| Message ID | 20220309134459.6448-7-konstantin.meskhidze@huawei.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | Landlock LSM | expand |
On 09/03/2022 14:44, Konstantin Meskhidze wrote: > Landlock_add_rule syscall was refactored to support new > rule types in future Landlock versions. Add_rule_path_beneath() > helper was added to support current filesystem rules. It is called > by the switch case. > > Signed-off-by: Konstantin Meskhidze <konstantin.meskhidze@huawei.com> > --- > > Changes since v3: > * Split commit. > * Refactoring landlock_add_rule syscall. > > --- > security/landlock/syscalls.c | 95 ++++++++++++++++++++---------------- > 1 file changed, 53 insertions(+), 42 deletions(-) > > diff --git a/security/landlock/syscalls.c b/security/landlock/syscalls.c > index 5931b666321d..8c0f6165fe3a 100644 > --- a/security/landlock/syscalls.c > +++ b/security/landlock/syscalls.c > @@ -274,54 +274,13 @@ static int get_path_from_fd(const s32 fd, struct path *const path) > return err; > } > > -/** > - * sys_landlock_add_rule - Add a new rule to a ruleset > - * > - * @ruleset_fd: File descriptor tied to the ruleset that should be extended > - * with the new rule. > - * @rule_type: Identify the structure type pointed to by @rule_attr (only > - * LANDLOCK_RULE_PATH_BENEATH for now). > - * @rule_attr: Pointer to a rule (only of type &struct > - * landlock_path_beneath_attr for now). > - * @flags: Must be 0. > - * > - * This system call enables to define a new rule and add it to an existing > - * ruleset. > - * > - * Possible returned errors are: > - * > - * - EOPNOTSUPP: Landlock is supported by the kernel but disabled at boot time; > - * - EINVAL: @flags is not 0, or inconsistent access in the rule (i.e. > - * &landlock_path_beneath_attr.allowed_access is not a subset of the rule's > - * accesses); > - * - ENOMSG: Empty accesses (e.g. &landlock_path_beneath_attr.allowed_access); > - * - EBADF: @ruleset_fd is not a file descriptor for the current thread, or a > - * member of @rule_attr is not a file descriptor as expected; > - * - EBADFD: @ruleset_fd is not a ruleset file descriptor, or a member of > - * @rule_attr is not the expected file descriptor type (e.g. file open > - * without O_PATH); > - * - EPERM: @ruleset_fd has no write access to the underlying ruleset; > - * - EFAULT: @rule_attr inconsistency. > - */ > -SYSCALL_DEFINE4(landlock_add_rule, > - const int, ruleset_fd, const enum landlock_rule_type, rule_type, > - const void __user *const, rule_attr, const __u32, flags) > +static int add_rule_path_beneath(const int ruleset_fd, const void *const rule_attr) > { > struct landlock_path_beneath_attr path_beneath_attr; > struct path path; > struct landlock_ruleset *ruleset; > int res, err; > > - if (!landlock_initialized) > - return -EOPNOTSUPP; > - > - /* No flag for now. */ > - if (flags) > - return -EINVAL; > - > - if (rule_type != LANDLOCK_RULE_PATH_BENEATH) > - return -EINVAL; > - > /* Copies raw user space buffer, only one type for now. */ > res = copy_from_user(&path_beneath_attr, rule_attr, > sizeof(path_beneath_attr)); > @@ -367,6 +326,58 @@ SYSCALL_DEFINE4(landlock_add_rule, > return err; > } > > +/** > + * sys_landlock_add_rule - Add a new rule to a ruleset > + * > + * @ruleset_fd: File descriptor tied to the ruleset that should be extended > + * with the new rule. > + * @rule_type: Identify the structure type pointed to by @rule_attr (only > + * LANDLOCK_RULE_PATH_BENEATH for now). > + * @rule_attr: