1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * Landlock LSM - System call implementations and user space interfaces
4 *
5 * Copyright © 2016-2020 Mickaël Salaün <mic@digikod.net>
6 * Copyright © 2018-2020 ANSSI
7 */
8
9#include <asm/current.h>
10#include <linux/anon_inodes.h>
11#include <linux/build_bug.h>
12#include <linux/capability.h>
13#include <linux/compiler_types.h>
14#include <linux/dcache.h>
15#include <linux/err.h>
16#include <linux/errno.h>
17#include <linux/fs.h>
18#include <linux/limits.h>
19#include <linux/mount.h>
20#include <linux/path.h>
21#include <linux/sched.h>
22#include <linux/security.h>
23#include <linux/stddef.h>
24#include <linux/syscalls.h>
25#include <linux/types.h>
26#include <linux/uaccess.h>
27#include <uapi/linux/landlock.h>
28
29#include "cred.h"
30#include "fs.h"
31#include "limits.h"
32#include "net.h"
33#include "ruleset.h"
34#include "setup.h"
35
36static bool is_initialized(void)
37{
38 if (likely(landlock_initialized))
39 return true;
40
41 pr_warn_once(
42 "Disabled but requested by user space. "
43 "You should enable Landlock at boot time: "
44 "https://docs.kernel.org/userspace-api/landlock.html#boot-time-configuration\n");
45 return false;
46}
47
48/**
49 * copy_min_struct_from_user - Safe future-proof argument copying
50 *
51 * Extend copy_struct_from_user() to check for consistent user buffer.
52 *
53 * @dst: Kernel space pointer or NULL.
54 * @ksize: Actual size of the data pointed to by @dst.
55 * @ksize_min: Minimal required size to be copied.
56 * @src: User space pointer or NULL.
57 * @usize: (Alleged) size of the data pointed to by @src.
58 */
59static __always_inline int
60copy_min_struct_from_user(void *const dst, const size_t ksize,
61 const size_t ksize_min, const void __user *const src,
62 const size_t usize)
63{
64 /* Checks buffer inconsistencies. */
65 BUILD_BUG_ON(!dst);
66 if (!src)
67 return -EFAULT;
68
69 /* Checks size ranges. */
70 BUILD_BUG_ON(ksize <= 0);
71 BUILD_BUG_ON(ksize < ksize_min);
72 if (usize < ksize_min)
73 return -EINVAL;
74 if (usize > PAGE_SIZE)
75 return -E2BIG;
76
77 /* Copies user buffer and fills with zeros. */
78 return copy_struct_from_user(dst, ksize, src, usize);
79}
80
81/*
82 * This function only contains arithmetic operations with constants, leading to
83 * BUILD_BUG_ON(). The related code is evaluated and checked at build time,
84 * but it is then ignored thanks to compiler optimizations.
85 */
86static void build_check_abi(void)
87{
88 struct landlock_ruleset_attr ruleset_attr;
89 struct landlock_path_beneath_attr path_beneath_attr;
90 struct landlock_net_port_attr net_port_attr;
91 size_t ruleset_size, path_beneath_size, net_port_size;
92
93 /*
94 * For each user space ABI structures, first checks that there is no
95 * hole in them, then checks that all architectures have the same
96 * struct size.
