From patchwork Sat Aug 27 11:12:10 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Xiu Jianfeng X-Patchwork-Id: 12956980 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A5007C0502E for ; Sat, 27 Aug 2022 11:15:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237842AbiH0LPy (ORCPT ); Sat, 27 Aug 2022 07:15:54 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47438 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233908AbiH0LPw (ORCPT ); Sat, 27 Aug 2022 07:15:52 -0400 Received: from szxga03-in.huawei.com (szxga03-in.huawei.com [45.249.212.189]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 596F31CB11; Sat, 27 Aug 2022 04:15:52 -0700 (PDT) Received: from dggpeml500023.china.huawei.com (unknown [172.30.72.56]) by szxga03-in.huawei.com (SkyGuard) with ESMTP id 4MFDbz2g1SzGpsR; Sat, 27 Aug 2022 19:14:07 +0800 (CST) Received: from ubuntu1804.huawei.com (10.67.174.58) by dggpeml500023.china.huawei.com (7.185.36.114) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Sat, 27 Aug 2022 19:15:50 +0800 From: Xiu Jianfeng To: , , , , , CC: , , , Subject: [PATCH -next v2 1/6] landlock: expand access_mask_t to u32 type Date: Sat, 27 Aug 2022 19:12:10 +0800 Message-ID: <20220827111215.131442-2-xiujianfeng@huawei.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20220827111215.131442-1-xiujianfeng@huawei.com> References: <20220827111215.131442-1-xiujianfeng@huawei.com> MIME-Version: 1.0 X-Originating-IP: [10.67.174.58] X-ClientProxiedBy: dggems705-chm.china.huawei.com (10.3.19.182) To dggpeml500023.china.huawei.com (7.185.36.114) X-CFilter-Loop: Reflected Precedence: bulk List-ID: u16 is not enough to add more types of restritions, so expand it to u32 Signed-off-by: Xiu Jianfeng --- security/landlock/ruleset.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/security/landlock/ruleset.h b/security/landlock/ruleset.h index d43231b783e4..607b3dc0ef19 100644 --- a/security/landlock/ruleset.h +++ b/security/landlock/ruleset.h @@ -19,7 +19,7 @@ #include "limits.h" #include "object.h" -typedef u16 access_mask_t; +typedef u32 access_mask_t; /* Makes sure all filesystem access rights can be stored. */ static_assert(BITS_PER_TYPE(access_mask_t) >= LANDLOCK_NUM_ACCESS_FS); /* Makes sure for_each_set_bit() and for_each_clear_bit() calls are OK. */ From patchwork Sat Aug 27 11:12:11 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Xiu Jianfeng X-Patchwork-Id: 12956981 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1AACAC0502E for ; Sat, 27 Aug 2022 11:16:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245743AbiH0LQC (ORCPT ); Sat, 27 Aug 2022 07:16:02 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47688 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243366AbiH0LPz (ORCPT ); Sat, 27 Aug 2022 07:15:55 -0400 Received: from szxga03-in.huawei.com (szxga03-in.huawei.com [45.249.212.189]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9AE5D20BC5; Sat, 27 Aug 2022 04:15:53 -0700 (PDT) Received: from dggpeml500023.china.huawei.com (unknown [172.30.72.57]) by szxga03-in.huawei.com (SkyGuard) with ESMTP id 4MFDc04VsLzGpsS; Sat, 27 Aug 2022 19:14:08 +0800 (CST) Received: from ubuntu1804.huawei.com (10.67.174.58) by dggpeml500023.china.huawei.com (7.185.36.114) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Sat, 27 Aug 2022 19:15:51 +0800 From: Xiu Jianfeng To: , , , , , CC: , , , Subject: [PATCH -next v2 2/6] landlock: abstract walk_to_visible_parent() helper Date: Sat, 27 Aug 2022 19:12:11 +0800 Message-ID: <20220827111215.131442-3-xiujianfeng@huawei.