Pointer to a rule (only of type &struct > + * landlock_path_beneath_attr for now). > + * @flags: Must be 0. > + * > + * This system call enables to define a new rule and add it to an existing > + * ruleset. > + * > + * Possible returned errors are: > + * > + * - EOPNOTSUPP: Landlock is supported by the kernel but disabled at boot time; > + * - EINVAL: @flags is not 0, or inconsistent access in the rule (i.e. > + * &landlock_path_beneath_attr.allowed_access is not a subset of the rule's > + * accesses); > + * - ENOMSG: Empty accesses (e.g. &landlock_path_beneath_attr.allowed_access); > + * - EBADF: @ruleset_fd is not a file descriptor for the current thread, or a > + * member of @rule_attr is not a file descriptor as expected; > + * - EBADFD: @ruleset_fd is not a ruleset file descriptor, or a member of > + * @rule_attr is not the expected file descriptor type (e.g. file open > + * without O_PATH); > + * - EPERM: @ruleset_fd has no write access to the underlying ruleset; > + * - EFAULT: @rule_attr inconsistency. > + */ > +SYSCALL_DEFINE4(landlock_add_rule, > + const int, ruleset_fd, const enum landlock_rule_type, rule_type, > + const void __user *const, rule_attr, const __u32, flags) > +{ > + int err; > + > + if (!landlock_initialized) > + return -EOPNOTSUPP; > + > + /* No flag for now. */ > + if (flags) > + return -EINVAL; As you can see in my yesterday patch, the get_ruleset_from_fd() call should be here. > + > + switch (rule_type) { > + case LANDLOCK_RULE_PATH_BENEATH: > + err = add_rule_path_beneath(ruleset_fd, rule_attr); > + break; > + default: > + err = -EINVAL; > + } > + return err; > +} > + > /* Enforcement */ > > /** > -- > 2.25.1 >
4/12/2022 2:12 PM, Mickaël Salaün пишет: > > On 09/03/2022 14:44, Konstantin Meskhidze wrote: >> Landlock_add_rule syscall was refactored to support new >> rule types in future Landlock versions. Add_rule_path_beneath() >> helper was added to support current filesystem rules. It is called >> by the switch case. >> >> Signed-off-by: Konstantin Meskhidze <konstantin.meskhidze@huawei.com> >> --- >> >> Changes since v3: >> * Split commit. >> * Refactoring landlock_add_rule syscall. >> >> --- >> security/landlock/syscalls.c | 95 ++++++++++++++++++++---------------- >> 1 file changed, 53 insertions(+), 42 deletions(-) >> >> diff --git a/security/landlock/syscalls.c b/security/landlock/syscalls.c >> index 5931b666321d..8c0f6165fe3a 100644 >> --- a/security/landlock/syscalls.c >> +++ b/security/landlock/syscalls.c >> @@ -274,54 +274,13 @@ static int get_path_from_fd(const s32 fd, struct >> path *const path) >> return err; >> } >> >> -/** >> - * sys_landlock_add_rule - Add a new rule to a ruleset >> - * >> - * @ruleset_fd: File descriptor tied to the ruleset that should be >> extended >> - * with the new rule. >> - * @rule_type: Identify the structure type pointed to by @rule_attr >> (only >> - * LANDLOCK_RULE_PATH_BENEATH for now). >> - * @rule_attr: Pointer to a rule (only of type &struct >> - * landlock_path_beneath_attr for now). >> - * @flags: Must be 0. >> - * >> - * This system call enables to define a new rule and add it to an >> existing >> - * ruleset. >> - * >> - * Possible returned errors are: >> - * >> - * - EOPNOTSUPP: Landlock is supported by the kernel but disabled at >> boot time; >> - * - EINVAL: @flags is not 0, or inconsistent access in the rule (i.e. >> - * &landlock_path_beneath_attr.allowed_access is not a subset of >> the rule's >> - * accesses); >> - * - ENOMSG: Empty accesses (e.g. >> &landlock_path_beneath_attr.allowed_access); >> - * - EBADF: @ruleset_fd is not a file descriptor for the current >> thread, or a >> - * member of @rule_attr is not a file descriptor as expected; >> - * - EBADFD: @ruleset_fd is not a ruleset file descriptor, or a >> member of >> - * @rule_attr is not the expected file descriptor type (e.g. file open >> - * without O_PATH); >> - * - EPERM: @ruleset_fd has no write access to the underlying ruleset; >> - * - EFAULT: @rule_attr inconsistency. >> - */ >> -SYSCALL_DEFINE4(landlock_add_rule, >> - const int, ruleset_fd, const enum landlock_rule_type, rule_type, >> - const void __user *const, rule_attr, const __u32, flags) >> +static int add_rule_path_beneath(const int ruleset_fd, const void >> *const rule_attr) >> { >> struct landlock_path_beneath_attr path_beneath_attr; >> struct path path; >> struct landlock_ruleset *ruleset; >> int res, err; >> >> - if (!landlock_initialized) >> - return -EOPNOTSUPP; >> - >> - /* No flag for now. */ >> - if (flags) >> - return -EINVAL; >> - >> - if (rule_type != LANDLOCK_RULE_PATH_BENEATH) >> - return -EINVAL; >> - >> /* Copies raw user space buffer, only one type for now. */ >> res = copy_from_user(&path_beneath_attr, rule_attr, >> sizeof(path_beneath_attr)); >> @@ -367,6 +326,58 @@ SYSCALL_DEFINE4(landlock_add_rule, >> return err; >> } >> >> +/** >> + * sys_landlock_add_rule - Add a new rule to a ruleset >> + * >> + * @ruleset_fd: File descriptor tied to the ruleset that should be >> extended >> + * with the new rule. >> + * @rule_type: Identify the structure type pointed to by @rule_attr >> (only >> + * LANDLOCK_RULE_PATH_BENEATH for now). >> + * @rule_attr: Pointer to a rule (only of type &struct >> + * landlock_path_beneath_attr for now). >> + * @flags: Must be 0. >> + * >> + * This system call enables to define a new rule and add it to an >> existing >> + * ruleset. >> + * >> + * Possible returned errors are: >> + * >> + * - EOPNOTSUPP: Landlock is supported by the kernel but disabled at >> boot time; >> + * - EINVAL: @flags is not 0, or inconsistent access in the rule (i.e. >> + * &landlock_path_beneath_attr.allowed_access is not a subset of >> the rule's >> + * accesses); >> + * - ENOMSG: Empty accesses (e.g. >> &landlock_path_beneath_attr.allowed_access); >> + * - EBADF: @ruleset_fd is not a file descriptor for the current >> thread, or a >> + * member of @rule_attr is not a file descriptor as expected; >> + * - EBADFD: @ruleset_fd is not a ruleset file descriptor, or a >> member of >> + * @rule_attr is not the expected file descriptor type (e.g. file open >> + * without O_PATH); >> + * - EPERM: @ruleset_fd has no write access to the underlying ruleset; >> + * - EFAULT: @rule_attr inconsistency. >> + */ >> +SYSCALL_DEFINE4(landlock_add_rule, >> + const int, ruleset_fd, const enum landlock_rule_type, rule_type, >> + const void __user *const, rule_attr, const __u32, flags) >> +{ >> + int err; >> + >> + if (!landlock_initialized) >> + return -EOPNOTSUPP; >> + >> + /* No flag for now. */ >> + if (flags) >> + return -EINVAL; > > As you can see in my yesterday patch, the get_ruleset_from_fd() call > should be here. > Ok. Thnaks > >> + >> + switch (rule_type) { >> + case LANDLOCK_RULE_PATH_BENEATH: >> + err = add_rule_path_beneath(ruleset_fd, rule_attr); >> + break; >> + default: >> + err = -EINVAL; >> + } >> + return err; >> +} >> + >> /* Enforcement */ >> >> /** >> -- >> 2.25.1 >> > .
