| Message ID | 20240814030151.2380280-10-ivanov.mikhail1@huawei-partners.com (mailing list archive) |
|---|---|
| State | RFC |
| Headers | show |
| Series | Support TCP listen access-control | expand |
| Context | Check | Description |
|---|---|---|
| netdev/tree_selection | success | Not a local patch, async |
On Wed, Aug 14, 2024 at 11:01:51AM +0800, Mikhail Ivanov wrote: > Extend sample with TCP listen control logic. > > Signed-off-by: Mikhail Ivanov <ivanov.mikhail1@huawei-partners.com> > --- > samples/landlock/sandboxer.c | 31 ++++++++++++++++++++++++++----- > 1 file changed, 26 insertions(+), 5 deletions(-) > > diff --git a/samples/landlock/sandboxer.c b/samples/landlock/sandboxer.c > index e8223c3e781a..3f50cb3f8039 100644 > --- a/samples/landlock/sandboxer.c > +++ b/samples/landlock/sandboxer.c > @@ -55,6 +55,7 @@ static inline int landlock_restrict_self(const int ruleset_fd, > #define ENV_FS_RW_NAME "LL_FS_RW" > #define ENV_TCP_BIND_NAME "LL_TCP_BIND" > #define ENV_TCP_CONNECT_NAME "LL_TCP_CONNECT" > +#define ENV_TCP_LISTEN_NAME "LL_TCP_LISTEN" > #define ENV_DELIMITER ":" > > static int parse_path(char *env_path, const char ***const path_list) > @@ -208,7 +209,7 @@ static int populate_ruleset_net(const char *const env_var, const int ruleset_fd, > > /* clang-format on */ > > -#define LANDLOCK_ABI_LAST 5 > +#define LANDLOCK_ABI_LAST 6 > > int main(const int argc, char *const argv[], char *const *const envp) > { > @@ -222,15 +223,16 @@ int main(const int argc, char *const argv[], char *const *const envp) > struct landlock_ruleset_attr ruleset_attr = { > .handled_access_fs = access_fs_rw, > .handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP | > - LANDLOCK_ACCESS_NET_CONNECT_TCP, > + LANDLOCK_ACCESS_NET_CONNECT_TCP | > + LANDLOCK_ACCESS_NET_LISTEN_TCP, > }; > > if (argc < 2) { > fprintf(stderr, > - "usage: %s=\"...\" %s=\"...\" %s=\"...\" %s=\"...\"%s " > + "usage: %s=\"...\" %s=\"...\" %s=\"...\" %s=\"...\" %s=\"...\"%s " > "<cmd> [args]...\n\n", > ENV_FS_RO_NAME, ENV_FS_RW_NAME, ENV_TCP_BIND_NAME, > - ENV_TCP_CONNECT_NAME, argv[0]); > + ENV_TCP_CONNECT_NAME, ENV_TCP_LISTEN_NAME, argv[0]); > fprintf(stderr, > "Execute a command in a restricted environment.\n\n"); > fprintf(stderr, > @@ -251,15 +253,19 @@ int main(const int argc, char *const argv[], char *const *const envp) > fprintf(stderr, > "* %s: list of ports allowed to connect (client).\n", > ENV_TCP_CONNECT_NAME); > + fprintf(stderr, > + "* %s: list of ports allowed to listen (server).\n", > + ENV_TCP_LISTEN_NAME); > fprintf(stderr, > "\nexample:\n" > "%s=\"${PATH}:/lib:/usr:/proc:/etc:/dev/urandom\" " > "%s=\"/dev/null:/dev/full:/dev/zero:/dev/pts:/tmp\" " > "%s=\"9418\" " > "%s=\"80:443\" " > + "%s=\"9418\" " > "%s bash -i\n\n", > ENV_FS_RO_NAME, ENV_FS_RW_NAME, ENV_TCP_BIND_NAME, > - ENV_TCP_CONNECT_NAME, argv[0]); > + ENV_TCP_CONNECT_NAME, ENV_TCP_LISTEN_NAME, argv[0]); > fprintf(stderr, > "This sandboxer can use Landlock features " > "up to ABI version %d.