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20220827111215.131442-1-xiujianfeng@huawei.com> References: <20220827111215.131442-1-xiujianfeng@huawei.com> MIME-Version: 1.0 X-Originating-IP: [10.67.174.58] X-ClientProxiedBy: dggems705-chm.china.huawei.com (10.3.19.182) To dggpeml500023.china.huawei.com (7.185.36.114) X-CFilter-Loop: Reflected Precedence: bulk List-ID: This helper will be used in the next commit which supports chmod and chown access rights restriction. Signed-off-by: Xiu Jianfeng --- security/landlock/fs.c | 67 ++++++++++++++++++++++++++++++------------ 1 file changed, 49 insertions(+), 18 deletions(-) diff --git a/security/landlock/fs.c b/security/landlock/fs.c index c57f581a9cd5..4ef614a4ea22 100644 --- a/security/landlock/fs.c +++ b/security/landlock/fs.c @@ -38,6 +38,44 @@ #include "ruleset.h" #include "setup.h" +enum walk_result { + WALK_CONTINUE, + WALK_TO_REAL_ROOT, + WALK_TO_DISCONN_ROOT, +}; + +/* + * walk to the visible parent, caller should call path_get()/path_put() + * before/after this helpler. + * + * Returns: + * - WALK_TO_REAL_ROOT if walk to the real root; + * - WALK_TO_DISCONN_ROOT if walk to disconnected root; + * - WALK_CONTINUE otherwise. + */ +static enum walk_result walk_to_visible_parent(struct path *path) +{ + struct dentry *parent_dentry; +jump_up: + if (path->dentry == path->mnt->mnt_root) { + if (follow_up(path)) { + /* Ignores hidden mount points. */ + goto jump_up; + } else { + /* Stop at the real root. */ + return WALK_TO_REAL_ROOT; + } + } + /* Stops at disconnected root directories. */ + if (unlikely(IS_ROOT(path->dentry))) + return WALK_TO_DISCONN_ROOT; + parent_dentry = dget_parent(path->dentry); + dput(path->dentry); + path->dentry = parent_dentry; + + return WALK_CONTINUE; +} + /* Underlying object management */ static void release_inode(struct landlock_object *const object) @@ -539,8 +577,8 @@ static int check_access_path_dual( * restriction. */ while (true) { - struct dentry *parent_dentry; const struct landlock_rule *rule; + enum walk_result wr; /* * If at least all accesses allowed on the destination are @@ -588,20 +626,12 @@ static int check_access_path_dual( if (allowed_parent1 && allowed_parent2) break; -jump_up: - if (walker_path.dentry == walker_path.mnt->mnt_root) { - if (follow_up(&walker_path)) { - /* Ignores hidden mount points. */ - goto jump_up; - } else { - /* - * Stops at the real root. Denies access - * because not all layers have granted access. - */ - break; - } - } - if (unlikely(IS_ROOT(walker_path.dentry))) { + wr = walk_to_visible_parent(&walker_path); + switch (wr) { + case WALK_TO_REAL_ROOT: + /* Stop at the real root. */ + goto out; + case WALK_TO_DISCONN_ROOT: /* * Stops at disconnected root directories. Only allows * access to internal filesystems (e.g. nsfs, which is @@ -609,12 +639,13 @@ static int check_access_path_dual( */ allowed_parent1 = allowed_parent2 = !!(walker_path.mnt->mnt_flags & MNT_INTERNAL); + goto out; + case WALK_CONTINUE: + default: break; } - parent_dentry = dget_parent(walker_path.dentry); - dput(walker_path.dentry); - walker_path.dentry = parent_dentry; } +out: path_put(&walker_path); if (allowed_parent1 && allowed_parent2) From patchwork Sat Aug 27 11:12:12 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Xiu Jianfeng X-Patchwork-Id: 12956982 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7719DC0502A for ; Sat, 27 Aug 2022 11:16:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345037AbiH0LQD (ORCPT ); Sat, 27 Aug 2022 07:16:03 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47744 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230499AbiH0LPz (ORCPT ); Sat, 27 Aug 2022 07:15:55 -0400 Received: from szxga01-in.huawei.com (szxga01-in.huawei.com [45.249.212.187]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9CAF417AA5; Sat, 27 Aug 2022 04:15:54 -0700 (PDT) Received: from dggpeml500023.china.huawei.com (unknown [172.30.72.56]) by szxga01-in.huawei.com (SkyGuard) with ESMTP id 4MFDYt2l3wzkWZY; Sat, 27 Aug 2022 19:12:18 +0800 (CST) Received: from ubuntu1804.huawei.com (10.67.174.58) by dggpeml500023.china.huawei.com (7.185.36.114) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Sat, 27 Aug 2022 19:15:52 +0800 From: Xiu Jianfeng To: , , , , , CC: , , , Subject: [PATCH -next v2 3/6] landlock: add chmod and chown support Date: Sat, 27 Aug 2022 19:12:12 +0800 Message-ID: <20220827111215.131442-4-xiujianfeng@huawei.