[RFC,0/2] Landlock network PoC implementation

From: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>

According the main idea of Landlock's author Mickaёl Salun the goal
of Landlock is to enable to restrict ambient rights
(e.g. global filesystem access) for a set of processes.
Landlock is stackable LSM. Landlock empowers any process,
including unprivileged ones, to securely restrict themselves.
This feature could be very helpful in containerized environment
and different sandboxed applications.

Now Landlock supports a number of filesytem access rights:
	- file execute
	- write to file
	- read file
	- make directory
 and etc.

So, this PoC patch provides the basic idea for Landlock network
access-control implementation.
eBPF-based sandboxes like BPFcontain and BPFbox sandboxes confine
network traffic at the socket level. Network rules grant access
to various socket operations on the IPv4 and IPv6 socket families.
Socket operations could be grouped by different use cases:
	• Client, server.
	• Send and receive categories.
BPFbox operation example:
	- connect
	- bind
	- accept
	- listen
	- send
 and etc.

Landlock network enhancement should follow similar logic
like in mentioned sandboxes!

Implementation related issues
=============================

1. Its needed to add a new type of rules:

enum landlock_rule_type {
	LANDLOCK_RULE_PATH_BENEATH = 1,
	LANDLOCK_RULE_NET = 2,
	LANDLOCK_RULE_TYPE_NUM
}

struct landlock_ruleset_attr {
	_u64 handled_access_fs;
	_u64 handled_actions_net;
}

struct landlock_net_beneath_attr {
	/**
	 * @allowed_actions: Bitmask of allowed network actions
	 * for a current process
	 */
	__u64 allowed_actions;
}

2. Added 2 defines for network allowed actions.
Now the current prototype patch support creating 2 types
of sockets - unix and inet:
	LANDLOCK_ACCESS_FS_MAKE_UNIX_SOCK	 (1ULL << 0)
	LANDLOCK_ACCESS_FS_MAKE_INET_SOCK	 (1ULL << 1)

Its needed to discuss what kind of sockets types and actions
should be supported in MINIMAL version!!!

3. Syscalls interfaces.
Current syscall interface look like enough for support different
rule types, but it’s needed to modify some internal functions
to support it.

As an example:
struct landlock_ruleset *landlock_create_ruleset(const u32 fs_access_mask,
						 const u32 net_access_mask)
{
	struct landlock_ruleset *new_ruleset;

	/* Informs about useless ruleset. */
	if (!access_mask && !net_access_mask )
		return ERR_PTR(-ENOMSG);
	new_ruleset = create_ruleset(1);
	if (!IS_ERR(new_ruleset) && access_mask)
		new_ruleset->access_masks[0][0] = access_mask;
	if (!IS_ERR(new_ruleset) && net_access_mask)
		new_ruleset->fs_access_masks[1][0] = net_access_mask;

	return new_ruleset;
}

In future, it's to use an array access_mask[LANDLOCK_RULE_TYPE_NUM - 1]
enum landlock_rule_type {
	LANDLOCK_RULE_PATH_BENEATH = 1
	LANDLOCK_RULE_NET = 2,

	LANDLOCK_RULE_TYPE_NUM
};

4. Kernel objects.
For filesystem restrictions inodes objects are used to tie landlock rules.
But for socket operations it's preferred to use task_struct object of
a process, cause sockets' inodes are created just after
security_socket_create() hook is called, and if its needed to have
some restriction rule for creating sockets, this rule can't be tied
to a socket inode cause there is no any has been created at the hook's
catching moment, see the sock_create_lite() function below:

int sock_create_lite(int family, int type, int protocol,
		     struct socket **res)
{
	int err;
	struct socket *sock = NULL;

	err = security_socket_create(family, type, protocol, 1);
	if (err)
		goto out;
	...

	sock = sock_alloc();
	if (!sock) {
		err = -ENOMEM;
		goto out;
	}
	...
}
And all other socket rules can be tied to a process object, cause
it would be easier to maintaint and control it.
For containerized application a user could create a bunch container with
individual network restriction rules tied to them.

