[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <dcb11989-fa8d-3966-77da-2ff5fab2ef32@digikod.net>
Date: Fri, 10 Feb 2023 18:37:53 +0100
From: Mickaël Salaün <mic@...ikod.net>
To: Konstantin Meskhidze <konstantin.meskhidze@...wei.com>
Cc: willemdebruijn.kernel@...il.com, gnoack3000@...il.com,
linux-security-module@...r.kernel.org, netdev@...r.kernel.org,
netfilter-devel@...r.kernel.org, yusongping@...wei.com,
artem.kuzin@...wei.com
Subject: Re: [PATCH v9 05/12] landlock: Move and rename umask_layers() and
init_layer_masks()
On 16/01/2023 09:58, Konstantin Meskhidze wrote:
> This patch renames and moves unmask_layers() and init_layer_masks()
> helpers to ruleset.c to share them with Landlock network implementation
> in following commits.
>
> Signed-off-by: Konstantin Meskhidze <konstantin.meskhidze@...wei.com>
> ---
>
> Changes since v8:
> * Refactors commit message.
> * Adds "landlock_" prefix for moved helpers.
>
> Changes since v7:
> * Refactors commit message.
>
> Changes since v6:
> * Moves get_handled_accesses() helper from ruleset.c back to fs.c,
> cause it's not used in coming network commits.
>
> Changes since v5:
> * Splits commit.
> * Moves init_layer_masks() and get_handled_accesses() helpers
> to ruleset.c and makes then non-static.
> * Formats code with clang-format-14.
>
> ---
[...]
> diff --git a/security/landlock/ruleset.c b/security/landlock/ruleset.c
> index 3e1cffda128e..22590cac3d56 100644
> --- a/security/landlock/ruleset.c
> +++ b/security/landlock/ruleset.c
> @@ -572,3 +572,101 @@ landlock_find_rule(const struct landlock_ruleset *const ruleset,
> }
> return NULL;
> }
> +
> +/*
> + * @layer_masks is read and may be updated according to the access request and
> + * the matching rule.
> + *
> + * Returns true if the request is allowed (i.e. relevant layer masks for the
> + * request are empty).
> + */
> +bool landlock_unmask_layers(
> + const struct landlock_rule *const rule,
> + const access_mask_t access_request,
> + layer_mask_t (*const layer_masks)[LANDLOCK_NUM_ACCESS_FS])
> +{
> + size_t layer_level;
> +
> + if (!access_request || !layer_masks)
> + return true;
> + if (!rule)
> + return false;
> +
> + /*
> + * An access is granted if, for each policy layer, at least one rule
> + * encountered on the pathwalk grants the requested access,
> + * regardless of its position in the layer stack. We must then check
> + * the remaining layers for each inode, from the first added layer to
> + * the last one. When there is multiple requested accesses, for each
> + * policy layer, the full set of requested accesses may not be granted
> + * by only one rule, but by the union (binary OR) of multiple rules.
> + * E.g. /a/b <execute> + /a <read> => /a/b <execute + read>
> + */
> + for (layer_level = 0; layer_level < rule->num_layers; layer_level++) {
> + const struct landlock_layer *const layer =
> + &rule->layers[layer_level];
> + const layer_mask_t layer_bit = BIT_ULL(layer->level - 1);
> + const unsigned long access_req = access_request;
> + unsigned long access_bit;
> + bool is_empty;
> +
> + /*
> + * Records in @layer_masks which layer grants access to each
> + * requested access.
> + */
> + is_empty = true;
> + for_each_set_bit(access_bit, &access_req,
> + ARRAY_SIZE(*layer_masks)) {
> + if (layer->access & BIT_ULL(access_bit))
> + (*layer_masks)[access_bit] &= ~layer_bit;
> + is_empty = is_empty && !(*layer_masks)[access_bit];
> + }
> + if (is_empty)
> + return true;
> + }
> + return false;
> +}
> +
> +/*
Please keep the original "/**"
> + * init_layer_masks - Initialize layer masks from an access request
> + *
> + * Populates @layer_masks such that for each access right in @access_request,
> + * the bits for all the layers are set where this access right is handled.
> + *
> + * @domain: The domain that defines the current restrictions.
> + * @access_request: The requested access rights to check.
> + * @layer_masks: The layer masks to populate.
> + *
> + * Returns: An access mask where each access right bit is set which is handled
> + * in any of the active layers in @domain.
> + */
Powered by blists - more mailing lists