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20220827111215.131442-1-xiujianfeng@huawei.com> References: <20220827111215.131442-1-xiujianfeng@huawei.com> MIME-Version: 1.0 X-Originating-IP: [10.67.174.58] X-ClientProxiedBy: dggems705-chm.china.huawei.com (10.3.19.182) To dggpeml500023.china.huawei.com (7.185.36.114) X-CFilter-Loop: Reflected Precedence: bulk List-ID: Add two flags LANDLOCK_ACCESS_FS_CHMOD and LANDLOCK_ACCESS_FS_CHGRP to support restriction to chmod(2) and chown(2) with landlock. If these two access rights are set on a directory, they only take effect for its context, not the directory itself. This patch also change the landlock ABI version from 3 to 4. Signed-off-by: Xiu Jianfeng --- include/uapi/linux/landlock.h | 10 +++-- security/landlock/fs.c | 43 +++++++++++++++++++- security/landlock/limits.h | 2 +- security/landlock/syscalls.c | 2 +- tools/testing/selftests/landlock/base_test.c | 2 +- tools/testing/selftests/landlock/fs_test.c | 6 ++- 6 files changed, 56 insertions(+), 9 deletions(-) diff --git a/include/uapi/linux/landlock.h b/include/uapi/linux/landlock.h index 735b1fe8326e..07b73626ff20 100644 --- a/include/uapi/linux/landlock.h +++ b/include/uapi/linux/landlock.h @@ -141,14 +141,16 @@ struct landlock_path_beneath_attr { * directory) parent. Otherwise, such actions are denied with errno set to * EACCES. The EACCES errno prevails over EXDEV to let user space * efficiently deal with an unrecoverable error. + * - %LANDLOCK_ACCESS_FS_CHMOD: Change the file mode bits of a file. + * - %LANDLOCK_ACCESS_FS_CHGRP: Change the owner and/or group of a file. * * .. warning:: * * It is currently not possible to restrict some file-related actions * accessible through these syscall families: :manpage:`chdir(2)`, - * :manpage:`stat(2)`, :manpage:`flock(2)`, :manpage:`chmod(2)`, - * :manpage:`chown(2)`, :manpage:`setxattr(2)`, :manpage:`utime(2)`, - * :manpage:`ioctl(2)`, :manpage:`fcntl(2)`, :manpage:`access(2)`. + * :manpage:`stat(2)`, :manpage:`flock(2)`, :manpage:`setxattr(2)`, + * :manpage:`utime(2)`,:manpage:`ioctl(2)`, :manpage:`fcntl(2)`, + * :manpage:`access(2)`. * Future Landlock evolutions will enable to restrict them. */ /* clang-format off */ @@ -167,6 +169,8 @@ struct landlock_path_beneath_attr { #define LANDLOCK_ACCESS_FS_MAKE_SYM (1ULL << 12) #define LANDLOCK_ACCESS_FS_REFER (1ULL << 13) #define LANDLOCK_ACCESS_FS_TRUNCATE (1ULL << 14) +#define LANDLOCK_ACCESS_FS_CHMOD (1ULL << 15) +#define LANDLOCK_ACCESS_FS_CHGRP (1ULL << 16) /* clang-format on */ #endif /* _UAPI_LINUX_LANDLOCK_H */ diff --git a/security/landlock/fs.c b/security/landlock/fs.c index 4ef614a4ea22..6ac83d96ada7 100644 --- a/security/landlock/fs.c +++ b/security/landlock/fs.c @@ -185,7 +185,9 @@ static struct landlock_object *get_inode_object(struct inode *const inode) LANDLOCK_ACCESS_FS_EXECUTE | \ LANDLOCK_ACCESS_FS_WRITE_FILE | \ LANDLOCK_ACCESS_FS_READ_FILE | \ - LANDLOCK_ACCESS_FS_TRUNCATE) + LANDLOCK_ACCESS_FS_TRUNCATE | \ + LANDLOCK_ACCESS_FS_CHMOD | \ + LANDLOCK_ACCESS_FS_CHGRP) /* clang-format on */ /* @@ -690,6 +692,31 @@ static inline int current_check_access_path(const struct path *const path, return check_access_path(dom, path, access_request); } +static inline int +current_check_access_path_context_only(const struct path *const path, + const access_mask_t access_request) +{ + const struct landlock_ruleset *const dom = + landlock_get_current_domain(); + struct path eff_path; + int ret; + + if (!dom) + return 0; + eff_path = *path; + /* if it's dir, check its visible parent. */ + if (d_is_dir(eff_path.dentry)) { + path_get(&eff_path); + /* dont care if reaches the root or not. */ + walk_to_visible_parent(&eff_path); + ret = current_check_access_path(&eff_path, access_request); + path_put(&eff_path); + } else { + ret = current_check_access_path(&eff_path, access_request); + } + return ret; +} + static inline access_mask_t get_mode_access(const umode_t mode) { switch (mode & S_IFMT) { @@ -1177,6 +1204,18 @@ static int hook_path_truncate(const struct path *const path) return current_check_access_path(path, LANDLOCK_ACCESS_FS_TRUNCATE); } +static int hook_path_chmod(const struct path *const path, umode_t mode) +{ + return current_check_access_path_context_only(path, + LANDLOCK_ACCESS_FS_CHMOD); +} + +static int hook_path_chown(const struct path *const path, kuid_t uid, kgid_t gid) +{ + return current_check_access_path_context_only(path, + LANDLOCK_ACCESS_FS_CHGRP); +} + /* File hooks */ static inline access_mask_t get_file_access(const struct file *const file) @@ -1230,6 +1269,8 @@ static struct security_hook_list landlock_hooks[] __lsm_ro_after_init = { LSM_HOOK_INIT(path_unlink, hook_path_unlink), LSM_HOOK_INIT(path_rmdir, hook_path_rmdir), LSM_HOOK_INIT(path_truncate, hook_path_truncate), + LSM_HOOK_INIT(path_chmod, hook_path_chmod), + LSM_HOOK_INIT(path_chown, hook_path_chown), LSM_HOOK_INIT(file_open, hook_file_open), }; diff --git a/security/landlock/limits.h b/security/landlock/limits.h index 82288f0e9e5e..7cdd7d467d12 100644 --- a/security/landlock/limits.h +++ b/security/landlock/limits.h @@ -18,7 +18,7 @@ #define LANDLOCK_MAX_NUM_LAYERS 16 #define LANDLOCK_MAX_NUM_RULES U32_MAX -#define LANDLOCK_LAST_ACCESS_FS LANDLOCK_ACCESS_FS_TRUNCATE +#define LANDLOCK_LAST_ACCESS_FS LANDLOCK_ACCESS_FS_CHGRP #define LANDLOCK_MASK_ACCESS_FS ((LANDLOCK_LAST_ACCESS_FS << 1) - 1) #define LANDLOCK_NUM_ACCESS_FS __const_hweight64(LANDLOCK_MASK_ACCESS_FS) diff --git a/security/landlock/syscalls.c b/security/landlock/syscalls.c index f4d6fc7ed17f..469e0e11735c 100644 --- a/security/landlock/syscalls.c +++ b/security/landlock/syscalls.c @@ -129,7 +129,7 @@ static const struct file_operations ruleset_fops = { .write = fop_dummy_write, }; -#define LANDLOCK_ABI_VERSION 3 +#define LANDLOCK_ABI_VERSION 4 /** * sys_landlock_create_ruleset - Create a new ruleset diff --git a/tools/testing/selftests/landlock/base_test.c b/tools/testing/selftests/landlock/base_test.c index 72cdae277b02..9f00582f639c 100644 --- a/tools/testing/selftests/landlock/base_test.c +++ b/tools/testing/selftests/landlock/base_test.c @@ -75,7 +75,7 @@ TEST(abi_version) const struct landlock_ruleset_attr ruleset_attr = { .handled_access_fs = LANDLOCK_ACCESS_FS_READ_FILE, }; - ASSERT_EQ(3, landlock_create_ruleset(NULL, 0, + ASSERT_EQ(4, landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_VERSION)); ASSERT_EQ(-1, landlock_create_ruleset(&ruleset_attr, 0, diff --git a/tools/testing/selftests/landlock/fs_test.c b/tools/testing/selftests/landlock/fs_test.c index debe2d9ea6cf..f513cd8d9d51 100644 --- a/tools/testing/selftests/landlock/fs_test.c +++ b/tools/testing/selftests/landlock/fs_test.c @@ -404,9 +404,11 @@ TEST_F_FORK(layout1, inval) LANDLOCK_ACCESS_FS_EXECUTE | \ LANDLOCK_ACCESS_FS_WRITE_FILE | \ LANDLOCK_ACCESS_FS_READ_FILE | \ - LANDLOCK_ACCESS_FS_TRUNCATE) + LANDLOCK_ACCESS_FS_TRUNCATE | \ + LANDLOCK_ACCESS_FS_CHMOD | \ + LANDLOCK_ACCESS_FS_CHGRP) -#define ACCESS_LAST LANDLOCK_ACCESS_FS_TRUNCATE +#define ACCESS_LAST LANDLOCK_ACCESS_FS_CHGRP #define ACCESS_ALL ( \ ACCESS_FILE | \ From patchwork Sat Aug 27 11:12:13 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Xiu