netdev - Re: [RFC PATCH 0/2] landlock network implementation cover letter

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <51967ba5-519a-8af2-76ce-eafa8c1dea33@huawei.com>
Date:   Mon, 7 Feb 2022 16:18:47 +0300
From:   Konstantin Meskhidze <konstantin.meskhidze@...wei.com>
To:     Mickaël Salaün <mic@...ikod.net>
CC:     <linux-security-module@...r.kernel.org>, <netdev@...r.kernel.org>,
        <netfilter@...r.kernel.org>, <yusongping@...wei.com>,
        <artem.kuzin@...wei.com>
Subject: Re: [RFC PATCH 0/2] landlock network implementation cover letter



2/1/2022 8:53 PM, Mickaël Salaün пишет:
> 
> On 24/01/2022 09:02, Konstantin Meskhidze wrote:
>> Hi, all!
>>
>> This is a new bunch of RFC patches related to Landlock LSM network 
>> confinement.
>> Here are previous discussions:
>> 1. 
>> https://lore.kernel.org/linux-security-module/20211210072123.386713-1-konstantin.meskhidze@huawei.com/ 
>>
>> 2. 
>> https://lore.kernel.org/linux-security-module/20211228115212.703084-1-konstantin.meskhidze@huawei.com/ 
>>
>>
>> As in previous RFCs, 2 hooks are supported:
>>    - hook_socket_bind()
>>    - hook_socket_connect()
>>
>> Selftest are provided in tools/testing/selftests/landlock/network_test.c;
>> Implementation was tested in QEMU invironment with 5.13 kernel version:
> 
> Again, you need to base your work on the latest kernel version.
> 
   Is it because there are new Landlock features in a latest kernel
   version?
   I thought 5.13 kernel version and the latest one have the same
   Landlock functionality and there will not be rebasing problems in
   future. But anyway I will base the work on the latest kernel.
   Which kernel version do you work on now?

> 
>>   1. base_test - passed all tests
>>   2. fs_test - passed 44/46 tests. 2 tests related to overlayfs failed.
>>      Probably, I have wrong config options for overlayfs.
> 
> The minimal required configuration is listed in the "config" file. You 
> need to update it for the network tests as well. You missed the 
> ptrace_test. To test everything you can run:
> fakeroot make -C tools/testing/selftests TARGETS=landlock gen_tar
> and then extract 
> tools/testing/selftests/kselftest_install/kselftest-packages/kselftest.tar.gz 
> and execute run_kselftest.sh on your VM.

   Thank you. I missed config file in landlock selftests.
   I will launch all landlock tests.
> 
> 
>>   3. network_test - passed all tests.
>>      Please give your suggestions about test cover in network_test.c
>>
>> Implementation related issues
>> =============================
> 
> It is more a changelog than issues. ;)

   Ok. Thanks. I will add a changelog into the next patches.
> 
> 
>>
>> 1. Access masks array refactored into 1D one and changed
>> to 32 bits. Filesystem masks occupy 16 lower bits and network
>> masks reside in 16 upper bits.
>>
>>        struct landlock_ruleset {
>>              ...
>>              ...
>>              u32 access_masks[];
>>        }
>>
>> 2. Refactor API functions in ruleset.c:
>>      1. Add (void *)object argument.
>>      2. Add u16 rule_type argument.
>>
>>    - In filesystem case the "object" is defined by underlying inode.
>>    In network case the "object" is defined by a port. There is
>>    a union containing either a struct landlock_object pointer or a
>>    raw data (here a u16 port):
>>      union {
>>          struct landlock_object *ptr;
>>          uintptr_t data;
>>      } object;
>>
>>    - Everytime when a rule is inserted it's needed to provide a rule 
>> type:
>>
>>      landlock_insert_rule(ruleset, (void *)object, access, rule_type)
>>        1. A rule_type could be or LANDLOCK_RULE_NET_SERVICE or
>>        LANDLOCK_RULE_PATH_BENEATH;
>>        2. (void *) object - is either landlock_object *ptr or port value;
>>
>> 3. Use two rb_trees in ruleset structure:
>>      1. root_inode - for filesystem objects (inodes).
>>      2. root_net_port - for network port objects.
> 
> Thanks for these explanations!

   Thanks for the review!!!
> 
> 
>>
>> Konstantin Meskhidze (2):
>>    landlock: TCP network hooks implementation
>>    landlock: selftests for bind and connect hooks
>>
>>   include/uapi/linux/landlock.h                 |  52 +++
>>   security/landlock/Makefile                    |   2 +-
>>   security/landlock/fs.c                        |  12 +-
>>   security/landlock/limits.h                    |   6 +
>>   security/landlock/net.c                       | 175 +++++++++
>>   security/landlock/net.h                       |  21 ++
>>   security/landlock/ruleset.c                   | 167 ++++++---
>>   security/landlock/ruleset.h                   |  40 +-
>>   security/landlock/setup.c                     |   3 +
>>   security/landlock/syscalls.c                  | 142 ++++---
>>   .../testing/selftests/landlock/network_test.c | 346 ++++++++++++++++++
>>   11 files changed, 860 insertions(+), 106 deletions(-)
>>   create mode 100644 security/landlock/net.c
>>   create mode 100644 security/landlock/net.h
>>   create mode 100644 tools/testing/selftests/landlock/network_test.c
>>
>> -- 
>> 2.25.1
>>
> .