/01/2022 09:02, Konstantin Meskhidze wrote: >> Hi, all! >> >> This is a new bunch of RFC patches related to Landlock LSM network >> confinement. >> Here are previous discussions: >> 1. >> https://lore.kernel.org/linux-security-module/20211210072123.386713-1-konstantin.meskhidze@huawei.com/ >> >> 2. >> https://lore.kernel.org/linux-security-module/20211228115212.703084-1-konstantin.meskhidze@huawei.com/ >> >> >> As in previous RFCs, 2 hooks are supported: >> - hook_socket_bind() >> - hook_socket_connect() >> >> Selftest are provided in tools/testing/selftests/landlock/network_test.c; >> Implementation was tested in QEMU invironment with 5.13 kernel version: > > Again, you need to base your work on the latest kernel version. > Is it because there are new Landlock features in a latest kernel version? I thought 5.13 kernel version and the latest one have the same Landlock functionality and there will not be rebasing problems in future. But anyway I will base the work on the latest kernel. Which kernel version do you work on now? > >> 1. base_test - passed all tests >> 2. fs_test - passed 44/46 tests. 2 tests related to overlayfs failed. >> Probably, I have wrong config options for overlayfs. > > The minimal required configuration is listed in the "config" file. You > need to update it for the network tests as well. You missed the > ptrace_test. To test everything you can run: > fakeroot make -C tools/testing/selftests TARGETS=landlock gen_tar > and then extract > tools/testing/selftests/kselftest_install/kselftest-packages/kselftest.tar.gz > and execute run_kselftest.sh on your VM. Thank you. I missed config file in landlock selftests. I will launch all landlock tests. > > >> 3. network_test - passed all tests. >> Please give your suggestions about test cover in network_test.c >> >> Implementation related issues >> ============================= > > It is more a changelog than issues. ;) Ok. Thanks. I will add a changelog into the next patches. > > >> >> 1. Access masks array refactored into 1D one and changed >> to 32 bits. Filesystem masks occupy 16 lower bits and network >> masks reside in 16 upper bits. >> >> struct landlock_ruleset { >> ... >> ... >> u32 access_masks[]; >> } >> >> 2. Refactor API functions in ruleset.c: >> 1. Add (void *)object argument. >> 2. Add u16 rule_type argument. >> >> - In filesystem case the "object" is defined by underlying inode. >> In network case the "object" is defined by a port. There is >> a union containing either a struct landlock_object pointer or a >> raw data (here a u16 port): >> union { >> struct landlock_object *ptr; >> uintptr_t data; >> } object; >> >> - Everytime when a rule is inserted it's needed to provide a rule >> type: >> >> landlock_insert_rule(ruleset, (void *)object, access, rule_type) >> 1. A rule_type could be or LANDLOCK_RULE_NET_SERVICE or >> LANDLOCK_RULE_PATH_BENEATH; >> 2. (void *) object - is either landlock_object *ptr or port value; >> >> 3. Use two rb_trees in ruleset structure: >> 1. root_inode - for filesystem objects (inodes). >> 2. root_net_port - for network port objects. > > Thanks for these explanations! Thanks for the review!!! > > >> >> Konstantin Meskhidze (2): >> landlock: TCP network hooks implementation >> landlock: selftests for bind and connect hooks >> >> include/uapi/linux/landlock.h | 52 +++ >> security/landlock/Makefile | 2 +- >> security/landlock/fs.c | 12 +- >> security/landlock/limits.h | 6 + >> security/landlock/net.c | 175 +++++++++ >> security/landlock/net.h | 21 ++ >> security/landlock/ruleset.c | 167 ++++++--- >> security/landlock/ruleset.h | 40 +- >> security/landlock/setup.c | 3 + >> security/landlock/syscalls.c | 142 ++++--- >> .../testing/selftests/landlock/network_test.c | 346 ++++++++++++++++++ >> 11 files changed, 860 insertions(+), 106 deletions(-) >> create mode 100644 security/landlock/net.c >> create mode 100644 security/landlock/net.h >> create mode 100644 tools/testing/selftests/landlock/network_test.c >> >> -- >> 2.25.1 >> > .
On 07/02/2022 14:18, Konstantin Meskhidze wrote: > > > 2/1/2022 8:53 PM, Mickaël Salaün пишет: >> >> On 24/01/2022 09:02, Konstantin Meskhidze wrote: >>> Hi, all! >>> >>> This is a new bunch of RFC patches related to Landlock LSM network >>> confinement. >>> Here are previous discussions: >>> 1. >>> https://lore.kernel.org/linux-security-module/20211210072123.386713-1-konstantin.meskhidze@huawei.com/ >>> >>> 2. >>> https://lore.kernel.org/linux-security-module/20211228115212.703084-1-konstantin.meskhidze@huawei.com/ >>> >>> >>> As in previous RFCs, 2 hooks are supported: >>> - hook_socket_bind() >>> - hook_socket_connect() >>> >>> Selftest are provided in >>> tools/testing/selftests/landlock/network_test.c; >>> Implementation was tested in QEMU invironment with 5.13 kernel version: >> >> Again, you need to base your work on the latest kernel version. >> > Is it because there are new Landlock features in a latest kernel > version? > I thought 5.13 kernel version and the latest one have the same > Landlock functionality and there will not be rebasing problems in > future. But anyway I will base the work on the latest kernel. > Which kernel version do you work on now? For now, the security/landlock/ files didn't changed yet, but that will come. All other kernel APIs (and semantic) may change over time (e.g. LSM API, network types…). I'm working on Linus's master branch (when it becomes stable enough) or the linux-rolling-stable branch (from the stable repository). When it will be ready for a merge, we need to base our work on linux-next.
