linux-kernel - Re: [PATCH v4 06/30] landlock: Simplify initially denied access rights

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250110.lie1eeCiefoo@digikod.net>
Date: Fri, 10 Jan 2025 12:24:03 +0100
From: Mickaël Salaün <mic@...ikod.net>
To: Eric Paris <eparis@...hat.com>, Paul Moore <paul@...l-moore.com>, 
	Günther Noack <gnoack@...gle.com>, "Serge E . Hallyn" <serge@...lyn.com>
Cc: Ben Scarlato <akhna@...gle.com>, 
	Casey Schaufler <casey@...aufler-ca.com>, Charles Zaffery <czaffery@...lox.com>, 
	Daniel Burgener <dburgener@...ux.microsoft.com>, Francis Laniel <flaniel@...ux.microsoft.com>, 
	James Morris <jmorris@...ei.org>, Jann Horn <jannh@...gle.com>, Jeff Xu <jeffxu@...gle.com>, 
	Jorge Lucangeli Obes <jorgelo@...gle.com>, Kees Cook <kees@...nel.org>, 
	Konstantin Meskhidze <konstantin.meskhidze@...wei.com>, Matt Bobrowski <mattbobrowski@...gle.com>, 
	Mikhail Ivanov <ivanov.mikhail1@...wei-partners.com>, Phil Sutter <phil@....cc>, 
	Praveen K Paladugu <prapal@...ux.microsoft.com>, Robert Salvet <robert.salvet@...lox.com>, 
	Shervin Oloumi <enlightened@...gle.com>, Song Liu <song@...nel.org>, 
	Tahera Fahimi <fahimitahera@...il.com>, Tyler Hicks <code@...icks.com>, audit@...r.kernel.org, 
	linux-kernel@...r.kernel.org, linux-security-module@...r.kernel.org
Subject: Re: [PATCH v4 06/30] landlock: Simplify initially denied access
 rights

On Wed, Jan 08, 2025 at 04:43:14PM +0100, Mickaël Salaün wrote:
> Upgrade domain's handled access masks when creating a domain from a
> ruleset, instead of converting them at runtime.  This is more consistent
> and helps with audit support.
> 
> Cc: Günther Noack <gnoack@...gle.com>
> Signed-off-by: Mickaël Salaün <mic@...ikod.net>
> Link: https://lore.kernel.org/r/20250108154338.1129069-7-mic@digikod.net

Pushed in my next tree to simplify next patch series.

> ---
> 
> Changes since v2:
> - New patch.
> ---
>  security/landlock/access.h  | 17 ++++++++++++++++-
>  security/landlock/fs.c      | 10 +---------
>  security/landlock/ruleset.c |  3 ++-
>  3 files changed, 19 insertions(+), 11 deletions(-)
> 
> diff --git a/security/landlock/access.h b/security/landlock/access.h
> index 9ee4b30a87e6..74fd8f399fbd 100644
> --- a/security/landlock/access.h
> +++ b/security/landlock/access.h
> @@ -20,7 +20,8 @@
>  /*
>   * All access rights that are denied by default whether they are handled or not
>   * by a ruleset/layer.  This must be ORed with all ruleset->access_masks[]
> - * entries when we need to get the absolute handled access masks.
> + * entries when we need to get the absolute handled access masks, see
> + * landlock_upgrade_handled_access_masks().
>   */
>  /* clang-format off */
>  #define _LANDLOCK_ACCESS_FS_INITIALLY_DENIED ( \
> @@ -59,4 +60,18 @@ typedef u16 layer_mask_t;
>  /* Makes sure all layers can be checked. */
>  static_assert(BITS_PER_TYPE(layer_mask_t) >= LANDLOCK_MAX_NUM_LAYERS);
>  
> +/* Upgrades with all initially denied by default access rights. */
> +static inline struct access_masks
> +landlock_upgrade_handled_access_masks(struct access_masks access_masks)
> +{
> +	/*
> +	 * All access rights that are denied by default whether they are
> +	 * explicitly handled or not.
> +	 */
> +	if (access_masks.fs)
> +		access_masks.fs |= _LANDLOCK_ACCESS_FS_INITIALLY_DENIED;
> +
> +	return access_masks;
> +}
> +
>  #endif /* _SECURITY_LANDLOCK_ACCESS_H */
> diff --git a/security/landlock/fs.c b/security/landlock/fs.c
> index 3da5f1945158..9779170d9199 100644
> --- a/security/landlock/fs.c
> +++ b/security/landlock/fs.c
> @@ -389,14 +389,6 @@ static bool is_nouser_or_private(const struct dentry *dentry)
>  		unlikely(IS_PRIVATE(d_backing_inode(dentry))));
>  }
>  
> -static access_mask_t
> -get_handled_fs_accesses(const struct landlock_ruleset *const domain)
> -{
> -	/* Handles all initially denied by default access rights. */
> -	return landlock_union_access_masks(domain).fs |
> -	       _LANDLOCK_ACCESS_FS_INITIALLY_DENIED;
> -}
> -
>  static const struct access_masks any_fs = {
>  	.fs = ~0,
>  };
> @@ -788,7 +780,7 @@ static bool is_access_to_paths_allowed(
>  		 * a superset of the meaningful requested accesses).
>  		 */
>  		access_masked_parent1 = access_masked_parent2 =
> -			get_handled_fs_accesses(domain);
> +			landlock_union_access_masks(domain).fs;
>  		is_dom_check = true;
>  	} else {
>  		if (WARN_ON_ONCE(dentry_child1 || dentry_child2))
> diff --git a/security/landlock/ruleset.c b/security/landlock/ruleset.c
> index cae69f2f01d9..dbc528f5f3b7 100644
> --- a/security/landlock/ruleset.c
> +++ b/security/landlock/ruleset.c
> @@ -385,7 +385,8 @@ static int merge_ruleset(struct landlock_ruleset *const dst,
>  		err = -EINVAL;
>  		goto out_unlock;
>  	}
> -	dst->access_masks[dst->num_layers - 1] = src->access_masks[0];
> +	dst->access_masks[dst->num_layers - 1] =
> +		landlock_upgrade_handled_access_masks(src->access_masks[0]);
>  
>  	/* Merges the @src inode tree. */
>  	err = merge_tree(dst, src, LANDLOCK_KEY_INODE);
> -- 
> 2.47.1
> 
>