97 */
98 ruleset_size = sizeof(ruleset_attr.handled_access_fs);
99 ruleset_size += sizeof(ruleset_attr.handled_access_net);
100 BUILD_BUG_ON(sizeof(ruleset_attr) != ruleset_size);
101 BUILD_BUG_ON(sizeof(ruleset_attr) != 16);
102
103 path_beneath_size = sizeof(path_beneath_attr.allowed_access);
104 path_beneath_size += sizeof(path_beneath_attr.parent_fd);
105 BUILD_BUG_ON(sizeof(path_beneath_attr) != path_beneath_size);
106 BUILD_BUG_ON(sizeof(path_beneath_attr) != 12);
107
108 net_port_size = sizeof(net_port_attr.allowed_access);
109 net_port_size += sizeof(net_port_attr.port);
110 BUILD_BUG_ON(sizeof(net_port_attr) != net_port_size);
111 BUILD_BUG_ON(sizeof(net_port_attr) != 16);
112}
113
114/* Ruleset handling */
115
116static int fop_ruleset_release(struct inode *const inode,
117 struct file *const filp)
118{
119 struct landlock_ruleset *ruleset = filp->private_data;
120
121 landlock_put_ruleset(ruleset);
122 return 0;
123}
124
125static ssize_t fop_dummy_read(struct file *const filp, char __user *const buf,
126 const size_t size, loff_t *const ppos)
127{
128 /* Dummy handler to enable FMODE_CAN_READ. */
129 return -EINVAL;
130}
131
132static ssize_t fop_dummy_write(struct file *const filp,
133 const char __user *const buf, const size_t size,
134 loff_t *const ppos)
135{
136 /* Dummy handler to enable FMODE_CAN_WRITE. */
137 return -EINVAL;
138}
139
140/*
141 * A ruleset file descriptor enables to build a ruleset by adding (i.e.
142 * writing) rule after rule, without relying on the task's context. This
143 * reentrant design is also used in a read way to enforce the ruleset on the
144 * current task.
145 */
146static const struct file_operations ruleset_fops = {
147 .release = fop_ruleset_release,
148 .read = fop_dummy_read,
149 .write = fop_dummy_write,
150};
151
152#define LANDLOCK_ABI_VERSION 4
153
154/**
155 * sys_landlock_create_ruleset - Create a new ruleset
156 *
157 * @attr: Pointer to a &struct landlock_ruleset_attr identifying the scope of
158 * the new ruleset.
159 * @size: Size of the pointed &struct landlock_ruleset_attr (needed for
160 * backward and forward compatibility).
161 * @flags: Supported value: %LANDLOCK_CREATE_RULESET_VERSION.
162 *
163 * This system call enables to create a new Landlock ruleset, and returns the
164 * related file descriptor on success.
165 *
166 * If @flags is %LANDLOCK_CREATE_RULESET_VERSION and @attr is NULL and @size is
167 * 0, then the returned value is the highest supported Landlock ABI version
168 * (starting at 1).
169 *
170 * Possible returned errors are:
171 *
172 * - %EOPNOTSUPP: Landlock is supported by the kernel but disabled at boot time;
173 * - %EINVAL: unknown @flags, or unknown access, or too small @size;
174 * - %E2BIG or %EFAULT: @attr or @size inconsistencies;
175 * - %ENOMSG: empty &landlock_ruleset_attr.handled_access_fs.
176 */
177SYSCALL_DEFINE3(landlock_create_ruleset,
178 const struct landlock_ruleset_attr __user *const, attr,
179 const size_t, size, const __u32, flags)
180{
181 struct landlock_ruleset_attr ruleset_attr;
182 struct landlock_ruleset *ruleset;
183 int err, ruleset_fd;
184
185 /* Build-time checks. */
186 build_check_abi();
187
188 if (!is_initialized())
189 return -EOPNOTSUPP;
190
191 if (flags) {
192 if ((flags == LANDLOCK_CREATE_RULESET_VERSION) && !attr &&
193 !size)
194 return LANDLOCK_ABI_VERSION;
195 return -EINVAL;
196 }
197
198 /* Copies raw user space buffer. */
199 err = copy_min_struct_from_user(dst: &ruleset_attr, ksize: sizeof(ruleset_attr),
200 offsetofend(typeof(ruleset_attr),
201 handled_access_fs),
202 src: attr, usize: size);
203 if (err)
204 return err;
205
206 /* Checks content (and 32-bits cast). */
207 if ((ruleset_attr.handled_access_fs | LANDLOCK_MASK_ACCESS_FS) !=
208 LANDLOCK_MASK_ACCESS_FS)
209 return -EINVAL;
210
211 /* Checks network content (and 32-bits cast). */
212 if ((ruleset_attr.handled_access_net | LANDLOCK_MASK_ACCESS_NET) !=
213 LANDLOCK_MASK_ACCESS_NET)
214 return -EINVAL;
215
216 /* Checks arguments and transforms to kernel struct. */
217 ruleset = landlock_create_ruleset(access_mask_fs: ruleset_attr.handled_access_fs,
218 access_mask_net: ruleset_attr.handled_access_net);
219 if (IS_ERR(ptr: ruleset))
220 return PTR_ERR(ptr: ruleset);
221
222 /* Creates anonymous FD referring to the ruleset. */
223 ruleset_fd = anon_inode_getfd(name: "[landlock-ruleset]", fops: &ruleset_fops,
224 priv: ruleset, O_RDWR | O_CLOEXEC);
225 if (ruleset_fd < 0)
226 landlock_put_ruleset(ruleset);
227 return ruleset_fd;
228}
229
230/*
231 * Returns an owned ruleset from a FD. It is thus needed to call
232 * landlock_put_ruleset() on the return value.