Jianfeng X-Patchwork-Id: 12956985 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CA4D2C3DA6B for ; Sat, 27 Aug 2022 11:16:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233908AbiH0LQK (ORCPT ); Sat, 27 Aug 2022 07:16:10 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47800 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234627AbiH0LP5 (ORCPT ); Sat, 27 Aug 2022 07:15:57 -0400 Received: from szxga02-in.huawei.com (szxga02-in.huawei.com [45.249.212.188]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5258F222A4; Sat, 27 Aug 2022 04:15:55 -0700 (PDT) Received: from dggpeml500023.china.huawei.com (unknown [172.30.72.56]) by szxga02-in.huawei.com (SkyGuard) with ESMTP id 4MFDY10qwnzYcn5; Sat, 27 Aug 2022 19:11:33 +0800 (CST) Received: from ubuntu1804.huawei.com (10.67.174.58) by dggpeml500023.china.huawei.com (7.185.36.114) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Sat, 27 Aug 2022 19:15:53 +0800 From: Xiu Jianfeng To: , , , , , CC: , , , Subject: [PATCH -next v2 4/6] landlock/selftests: add selftests for chmod and chown Date: Sat, 27 Aug 2022 19:12:13 +0800 Message-ID: <20220827111215.131442-5-xiujianfeng@huawei.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20220827111215.131442-1-xiujianfeng@huawei.com> References: <20220827111215.131442-1-xiujianfeng@huawei.com> MIME-Version: 1.0 X-Originating-IP: [10.67.174.58] X-ClientProxiedBy: dggems705-chm.china.huawei.com (10.3.19.182) To dggpeml500023.china.huawei.com (7.185.36.114) X-CFilter-Loop: Reflected Precedence: bulk List-ID: The following APIs are tested with simple scenarios. 1. chmod/fchmod/fchmodat; 2. chmod/fchmod/lchown/fchownat; The key point is that set these access rights on a directory but only for its content, not the directory itself. this scenario is covered. Signed-off-by: Xiu Jianfeng --- tools/testing/selftests/landlock/fs_test.c | 261 +++++++++++++++++++++ 1 file changed, 261 insertions(+) diff --git a/tools/testing/selftests/landlock/fs_test.c b/tools/testing/selftests/landlock/fs_test.c index f513cd8d9d51..982cb824967c 100644 --- a/tools/testing/selftests/landlock/fs_test.c +++ b/tools/testing/selftests/landlock/fs_test.c @@ -3272,6 +3272,267 @@ TEST_F_FORK(layout1, truncate) EXPECT_EQ(0, test_creat(file_in_dir_w)); } +/* Invokes chmod(2) and returns its errno or 0. */ +static int test_chmod(const char *const path, mode_t mode) +{ + if (chmod(path, mode) < 0) + return errno; + return 0; +} + +/* Invokes fchmod(2) and returns its errno or 0. */ +static int test_fchmod(int fd, mode_t mode) +{ + if (fchmod(fd, mode) < 0) + return errno; + return 0; +} + +/* Invokes fchmodat(2) and returns its errno or 0. */ +static int test_fchmodat(int dirfd, const char *path, mode_t mode, int flags) +{ + if (fchmodat(dirfd, path, mode, flags) < 0) + return errno; + return 0; +} + +/* Invokes chown(2) and returns its errno or 0. */ +static int test_chown(const char *path, uid_t uid, gid_t gid) +{ + if (chown(path, uid, gid) < 0) + return errno; + return 0; +} + +/* Invokes fchown(2) and returns its errno or 0. */ +static int test_fchown(int fd, uid_t uid, gid_t gid) +{ + if (fchown(fd, uid, gid) < 0) + return errno; + return 0; +} + +/* Invokes lchown(2) and returns its errno or 0. */ +static int test_lchown(const char *path, uid_t uid, gid_t gid) +{ + if (lchown(path, uid, gid) < 0) + return errno; + return 0; +} + +/* Invokes fchownat(2) and returns its errno or 0. */ +static int test_fchownat(int dirfd, const char *path, + uid_t uid, gid_t gid, int flags) +{ + if (fchownat(dirfd, path, uid, gid, flags) < 0) + return errno; + return 0; +} + +TEST_F_FORK(layout1, unhandled_chmod) +{ + int ruleset_fd, file1_fd; + const char *file1 = file1_s1d1; + const char *file2 = file2_s1d1; + const char *dir1 = dir_s1d1; + const