1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * Landlock LSM - System call implementations and user space interfaces
4 *
5 * Copyright © 2016-2020 Mickaël Salaün <mic@digikod.net>
6 * Copyright © 2018-2020 ANSSI
7 */
8
9 #include <asm/current.h>
10 #include <linux/anon_inodes.h>
11 #include <linux/build_bug.h>
12 #include <linux/capability.h>
13 #include <linux/compiler_types.h>
14 #include <linux/dcache.h>
15 #include <linux/err.h>
16 #include <linux/errno.h>
17 #include <linux/fs.h>
18 #include <linux/limits.h>
19 #include <linux/mount.h>
20 #include <linux/path.h>
21 #include <linux/sched.h>
22 #include <linux/security.h>
23 #include <linux/stddef.h>
24 #include <linux/syscalls.h>
25 #include <linux/types.h>
26 #include <linux/uaccess.h>
27 #include <uapi/linux/landlock.h>
28
29 #include "cred.h"
30 #include "fs.h"
31 #include "limits.h"
32 #include "net.h"
33 #include "ruleset.h"
34 #include "setup.h"
35
is_initialized(void)36 static bool is_initialized(void)
37 {
38 if (likely(landlock_initialized))
39 return true;
40
41 pr_warn_once(
42 "Disabled but requested by user space. "
43 "You should enable Landlock at boot time: "
44 "https://docs.kernel.org/userspace-api/landlock.html#boot-time-configuration\n");
45 return false;
46 }
47
48 /**
49 * copy_min_struct_from_user - Safe future-proof argument copying
50 *
51 * Extend copy_struct_from_user() to check for consistent user buffer.
52 *
53 * @dst: Kernel space pointer or NULL.
54 * @ksize: Actual size of the data pointed to by @dst.
55 * @ksize_min: Minimal required size to be copied.
56 * @src: User space pointer or NULL.
57 * @usize: (Alleged) size of the data pointed to by @src.
58 */
59 static __always_inline int
copy_min_struct_from_user(void * const dst,const size_t ksize,const size_t ksize_min,const void __user * const src,const size_t usize)60 copy_min_struct_from_user(void *const dst, const size_t ksize,
61 const size_t ksize_min, const void __user *const src,
62 const size_t usize)
63 {
64 /* Checks buffer inconsistencies. */
65 BUILD_BUG_ON(!dst);
66 if (!src)
67 return -EFAULT;
68
69 /* Checks size ranges. */
70 BUILD_BUG_ON(ksize <= 0);
71 BUILD_BUG_ON(ksize < ksize_min);
72 if (usize < ksize_min)
73 return -EINVAL;
74 if (usize > PAGE_SIZE)
75 return -E2BIG;
76
77 /* Copies user buffer and fills with zeros. */
78 return copy_struct_from_user(dst, ksize, src, usize);
79 }
80
81 /*
82 * This function only contains arithmetic operations with constants, leading to
83 * BUILD_BUG_ON(). The related code is evaluated and checked at build time,
84 * but it is then ignored thanks to compiler optimizations.
85 */
build_check_abi(void)86 static void build_check_abi(void)
87 {
88 struct landlock_ruleset_attr ruleset_attr;
89 struct landlock_path_beneath_attr path_beneath_attr;
90 struct landlock_net_port_attr net_port_attr;
91 size_t ruleset_size, path_beneath_size, net_port_size;
92
93 /*
94 * For each user space ABI structures, first checks that there is no
95 * hole in them, then checks that all architectures have the same
96 * struct size.
