1 // SPDX-License-Identifier: GPL-2.0-only
3 * Landlock LSM - System call implementations and user space interfaces
5 * Copyright © 2016-2020 Mickaël Salaün <mic@digikod.net>
6 * Copyright © 2018-2020 ANSSI
9 #include <asm/current.h>
10 #include <linux/anon_inodes.h>
11 #include <linux/build_bug.h>
12 #include <linux/capability.h>
13 #include <linux/compiler_types.h>
14 #include <linux/dcache.h>
15 #include <linux/err.h>
16 #include <linux/errno.h>
18 #include <linux/limits.h>
19 #include <linux/mount.h>
20 #include <linux/path.h>
21 #include <linux/sched.h>
22 #include <linux/security.h>
23 #include <linux/stddef.h>
24 #include <linux/syscalls.h>
25 #include <linux/types.h>
26 #include <linux/uaccess.h>
27 #include <uapi/linux/landlock.h>
36 * copy_min_struct_from_user - Safe future-proof argument copying
38 * Extend copy_struct_from_user() to check for consistent user buffer.
40 * @dst: Kernel space pointer or NULL.
41 * @ksize: Actual size of the data pointed to by @dst.
42 * @ksize_min: Minimal required size to be copied.
43 * @src: User space pointer or NULL.
44 * @usize: (Alleged) size of the data pointed to by @src.
46 static __always_inline
int copy_min_struct_from_user(void *const dst
,
47 const size_t ksize
, const size_t ksize_min
,
48 const void __user
*const src
, const size_t usize
)
50 /* Checks buffer inconsistencies. */
55 /* Checks size ranges. */
56 BUILD_BUG_ON(ksize
<= 0);
57 BUILD_BUG_ON(ksize
< ksize_min
);
58 if (usize
< ksize_min
)
60 if (usize
> PAGE_SIZE
)
63 /* Copies user buffer and fills with zeros. */
64 return copy_struct_from_user(dst
, ksize
, src
, usize
);
68 * This function only contains arithmetic operations with constants, leading to
69 * BUILD_BUG_ON(). The related code is evaluated and checked at build time,
70 * but it is then ignored thanks to compiler optimizations.
72 static void build_check_abi(void)
74 struct landlock_ruleset_attr ruleset_attr
;
75 struct landlock_path_beneath_attr path_beneath_attr
;
76 size_t ruleset_size
, path_beneath_size
;
79 * For each user space ABI structures, first checks that there is no
80 * hole in them, then checks that all architectures have the same
83 ruleset_size
= sizeof(ruleset_attr
.handled_access_fs
);
84 BUILD_BUG_ON(sizeof(ruleset_attr
) != ruleset_size
);
85 BUILD_BUG_ON(sizeof(ruleset_attr
) != 8);
87 path_beneath_size
= sizeof(path_beneath_attr
.allowed_access
);
88 path_beneath_size
+= sizeof(path_beneath_attr
.parent_fd
);
89 BUILD_BUG_ON(sizeof(path_beneath_attr
) != path_beneath_size
);
90 BUILD_BUG_ON(sizeof(path_beneath_attr
) != 12);
93 /* Ruleset handling */
95 static int fop_ruleset_release(struct inode
*const inode
,
96 struct file
*const filp
)
98 struct landlock_ruleset
*ruleset
= filp
->private_data
;
100 landlock_put_ruleset(ruleset
);
104 static ssize_t
fop_dummy_read(struct file
*const filp
, char __user
*const buf
,
105 const size_t size
, loff_t
*const ppos
)
107 /* Dummy handler to enable FMODE_CAN_READ. */
111 static ssize_t
fop_dummy_write(struct file
*const filp
,
112 const char __user
*const buf
, const size_t size
,
115 /* Dummy handler to enable FMODE_CAN_WRITE. */
120 * A ruleset file descriptor enables to build a ruleset by adding (i.e.
121 * writing) rule after rule, without relying on the task's context. This
122 * reentrant design is also used in a read way to enforce the ruleset on the
125 static const struct file_operations ruleset_fops
= {
126 .release
= fop_ruleset_release
,
127 .read
= fop_dummy_read
,
128 .write
= fop_dummy_write
,
131 #define LANDLOCK_ABI_VERSION 1
134 * sys_landlock_create_ruleset - Create a new ruleset
136 * @attr: Pointer to a &struct landlock_ruleset_attr identifying the scope of
138 * @size: Size of the pointed &struct landlock_ruleset_attr (needed for
139 * backward and forward compatibility).
140 * @flags: Supported value: %LANDLOCK_CREATE_RULESET_VERSION.
142 * This system call enables to create a new Landlock ruleset, and returns the
143 * related file descriptor on success.