2/7/2022 4:35 PM, Mickaël Salaün пишет: > > On 07/02/2022 14:18, Konstantin Meskhidze wrote: >> >> >> 2/1/2022 8:53 PM, Mickaël Salaün пишет: >>> >>> On 24/01/2022 09:02, Konstantin Meskhidze wrote: >>>> Hi, all! >>>> >>>> This is a new bunch of RFC patches related to Landlock LSM network >>>> confinement. >>>> Here are previous discussions: >>>> 1. >>>> https://lore.kernel.org/linux-security-module/20211210072123.386713-1-konstantin.meskhidze@huawei.com/ >>>> >>>> 2. >>>> https://lore.kernel.org/linux-security-module/20211228115212.703084-1-konstantin.meskhidze@huawei.com/ >>>> >>>> >>>> As in previous RFCs, 2 hooks are supported: >>>> - hook_socket_bind() >>>> - hook_socket_connect() >>>> >>>> Selftest are provided in >>>> tools/testing/selftests/landlock/network_test.c; >>>> Implementation was tested in QEMU invironment with 5.13 kernel version: >>> >>> Again, you need to base your work on the latest kernel version. >>> >> Is it because there are new Landlock features in a latest kernel >> version? >> I thought 5.13 kernel version and the latest one have the same >> Landlock functionality and there will not be rebasing problems in >> future. But anyway I will base the work on the latest kernel. >> Which kernel version do you work on now? > > > For now, the security/landlock/ files didn't changed yet, but that will > come. All other kernel APIs (and semantic) may change over time (e.g. > LSM API, network types…). I'm working on Linus's master branch (when it > becomes stable enough) or the linux-rolling-stable branch (from the > stable repository). When it will be ready for a merge, we need to base > our work on linux-next. Ok. I got it. I will rebase to the latest version. Thanks. > .
Hi, all! This is a new bunch of RFC patches related to Landlock LSM network confinement. Here are previous discussions: 1. https://lore.kernel.org/linux-security-module/20211210072123.386713-1-konstantin.meskhidze@huawei.com/ 2. https://lore.kernel.org/linux-security-module/20211228115212.703084-1-konstantin.meskhidze@huawei.com/ As in previous RFCs, 2 hooks are supported: - hook_socket_bind() - hook_socket_connect() Selftest are provided in tools/testing/selftests/landlock/network_test.c; Implementation was tested in QEMU invironment with 5.13 kernel version: 1. base_test - passed all tests 2. fs_test - passed 44/46 tests. 2 tests related to overlayfs failed. Probably, I have wrong config options for overlayfs. 3. network_test - passed all tests. Please give your suggestions about test cover in network_test.c Implementation related issues ============================= 1. Access masks array refactored into 1D one and changed to 32 bits. Filesystem masks occupy 16 lower bits and network masks reside in 16 upper bits. struct landlock_ruleset { ... ... u32 access_masks[]; } 2. Refactor API functions in ruleset.c: 1. Add (void *)object argument. 2. Add u16 rule_type argument. - In filesystem case the "object" is defined by underlying inode. In network case the "object" is defined by a port. There is a union containing either a struct landlock_object pointer or a raw data (here a u16 port): union { struct landlock_object *ptr; uintptr_t data; } object; - Everytime when a rule is inserted it's needed to provide a rule type: landlock_insert_rule(ruleset, (void *)object, access, rule_type) 1. A rule_type could be or LANDLOCK_RULE_NET_SERVICE or LANDLOCK_RULE_PATH_BENEATH; 2. (void *) object - is either landlock_object *ptr or port value; 3. Use two rb_trees in ruleset structure: 1. root_inode - for filesystem objects (inodes). 2. root_net_port - for network port objects. Konstantin Meskhidze (2): landlock: TCP network hooks implementation landlock: selftests for bind and connect hooks include/uapi/linux/landlock.h | 52 +++ security/landlock/Makefile | 2 +- security/landlock/fs.c | 12 +- security/landlock/limits.h | 6 + security/landlock/net.c | 175 +++++++++ security/landlock/net.h | 21 ++ security/landlock/ruleset.c | 167 ++++++--- security/landlock/ruleset.h | 40 +- security/landlock/setup.c | 3 + security/landlock/syscalls.c | 142 ++++--- .../testing/selftests/landlock/network_test.c | 346 ++++++++++++++++++ 11 files changed, 860 insertions(+), 106 deletions(-) create mode 100644 security/landlock/net.c create mode 100644 security/landlock/net.h create mode 100644 tools/testing/selftests/landlock/network_test.c -- 2.25.1