struct rule rules[] = { + { + .path = file1, + .access = LANDLOCK_ACCESS_FS_WRITE_FILE, + }, + { + .path = file2, + .access = LANDLOCK_ACCESS_FS_READ_FILE | + LANDLOCK_ACCESS_FS_WRITE_FILE, + }, + { + .path = dir1, + .access = ACCESS_RW, + }, + {}, + }; + + ruleset_fd = create_ruleset(_metadata, ACCESS_RW, rules); + ASSERT_LE(0, ruleset_fd); + file1_fd = open(file1, O_WRONLY | O_CLOEXEC); + ASSERT_LE(0, file1_fd); + + enforce_ruleset(_metadata, ruleset_fd); + ASSERT_EQ(0, close(ruleset_fd)); + + EXPECT_EQ(0, test_chmod(file1, 0400)); + EXPECT_EQ(0, test_fchmod(file1_fd, 0400)); + EXPECT_EQ(0, test_fchmodat(AT_FDCWD, file1, 0400, 0)); + EXPECT_EQ(0, test_chmod(file2, 0400)); + EXPECT_EQ(0, test_chmod(dir1, 0700)); + ASSERT_EQ(0, close(file1_fd)); +} + +TEST_F_FORK(layout1, chmod) +{ + int ruleset_fd, file1_fd; + const char *file1 = file1_s1d1; + const char *file2 = file2_s1d1; + const char *file3 = file1_s2d1; + const char *dir1 = dir_s1d1; + const char *dir2 = dir_s2d1; + const struct rule rules[] = { + { + .path = file1, + .access = LANDLOCK_ACCESS_FS_WRITE_FILE | + LANDLOCK_ACCESS_FS_CHMOD, + }, + { + .path = file2, + .access = LANDLOCK_ACCESS_FS_READ_FILE | + LANDLOCK_ACCESS_FS_WRITE_FILE, + }, + { + .path = dir1, + .access = ACCESS_RW, + }, + { + .path = dir2, + .access = ACCESS_RW | LANDLOCK_ACCESS_FS_CHMOD, + }, + {}, + }; + + ruleset_fd = create_ruleset(_metadata, ACCESS_RW | LANDLOCK_ACCESS_FS_CHMOD, rules); + ASSERT_LE(0, ruleset_fd); + file1_fd = open(file1, O_WRONLY | O_CLOEXEC); + ASSERT_LE(0, file1_fd); + + enforce_ruleset(_metadata, ruleset_fd); + ASSERT_EQ(0, close(ruleset_fd)); + + EXPECT_EQ(0, test_chmod(file1, 0400)); + EXPECT_EQ(0, test_fchmod(file1_fd, 0400)); + EXPECT_EQ(0, test_fchmodat(AT_FDCWD, file1, 0400, 0)); + EXPECT_EQ(EACCES, test_chmod(file2, 0400)); + EXPECT_EQ(EACCES, test_chmod(dir1, 0700)); + /* set CHMOD right on dir will only affect its context not dir itself*/ + EXPECT_EQ(0, test_chmod(file3, 0400)); + EXPECT_EQ(0, test_fchmodat(AT_FDCWD, file3, 0400, 0)); + EXPECT_EQ(EACCES, test_chmod(dir2, 0700)); + EXPECT_EQ(EACCES, test_fchmodat(AT_FDCWD, dir2, 0700, 0)); + ASSERT_EQ(0, close(file1_fd)); +} + +TEST_F_FORK(layout1, unhandled_chown) +{ + int ruleset_fd, file1_fd; + const char *file1 = file1_s1d1; + const char *file2 = file2_s1d1; + const char *dir1 = dir_s1d1; + const struct rule rules[] = { + { + .path = file1, + .access = LANDLOCK_ACCESS_FS_WRITE_FILE, + }, + { + .path = file2, + .access = LANDLOCK_ACCESS_FS_READ_FILE | + LANDLOCK_ACCESS_FS_WRITE_FILE, + }, + { + .path = dir1, + .access = ACCESS_RW, + }, + {}, + }; + struct stat st; + uid_t uid; + gid_t gid; + + ruleset_fd = create_ruleset(_metadata, ACCESS_RW, rules); + ASSERT_LE(0, ruleset_fd); + file1_fd = open(file1, O_WRONLY | O_CLOEXEC); + ASSERT_LE(0, file1_fd); + /* + * there is no CAP_CHOWN when the testcases framework setup, + * and we cannot assume the testcases are run as root, to make + * sure {f}chown syscall won't fail, get the original uid/gid and + * use them in test_{f}chown. + */ + ASSERT_EQ(0, stat(dir1, &st)); + uid = st.st_uid; + gid = st.st_gid; + + enforce_ruleset(_metadata, ruleset_fd); + ASSERT_EQ(0, close(ruleset_fd)); + + EXPECT_EQ(0, test_chown(file1, uid, gid)); + EXPECT_EQ(0, test_fchown(file1_fd, uid, gid)); + EXPECT_EQ(0, test_lchown(file1, uid, gid)); + EXPECT_EQ(0, test_fchownat(AT_FDCWD, file1, uid, gid, 0)); + EXPECT_EQ(0, test_chown(file2, uid, gid)); + EXPECT_EQ(0, test_chown(dir1, uid, gid)); + ASSERT_EQ(0, close(file1_fd)); +} + +TEST_F_FORK(layout1, chown) +{ + int ruleset_fd, file1_fd; + const char *file1 = file1_s1d1; + const char *file2 = file2_s1d1; + const char *file3 = file1_s2d1; + const char *dir1 = dir_s1d1; + const char *dir2 = dir_s2d1; + const struct rule