| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <49ed71a5-763d-a101-9d0d-5956e15b3de6@huawei-partners.com>
Date: Fri, 24 Jan 2025 14:06:42 +0300
From: Mikhail Ivanov <ivanov.mikhail1@...wei-partners.com>
To: Matthieu Buffet <matthieu@...fet.re>, Mickael Salaun <mic@...ikod.net>
CC: Gunther Noack <gnoack@...gle.com>, <konstantin.meskhidze@...wei.com>, Paul
Moore <paul@...l-moore.com>, James Morris <jmorris@...ei.org>, "Serge E .
Hallyn" <serge@...lyn.com>, <linux-security-module@...r.kernel.org>,
<netdev@...r.kernel.org>
Subject: Re: [PATCH v2 5/6] samples/landlock: Add sandboxer UDP access control
On 12/14/2024 9:45 PM, Matthieu Buffet wrote:
> Add environment variables to control associated access rights:
> (each one takes a list of ports separated by colons, like other
> list options)
>
> - LL_UDP_BIND
> - LL_UDP_CONNECT
> - LL_UDP_SENDTO
>
> Signed-off-by: Matthieu Buffet <matthieu@...fet.re>
> ---
> samples/landlock/sandboxer.c | 58 ++++++++++++++++++++++++++++++++++--
> 1 file changed, 56 insertions(+), 2 deletions(-)
>
> diff --git a/samples/landlock/sandboxer.c b/samples/landlock/sandboxer.c
> index 57565dfd74a2..61dc2645371e 100644
> --- a/samples/landlock/sandboxer.c
> +++ b/samples/landlock/sandboxer.c
> @@ -58,6 +58,9 @@ static inline int landlock_restrict_self(const int ruleset_fd,
> #define ENV_TCP_BIND_NAME "LL_TCP_BIND"
> #define ENV_TCP_CONNECT_NAME "LL_TCP_CONNECT"
> #define ENV_SCOPED_NAME "LL_SCOPED"
> +#define ENV_UDP_BIND_NAME "LL_UDP_BIND"
> +#define ENV_UDP_CONNECT_NAME "LL_UDP_CONNECT"
> +#define ENV_UDP_SENDTO_NAME "LL_UDP_SENDTO"
> #define ENV_DELIMITER ":"
>
> static int str2num(const char *numstr, __u64 *num_dst)
> @@ -288,7 +291,7 @@ static bool check_ruleset_scope(const char *const env_var,
>
> /* clang-format on */
>
> -#define LANDLOCK_ABI_LAST 6
> +#define LANDLOCK_ABI_LAST 7
>
> #define XSTR(s) #s
> #define STR(s) XSTR(s)
> @@ -311,6 +314,11 @@ static const char help[] =
> "means an empty list):\n"
> "* " ENV_TCP_BIND_NAME ": ports allowed to bind (server)\n"
> "* " ENV_TCP_CONNECT_NAME ": ports allowed to connect (client)\n"
> + "* " ENV_UDP_BIND_NAME ": UDP ports allowed to bind (client: set as "
> + "source port / server: prepare to listen on port)\n"
listen(2) is not supported for UDP sockets.