145 * If @flags is %LANDLOCK_CREATE_RULESET_VERSION and @attr is NULL and @size is
146 * 0, then the returned value is the highest supported Landlock ABI version
149 * Possible returned errors are:
151 * - EOPNOTSUPP: Landlock is supported by the kernel but disabled at boot time;
152 * - EINVAL: unknown @flags, or unknown access, or too small @size;
153 * - E2BIG or EFAULT: @attr or @size inconsistencies;
154 * - ENOMSG: empty &landlock_ruleset_attr.handled_access_fs.
156 SYSCALL_DEFINE3(landlock_create_ruleset
,
157 const struct landlock_ruleset_attr __user
*const, attr
,
158 const size_t, size
, const __u32
, flags
)
160 struct landlock_ruleset_attr ruleset_attr
;
161 struct landlock_ruleset
*ruleset
;
164 /* Build-time checks. */
167 if (!landlock_initialized
)
171 if ((flags
== LANDLOCK_CREATE_RULESET_VERSION
)
173 return LANDLOCK_ABI_VERSION
;
177 /* Copies raw user space buffer. */
178 err
= copy_min_struct_from_user(&ruleset_attr
, sizeof(ruleset_attr
),
179 offsetofend(typeof(ruleset_attr
), handled_access_fs
),
184 /* Checks content (and 32-bits cast). */
185 if ((ruleset_attr
.handled_access_fs
| LANDLOCK_MASK_ACCESS_FS
) !=
186 LANDLOCK_MASK_ACCESS_FS
)
189 /* Checks arguments and transforms to kernel struct. */
190 ruleset
= landlock_create_ruleset(ruleset_attr
.handled_access_fs
);
192 return PTR_ERR(ruleset
);
194 /* Creates anonymous FD referring to the ruleset. */
195 ruleset_fd
= anon_inode_getfd("landlock-ruleset", &ruleset_fops
,
196 ruleset
, O_RDWR
| O_CLOEXEC
);
198 landlock_put_ruleset(ruleset
);
203 * Returns an owned ruleset from a FD. It is thus needed to call
204 * landlock_put_ruleset() on the return value.
206 static struct landlock_ruleset
*get_ruleset_from_fd(const int fd
,
210 struct landlock_ruleset
*ruleset
;
212 ruleset_f
= fdget(fd
);
214 return ERR_PTR(-EBADF
);
216 /* Checks FD type and access right. */
217 if (ruleset_f
.file
->f_op
!= &ruleset_fops
) {
218 ruleset
= ERR_PTR(-EBADFD
);
221 if (!(ruleset_f
.file
->f_mode
& mode
)) {
222 ruleset
= ERR_PTR(-EPERM
);
225 ruleset
= ruleset_f
.file
->private_data
;
226 if (WARN_ON_ONCE(ruleset
->num_layers
!= 1)) {
227 ruleset
= ERR_PTR(-EINVAL
);
230 landlock_get_ruleset(ruleset
);
240 * @path: Must call put_path(@path) after the call if it succeeded.
242 static int get_path_from_fd(const s32 fd
, struct path
*const path
)
247 BUILD_BUG_ON(!__same_type(fd
,
248 ((struct landlock_path_beneath_attr
*)NULL
)->parent_fd
));
250 /* Handles O_PATH. */
255 * Forbids ruleset FDs, internal filesystems (e.g. nsfs), including
256 * pseudo filesystems that will never be mountable (e.g. sockfs,
259 if ((f
.file
->f_op
== &ruleset_fops
) ||
260 (f
.file
->f_path
.mnt
->mnt_flags
& MNT_INTERNAL
) ||
261 (f
.file
->f_path
.dentry
->d_sb
->s_flags
& SB_NOUSER
) ||
262 d_is_negative(f
.file
->f_path
.dentry
) ||
263 IS_PRIVATE(d_backing_inode(f
.file
->f_path
.dentry
))) {
267 *path
= f
.file
->f_path
;
276 * sys_landlock_add_rule - Add a new rule to a ruleset
278 * @ruleset_fd: File descriptor tied to the ruleset that should be extended
280 * @rule_type: Identify the structure type pointed to by @rule_attr (only
281 * LANDLOCK_RULE_PATH_BENEATH for now).
282 * @rule_attr: Pointer to a rule (only of type &struct
283 * landlock_path_beneath_attr for now).
286 * This system call enables to define a new rule and add it to an existing
289 * Possible returned errors are:
291 * - EOPNOTSUPP: Landlock is supported by the kernel but disabled at boot time;
292 * - EINVAL: @flags is not 0, or inconsistent access in the rule (i.e.