97 */
98 ruleset_size = sizeof(ruleset_attr.handled_access_fs);
99 ruleset_size += sizeof(ruleset_attr.handled_access_net);
100 ruleset_size += sizeof(ruleset_attr.scoped);
101 BUILD_BUG_ON(sizeof(ruleset_attr) != ruleset_size);
102 BUILD_BUG_ON(sizeof(ruleset_attr) != 24);
103
104 path_beneath_size = sizeof(path_beneath_attr.allowed_access);
105 path_beneath_size += sizeof(path_beneath_attr.parent_fd);
106 BUILD_BUG_ON(sizeof(path_beneath_attr) != path_beneath_size);
107 BUILD_BUG_ON(sizeof(path_beneath_attr) != 12);
108
109 net_port_size = sizeof(net_port_attr.allowed_access);
110 net_port_size += sizeof(net_port_attr.port);
111 BUILD_BUG_ON(sizeof(net_port_attr) != net_port_size);
112 BUILD_BUG_ON(sizeof(net_port_attr) != 16);
113 }
114
115 /* Ruleset handling */
116
fop_ruleset_release(struct inode * const inode,struct file * const filp)117 static int fop_ruleset_release(struct inode *const inode,
118 struct file *const filp)
119 {
120 struct landlock_ruleset *ruleset = filp->private_data;
121
122 landlock_put_ruleset(ruleset);
123 return 0;
124 }
125
fop_dummy_read(struct file * const filp,char __user * const buf,const size_t size,loff_t * const ppos)126 static ssize_t fop_dummy_read(struct file *const filp, char __user *const buf,
127 const size_t size, loff_t *const ppos)
128 {
129 /* Dummy handler to enable FMODE_CAN_READ. */
130 return -EINVAL;
131 }
132
fop_dummy_write(struct file * const filp,const char __user * const buf,const size_t size,loff_t * const ppos)133 static ssize_t fop_dummy_write(struct file *const filp,
134 const char __user *const buf, const size_t size,
135 loff_t *const ppos)
136 {
137 /* Dummy handler to enable FMODE_CAN_WRITE. */
138 return -EINVAL;
139 }
140
141 /*
142 * A ruleset file descriptor enables to build a ruleset by adding (i.e.
143 * writing) rule after rule, without relying on the task's context. This
144 * reentrant design is also used in a read way to enforce the ruleset on the
145 * current task.
146 */
147 static const struct file_operations ruleset_fops = {
148 .release = fop_ruleset_release,
149 .read = fop_dummy_read,
150 .write = fop_dummy_write,
151 };
152
153 #define LANDLOCK_ABI_VERSION 6
154
155 /**
156 * sys_landlock_create_ruleset - Create a new ruleset
157 *
158 * @attr: Pointer to a &struct landlock_ruleset_attr identifying the scope of
159 * the new ruleset.
160 * @size: Size of the pointed &struct landlock_ruleset_attr (needed for
161 * backward and forward compatibility).
162 * @flags: Supported value:
163 * - %LANDLOCK_CREATE_RULESET_VERSION
164 * - %LANDLOCK_CREATE_RULESET_ERRATA
165 *
166 * This system call enables to create a new Landlock ruleset, and returns the
167 * related file descriptor on success.
168 *
169 * If @flags is %LANDLOCK_CREATE_RULESET_VERSION and @attr is NULL and @size is
170 * 0, then the returned value is the highest supported Landlock ABI version
171 * (starting at 1).
172 *
173 * If @flags is %LANDLOCK_CREATE_RULESET_ERRATA and @attr is NULL and @size is
174 * 0, then the returned value is a bitmask of fixed issues for the current
175 * Landlock ABI version.
176 *
177 * Possible returned errors are:
178 *
179 * - %EOPNOTSUPP: Landlock is supported by the kernel but disabled at boot time;
180 * - %EINVAL: unknown @flags, or unknown access, or unknown scope, or too small @size;
181 * - %E2BIG: @attr or @size inconsistencies;
182 * - %EFAULT: @attr or @size inconsistencies;
183 * - %ENOMSG: empty &landlock_ruleset_attr.handled_access_fs.
