lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <CA+FuTSf4EjgjBCCOiu-PHJcTMia41UkTh8QJ0+qdxL_J8445EA@mail.gmail.com> Date: Tue, 25 Jan 2022 09:17:10 -0500 From: Willem de Bruijn <willemdebruijn.kernel@...il.com> To: Konstantin Meskhidze <konstantin.meskhidze@...wei.com> Cc: mic@...ikod.net, linux-security-module@...r.kernel.org, netdev@...r.kernel.org, netfilter@...r.kernel.org, yusongping@...wei.com, artem.kuzin@...wei.com Subject: Re: [RFC PATCH 1/2] landlock: TCP network hooks implementation On Mon, Jan 24, 2022 at 3:02 AM Konstantin Meskhidze <konstantin.meskhidze@...wei.com> wrote: > > Support of socket_bind() and socket_connect() hooks. > Current prototype can restrict binding and connecting of TCP > types of sockets. Its just basic idea how Landlock could support > network confinement. > > Changes: > 1. Access masks array refactored into 1D one and changed > to 32 bits. Filesystem masks occupy 16 lower bits and network > masks reside in 16 upper bits. > 2. Refactor API functions in ruleset.c: > 1. Add void *object argument. > 2. Add u16 rule_type argument. > 3. Use two rb_trees in ruleset structure: > 1. root_inode - for filesystem objects > 2. root_net_port - for network port objects > > Signed-off-by: Konstantin Meskhidze <konstantin.meskhidze@...wei.com> > +static int hook_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen) > +{ > + short socket_type; > + struct sockaddr_in *sockaddr; > + u16 port; > + const struct landlock_ruleset *const dom = landlock_get_current_domain(); > + > + /* Check if the hook is AF_INET* socket's action */ > + if ((address->sa_family != AF_INET) && (address->sa_family != AF_INET6)) > + return 0; Should this be a check on the socket family (sock->ops->family) instead of the address family? It is valid to pass an address with AF_UNSPEC to a PF_INET(6) socket. And there are legitimate reasons to want to deny this. Such as passing a connection to a unprivileged process and disallow it from disconnect and opening a different new connection. > + > + socket_type = sock->type; > + /* Check if it's a TCP socket */ > + if (socket_type != SOCK_STREAM) > + return 0; > + > + if (!dom) > + return 0; > + > + /* Get port value in host byte order */ > + sockaddr = (struct sockaddr_in *)address; > + port = ntohs(sockaddr->sin_port); > + > + return check_socket_access(dom, port, LANDLOCK_ACCESS_NET_CONNECT_TCP); > +}
Powered by blists - more mailing lists