\n", > @@ -326,6 +332,11 @@ int main(const int argc, char *const argv[], char *const *const envp) > case 4: > /* Removes LANDLOCK_ACCESS_FS_IOCTL_DEV for ABI < 5 */ > ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_IOCTL_DEV; > + __attribute__((fallthrough)); > + case 5: > + /* Removes LANDLOCK_ACCESS_NET_LISTEN support for ABI < 6 */ > + ruleset_attr.handled_access_net &= > + ~(LANDLOCK_ACCESS_NET_LISTEN_TCP); (same remark as on other patch set) ABI version has shifted by one in the meantime. > > fprintf(stderr, > "Hint: You should update the running kernel " > @@ -357,6 +368,12 @@ int main(const int argc, char *const argv[], char *const *const envp) > ruleset_attr.handled_access_net &= > ~LANDLOCK_ACCESS_NET_CONNECT_TCP; > } > + /* Removes listen access attribute if not supported by a user. */ (also same remark as on other patch set) Please s/supported/requested/, for consistency. > + env_port_name = getenv(ENV_TCP_LISTEN_NAME); > + if (!env_port_name) { > + ruleset_attr.handled_access_net &= > + ~LANDLOCK_ACCESS_NET_LISTEN_TCP; > + } > > ruleset_fd = > landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); > @@ -380,6 +397,10 @@ int main(const int argc, char *const argv[], char *const *const envp) > LANDLOCK_ACCESS_NET_CONNECT_TCP)) { > goto err_close_ruleset; > } > + if (populate_ruleset_net(ENV_TCP_LISTEN_NAME, ruleset_fd, > + LANDLOCK_ACCESS_NET_LISTEN_TCP)) { > + goto err_close_ruleset; > + } > > if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { > perror("Failed to restrict privileges"); > -- > 2.34.1 > Reviewed-by: Günther Noack <gnoack3000@gmail.com>
On 10/5/2024 7:57 PM, Günther Noack wrote: > On Wed, Aug 14, 2024 at 11:01:51AM +0800, Mikhail Ivanov wrote: >> Extend sample with TCP listen control logic. >> >> Signed-off-by: Mikhail Ivanov <ivanov.mikhail1@huawei-partners.com> >> --- >> samples/landlock/sandboxer.c | 31 ++++++++++++++++++++++++++----- >> 1 file changed, 26 insertions(+), 5 deletions(-) >> >> diff --git a/samples/landlock/sandboxer.c b/samples/landlock/sandboxer.c >> index e8223c3e781a..3f50cb3f8039 100644 >> --- a/samples/landlock/sandboxer.c >> +++ b/samples/landlock/sandboxer.c >> @@ -55,6 +55,7 @@ static inline int landlock_restrict_self(const int ruleset_fd, >> #define ENV_FS_RW_NAME "LL_FS_RW" >> #define ENV_TCP_BIND_NAME "LL_TCP_BIND" >> #define ENV_TCP_CONNECT_NAME "LL_TCP_CONNECT" >> +#define ENV_TCP_LISTEN_NAME "LL_TCP_LISTEN" >> #define ENV_DELIMITER ":" >> >> static int parse_path(char *env_path, const char ***const path_list) >> @@ -208,7 +209,7 @@ static int populate_ruleset_net(const char *const env_var, const int ruleset_fd, >> >> /* clang-format on */ >> >> -#define LANDLOCK_ABI_LAST 5 >> +#define LANDLOCK_ABI_LAST 6 >> >> int main(const int argc, char *const argv[], char *const *const envp) >> { >> @@ -222,15 +223,16 @@ int main(const int argc, char *const argv[], char *const *const envp) >> struct landlock_ruleset_attr ruleset_attr = { >> .handled_access_fs = access_fs_rw, >> .handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP | >> - LANDLOCK_ACCESS_NET_CONNECT_TCP, >> + LANDLOCK_ACCESS_NET_CONNECT_TCP | >> + LANDLOCK_ACCESS_NET_LISTEN_TCP, >> }; >> >> if (argc < 2) { >> fprintf(stderr, >> - "usage: %s=\"...\" %s=\"...\" %s=\"...\" %s=\"...\"%s " >> + "usage: %s=\"...\" %s=\"...\" %s=\"...\" %s=\"...\" %s=\"...\"%s " >> "<cmd> [args]...