| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <638ae3c4-09cd-2eaf-858b-4909f2a9cdcc@digikod.net>
Date: Tue, 12 Apr 2022 13:12:48 +0200
From: Mickaël Salaün <mic@...ikod.net>
To: Konstantin Meskhidze <konstantin.meskhidze@...wei.com>
Cc: willemdebruijn.kernel@...il.com,
linux-security-module@...r.kernel.org, netdev@...r.kernel.org,
netfilter-devel@...r.kernel.org, yusongping@...wei.com,
artem.kuzin@...wei.com, anton.sirazetdinov@...wei.com
Subject: Re: [RFC PATCH v4 06/15] landlock: landlock_add_rule syscall
refactoring
On 09/03/2022 14:44, Konstantin Meskhidze wrote:
> Landlock_add_rule syscall was refactored to support new
> rule types in future Landlock versions. Add_rule_path_beneath()
> helper was added to support current filesystem rules. It is called
> by the switch case.
>
> Signed-off-by: Konstantin Meskhidze <konstantin.meskhidze@...wei.com>
> ---
>
> Changes since v3:
> * Split commit.
> * Refactoring landlock_add_rule syscall.
>
> ---
> security/landlock/syscalls.c | 95 ++++++++++++++++++++----------------
> 1 file changed, 53 insertions(+), 42 deletions(-)
>
> diff --git a/security/landlock/syscalls.c b/security/landlock/syscalls.c
> index 5931b666321d..8c0f6165fe3a 100644
> --- a/security/landlock/syscalls.c
> +++ b/security/landlock/syscalls.c
> @@ -274,54 +274,13 @@ static int get_path_from_fd(const s32 fd, struct path *const path)
> return err;
> }
>
> -/**
> - * sys_landlock_add_rule - Add a new rule to a ruleset
> - *
> - * @ruleset_fd: File descriptor tied to the ruleset that should be extended
> - * with the new rule.
> - * @rule_type: Identify the structure type pointed to by @rule_attr (only
> - * LANDLOCK_RULE_PATH_BENEATH for now).
> - * @rule_attr: Pointer to a rule (only of type &struct
> - * landlock_path_beneath_attr for now).
> - * @flags: Must be 0.
> - *
> - * This system call enables to define a new rule and add it to an existing
> - * ruleset.
> - *
> - * Possible returned errors are:
> - *
> - * - EOPNOTSUPP: Landlock is supported by the kernel but disabled at boot time;
> - * - EINVAL: @flags is not 0, or inconsistent access in the rule (i.e.
> - * &landlock_path_beneath_attr.allowed_access is not a subset of the rule's
> - * accesses);
> - * - ENOMSG: Empty accesses (e.g. &landlock_path_beneath_attr.allowed_access);
> - * - EBADF: @ruleset_fd is not a file descriptor for the current thread, or a
> - * member of @rule_attr is not a file descriptor as expected;
> - * - EBADFD: @ruleset_fd is not a ruleset file descriptor, or a member of
> - * @rule_attr is not the expected file descriptor type (e.g. file open
> - * without O_PATH);
> - * - EPERM: @ruleset_fd has no write access to the underlying ruleset;
> - * - EFAULT: @rule_attr inconsistency.
> - */
> -SYSCALL_DEFINE4(landlock_add_rule,
> - const int, ruleset_fd, const enum landlock_rule_type, rule_type,
> - const void __user *const, rule_attr, const __u32, flags)
> +static int add_rule_path_beneath(const int ruleset_fd, const void *const rule_attr)
> {
> struct landlock_path_beneath_attr path_beneath_attr;
> struct path path;
> struct landlock_ruleset *ruleset;
> int res, err;
>
> - if (!landlock_initialized)
> - return -EOPNOTSUPP;
> -
> - /* No flag for now. */
> - if (flags)
> - return -EINVAL;
> -
> - if (rule_type != LANDLOCK_RULE_PATH_BENEATH)
> - return -EINVAL;
> -
> /* Copies raw user space buffer, only one type for now. */
> res = copy_from_user(&path_beneath_attr, rule_attr,
> sizeof(path_beneath_attr));
> @@ -367,6 +326,58 @@ SYSCALL_DEFINE4(landlock_add_rule,
> return err;
> }
>
> +/**
> + * sys_landlock_add_rule - Add a new rule to a ruleset
> + *
> + * @ruleset_fd: File descriptor tied to the ruleset that should be extended
> + * with the new rule.
> + * @rule_type: Identify the structure type pointed to by @rule_attr (only
> + * LANDLOCK_RULE_PATH_BENEATH for now).
> + * @rule_attr: Pointer to a rule (only of type &struct
> + * landlock_path_beneath_attr for now).
> + * @flags: Must be 0.
> + *
> + * This system call enables to define a new rule and add it to an existing
> + * ruleset.
> + *
> + * Possible returned errors are:
> + *
> + * - EOPNOTSUPP: Landlock is supported by the kernel but disabled at boot time;
> + * - EINVAL: @flags is not 0, or inconsistent access in the rule (i.e.
> + * &landlock_path_beneath_attr.allowed_access is not a subset of the rule's
> + * accesses);
> + * - ENOMSG: Empty accesses (e.g. &landlock_path_beneath_attr.allowed_access);
> + * - EBADF: @ruleset_fd is not a file descriptor for the current thread, or a
> + * member of @rule_attr is not a file descriptor as expected;
> + * - EBADFD: @ruleset_fd is not a ruleset file descriptor, or a member of
> + * @rule_attr is not the expected file descriptor type (e.g. file open
> + * without O_PATH);
> + * - EPERM: @ruleset_fd has no write access to the underlying ruleset;
> + * - EFAULT: @rule_attr inconsistency.
> + */
> +SYSCALL_DEFINE4(landlock_add_rule,
> + const int, ruleset_fd, const enum landlock_rule_type, rule_type,
> + const void __user *const, rule_attr, const __u32, flags)
> +{
> + int err;
> +
> + if (!landlock_initialized)
> + return -EOPNOTSUPP;
> +
> + /* No flag for now. */
> + if (flags)
> + return -EINVAL;
As you can see in my yesterday patch, the get_ruleset_from_fd() call
should be here.
> +
> + switch (rule_type) {
> + case LANDLOCK_RULE_PATH_BENEATH:
> + err = add_rule_path_beneath(ruleset_fd, rule_attr);
> + break;
> + default:
> + err = -EINVAL;
> + }
> + return err;
> +}
> +
> /* Enforcement */
>
> /**
> --
> 2.25.1
>
Powered by blists - more mailing lists