184 */
SYSCALL_DEFINE3(landlock_create_ruleset,const struct landlock_ruleset_attr __user * const,attr,const size_t,size,const __u32,flags)185 SYSCALL_DEFINE3(landlock_create_ruleset,
186 const struct landlock_ruleset_attr __user *const, attr,
187 const size_t, size, const __u32, flags)
188 {
189 struct landlock_ruleset_attr ruleset_attr;
190 struct landlock_ruleset *ruleset;
191 int err, ruleset_fd;
192
193 /* Build-time checks. */
194 build_check_abi();
195
196 if (!is_initialized())
197 return -EOPNOTSUPP;
198
199 if (flags) {
200 if (attr || size)
201 return -EINVAL;
202
203 if (flags == LANDLOCK_CREATE_RULESET_VERSION)
204 return landlock_abi_version;
205
206 if (flags == LANDLOCK_CREATE_RULESET_ERRATA)
207 return landlock_errata;
208
209 return -EINVAL;
210 }
211
212 /* Copies raw user space buffer. */
213 err = copy_min_struct_from_user(&ruleset_attr, sizeof(ruleset_attr),
214 offsetofend(typeof(ruleset_attr),
215 handled_access_fs),
216 attr, size);
217 if (err)
218 return err;
219
220 /* Checks content (and 32-bits cast). */
221 if ((ruleset_attr.handled_access_fs | LANDLOCK_MASK_ACCESS_FS) !=
222 LANDLOCK_MASK_ACCESS_FS)
223 return -EINVAL;
224
225 /* Checks network content (and 32-bits cast). */
226 if ((ruleset_attr.handled_access_net | LANDLOCK_MASK_ACCESS_NET) !=
227 LANDLOCK_MASK_ACCESS_NET)
228 return -EINVAL;
229
230 /* Checks IPC scoping content (and 32-bits cast). */
231 if ((ruleset_attr.scoped | LANDLOCK_MASK_SCOPE) != LANDLOCK_MASK_SCOPE)
232 return -EINVAL;
233
234 /* Checks arguments and transforms to kernel struct. */
235 ruleset = landlock_create_ruleset(ruleset_attr.handled_access_fs,
236 ruleset_attr.handled_access_net,
237 ruleset_attr.scoped);
238 if (IS_ERR(ruleset))
239 return PTR_ERR(ruleset);
240
241 /* Creates anonymous FD referring to the ruleset. */
242 ruleset_fd = anon_inode_getfd("[landlock-ruleset]", &ruleset_fops,
243 ruleset, O_RDWR | O_CLOEXEC);
244 if (ruleset_fd < 0)
245 landlock_put_ruleset(ruleset);
246 return ruleset_fd;
247 }
248
249 const int landlock_abi_version = LANDLOCK_ABI_VERSION;
250
251 /*
252 * Returns an owned ruleset from a FD. It is thus needed to call
253 * landlock_put_ruleset() on the return value.
254 */
get_ruleset_from_fd(const int fd,const fmode_t mode)255 static struct landlock_ruleset *get_ruleset_from_fd(const int fd,
256 const fmode_t mode)
257 {
258 struct fd ruleset_f;
259 struct landlock_ruleset *ruleset;
260
261 ruleset_f = fdget(fd);
262 if (!fd_file(ruleset_f))
263 return ERR_PTR(-EBADF);
264
265 /* Checks FD type and access right. */
266 if (fd_file(ruleset_f)->f_op != &ruleset_fops) {
267 ruleset = ERR_PTR(-EBADFD);
268 goto out_fdput;
269 }
270 if (!(fd_file(ruleset_f)->f_mode & mode)) {
271 ruleset = ERR_PTR(-EPERM);
272 goto out_fdput;
273 }
274 ruleset = fd_file(ruleset_f)->private_data;
275 if (WARN_ON_ONCE(ruleset->num_layers != 1)) {
276 ruleset = ERR_PTR(-EINVAL);
277 goto out_fdput;
278 }
279 landlock_get_ruleset(ruleset);
280
281 out_fdput:
282 fdput(ruleset_f);
283 return ruleset;
284 }
285
286 /* Path handling */
287
288 /*
289 * @path: Must call put_path(@path) after the call if it succeeded.
290 */
get_path_from_fd(const s32 fd,struct path * const path)291 static int get_path_from_fd(const s32 fd, struct path *const path)
292 {
293 struct fd f;
294 int err = 0;
295
296 BUILD_BUG_ON(!__same_type(
297 fd, ((struct landlock_path_beneath_attr *)NULL)->parent_fd));
298
299 /* Handles O_PATH. */
300 f = fdget_raw(fd);
301 if (!fd_file(f))
302 return -EBADF;
303 /*
304 * Forbids ruleset FDs, internal filesystems (e.g. nsfs), including
305 * pseudo filesystems that will never be mountable (e.g. sockfs,
306 * pipefs).
307 */
308 if ((fd_file(f)->f_op == &ruleset_fops) ||
309 (fd_file(f)->f_path.mnt->mnt_flags & MNT_INTERNAL) ||
310 (fd_file(f)->f_path.dentry->d_sb->s_flags & SB_NOUSER) ||
311 d_is_negative(fd_file(f)->f_path.dentry) ||
312 IS_PRIVATE(d_backing_inode(fd_file(f)->f_path.dentry))) {
313 err = -EBADFD;
314 goto out_fdput;
315 }
316 *path = fd_file(f)->f_path;
317 path_get(path);
318
319 out_fdput:
320 fdput(f);
321 return err;
322 }
323
add_rule_path_beneath(struct landlock_ruleset * const ruleset,const void __user * const rule_attr)324 static int add_rule_path_beneath(struct landlock_ruleset *const ruleset,
325 const void __user *const rule_attr)
326 {
327 struct landlock_path_beneath_attr path_beneath_attr;
328 struct path path;
329 int res, err;
330 access_mask_t mask;
331
332 /* Copies raw user space buffer. */
333 res = copy_from_user(&path_beneath_attr, rule_attr,
334 sizeof(path_beneath_attr));
335 if (res)
336 return -EFAULT;
337
338 /*
339 * Informs about useless rule: empty allowed_access (i.e. deny rules)
340 * are ignored in path walks.