This solution (what kernel object to use) must be established first,
cause the following design depends on it.

5. Landlock internal structures modifications.

 - In further patches its needed network_rules structure in landlock_layer
structure to support network rules:

	struct landlock_layer {
		/**
		* @level: Position of this layer in the layer stack.
		*/
		u16 level;
		/**
		* @access: Bitfield of allowed actions on the kernel object.  They are
		* relative to the object type (e.g. %LANDLOCK_ACTION_FS_READ).
		*/
		u16 access;

		struct network_rules;
	};

The architecture of struct network_rules has not been established yet,
and it could be like this :

	struct network_rules {
		Socket_domains = {AF_UNIX, AF_INET
		Socket_types = {SOCK_STREAM, ...
		Socket_protocols = {IP, TCP, ...
		Socket_actions = {"connect", "bind"
		IP_address_allowed[]
	}

 - Using pointer to FAM arrays of different types of access masks: fs,
network, ipc etc.

	struct landlock_ruleset {

		struct rb_root root;
		...
		...

		u16 *access_masks[];
	};

This is just the basic ideas for the open discussion.
Please give your opinion and suggestion.

Konstantin Meskhidze (2):
  landlock: base template for network hooks
  landlock: socket_create() hook implemented

 include/uapi/linux/landlock.h |  69 +++++++++++
 security/landlock/Makefile    |   2 +-
 security/landlock/fs.c        |   4 +-
 security/landlock/limits.h    |   3 +
 security/landlock/net.c       | 209 ++++++++++++++++++++++++++++++++++
 security/landlock/net.h       |  50 ++++++++
 security/landlock/ruleset.c   |  46 ++++++--
 security/landlock/ruleset.h   |  11 +-
 security/landlock/setup.c     |   3 +
 security/landlock/syscalls.c  | 140 ++++++++++++++++-------
 10 files changed, 479 insertions(+), 58 deletions(-)
 create mode 100644 security/landlock/net.c
 create mode 100644 security/landlock/net.h

--
2.25.1

From 8f1dff03a9722601334a31ee3c6680240a0e6e1c Mon Sep 17 00:00:00 2001
From: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
Date: Fri, 19 Nov 2021 11:18:23 +0800
Subject: [RFC PATCH 1/2] landlock: base template for network hooks

Add a new rule type LANDLOCK_RULE_NET to
landlock_rule_type.
Add landlock_net_beneath_attr to support network
allowed actions.
Add two network flags for socket creation confinement:
LANDLOCK_ACCESS_FS_MAKE_UNIX_SOCK,
LANDLOCK_ACCESS_FS_MAKE_INET_SOCK.
Update Landlock syscalls to support network rules
injections.
Update landlock_ruleset structure to support network access mask.
Add net.c and net.h files with network template functions.
Add new blob size with lbs_task and landlock_add_net_hooks
into landlock_init().

Signed-off-by: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
---
 include/uapi/linux/landlock.h |  69 +++++++++++++++++
 security/landlock/Makefile    |   2 +-
 security/landlock/fs.c        |   4 +-
 security/landlock/limits.h    |   3 +
 security/landlock/net.c       |  88 +++++++++++++++++++++
 security/landlock/net.h       |  51 +++++++++++++
 security/landlock/ruleset.c   |  46 ++++++++---
 security/landlock/ruleset.h   |   9 ++-
 security/landlock/setup.c     |   3 +
 security/landlock/syscalls.c  | 140 ++++++++++++++++++++++++----------
 10 files changed, 358 insertions(+), 57 deletions(-)
 create mode 100644 security/landlock/net.c
 create mode 100644 security/landlock/net.h

--
2.25.1

[RFC,0/2] Landlock network PoC implementation

Commit Message

Comments

Patch