233 */
234static struct landlock_ruleset *get_ruleset_from_fd(const int fd,
235 const fmode_t mode)
236{
237 struct fd ruleset_f;
238 struct landlock_ruleset *ruleset;
239
240 ruleset_f = fdget(fd);
241 if (!ruleset_f.file)
242 return ERR_PTR(error: -EBADF);
243
244 /* Checks FD type and access right. */
245 if (ruleset_f.file->f_op != &ruleset_fops) {
246 ruleset = ERR_PTR(error: -EBADFD);
247 goto out_fdput;
248 }
249 if (!(ruleset_f.file->f_mode & mode)) {
250 ruleset = ERR_PTR(error: -EPERM);
251 goto out_fdput;
252 }
253 ruleset = ruleset_f.file->private_data;
254 if (WARN_ON_ONCE(ruleset->num_layers != 1)) {
255 ruleset = ERR_PTR(error: -EINVAL);
256 goto out_fdput;
257 }
258 landlock_get_ruleset(ruleset);
259
260out_fdput:
261 fdput(fd: ruleset_f);
262 return ruleset;
263}
264
265/* Path handling */
266
267/*
268 * @path: Must call put_path(@path) after the call if it succeeded.
269 */
270static int get_path_from_fd(const s32 fd, struct path *const path)
271{
272 struct fd f;
273 int err = 0;
274
275 BUILD_BUG_ON(!__same_type(
276 fd, ((struct landlock_path_beneath_attr *)NULL)->parent_fd));
277
278 /* Handles O_PATH. */
279 f = fdget_raw(fd);
280 if (!f.file)
281 return -EBADF;
282 /*
283 * Forbids ruleset FDs, internal filesystems (e.g. nsfs), including
284 * pseudo filesystems that will never be mountable (e.g. sockfs,
285 * pipefs).
286 */
287 if ((f.file->f_op == &ruleset_fops) ||
288 (f.file->f_path.mnt->mnt_flags & MNT_INTERNAL) ||
289 (f.file->f_path.dentry->d_sb->s_flags & SB_NOUSER) ||
290 d_is_negative(dentry: f.file->f_path.dentry) ||
291 IS_PRIVATE(d_backing_inode(f.file->f_path.dentry))) {
292 err = -EBADFD;
293 goto out_fdput;
294 }
295 *path = f.file->f_path;
296 path_get(path);
297
298out_fdput:
299 fdput(fd: f);
300 return err;
301}
302
303static int add_rule_path_beneath(struct landlock_ruleset *const ruleset,
304 const void __user *const rule_attr)
305{
306 struct landlock_path_beneath_attr path_beneath_attr;
307 struct path path;
308 int res, err;
309 access_mask_t mask;
310
311 /* Copies raw user space buffer. */
312 res = copy_from_user(to: &path_beneath_attr, from: rule_attr,
313 n: sizeof(path_beneath_attr));
314 if (res)
315 return -EFAULT;
316
317 /*
318 * Informs about useless rule: empty allowed_access (i.e. deny rules)
319 * are ignored in path walks.