rules[] = { + { + .path = file1, + .access = LANDLOCK_ACCESS_FS_WRITE_FILE | + LANDLOCK_ACCESS_FS_CHGRP, + }, + { + .path = file2, + .access = LANDLOCK_ACCESS_FS_READ_FILE | + LANDLOCK_ACCESS_FS_WRITE_FILE, + }, + { + .path = dir1, + .access = ACCESS_RW, + }, + { + .path = dir2, + .access = ACCESS_RW | LANDLOCK_ACCESS_FS_CHGRP, + }, + {}, + }; + struct stat st; + uid_t uid; + gid_t gid; + + ruleset_fd = create_ruleset(_metadata, ACCESS_RW | LANDLOCK_ACCESS_FS_CHGRP, rules); + ASSERT_LE(0, ruleset_fd); + file1_fd = open(file1, O_WRONLY | O_CLOEXEC); + ASSERT_LE(0, file1_fd); + /* + * there is no CAP_CHOWN when the testcases framework setup, + * and we cannot assume the testcases are run as root, to make + * sure {f}chown syscall won't fail, get the original uid/gid and + * use them in test_{f}chown. + */ + ASSERT_EQ(0, stat(dir1, &st)); + uid = st.st_uid; + gid = st.st_gid; + + enforce_ruleset(_metadata, ruleset_fd); + ASSERT_EQ(0, close(ruleset_fd)); + + EXPECT_EQ(0, test_chown(file1, uid, gid)); + EXPECT_EQ(0, test_fchown(file1_fd, uid, gid)); + EXPECT_EQ(0, test_lchown(file1, uid, gid)); + EXPECT_EQ(0, test_fchownat(AT_FDCWD, file1, uid, gid, 0)); + EXPECT_EQ(EACCES, test_chown(file2, uid, gid)); + EXPECT_EQ(EACCES, test_chown(dir1, uid, gid)); + /* set CHOWN right on dir will only affect its context not dir itself*/ + EXPECT_EQ(0, test_chown(file3, uid, gid)); + EXPECT_EQ(EACCES, test_chown(dir2, uid, gid)); + ASSERT_EQ(0, close(file1_fd)); +} + /* clang-format off */ FIXTURE(layout1_bind) {}; /* clang-format on */ From patchwork Sat Aug 27 11:12:14 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Xiu Jianfeng X-Patchwork-Id: 12956983 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7B198C0502F for ; Sat, 27 Aug 2022 11:16:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345265AbiH0LQF (ORCPT ); Sat, 27 Aug 2022 07:16:05 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47688 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245071AbiH0LQB (ORCPT ); Sat, 27 Aug 2022 07:16:01 -0400 Received: from szxga02-in.huawei.com (szxga02-in.huawei.com [45.249.212.188]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2391222BD5; Sat, 27 Aug 2022 04:15:56 -0700 (PDT) Received: from dggpeml500023.china.huawei.com (unknown [172.30.72.55]) by szxga02-in.huawei.com (SkyGuard) with ESMTP id 4MFDZC5GRdzlWWl; Sat, 27 Aug 2022 19:12:35 +0800 (CST) Received: from ubuntu1804.huawei.com (10.67.174.58) by dggpeml500023.china.huawei.com (7.185.36.114) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Sat, 27 Aug 2022 19:15:54 +0800 From: Xiu Jianfeng To: , , , , , CC: , , , Subject: [PATCH -next v2 5/6] landlock/samples: add chmod and chown support Date: Sat, 27 Aug 2022 19:12:14 +0800 Message-ID: <20220827111215.131442-6-xiujianfeng@huawei.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20220827111215.131442-1-xiujianfeng@huawei.com> References: <20220827111215.131442-1-xiujianfeng@huawei.com> MIME-Version: 1.0 X-Originating-IP: [10.67.174.58] X-ClientProxiedBy: dggems705-chm.china.huawei.com (10.3.19.182) To dggpeml500023.china.huawei.com (7.185.36.114) X-CFilter-Loop: Reflected Precedence: bulk List-ID: update landlock sample to support the new flags LANDLOCK_ACCESS_FS_{CHMOD, CHGRP} Signed-off-by: Xiu Jianfeng --- samples/landlock/sandboxer.