> + "* " ENV_UDP_CONNECT_NAME ": UDP ports allowed to connect (client: "
> + "set as destination port / server: only receive from one client)\n"
> + "* " ENV_UDP_SENDTO_NAME ": UDP ports allowed to send to (client/server)\n"
> "* " ENV_SCOPED_NAME ": actions denied on the outside of the landlock domain\n"
> " - \"a\" to restrict opening abstract unix sockets\n"
> " - \"s\" to restrict sending signals\n"
> @@ -320,6 +328,8 @@ static const char help[] =
> ENV_FS_RW_NAME "=\"/dev/null:/dev/full:/dev/zero:/dev/pts:/tmp\" "
> ENV_TCP_BIND_NAME "=\"9418\" "
> ENV_TCP_CONNECT_NAME "=\"80:443\" "
> + ENV_UDP_CONNECT_NAME "=\"53\" "
> + ENV_UDP_SENDTO_NAME "=\"53\" "
> ENV_SCOPED_NAME "=\"a:s\" "
> "%1$s bash -i\n"
> "\n"
> @@ -340,7 +350,10 @@ int main(const int argc, char *const argv[], char *const *const envp)
> struct landlock_ruleset_attr ruleset_attr = {
> .handled_access_fs = access_fs_rw,
> .handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP |
> - LANDLOCK_ACCESS_NET_CONNECT_TCP,
> + LANDLOCK_ACCESS_NET_CONNECT_TCP |
> + LANDLOCK_ACCESS_NET_BIND_UDP |
> + LANDLOCK_ACCESS_NET_CONNECT_UDP |
> + LANDLOCK_ACCESS_NET_SENDTO_UDP,
> .scoped = LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET |
> LANDLOCK_SCOPE_SIGNAL,
> };
> @@ -415,6 +428,14 @@ int main(const int argc, char *const argv[], char *const *const envp)
> /* Removes LANDLOCK_SCOPE_* for ABI < 6 */
> ruleset_attr.scoped &= ~(LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET |
> LANDLOCK_SCOPE_SIGNAL);
> +
> + __attribute__((fallthrough));
> + case 6:
> + /* Removes UDP support for ABI < 7 */
> + ruleset_attr.handled_access_fs &=
typo: handled_access_fs -> handled_access_net
> + ~(LANDLOCK_ACCESS_NET_BIND_UDP |
> + LANDLOCK_ACCESS_NET_CONNECT_UDP |
> + LANDLOCK_ACCESS_NET_SENDTO_UDP);
> fprintf(stderr,
> "Hint: You should update the running kernel "
> "to leverage Landlock features "
> @@ -445,6 +466,27 @@ int main(const int argc, char *const argv[], char *const *const envp)
> ruleset_attr.handled_access_net &=
> ~LANDLOCK_ACCESS_NET_CONNECT_TCP;
> }
> + /* Removes UDP bind access control if not supported by a user */
nit: missing dot here and in some other places.
> + env_port_name = getenv(ENV_UDP_BIND_NAME);
> + if (!env_port_name) {
> + ruleset_attr.handled_access_net &=
> + ~LANDLOCK_ACCESS_NET_BIND_UDP;
> + }
> + /* Removes UDP connect access control if not supported by a user */
> + env_port_name = getenv(ENV_UDP_CONNECT_NAME);
> + if (!env_port_name) {
> + ruleset_attr.handled_access_net &=
> + ~LANDLOCK_ACCESS_NET_CONNECT_UDP;
> + }
> + /*
> + * Removes UDP sendmsg(addr != NULL) access control if not
> + * supported by a user
> + */
> + env_port_name = getenv(ENV_UDP_SENDTO_NAME);
> + if (!env_port_name) {
> + ruleset_attr.handled_access_net &=
> + ~LANDLOCK_ACCESS_NET_SENDTO_UDP;
> + }
>
> if (check_ruleset_scope(ENV_SCOPED_NAME, &ruleset_attr))
> return 1;
> @@ -471,6 +513,18 @@ int main(const int argc, char *const argv[], char *const *const envp)
> LANDLOCK_ACCESS_NET_CONNECT_TCP)) {
> goto err_close_ruleset;
> }
> + if (populate_ruleset_net(ENV_UDP_BIND_NAME, ruleset_fd,
> + LANDLOCK_ACCESS_NET_BIND_UDP)) {
> + goto err_close_ruleset;
> + }
> + if (populate_ruleset_net(ENV_UDP_CONNECT_NAME, ruleset_fd,
> + LANDLOCK_ACCESS_NET_CONNECT_UDP)) {
> + goto err_close_ruleset;
> + }
> + if (populate_ruleset_net(ENV_UDP_SENDTO_NAME, ruleset_fd,
> + LANDLOCK_ACCESS_NET_SENDTO_UDP)) {
> + goto err_close_ruleset;
> + }
>
> if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
> perror("Failed to restrict privileges");
Powered by blists - more mailing lists