320 */
321 if (!path_beneath_attr.allowed_access)
322 return -ENOMSG;
323
324 /* Checks that allowed_access matches the @ruleset constraints. */
325 mask = landlock_get_raw_fs_access_mask(ruleset, layer_level: 0);
326 if ((path_beneath_attr.allowed_access | mask) != mask)
327 return -EINVAL;
328
329 /* Gets and checks the new rule. */
330 err = get_path_from_fd(fd: path_beneath_attr.parent_fd, path: &path);
331 if (err)
332 return err;
333
334 /* Imports the new rule. */
335 err = landlock_append_fs_rule(ruleset, path: &path,
336 access_hierarchy: path_beneath_attr.allowed_access);
337 path_put(&path);
338 return err;
339}
340
341static int add_rule_net_port(struct landlock_ruleset *ruleset,
342 const void __user *const rule_attr)
343{
344 struct landlock_net_port_attr net_port_attr;
345 int res;
346 access_mask_t mask;
347
348 /* Copies raw user space buffer. */
349 res = copy_from_user(to: &net_port_attr, from: rule_attr, n: sizeof(net_port_attr));
350 if (res)
351 return -EFAULT;
352
353 /*
354 * Informs about useless rule: empty allowed_access (i.e. deny rules)
355 * are ignored by network actions.
356 */
357 if (!net_port_attr.allowed_access)
358 return -ENOMSG;
359
360 /* Checks that allowed_access matches the @ruleset constraints. */
361 mask = landlock_get_net_access_mask(ruleset, layer_level: 0);
362 if ((net_port_attr.allowed_access | mask) != mask)
363 return -EINVAL;
364
365 /* Denies inserting a rule with port greater than 65535. */
366 if (net_port_attr.port > U16_MAX)
367 return -EINVAL;
368
369 /* Imports the new rule. */
370 return landlock_append_net_rule(ruleset, port: net_port_attr.port,
371 access_rights: net_port_attr.allowed_access);
372}
373
374/**
375 * sys_landlock_add_rule - Add a new rule to a ruleset
376 *
377 * @ruleset_fd: File descriptor tied to the ruleset that should be extended
378 * with the new rule.
379 * @rule_type: Identify the structure type pointed to by @rule_attr:
380 * %LANDLOCK_RULE_PATH_BENEATH or %LANDLOCK_RULE_NET_PORT.
381 * @rule_attr: Pointer to a rule (only of type &struct
382 * landlock_path_beneath_attr for now).
383 * @flags: Must be 0.
384 *
385 * This system call enables to define a new rule and add it to an existing
386 * ruleset.
387 *
388 * Possible returned errors are:
389 *
390 * - %EOPNOTSUPP: Landlock is supported by the kernel but disabled at boot time;
391 * - %EAFNOSUPPORT: @rule_type is %LANDLOCK_RULE_NET_PORT but TCP/IP is not
392 * supported by the running kernel;
393 * - %EINVAL: @flags is not 0, or inconsistent access in the rule (i.e.
394 * &landlock_path_beneath_attr.allowed_access or
395 * &landlock_net_port_attr.allowed_access is not a subset of the
396 * ruleset handled accesses), or &landlock_net_port_attr.port is
397 * greater than 65535;
398 * - %ENOMSG: Empty accesses (e.g. &landlock_path_beneath_attr.allowed_access);
399 * - %EBADF: @ruleset_fd is not a file descriptor for the current thread, or a
400 * member of @rule_attr is not a file descriptor as expected;
401 * - %EBADFD: @ruleset_fd is not a ruleset file descriptor, or a member of
402 * @rule_attr is not the expected file descriptor type;
403 * - %EPERM: @ruleset_fd has no write access to the underlying ruleset;
404 * - %EFAULT: @rule_attr inconsistency.
