| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20240916122230.114800-6-matthieu@buffet.re>
Date: Mon, 16 Sep 2024 14:22:28 +0200
From: Matthieu Buffet <matthieu@...fet.re>
To: Mickaël Salaün <mic@...ikod.net>
Cc: Günther Noack <gnoack@...gle.com>,
Paul Moore <paul@...l-moore.com>,
James Morris <jmorris@...ei.org>,
"Serge E . Hallyn" <serge@...lyn.com>,
linux-security-module@...r.kernel.org,
linux-kernel@...r.kernel.org,
netdev@...r.kernel.org,
Matthieu Buffet <matthieu@...fet.re>
Subject: [RFC PATCH v1 5/7] samples/landlock: Add sandboxer UDP access control
Add environment variables to control associated access rights:
(each one takes a list of ports separated by colons, like other
list options)
- LL_UDP_BIND
- LL_UDP_CONNECT
- LL_UDP_RECVMSG
- LL_UDP_SENDMSG
Signed-off-by: Matthieu Buffet <matthieu@...fet.re>
---
samples/landlock/sandboxer.c | 88 ++++++++++++++++++++++++++++++++----
1 file changed, 80 insertions(+), 8 deletions(-)
diff --git a/samples/landlock/sandboxer.c b/samples/landlock/sandboxer.c
index 08704504dc51..dadd30dad712 100644
--- a/samples/landlock/sandboxer.c
+++ b/samples/landlock/sandboxer.c
@@ -55,6 +55,10 @@ static inline int landlock_restrict_self(const int ruleset_fd,
#define ENV_FS_RW_NAME "LL_FS_RW"
#define ENV_TCP_BIND_NAME "LL_TCP_BIND"
#define ENV_TCP_CONNECT_NAME "LL_TCP_CONNECT"
+#define ENV_UDP_BIND_NAME "LL_UDP_BIND"
+#define ENV_UDP_CONNECT_NAME "LL_UDP_CONNECT"
+#define ENV_UDP_RECVMSG_NAME "LL_UDP_RECVMSG"
+#define ENV_UDP_SENDMSG_NAME "LL_UDP_SENDMSG"
#define ENV_DELIMITER ":"
static int parse_path(char *env_path, const char ***const path_list)
@@ -219,7 +223,7 @@ static int populate_ruleset_net(const char *const env_var, const int ruleset_fd,
/* clang-format on */
-#define LANDLOCK_ABI_LAST 5
+#define LANDLOCK_ABI_LAST 6
static void print_help(const char *prog)
{
@@ -247,11 +251,25 @@ static void print_help(const char *prog)
"to allow nothing, e.g. %s=\"\"):\n",
ENV_TCP_BIND_NAME);
fprintf(stderr,
- "* %s: list of ports allowed to bind (server).\n",
+ "* %s: list of TCP ports allowed to bind (server)\n",
ENV_TCP_BIND_NAME);
fprintf(stderr,
- "* %s: list of ports allowed to connect (client).\n",
+ "* %s: list of TCP ports allowed to connect (client)\n",
ENV_TCP_CONNECT_NAME);
+ fprintf(stderr,
+ "* %s: list of UDP ports allowed to bind (client: set as "
+ "source port/server: listen on port)\n",
+ ENV_UDP_BIND_NAME);
+ fprintf(stderr,
+ "* %s: list of UDP ports allowed to connect (client: set as "
+ "destination port/server: only receive from one client)\n",
+ ENV_UDP_CONNECT_NAME);
+ fprintf(stderr,
+ "* %s: list of UDP ports allowed to send to (client/server)\n",
+ ENV_UDP_SENDMSG_NAME);
+ fprintf(stderr,
+ "* %s: list of UDP ports allowed to recv from (client/server)\n",
+ ENV_UDP_RECVMSG_NAME);
fprintf(stderr,
"\n"
"Example:\n"
@@ -259,9 +277,12 @@ static void print_help(const char *prog)
"%s=\"/dev/null:/dev/full:/dev/zero:/dev/pts:/tmp\" "
"%s=\"9418\" "
"%s=\"80:443\" "
+ "%s=\"0\" "
+ "%s=\"53\" "
"%s bash -i\n\n",
ENV_FS_RO_NAME, ENV_FS_RW_NAME, ENV_TCP_BIND_NAME,
- ENV_TCP_CONNECT_NAME, prog);
+ ENV_TCP_CONNECT_NAME, ENV_UDP_RECVMSG_NAME,
+ ENV_UDP_SENDMSG_NAME, prog);
fprintf(stderr,
"This sandboxer can use Landlock features "
"up to ABI version %d.\n",
@@ -280,7 +301,11 @@ int main(const int argc, char *const argv[], char *const *const envp)
struct landlock_ruleset_attr ruleset_attr = {
.handled_access_fs = access_fs_rw,
.handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP |
- LANDLOCK_ACCESS_NET_CONNECT_TCP,
+ LANDLOCK_ACCESS_NET_CONNECT_TCP |
+ LANDLOCK_ACCESS_NET_BIND_UDP |
+ LANDLOCK_ACCESS_NET_CONNECT_UDP |
+ LANDLOCK_ACCESS_NET_RECVMSG_UDP |
+ LANDLOCK_ACCESS_NET_SENDMSG_UDP,
};
if (argc < 2) {
@@ -354,6 +379,14 @@ int main(const int argc, char *const argv[], char *const *const envp)
"provided by ABI version %d (instead of %d).\n",
LANDLOCK_ABI_LAST, abi);
__attribute__((fallthrough));
+ case 5:
+ /* Removes UDP support for ABI < 6 */
+ ruleset_attr.handled_access_net &=
+ ~(LANDLOCK_ACCESS_NET_BIND_UDP |
+ LANDLOCK_ACCESS_NET_CONNECT_UDP |
+ LANDLOCK_ACCESS_NET_RECVMSG_UDP |
+ LANDLOCK_ACCESS_NET_SENDMSG_UDP);
+ __attribute__((fallthrough));
case LANDLOCK_ABI_LAST:
break;
default:
@@ -366,18 +399,42 @@ int main(const int argc, char *const argv[], char *const *const envp)
access_fs_ro &= ruleset_attr.handled_access_fs;
access_fs_rw &= ruleset_attr.handled_access_fs;
- /* Removes bind access attribute if not supported by a user. */
+ /* Removes TCP bind access attribute if not supported by a user. */
env_port_name = getenv(ENV_TCP_BIND_NAME);
if (!env_port_name) {
ruleset_attr.handled_access_net &=
~LANDLOCK_ACCESS_NET_BIND_TCP;
}
- /* Removes connect access attribute if not supported by a user. */
+ /* Removes TCP connect access attribute if not supported by a user. */
env_port_name = getenv(ENV_TCP_CONNECT_NAME);
if (!env_port_name) {
ruleset_attr.handled_access_net &=
~LANDLOCK_ACCESS_NET_CONNECT_TCP;
}
+ /* Removes UDP bind access attribute if not supported by a user. */
+ env_port_name = getenv(ENV_UDP_BIND_NAME);
+ if (!env_port_name) {
+ ruleset_attr.handled_access_net &=
+ ~LANDLOCK_ACCESS_NET_BIND_UDP;
+ }
+ /* Removes UDP bind access attribute if not supported by a user. */
+ env_port_name = getenv(ENV_UDP_CONNECT_NAME);
+ if (!env_port_name) {
+ ruleset_attr.handled_access_net &=
+ ~LANDLOCK_ACCESS_NET_CONNECT_UDP;
+ }
+ /* Removes UDP recv access attribute if not supported by a user. */
+ env_port_name = getenv(ENV_UDP_RECVMSG_NAME);
+ if (!env_port_name) {
+ ruleset_attr.handled_access_net &=
+ ~LANDLOCK_ACCESS_NET_RECVMSG_UDP;
+ }
+ /* Removes UDP send access attribute if not supported by a user. */
+ env_port_name = getenv(ENV_UDP_SENDMSG_NAME);
+ if (!env_port_name) {
+ ruleset_attr.handled_access_net &=
+ ~LANDLOCK_ACCESS_NET_SENDMSG_UDP;
+ }
ruleset_fd =
landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
@@ -392,7 +449,6 @@ int main(const int argc, char *const argv[], char *const *const envp)
if (populate_ruleset_fs(ENV_FS_RW_NAME, ruleset_fd, access_fs_rw)) {
goto err_close_ruleset;
}
-
if (populate_ruleset_net(ENV_TCP_BIND_NAME, ruleset_fd,
LANDLOCK_ACCESS_NET_BIND_TCP)) {
goto err_close_ruleset;
@@ -401,6 +457,22 @@ int main(const int argc, char *const argv[], char *const *const envp)
LANDLOCK_ACCESS_NET_CONNECT_TCP)) {
goto err_close_ruleset;
}
+ if (populate_ruleset_net(ENV_UDP_BIND_NAME, ruleset_fd,
+ LANDLOCK_ACCESS_NET_BIND_UDP)) {
+ goto err_close_ruleset;
+ }
+ if (populate_ruleset_net(ENV_UDP_CONNECT_NAME, ruleset_fd,
+ LANDLOCK_ACCESS_NET_CONNECT_UDP)) {
+ goto err_close_ruleset;
+ }
+ if (populate_ruleset_net(ENV_UDP_RECVMSG_NAME, ruleset_fd,
+ LANDLOCK_ACCESS_NET_RECVMSG_UDP)) {
+ goto err_close_ruleset;
+ }
+ if (populate_ruleset_net(ENV_UDP_SENDMSG_NAME, ruleset_fd,
+ LANDLOCK_ACCESS_NET_SENDMSG_UDP)) {
+ goto err_close_ruleset;
+ }
if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
perror("Failed to restrict privileges");
--
2.39.5
Powered by blists - more mailing lists