diff --git a/security/landlock/syscalls.c b/security/landlock/syscalls.c index 5931b666321d..8c0f6165fe3a 100644 --- a/security/landlock/syscalls.c +++ b/security/landlock/syscalls.c @@ -274,54 +274,13 @@ static int get_path_from_fd(const s32 fd, struct path *const path) return err; } -/** - * sys_landlock_add_rule - Add a new rule to a ruleset - * - * @ruleset_fd: File descriptor tied to the ruleset that should be extended - * with the new rule. - * @rule_type: Identify the structure type pointed to by @rule_attr (only - * LANDLOCK_RULE_PATH_BENEATH for now). - * @rule_attr: Pointer to a rule (only of type &struct - * landlock_path_beneath_attr for now). - * @flags: Must be 0. - * - * This system call enables to define a new rule and add it to an existing - * ruleset. - * - * Possible returned errors are: - * - * - EOPNOTSUPP: Landlock is supported by the kernel but disabled at boot time; - * - EINVAL: @flags is not 0, or inconsistent access in the rule (i.e. - * &landlock_path_beneath_attr.allowed_access is not a subset of the rule's - * accesses); - * - ENOMSG: Empty accesses (e.g. &landlock_path_beneath_attr.allowed_access); - * - EBADF: @ruleset_fd is not a file descriptor for the current thread, or a - * member of @rule_attr is not a file descriptor as expected; - * - EBADFD: @ruleset_fd is not a ruleset file descriptor, or a member of - * @rule_attr is not the expected file descriptor type (e.g. file open - * without O_PATH); - * - EPERM: @ruleset_fd has no write access to the underlying ruleset; - * - EFAULT: @rule_attr inconsistency. - */ -SYSCALL_DEFINE4(landlock_add_rule, - const int, ruleset_fd, const enum landlock_rule_type, rule_type, - const void __user *const, rule_attr, const __u32, flags) +static int add_rule_path_beneath(const int ruleset_fd, const void *const rule_attr) { struct landlock_path_beneath_attr path_beneath_attr; struct path path; struct landlock_ruleset *ruleset; int res, err; - if (!landlock_initialized) - return -EOPNOTSUPP; - - /* No flag for now. */ - if (flags) - return -EINVAL; - - if (rule_type != LANDLOCK_RULE_PATH_BENEATH) - return -EINVAL; - /* Copies raw user space buffer, only one type for now. */ res = copy_from_user(&path_beneath_attr, rule_attr, sizeof(path_beneath_attr)); @@ -367,6 +326,58 @@ SYSCALL_DEFINE4(landlock_add_rule, return err; } +/** + * sys_landlock_add_rule - Add a new rule to a ruleset + * + * @ruleset_fd: File descriptor tied to the ruleset that should be extended + * with the new rule. + * @rule_type: Identify the structure type pointed to by @rule_attr (only + * LANDLOCK_RULE_PATH_BENEATH for now). + * @rule_attr: Pointer to a rule (only of type &struct + * landlock_path_beneath_attr for now). + * @flags: Must be 0. + * + * This system call enables to define a new rule and add it to an existing + * ruleset. + * + * Possible returned errors are: + * + * - EOPNOTSUPP: Landlock is supported by the kernel but disabled at boot time; + * - EINVAL: @flags is not 0, or inconsistent access in the rule (i.e. + * &landlock_path_beneath_attr.allowed_access is not a subset of the rule's + * accesses); + * - ENOMSG: Empty accesses (e.g. &landlock_path_beneath_attr.allowed_access); + * - EBADF: @ruleset_fd is not a file descriptor for the current thread, or a + * member of @rule_attr is not a file descriptor as expected; + * - EBADFD: @ruleset_fd is not a ruleset file descriptor, or a member of + * @rule_attr is not the expected file descriptor type (e.g. file open + * without O_PATH); + * - EPERM: @ruleset_fd has no write access to the underlying ruleset; + * - EFAULT: @rule_attr inconsistency. + */ +SYSCALL_DEFINE4(landlock_add_rule, + const int, ruleset_fd, const enum landlock_rule_type, rule_type, + const void __user *const, rule_attr, const __u32, flags) +{ + int err; + + if (!landlock_initialized) + return -EOPNOTSUPP; + + /* No flag for now. */ + if (flags) + return -EINVAL; + + switch (rule_type) { + case LANDLOCK_RULE_PATH_BENEATH: + err = add_rule_path_beneath(ruleset_fd, rule_attr); + break; + default: + err = -EINVAL; + } + return err; +} + /* Enforcement */ /**
Landlock_add_rule syscall was refactored to support new rule types in future Landlock versions. Add_rule_path_beneath() helper was added to support current filesystem rules. It is called by the switch case. Signed-off-by: Konstantin Meskhidze <konstantin.meskhidze@huawei.com> --- Changes since v3: * Split commit. * Refactoring landlock_add_rule syscall. --- security/landlock/syscalls.c | 95 ++++++++++++++++++++---------------- 1 file changed, 53 insertions(+), 42 deletions(-) -- 2.25.1