341 */
342 if (!path_beneath_attr.allowed_access)
343 return -ENOMSG;
344
345 /* Checks that allowed_access matches the @ruleset constraints. */
346 mask = ruleset->access_masks[0].fs;
347 if ((path_beneath_attr.allowed_access | mask) != mask)
348 return -EINVAL;
349
350 /* Gets and checks the new rule. */
351 err = get_path_from_fd(path_beneath_attr.parent_fd, &path);
352 if (err)
353 return err;
354
355 /* Imports the new rule. */
356 err = landlock_append_fs_rule(ruleset, &path,
357 path_beneath_attr.allowed_access);
358 path_put(&path);
359 return err;
360 }
361
add_rule_net_port(struct landlock_ruleset * ruleset,const void __user * const rule_attr)362 static int add_rule_net_port(struct landlock_ruleset *ruleset,
363 const void __user *const rule_attr)
364 {
365 struct landlock_net_port_attr net_port_attr;
366 int res;
367 access_mask_t mask;
368
369 /* Copies raw user space buffer. */
370 res = copy_from_user(&net_port_attr, rule_attr, sizeof(net_port_attr));
371 if (res)
372 return -EFAULT;
373
374 /*
375 * Informs about useless rule: empty allowed_access (i.e. deny rules)
376 * are ignored by network actions.
377 */
378 if (!net_port_attr.allowed_access)
379 return -ENOMSG;
380
381 /* Checks that allowed_access matches the @ruleset constraints. */
382 mask = landlock_get_net_access_mask(ruleset, 0);
383 if ((net_port_attr.allowed_access | mask) != mask)
384 return -EINVAL;
385
386 /* Denies inserting a rule with port greater than 65535. */
387 if (net_port_attr.port > U16_MAX)
388 return -EINVAL;
389
390 /* Imports the new rule. */
391 return landlock_append_net_rule(ruleset, net_port_attr.port,
392 net_port_attr.allowed_access);
393 }
394
395 /**
396 * sys_landlock_add_rule - Add a new rule to a ruleset
397 *
398 * @ruleset_fd: File descriptor tied to the ruleset that should be extended
399 * with the new rule.
400 * @rule_type: Identify the structure type pointed to by @rule_attr:
401 * %LANDLOCK_RULE_PATH_BENEATH or %LANDLOCK_RULE_NET_PORT.
402 * @rule_attr: Pointer to a rule (matching the @rule_type).
403 * @flags: Must be 0.
404 *
405 * This system call enables to define a new rule and add it to an existing
406 * ruleset.
407 *
408 * Possible returned errors are:
409 *
410 * - %EOPNOTSUPP: Landlock is supported by the kernel but disabled at boot time;
411 * - %EAFNOSUPPORT: @rule_type is %LANDLOCK_RULE_NET_PORT but TCP/IP is not
412 * supported by the running kernel;
413 * - %EINVAL: @flags is not 0;
414 * - %EINVAL: The rule accesses are inconsistent (i.e.
415 * &landlock_path_beneath_attr.allowed_access or
416 * &landlock_net_port_attr.allowed_access is not a subset of the ruleset
417 * handled accesses)
418 * - %EINVAL: &landlock_net_port_attr.port is greater than 65535;
419 * - %ENOMSG: Empty accesses (e.g. &landlock_path_beneath_attr.allowed_access is
420 * 0);
421 * - %EBADF: @ruleset_fd is not a file descriptor for the current thread, or a
422 * member of @rule_attr is not a file descriptor as expected;
423 * - %EBADFD: @ruleset_fd is not a ruleset file descriptor, or a member of
424 * @rule_attr is not the expected file descriptor type;
425 * - %EPERM: @ruleset_fd has no write access to the underlying ruleset;
426 * - %EFAULT: @rule_attr was not a valid address.