\n\n", >> ENV_FS_RO_NAME, ENV_FS_RW_NAME, ENV_TCP_BIND_NAME, >> - ENV_TCP_CONNECT_NAME, argv[0]); >> + ENV_TCP_CONNECT_NAME, ENV_TCP_LISTEN_NAME, argv[0]); >> fprintf(stderr, >> "Execute a command in a restricted environment.\n\n"); >> fprintf(stderr, >> @@ -251,15 +253,19 @@ int main(const int argc, char *const argv[], char *const *const envp) >> fprintf(stderr, >> "* %s: list of ports allowed to connect (client).\n", >> ENV_TCP_CONNECT_NAME); >> + fprintf(stderr, >> + "* %s: list of ports allowed to listen (server).\n", >> + ENV_TCP_LISTEN_NAME); >> fprintf(stderr, >> "\nexample:\n" >> "%s=\"${PATH}:/lib:/usr:/proc:/etc:/dev/urandom\" " >> "%s=\"/dev/null:/dev/full:/dev/zero:/dev/pts:/tmp\" " >> "%s=\"9418\" " >> "%s=\"80:443\" " >> + "%s=\"9418\" " >> "%s bash -i\n\n", >> ENV_FS_RO_NAME, ENV_FS_RW_NAME, ENV_TCP_BIND_NAME, >> - ENV_TCP_CONNECT_NAME, argv[0]); >> + ENV_TCP_CONNECT_NAME, ENV_TCP_LISTEN_NAME, argv[0]); >> fprintf(stderr, >> "This sandboxer can use Landlock features " >> "up to ABI version %d.\n", >> @@ -326,6 +332,11 @@ int main(const int argc, char *const argv[], char *const *const envp) >> case 4: >> /* Removes LANDLOCK_ACCESS_FS_IOCTL_DEV for ABI < 5 */ >> ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_IOCTL_DEV; >> + __attribute__((fallthrough)); >> + case 5: >> + /* Removes LANDLOCK_ACCESS_NET_LISTEN support for ABI < 6 */ >> + ruleset_attr.handled_access_net &= >> + ~(LANDLOCK_ACCESS_NET_LISTEN_TCP); > > (same remark as on other patch set) > > ABI version has shifted by one in the meantime. Thanks, I'll update it for the next version. > >> >> fprintf(stderr, >> "Hint: You should update the running kernel " >> @@ -357,6 +368,12 @@ int main(const int argc, char *const argv[], char *const *const envp) >> ruleset_attr.handled_access_net &= >> ~LANDLOCK_ACCESS_NET_CONNECT_TCP; >> } >> + /* Removes listen access attribute if not supported by a user. */ > > (also same remark as on other patch set) > > Please s/supported/requested/, for consistency. Ok, thanks! > >> + env_port_name = getenv(ENV_TCP_LISTEN_NAME); >> + if (!env_port_name) { >> + ruleset_attr.handled_access_net &= >> + ~LANDLOCK_ACCESS_NET_LISTEN_TCP; >> + } >> >> ruleset_fd = >> landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); >> @@ -380,6 +397,10 @@ int main(const int argc, char *const argv[], char *const *const envp) >> LANDLOCK_ACCESS_NET_CONNECT_TCP)) { >> goto err_close_ruleset; >> } >> + if (populate_ruleset_net(ENV_TCP_LISTEN_NAME, ruleset_fd, >> + LANDLOCK_ACCESS_NET_LISTEN_TCP)) { >> + goto err_close_ruleset; >> + } >> >> if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { >> perror("Failed to restrict privileges"); >> -- >> 2.34.1 >> > > Reviewed-by: Günther Noack <gnoack3000@gmail.com>
diff --git a/samples/landlock/sandboxer.c b/samples/landlock/sandboxer.c index e8223c3e781a..3f50cb3f8039 100644 --- a/samples/landlock/sandboxer.c +++ b/samples/landlock/sandboxer.c @@ -55,6 +55,7 @@ static inline int landlock_restrict_self(const int ruleset_fd, #define ENV_FS_RW_NAME "LL_FS_RW" #define ENV_TCP_BIND_NAME "LL_TCP_BIND" #define ENV_TCP_CONNECT_NAME "LL_TCP_CONNECT" +#define ENV_TCP_LISTEN_NAME "LL_TCP_LISTEN" #define ENV_DELIMITER ":" static int parse_path(char *env_path, const char ***const path_list) @@ -208,7 +209,7 @@ static int populate_ruleset_net(const char *const env_var, const int ruleset_fd, /* clang-format on */ -#define LANDLOCK_ABI_LAST 5 +#define LANDLOCK_ABI_LAST 6 int main(const int argc, char *const argv[], char *const *const envp) { @@ -222,15 +223,16 @@ int main(const int argc, char *const argv[], char *const *const envp) struct landlock_ruleset_attr ruleset_attr = { .handled_access_fs = access_fs_rw, .handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP | - LANDLOCK_ACCESS_NET_CONNECT_TCP, + LANDLOCK_ACCESS_NET_CONNECT_TCP | + LANDLOCK_ACCESS_NET_LISTEN_TCP, }; if (argc < 2) { fprintf(stderr, - "usage: %s=\"...\" %s=\"...\" %s=\"...\" %s=\"...\"%s " + "usage: %s=\"...\" %s=\"...\" %s=\"...\" %s=\"...\" %s=\"...\"%s " "<cmd> [args]...\n\n", ENV_FS_RO_NAME, ENV_FS_RW_NAME, ENV_TCP_BIND_NAME, - ENV_TCP_CONNECT_NAME, argv[0]); + ENV_TCP_CONNECT_NAME, ENV_TCP_LISTEN_NAME, argv[0]); fprintf(stderr, "Execute a command in a restricted environment.\n\n"); fprintf(stderr, @@ -251,15 +253,19 @@ int main(const int argc, char *const argv[], char *const *const envp) fprintf(stderr, "* %s: list of ports allowed to connect (client).\n", ENV_TCP_CONNECT_NAME); + fprintf(stderr, + "* %s: list of ports allowed to listen (server).\n", + ENV_TCP_LISTEN_NAME); fprintf(stderr, "\nexample:\n" "%s=\"${PATH}:/lib:/usr:/proc:/etc:/dev/urandom\" " "%s=\"/dev/null:/dev/full:/dev/zero:/dev/pts:/tmp\" " "%s=\"9418\" " "%s=\"80:443\" " + "%s=\"9418\" " "%s bash -i\n\n", ENV_FS_RO_NAME, ENV_FS_RW_NAME, ENV_TCP_BIND_NAME, - ENV_TCP_CONNECT_NAME, argv[0]); + ENV_TCP_CONNECT_NAME, ENV_TCP_LISTEN_NAME, argv[0]); fprintf(stderr, "This sandboxer can use Landlock features " "up to ABI version %d.\n", @@ -326,6 +332,11 @@ int main(const int argc, char *const argv[], char *const *const envp) case 4: /* Removes LANDLOCK_ACCESS_FS_IOCTL_DEV for ABI < 5 */ ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_IOCTL_DEV; + __attribute__((fallthrough)); + case 5: + /* Removes LANDLOCK_ACCESS_NET_LISTEN support for ABI < 6 */ + ruleset_attr.handled_access_net &= + ~(LANDLOCK_ACCESS_NET_LISTEN_TCP); fprintf(stderr, "Hint: You should update the running kernel " @@ -357,6 +368,12 @@ int main(const int argc, char *const argv[], char *const *const envp) ruleset_attr.handled_access_net &= ~LANDLOCK_ACCESS_NET_CONNECT_TCP; } + /* Removes listen access attribute if not supported by a user. */ + env_port_name = getenv(ENV_TCP_LISTEN_NAME); + if (!env_port_name) { + ruleset_attr.handled_access_net &= + ~LANDLOCK_ACCESS_NET_LISTEN_TCP; + } ruleset_fd = landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); @@ -380,6 +397,10 @@ int main(const int argc, char *const argv[], char *const *const envp) LANDLOCK_ACCESS_NET_CONNECT_TCP)) { goto err_close_ruleset; } + if (populate_ruleset_net(ENV_TCP_LISTEN_NAME, ruleset_fd, + LANDLOCK_ACCESS_NET_LISTEN_TCP)) { + goto err_close_ruleset; + } if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { perror("Failed to restrict privileges");
Extend sample with TCP listen control logic. Signed-off-by: Mikhail Ivanov <ivanov.mikhail1@huawei-partners.com> --- samples/landlock/sandboxer.c | 31 ++++++++++++++++++++++++++----- 1 file changed, 26 insertions(+), 5 deletions(-)