293 * &landlock_path_beneath_attr.allowed_access is not a subset of the rule's
295 * - ENOMSG: Empty accesses (e.g. &landlock_path_beneath_attr.allowed_access);
296 * - EBADF: @ruleset_fd is not a file descriptor for the current thread, or a
297 * member of @rule_attr is not a file descriptor as expected;
298 * - EBADFD: @ruleset_fd is not a ruleset file descriptor, or a member of
299 * @rule_attr is not the expected file descriptor type (e.g. file open
301 * - EPERM: @ruleset_fd has no write access to the underlying ruleset;
302 * - EFAULT: @rule_attr inconsistency.
304 SYSCALL_DEFINE4(landlock_add_rule
,
305 const int, ruleset_fd
, const enum landlock_rule_type
, rule_type
,
306 const void __user
*const, rule_attr
, const __u32
, flags
)
308 struct landlock_path_beneath_attr path_beneath_attr
;
310 struct landlock_ruleset
*ruleset
;
313 if (!landlock_initialized
)
316 /* No flag for now. */
320 if (rule_type
!= LANDLOCK_RULE_PATH_BENEATH
)
323 /* Copies raw user space buffer, only one type for now. */
324 res
= copy_from_user(&path_beneath_attr
, rule_attr
,
325 sizeof(path_beneath_attr
));
329 /* Gets and checks the ruleset. */
330 ruleset
= get_ruleset_from_fd(ruleset_fd
, FMODE_CAN_WRITE
);
332 return PTR_ERR(ruleset
);
335 * Informs about useless rule: empty allowed_access (i.e. deny rules)
336 * are ignored in path walks.
338 if (!path_beneath_attr
.allowed_access
) {
340 goto out_put_ruleset
;
343 * Checks that allowed_access matches the @ruleset constraints
344 * (ruleset->fs_access_masks[0] is automatically upgraded to 64-bits).
346 if ((path_beneath_attr
.allowed_access
| ruleset
->fs_access_masks
[0]) !=
347 ruleset
->fs_access_masks
[0]) {
349 goto out_put_ruleset
;
352 /* Gets and checks the new rule. */
353 err
= get_path_from_fd(path_beneath_attr
.parent_fd
, &path
);
355 goto out_put_ruleset
;
357 /* Imports the new rule. */
358 err
= landlock_append_fs_rule(ruleset
, &path
,
359 path_beneath_attr
.allowed_access
);
363 landlock_put_ruleset(ruleset
);
370 * sys_landlock_restrict_self - Enforce a ruleset on the calling thread
372 * @ruleset_fd: File descriptor tied to the ruleset to merge with the target.
375 * This system call enables to enforce a Landlock ruleset on the current
376 * thread. Enforcing a ruleset requires that the task has CAP_SYS_ADMIN in its
377 * namespace or is running with no_new_privs. This avoids scenarios where
378 * unprivileged tasks can affect the behavior of privileged children.
380 * Possible returned errors are:
382 * - EOPNOTSUPP: Landlock is supported by the kernel but disabled at boot time;
383 * - EINVAL: @flags is not 0.
384 * - EBADF: @ruleset_fd is not a file descriptor for the current thread;
385 * - EBADFD: @ruleset_fd is not a ruleset file descriptor;
386 * - EPERM: @ruleset_fd has no read access to the underlying ruleset, or the
387 * current thread is not running with no_new_privs, or it doesn't have
388 * CAP_SYS_ADMIN in its namespace.
389 * - E2BIG: The maximum number of stacked rulesets is reached for the current
392 SYSCALL_DEFINE2(landlock_restrict_self
,
393 const int, ruleset_fd
, const __u32
, flags
)
395 struct landlock_ruleset
*new_dom
, *ruleset
;
396 struct cred
*new_cred
;
397 struct landlock_cred_security
*new_llcred
;
400 if (!landlock_initialized
)
403 /* No flag for now. */
408 * Similar checks as for seccomp(2), except that an -EPERM may be
411 if (!task_no_new_privs(current
) &&
412 !ns_capable_noaudit(current_user_ns(), CAP_SYS_ADMIN
))
415 /* Gets and checks the ruleset. */
416 ruleset
= get_ruleset_from_fd(ruleset_fd
, FMODE_CAN_READ
);
418 return PTR_ERR(ruleset
);
420 /* Prepares new credentials. */
421 new_cred
= prepare_creds();
424 goto out_put_ruleset
;
426 new_llcred
= landlock_cred(new_cred
);
429 * There is no possible race condition while copying and manipulating
430 * the current credentials because they are dedicated per thread.
432 new_dom
= landlock_merge_ruleset(new_llcred
->domain
, ruleset
);
433 if (IS_ERR(new_dom
)) {
434 err
= PTR_ERR(new_dom
);
438 /* Replaces the old (prepared) domain. */
439 landlock_put_ruleset(new_llcred
->domain
);
440 new_llcred
->domain
= new_dom
;
442 landlock_put_ruleset(ruleset
);
443 return commit_creds(new_cred
);
446 abort_creds(new_cred
);
449 landlock_put_ruleset(ruleset
);