lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-Id: <1f3f1992b2abeb8e5d7aa61b854e1b0721978b9a.1725657728.git.fahimitahera@gmail.com> Date: Fri, 6 Sep 2024 15:30:07 -0600 From: Tahera Fahimi <fahimitahera@...il.com> To: outreachy@...ts.linux.dev Cc: mic@...ikod.net, gnoack@...gle.com, paul@...l-moore.com, jmorris@...ei.org, serge@...lyn.com, linux-security-module@...r.kernel.org, linux-kernel@...r.kernel.org, bjorn3_gh@...tonmail.com, jannh@...gle.com, netdev@...r.kernel.org, Tahera Fahimi <fahimitahera@...il.com> Subject: [PATCH v4 5/6] sample/landlock: Support sample for signal scoping restriction A sandboxer can receive the character "s" as input from the environment variable LL_SCOPE to restrict itself from sending a signal to a process outside its scoped domain. Example ======= Create a sandboxed shell and pass the character "s" to LL_SCOPED: LL_FS_RO=/ LL_FS_RW=. LL_SCOPED="s" ./sandboxer /bin/bash Try to send a SIGTRAP to a process with process ID <PID> through: kill -SIGTRAP <PID> The sandboxed process should not be able to send the signal. Signed-off-by: Tahera Fahimi <fahimitahera@...il.com> --- v4: - Make it compatible with changes in abstract UNIX socket scoping sample v3: - Add a restrict approach on input of LL_SCOPED, so it only allows zero or one "s" to be the input. --- samples/landlock/sandboxer.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/samples/landlock/sandboxer.c b/samples/landlock/sandboxer.c index 18d072c23a23..618fbf70d38f 100644 --- a/samples/landlock/sandboxer.c +++ b/samples/landlock/sandboxer.c @@ -191,11 +191,13 @@ static bool check_ruleset_scope(const char *const env_var, struct landlock_ruleset_attr *ruleset_attr) { bool abstract_scoping = false; + bool signal_scoping = false; bool ret = true; char *env_type_scope, *env_type_scope_next, *ipc_scoping_name; /* scoping is not supported by Landlock ABI */ - if (!(ruleset_attr->scoped & LANDLOCK_SCOPED_ABSTRACT_UNIX_SOCKET)) + if (!(ruleset_attr->scoped & + (LANDLOCK_SCOPED_ABSTRACT_UNIX_SOCKET | LANDLOCK_SCOPED_SIGNAL))) return ret; env_type_scope = getenv(env_var); @@ -212,6 +214,9 @@ static bool check_ruleset_scope(const char *const env_var, strsep(&env_type_scope_next, ENV_DELIMITER))) { if (strcmp("a", ipc_scoping_name) == 0 && !abstract_scoping) { abstract_scoping = true; + } else if (strcmp("s", ipc_scoping_name) == 0 && + !signal_scoping) { + signal_scoping = true; } else { fprintf(stderr, "Unsupported scoping \"%s\"\n", ipc_scoping_name); @@ -221,6 +226,8 @@ static bool check_ruleset_scope(const char *const env_var, } if (!abstract_scoping) ruleset_attr->scoped &= ~LANDLOCK_SCOPED_ABSTRACT_UNIX_SOCKET; + if (!signal_scoping) + ruleset_attr->scoped &= ~LANDLOCK_SCOPED_SIGNAL; out_free_name: free(env_type_scope); return ret; @@ -265,7 +272,8 @@ int main(const int argc, char *const argv[], char *const *const envp) .handled_access_fs = access_fs_rw, .handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP | LANDLOCK_ACCESS_NET_CONNECT_TCP, - .scoped = LANDLOCK_SCOPED_ABSTRACT_UNIX_SOCKET, + .scoped = LANDLOCK_SCOPED_ABSTRACT_UNIX_SOCKET | + LANDLOCK_SCOPED_SIGNAL, }; if (argc < 2) { @@ -302,7 +310,7 @@ int main(const int argc, char *const argv[], char *const *const envp) "%s=\"/dev/null:/dev/full:/dev/zero:/dev/pts:/tmp\" " "%s=\"9418\" " "%s=\"80:443\" " - "%s=\"a\" " + "%s=\"a:s\" " "%s bash -i\n\n", ENV_FS_RO_NAME, ENV_FS_RW_NAME, ENV_TCP_BIND_NAME, ENV_TCP_CONNECT_NAME, ENV_SCOPED_NAME, argv[0]); @@ -376,7 +384,8 @@ int main(const int argc, char *const argv[], char *const *const envp) __attribute__((fallthrough)); case 5: /* Removes LANDLOCK_SCOPED_ABSTRACT_UNIX_SOCKET for ABI < 6 */ - ruleset_attr.scoped &= ~LANDLOCK_SCOPED_ABSTRACT_UNIX_SOCKET; + ruleset_attr.scoped &= ~(LANDLOCK_SCOPED_ABSTRACT_UNIX_SOCKET | + LANDLOCK_SCOPED_SIGNAL); fprintf(stderr, "Hint: You should update the running kernel " "to leverage Landlock features " -- 2.34.1
Powered by blists - more mailing lists