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/samples/landlock/sandboxer.c b/samples/landlock/sandboxer.c index 771b6b10d519..639ec39ebd0a 100644 --- a/samples/landlock/sandboxer.c +++ b/samples/landlock/sandboxer.c @@ -77,7 +77,9 @@ static int parse_path(char *env_path, const char ***const path_list) LANDLOCK_ACCESS_FS_EXECUTE | \ LANDLOCK_ACCESS_FS_WRITE_FILE | \ LANDLOCK_ACCESS_FS_READ_FILE | \ - LANDLOCK_ACCESS_FS_TRUNCATE) + LANDLOCK_ACCESS_FS_TRUNCATE | \ + LANDLOCK_ACCESS_FS_CHMOD | \ + LANDLOCK_ACCESS_FS_CHGRP) /* clang-format on */ @@ -162,7 +164,9 @@ static int populate_ruleset(const char *const env_var, const int ruleset_fd, LANDLOCK_ACCESS_FS_MAKE_BLOCK | \ LANDLOCK_ACCESS_FS_MAKE_SYM | \ LANDLOCK_ACCESS_FS_REFER | \ - LANDLOCK_ACCESS_FS_TRUNCATE) + LANDLOCK_ACCESS_FS_TRUNCATE | \ + LANDLOCK_ACCESS_FS_CHMOD | \ + LANDLOCK_ACCESS_FS_CHGRP) /* clang-format on */ @@ -233,6 +237,11 @@ int main(const int argc, char *const argv[], char *const *const envp) case 2: /* Removes LANDLOCK_ACCESS_FS_TRUNCATE for ABI < 3 */ ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_TRUNCATE; + __attribute__((fallthrough)); + case 3: + /* Removes LANDLOCK_ACCESS_FS_{CHMOD, CHGRP} for ABI < 4 */ + ruleset_attr.handled_access_fs &= ~(LANDLOCK_ACCESS_FS_CHMOD | + LANDLOCK_ACCESS_FS_CHGRP); } access_fs_ro &= ruleset_attr.handled_access_fs; access_fs_rw &= ruleset_attr.handled_access_fs; From patchwork Sat Aug 27 11:12:15 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Xiu Jianfeng X-Patchwork-Id: 12956984 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A04E5C54EE9 for ; Sat, 27 Aug 2022 11:16:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345398AbiH0LQH (ORCPT ); Sat, 27 Aug 2022 07:16:07 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47766 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234486AbiH0LQD (ORCPT ); Sat, 27 Aug 2022 07:16:03 -0400 Received: from szxga08-in.huawei.com (szxga08-in.huawei.com [45.249.212.255]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3223E24945; Sat, 27 Aug 2022 04:15:56 -0700 (PDT) Received: from dggpeml500023.china.huawei.com (unknown [172.30.72.53]) by szxga08-in.huawei.com (SkyGuard) with ESMTP id 4MFDYx3ZmPz1N7JN; Sat, 27 Aug 2022 19:12:21 +0800 (CST) Received: from ubuntu1804.huawei.com (10.67.174.58) by dggpeml500023.china.huawei.com (7.185.36.114) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Sat, 27 Aug 2022 19:15:55 +0800 From: Xiu Jianfeng To: , , , , , CC: , , , Subject: [PATCH -next v2 6/6] landlock: update chmod and chown support in document Date: Sat, 27 Aug 2022 19:12:15 +0800 Message-ID: <20220827111215.131442-7-xiujianfeng@huawei.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20220827111215.131442-1-xiujianfeng@huawei.com> References: <20220827111215.131442-1-xiujianfeng@huawei.com> MIME-Version: 1.0 X-Originating-IP: [10.67.174.58] X-ClientProxiedBy: dggems705-chm.china.huawei.com (10.3.19.182) To dggpeml500023.china.huawei.com (7.185.36.114) X-CFilter-Loop: Reflected Precedence: bulk List-ID: update LANDLOCK_ACCESS_FS_{CHMOD, CHGRP} support and add abi change in the document. Signed-off-by: Xiu Jianfeng --- Documentation/userspace-api/landlock.rst | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/Documentation/userspace-api/landlock.rst b/Documentation/userspace-api/landlock.rst index 2509c2fbf98f..0e97a7998fa1 100644 --- a/Documentation/userspace-api/landlock.rst +++ b/Documentation/userspace-api/landlock.rst @@ -61,7 +61,9 @@ the need to be explicit about the denied-by-default access rights. LANDLOCK_ACCESS_FS_MAKE_BLOCK | LANDLOCK_ACCESS_FS_MAKE_SYM | LANDLOCK_ACCESS_FS_REFER | - LANDLOCK_ACCESS_FS_TRUNCATE, + LANDLOCK_ACCESS_FS_TRUNCATE | + LANDLOCK_ACCESS_FS_CHMOD | + LANDLOCK_ACCESS_FS_CHGRP }; Because we may not know on which kernel version an application will be @@ -90,6 +92,11 @@ the ABI. case 2: /* Removes LANDLOCK_ACCESS_FS_TRUNCATE for ABI < 3 */ ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_TRUNCATE; + __attribute__((fallthrough)); + case 3: + /* Removes LANDLOCK_ACCESS_FS_{CHMOD, CHGRP} for ABI < 4 */ + ruleset_attr.handled_access_fs &= ~(LANDLOCK_ACCESS_FS_CHMOD | + LANDLOCK_ACCESS_FS_CHGRP); } This enables to create an inclusive ruleset that will contain our rules.