| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20241113.oThieDiehaa8@digikod.net>
Date: Wed, 13 Nov 2024 16:21:47 +0100
From: Mickaël Salaün <mic@...ikod.net>
To: Francis Laniel <flaniel@...ux.microsoft.com>
Cc: Eric Paris <eparis@...hat.com>, Paul Moore <paul@...l-moore.com>,
Günther Noack <gnoack@...gle.com>, "Serge E . Hallyn" <serge@...lyn.com>,
Ben Scarlato <akhna@...gle.com>, Casey Schaufler <casey@...aufler-ca.com>,
Charles Zaffery <czaffery@...lox.com>, James Morris <jmorris@...ei.org>, Jann Horn <jannh@...gle.com>,
Jeff Xu <jeffxu@...gle.com>, Jorge Lucangeli Obes <jorgelo@...gle.com>,
Kees Cook <kees@...nel.org>, Konstantin Meskhidze <konstantin.meskhidze@...wei.com>,
Matt Bobrowski <mattbobrowski@...gle.com>, Mikhail Ivanov <ivanov.mikhail1@...wei-partners.com>,
Praveen K Paladugu <prapal@...ux.microsoft.com>, Robert Salvet <robert.salvet@...lox.com>,
Shervin Oloumi <enlightened@...gle.com>, Song Liu <song@...nel.org>,
Tahera Fahimi <fahimitahera@...il.com>, audit@...r.kernel.org, linux-kernel@...r.kernel.org,
linux-security-module@...r.kernel.org
Subject: Re: [RFC PATCH v2 12/14] landlock: Log TCP bind and connect denials
On Fri, Oct 25, 2024 at 05:25:45PM +0200, Francis Laniel wrote:
> Le mardi 22 octobre 2024, 18:10:07 CEST Mickaël Salaün a écrit :
> > Add audit support to socket_bind and socket_connect hooks.
> >
> > Audit record sample:
> >
> > DENY: domain=4533720601 blockers=net_connect_tcp daddr=127.0.0.1
> > dest=80 SYSCALL: arch=c000003e syscall=42 success=no exit=-13 ...
> >
> > Cc: Günther Noack <gnoack@...gle.com>
> > Cc: Konstantin Meskhidze <konstantin.meskhidze@...wei.com>
> > Cc: Mikhail Ivanov <ivanov.mikhail1@...wei-partners.com>
> > Signed-off-by: Mickaël Salaün <mic@...ikod.net>
> > Link: https://lore.kernel.org/r/20241022161009.982584-13-mic@digikod.net
> > ---
> > security/landlock/audit.c | 11 +++++++++
> > security/landlock/audit.h | 1 +
> > security/landlock/net.c | 52 ++++++++++++++++++++++++++++++++++++---
> > 3 files changed, 60 insertions(+), 4 deletions(-)
> >
> > diff --git a/security/landlock/audit.c b/security/landlock/audit.c
> > index 898c95ebe847..c31a4a8719ee 100644
> > --- a/security/landlock/audit.c
> > +++ b/security/landlock/audit.c
> > @@ -41,6 +41,12 @@ static const char *const fs_access_strings[] = {
> > };
> > static_assert(ARRAY_SIZE(fs_access_strings) == LANDLOCK_NUM_ACCESS_FS);
> >
> > +static const char *const net_access_strings[] = {
> > + [BIT_INDEX(LANDLOCK_ACCESS_NET_BIND_TCP)] = "net_bind_tcp",
> > + [BIT_INDEX(LANDLOCK_ACCESS_NET_CONNECT_TCP)] = "net_connect_tcp",
> > +};
> > +static_assert(ARRAY_SIZE(net_access_strings) == LANDLOCK_NUM_ACCESS_NET);
> > +
> > static __attribute_const__ const char *
> > get_blocker(const enum landlock_request_type type,
> > const unsigned long access_bit)
> > @@ -58,6 +64,11 @@ get_blocker(const enum landlock_request_type type,
> > if (WARN_ON_ONCE(access_bit >= ARRAY_SIZE(fs_access_strings)))
> > return "unknown";
> > return fs_access_strings[access_bit];
> > +
> > + case LANDLOCK_REQUEST_NET_ACCESS:
> > + if (WARN_ON_ONCE(access_bit >= ARRAY_SIZE(net_access_strings)))
