Message-Id: <ac75151861724c19ed62b500cfe497612d9a6607.1725494372.git.fahimitahera@gmail.com>
Date: Wed,  4 Sep 2024 18:14:02 -0600
From: Tahera Fahimi <fahimitahera@...il.com>
To: outreachy@...ts.linux.dev
Cc: mic@...ikod.net,
	gnoack@...gle.com,
	paul@...l-moore.com,
	jmorris@...ei.org,
	serge@...lyn.com,
	linux-security-module@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	bjorn3_gh@...tonmail.com,
	jannh@...gle.com,
	netdev@...r.kernel.org,
	Tahera Fahimi <fahimitahera@...il.com>
Subject: [PATCH v11 8/8] Landlock: Document LANDLOCK_SCOPED_ABSTRACT_UNIX_SOCKET and ABI version

Introducing LANDLOCK_SCOPED_ABSTRACT_UNIX_SOCKET as an IPC scoping
mechanism in Landlock ABI version 6, and updating ruleset_attr, Landlock
ABI version, and access rights code blocks based on that.

Signed-off-by: Tahera Fahimi <fahimitahera@...il.com>
---
v11:
- Documentation cases where i) a connected datagram UNIX socket send(2)/
  sendto(2) data, but it is denied when the socket is not connected, and
  ii) a scoped process cannot connect by an inherited socket's file
  descriptor.
v10:
- Update date.
v8:
- Improving documentation by specifying differences between scoped and
  non-scoped domains.
- Adding review notes of version 7.
- Update date.
v7:
- Add "LANDLOCK_SCOPED_ABSTRACT_UNIX_SOCKET" explanation to IPC scoping
  section and updating ABI to version 6.
- Adding "scoped" attribute to the Access rights section.
- In current limitation, unnamed sockets are specified as sockets that
  are not restricted.
- Update date.
---
 Documentation/userspace-api/landlock.rst | 45 ++++++++++++++++++++++--
 1 file changed, 43 insertions(+), 2 deletions(-)

diff --git a/Documentation/userspace-api/landlock.rst b/Documentation/userspace-api/landlock.rst
index 37dafce8038b..c3b87755e98d 100644
--- a/Documentation/userspace-api/landlock.rst
+++ b/Documentation/userspace-api/landlock.rst
@@ -8,7 +8,7 @@ Landlock: unprivileged access control
 =====================================
 
 :Author: Mickaël Salaün
-:Date: July 2024
+:Date: August 2024
 
 The goal of Landlock is to enable to restrict ambient rights (e.g. global
 filesystem or network access) for a set of processes.  Because Landlock
@@ -81,6 +81,8 @@ to be explicit about the denied-by-default access rights.
         .handled_access_net =
             LANDLOCK_ACCESS_NET_BIND_TCP |
             LANDLOCK_ACCESS_NET_CONNECT_TCP,
+        .scoped =
+            LANDLOCK_SCOPED_ABSTRACT_UNIX_SOCKET,
     };
 
 Because we may not know on which kernel version an application will be
@@ -119,6 +121,9 @@ version, and only use the available subset of access rights:
     case 4:
         /* Removes LANDLOCK_ACCESS_FS_IOCTL_DEV for ABI < 5 */
         ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_IOCTL_DEV;
+    case 5:
+        /* Removes LANDLOCK_SCOPED_ABSTRACT_UNIX_SOCKET for ABI < 6 */
+        ruleset_attr.scoped &= ~LANDLOCK_SCOPED_ABSTRACT_UNIX_SOCKET;
     }
 
 This enables to create an inclusive ruleset that will contain our rules.
@@ -306,6 +311,35 @@ To be allowed to use :manpage:`ptrace(2)` and related syscalls on a target
 process, a sandboxed process should have a subset of the target process rules,
 which means the tracee must be in a sub-domain of the tracer.
 
+IPC Scoping
+-----------
+
+Similar to the implicit `Ptrace restrictions`_, we may want to further
+restrict interactions between sandboxes. Each Landlock domain can be
+explicitly scoped for a set of actions by specifying it on a ruleset.
+For example, if a sandboxed process should not be able to
+:manpage:`connect(2)` to a non-sandboxed process through abstract
+:manpage:`unix(7)` sockets, we can specify such restriction with
+``LANDLOCK_SCOPED_ABSTRACT_UNIX_SOCKET``.
+
+A sandboxed process can connect to a non-sandboxed process when its
+domain is not scoped. If a process's domain is scoped, it can only
+connect to sockets created by processes in the same scoped domain.
+
+A connected datagram socket behaves like a stream socket when its domain
+is scoped, meaning if the domain is scoped after the socket is connected
+, it can still :manpage:`send(2)` data just like a stream socket.
+However, in the same scenario, a non-connected datagram socket cannot
+send data (with :manpage:`sendto(2)`) outside its scoped domain.
+
+A process with a scoped domain can inherit a socket created by a
+non-scoped process. The process cannot connect to this socket since it
+has a scoped domain.
+
+IPC scoping does not support Landlock rules, so if a domain is scoped,
+no rules can be added to allow access to a resource outside of the
+scoped domain.
+
 Truncating files
 ----------------
 
@@ -404,7 +438,7 @@ Access rights
 -------------
 
 .. kernel-doc:: include/uapi/linux/landlock.h
-    :identifiers: fs_access net_access
+    :identifiers: fs_access net_access scope
 
 Creating a new ruleset
 ----------------------
@@ -541,6 +575,13 @@ earlier ABI.
 Starting with the Landlock ABI version 5, it is possible to restrict the use of
 :manpage:`ioctl(2)` using the new ``LANDLOCK_ACCESS_FS_IOCTL_DEV`` right.
 
+Abstract UNIX sockets Restriction  (ABI < 6)
+--------------------------------------------
+
+With ABI version 6, it is possible to restrict connection to an abstract
+Unix socket through ``LANDLOCK_SCOPED_ABSTRACT_UNIX_SOCKET``, thanks to
+the ``scoped`` ruleset attribute.
+
 .. _kernel_support:
 
 Kernel support
-- 
2.34.1

Powered by blists - more mailing lists