427 */
SYSCALL_DEFINE4(landlock_add_rule,const int,ruleset_fd,const enum landlock_rule_type,rule_type,const void __user * const,rule_attr,const __u32,flags)428 SYSCALL_DEFINE4(landlock_add_rule, const int, ruleset_fd,
429 const enum landlock_rule_type, rule_type,
430 const void __user *const, rule_attr, const __u32, flags)
431 {
432 struct landlock_ruleset *ruleset;
433 int err;
434
435 if (!is_initialized())
436 return -EOPNOTSUPP;
437
438 /* No flag for now. */
439 if (flags)
440 return -EINVAL;
441
442 /* Gets and checks the ruleset. */
443 ruleset = get_ruleset_from_fd(ruleset_fd, FMODE_CAN_WRITE);
444 if (IS_ERR(ruleset))
445 return PTR_ERR(ruleset);
446
447 switch (rule_type) {
448 case LANDLOCK_RULE_PATH_BENEATH:
449 err = add_rule_path_beneath(ruleset, rule_attr);
450 break;
451 case LANDLOCK_RULE_NET_PORT:
452 err = add_rule_net_port(ruleset, rule_attr);
453 break;
454 default:
455 err = -EINVAL;
456 break;
457 }
458 landlock_put_ruleset(ruleset);
459 return err;
460 }
461
462 /* Enforcement */
463
464 /**
465 * sys_landlock_restrict_self - Enforce a ruleset on the calling thread
466 *
467 * @ruleset_fd: File descriptor tied to the ruleset to merge with the target.
468 * @flags: Must be 0.
469 *
470 * This system call enables to enforce a Landlock ruleset on the current
471 * thread. Enforcing a ruleset requires that the task has %CAP_SYS_ADMIN in its
472 * namespace or is running with no_new_privs. This avoids scenarios where
473 * unprivileged tasks can affect the behavior of privileged children.
474 *
475 * Possible returned errors are:
476 *
477 * - %EOPNOTSUPP: Landlock is supported by the kernel but disabled at boot time;
478 * - %EINVAL: @flags is not 0.
479 * - %EBADF: @ruleset_fd is not a file descriptor for the current thread;
480 * - %EBADFD: @ruleset_fd is not a ruleset file descriptor;
481 * - %EPERM: @ruleset_fd has no read access to the underlying ruleset, or the
482 * current thread is not running with no_new_privs, or it doesn't have
483 * %CAP_SYS_ADMIN in its namespace.
484 * - %E2BIG: The maximum number of stacked rulesets is reached for the current
485 * thread.
486 */
SYSCALL_DEFINE2(landlock_restrict_self,const int,ruleset_fd,const __u32,flags)487 SYSCALL_DEFINE2(landlock_restrict_self, const int, ruleset_fd, const __u32,
488 flags)
489 {
490 struct landlock_ruleset *new_dom, *ruleset;
491 struct cred *new_cred;
492 struct landlock_cred_security *new_llcred;
493 int err;
494
495 if (!is_initialized())
496 return -EOPNOTSUPP;
497
498 /*
499 * Similar checks as for seccomp(2), except that an -EPERM may be
500 * returned.
501 */
502 if (!task_no_new_privs(current) &&
503 !ns_capable_noaudit(current_user_ns(), CAP_SYS_ADMIN))
504 return -EPERM;
505
506 /* No flag for now. */
507 if (flags)
508 return -EINVAL;
509
510 /* Gets and checks the ruleset. */
511 ruleset = get_ruleset_from_fd(ruleset_fd, FMODE_CAN_READ);
512 if (IS_ERR(ruleset))
513 return PTR_ERR(ruleset);
514
515 /* Prepares new credentials. */
516 new_cred = prepare_creds();
517 if (!new_cred) {
518 err = -ENOMEM;
519 goto out_put_ruleset;
520 }
521 new_llcred = landlock_cred(new_cred);
522
523 /*
524 * There is no possible race condition while copying and manipulating
525 * the current credentials because they are dedicated per thread.
526 */
527 new_dom = landlock_merge_ruleset(new_llcred->domain, ruleset);
528 if (IS_ERR(new_dom)) {
529 err = PTR_ERR(new_dom);
530 goto out_put_creds;
531 }
532
533 /* Replaces the old (prepared) domain. */
534 landlock_put_ruleset(new_llcred->domain);
535 new_llcred->domain = new_dom;
536
537 landlock_put_ruleset(ruleset);
538 return commit_creds(new_cred);
539
540 out_put_creds:
541 abort_creds(new_cred);
542
543 out_put_ruleset:
544 landlock_put_ruleset(ruleset);
545 return err;
546 }
547