security/landlock/ptrace.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * Landlock LSM - Ptrace hooks
   4  *
   5  * Copyright © 2017-2020 Mickaël Salaün <mic@digikod.net>
   6  * Copyright © 2019-2020 ANSSI
   7  */
   8
   9 #include <asm/current.h>
  10 #include <linux/cred.h>
  11 #include <linux/errno.h>
  12 #include <linux/kernel.h>
  13 #include <linux/lsm_hooks.h>
  14 #include <linux/rcupdate.h>
  15 #include <linux/sched.h>
  16
  17 #include "common.h"
  18 #include "cred.h"
  19 #include "ptrace.h"
  20 #include "ruleset.h"
  21 #include "setup.h"
  22
  23 static struct lsm_id landlock_lsmid __lsm_ro_after_init = {
  24        .lsm  = "landlock",
  25        .slot = LSMBLOB_NEEDED
  26 };
  27
  28 /**
  29  * domain_scope_le - Checks domain ordering for scoped ptrace
  30  *
  31  * @parent: Parent domain.
  32  * @child: Potential child of @parent.
  33  *
  34  * Checks if the @parent domain is less or equal to (i.e. an ancestor, which
  35  * means a subset of) the @child domain.
  36  */
  37 static bool domain_scope_le(const struct landlock_ruleset *const parent,
  38                 const struct landlock_ruleset *const child)
  39 {
  40         const struct landlock_hierarchy *walker;
  41
  42         if (!parent)
  43                 return true;
  44         if (!child)
  45                 return false;
  46         for (walker = child->hierarchy; walker; walker = walker->parent) {
  47                 if (walker == parent->hierarchy)
  48                         /* @parent is in the scoped hierarchy of @child. */
  49                         return true;
  50         }
  51         /* There is no relationship between @parent and @child. */
  52         return false;
  53 }
  54
  55 static bool task_is_scoped(const struct task_struct *const parent,
  56                 const struct task_struct *const child)
  57 {
  58         bool is_scoped;
  59         const struct landlock_ruleset *dom_parent, *dom_child;
  60
  61         rcu_read_lock();
  62         dom_parent = landlock_get_task_domain(parent);
  63         dom_child = landlock_get_task_domain(child);
  64         is_scoped = domain_scope_le(dom_parent, dom_child);
  65         rcu_read_unlock();
  66         return is_scoped;
  67 }
  68
  69 static int task_ptrace(const struct task_struct *const parent,
  70                 const struct task_struct *const child)
  71 {
  72         /* Quick return for non-landlocked tasks. */
  73         if (!landlocked(parent))
  74                 return 0;
  75         if (task_is_scoped(parent, child))
  76                 return 0;
  77         return -EPERM;
  78 }
  79
  80 /**
  81  * hook_ptrace_access_check - Determines whether the current process may access
  82  *                            another
  83  *
  84  * @child: Process to be accessed.
  85  * @mode: Mode of attachment.
  86  *
  87  * If the current task has Landlock rules, then the child must have at least
  88  * the same rules.  Else denied.
  89  *
  90  * Determines whether a process may access another, returning 0 if permission
  91  * granted, -errno if denied.
  92  */
  93 static int hook_ptrace_access_check(struct task_struct *const child,
  94                 const unsigned int mode)
  95 {
  96         return task_ptrace(current, child);
  97 }
  98
  99 /**
 100  * hook_ptrace_traceme - Determines whether another process may trace the
 101  *                       current one
 102  *
 103  * @parent: Task proposed to be the tracer.
 104  *
 105  * If the parent has Landlock rules, then the current task must have the same
 106  * or more rules.  Else denied.
 107  *
 108  * Determines whether the nominated task is permitted to trace the current
 109  * process, returning 0 if permission is granted, -errno if denied.
 110  */
 111 static int hook_ptrace_traceme(struct task_struct *const parent)
 112 {
 113         return task_ptrace(parent, current);
 114 }
 115
 116 static struct security_hook_list landlock_hooks[] __lsm_ro_after_init = {
 117         LSM_HOOK_INIT(ptrace_access_check, hook_ptrace_access_check),
 118         LSM_HOOK_INIT(ptrace_traceme, hook_ptrace_traceme),
 119 };
 120
 121 __init void landlock_add_ptrace_hooks(void)
 122 {
 123         security_add_hooks(landlock_hooks, ARRAY_SIZE(landlock_hooks),
 124                         &landlock_lsmid);
 125 }