405 */
406SYSCALL_DEFINE4(landlock_add_rule, const int, ruleset_fd,
407 const enum landlock_rule_type, rule_type,
408 const void __user *const, rule_attr, const __u32, flags)
409{
410 struct landlock_ruleset *ruleset;
411 int err;
412
413 if (!is_initialized())
414 return -EOPNOTSUPP;
415
416 /* No flag for now. */
417 if (flags)
418 return -EINVAL;
419
420 /* Gets and checks the ruleset. */
421 ruleset = get_ruleset_from_fd(fd: ruleset_fd, FMODE_CAN_WRITE);
422 if (IS_ERR(ptr: ruleset))
423 return PTR_ERR(ptr: ruleset);
424
425 switch (rule_type) {
426 case LANDLOCK_RULE_PATH_BENEATH:
427 err = add_rule_path_beneath(ruleset, rule_attr);
428 break;
429 case LANDLOCK_RULE_NET_PORT:
430 err = add_rule_net_port(ruleset, rule_attr);
431 break;
432 default:
433 err = -EINVAL;
434 break;
435 }
436 landlock_put_ruleset(ruleset);
437 return err;
438}
439
440/* Enforcement */
441
442/**
443 * sys_landlock_restrict_self - Enforce a ruleset on the calling thread
444 *
445 * @ruleset_fd: File descriptor tied to the ruleset to merge with the target.
446 * @flags: Must be 0.
447 *
448 * This system call enables to enforce a Landlock ruleset on the current
449 * thread. Enforcing a ruleset requires that the task has %CAP_SYS_ADMIN in its
450 * namespace or is running with no_new_privs. This avoids scenarios where
451 * unprivileged tasks can affect the behavior of privileged children.
452 *
453 * Possible returned errors are:
454 *
455 * - %EOPNOTSUPP: Landlock is supported by the kernel but disabled at boot time;
456 * - %EINVAL: @flags is not 0.
457 * - %EBADF: @ruleset_fd is not a file descriptor for the current thread;
458 * - %EBADFD: @ruleset_fd is not a ruleset file descriptor;
459 * - %EPERM: @ruleset_fd has no read access to the underlying ruleset, or the
460 * current thread is not running with no_new_privs, or it doesn't have
461 * %CAP_SYS_ADMIN in its namespace.
462 * - %E2BIG: The maximum number of stacked rulesets is reached for the current
463 * thread.
464 */
465SYSCALL_DEFINE2(landlock_restrict_self, const int, ruleset_fd, const __u32,
466 flags)
467{
468 struct landlock_ruleset *new_dom, *ruleset;
469 struct cred *new_cred;
470 struct landlock_cred_security *new_llcred;
471 int err;
472
473 if (!is_initialized())
474 return -EOPNOTSUPP;
475
476 /*
477 * Similar checks as for seccomp(2), except that an -EPERM may be
478 * returned.
479 */
480 if (!task_no_new_privs(current) &&
481 !ns_capable_noaudit(current_user_ns(), CAP_SYS_ADMIN))
482 return -EPERM;
483
484 /* No flag for now. */
485 if (flags)
486 return -EINVAL;
487
488 /* Gets and checks the ruleset. */
489 ruleset = get_ruleset_from_fd(fd: ruleset_fd, FMODE_CAN_READ);
490 if (IS_ERR(ptr: ruleset))
491 return PTR_ERR(ptr: ruleset);
492
493 /* Prepares new credentials. */
494 new_cred = prepare_creds();
495 if (!new_cred) {
496 err = -ENOMEM;
497 goto out_put_ruleset;
498 }
499 new_llcred = landlock_cred(cred: new_cred);
500
501 /*
502 * There is no possible race condition while copying and manipulating
503 * the current credentials because they are dedicated per thread.
504 */
505 new_dom = landlock_merge_ruleset(parent: new_llcred->domain, ruleset);
506 if (IS_ERR(ptr: new_dom)) {
507 err = PTR_ERR(ptr: new_dom);
508 goto out_put_creds;
509 }
510
511 /* Replaces the old (prepared) domain. */
512 landlock_put_ruleset(ruleset: new_llcred->domain);
513 new_llcred->domain = new_dom;
514
515 landlock_put_ruleset(ruleset);
516 return commit_creds(new_cred);
517
518out_put_creds:
519 abort_creds(new_cred);
520
521out_put_ruleset:
522 landlock_put_ruleset(ruleset);
523 return err;
524}
525

source code of linux/security/landlock/syscalls.c