> > + return "unknown";
> > + return net_access_strings[access_bit];
> > }
> >
> > WARN_ON_ONCE(1);
> > diff --git a/security/landlock/audit.h b/security/landlock/audit.h
> > index 320394fd6b84..1075b0c8401f 100644
> > --- a/security/landlock/audit.h
> > +++ b/security/landlock/audit.h
> > @@ -18,6 +18,7 @@ enum landlock_request_type {
> > LANDLOCK_REQUEST_PTRACE = 1,
> > LANDLOCK_REQUEST_FS_CHANGE_LAYOUT,
> > LANDLOCK_REQUEST_FS_ACCESS,
> > + LANDLOCK_REQUEST_NET_ACCESS,
> > };
> >
> > /*
> > diff --git a/security/landlock/net.c b/security/landlock/net.c
> > index 27872d0f7e11..c21afd6e0b4d 100644
> > --- a/security/landlock/net.c
> > +++ b/security/landlock/net.c
> > @@ -7,10 +7,12 @@
> > */
> >
> > #include <linux/in.h>
> > +#include <linux/lsm_audit.h>
> > #include <linux/net.h>
> > #include <linux/socket.h>
> > #include <net/ipv6.h>
> >
> > +#include "audit.h"
> > #include "common.h"
> > #include "cred.h"
> > #include "limits.h"
> > @@ -56,6 +58,10 @@ static int current_check_access_socket(struct socket
> > *const sock, };
> > const struct landlock_ruleset *const dom =
> > landlock_match_ruleset(landlock_get_current_domain(), any_net);
> > + struct lsm_network_audit audit_net = {};
> > + struct landlock_request request = {
> > + .type = LANDLOCK_REQUEST_NET_ACCESS,
> > + };
> >
> > if (!dom)
> > return 0;
> > @@ -72,18 +78,49 @@ static int current_check_access_socket(struct socket
> > *const sock,
> >
> > switch (address->sa_family) {
> > case AF_UNSPEC:
> > - case AF_INET:
> > + case AF_INET: {
> > + const struct sockaddr_in *addr4;
> > +
> > if (addrlen < sizeof(struct sockaddr_in))
> > return -EINVAL;
> > - port = ((struct sockaddr_in *)address)->sin_port;
> > +
> > + addr4 = (struct sockaddr_in *)address;
> > + port = addr4->sin_port;
> > +
> > + if (access_request == LANDLOCK_ACCESS_NET_CONNECT_TCP) {
> > + audit_net.dport = port;
> > + audit_net.v4info.daddr = addr4->sin_addr.s_addr;
> > + } else if (access_request == LANDLOCK_ACCESS_NET_BIND_TCP) {
> > + audit_net.sport = port;
> > + audit_net.v4info.saddr = addr4->sin_addr.s_addr;
> > + } else {
> > + WARN_ON_ONCE(1);
> > + }
> > break;
> > + }
> >
> > #if IS_ENABLED(CONFIG_IPV6)
> > - case AF_INET6:
> > + case AF_INET6: {
> > + const struct sockaddr_in6 *addr6;
> > +
> > if (addrlen < SIN6_LEN_RFC2133)
> > return -EINVAL;
> > - port = ((struct sockaddr_in6 *)address)->sin6_port;
> > +
> > + addr6 = (struct sockaddr_in6 *)address;
> > + port = addr6->sin6_port;
> > + audit_net.v6info.saddr = addr6->sin6_addr;
>
> You set this for all access_request, but not for IPv4, is this done on
> purpose?
Indeed, this is a bug, I'll remove this line. Thanks!
>
> > +
> > + if (access_request == LANDLOCK_ACCESS_NET_CONNECT_TCP) {
> > + audit_net.dport = port;
> > + audit_net.v6info.daddr = addr6->sin6_addr;
> > + } else if (access_request == LANDLOCK_ACCESS_NET_BIND_TCP) {
> > + audit_net.sport = port;
> > + audit_net.v6info.saddr = addr6->sin6_addr;
> > + } else {
> > + WARN_ON_ONCE(1);
> > + }
> > break;
> > + }
> > #endif /* IS_ENABLED(CONFIG_IPV6) */
> >
> > default:
Powered by blists - more mailing lists