From patchwork Mon Aug 14 17:28:16 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?G=C3=BCnther_Noack?= X-Patchwork-Id: 13353154 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 97824C04E69 for ; Mon, 14 Aug 2023 17:29:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230202AbjHNR33 (ORCPT ); Mon, 14 Aug 2023 13:29:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58404 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230398AbjHNR26 (ORCPT ); Mon, 14 Aug 2023 13:28:58 -0400 Received: from mail-ed1-x54a.google.com (mail-ed1-x54a.google.com [IPv6:2a00:1450:4864:20::54a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 16D8D10D5 for ; Mon, 14 Aug 2023 10:28:56 -0700 (PDT) Received: by mail-ed1-x54a.google.com with SMTP id 4fb4d7f45d1cf-51a5296eb8eso3037158a12.2 for ; Mon, 14 Aug 2023 10:28:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20221208; t=1692034134; x=1692638934; h=content-transfer-encoding:cc:to:from:subject:references :mime-version:message-id:in-reply-to:date:from:to:cc:subject:date :message-id:reply-to; bh=smHHZUXo6xifLxvzSdFKZuUE8vzgs5PoROM2xnAb1UU=; b=MmICPA+CBs0ocp8vk0U5aDzxtXLls/Da9mjxg3tWq5UHM37KvQHj9TtYVrpEQ5dkfr BTJZesfkpmlWL5xX9gL9fD52AaWffPyLQ7ea0v9+TPgzmOJT4TsnZc/IzKirh6oEH50s K1OJpxQ3AbBfQzCHIBP98X6s8qCWxL+5Q+yXWMHMd9GRObLn3lZKWat9BAK21yWwgeyF JmcKT7XQn618XBmzaVjVoWBUjASU1q4DpOMHd8FPnMALqMDMjqRsPvaVQW8rnrmEyUNa c1qY+zbAeal3t5q13QJfbz1rYML33vj1OU6Cp6HMNbP7kr0DBwk0cMQhzCa69naHldxa lubw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1692034134; x=1692638934; h=content-transfer-encoding:cc:to:from:subject:references :mime-version:message-id:in-reply-to:date:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=smHHZUXo6xifLxvzSdFKZuUE8vzgs5PoROM2xnAb1UU=; b=ZzoFydNt6U3LazNmgO4qg7gFgPg1YtbY7zz3NXmkJiDH4XZ1FQ+mqROGOcKuL+eGAD bUcf4pmRvSWz/XX/NLMwgKMBY9HqSjf+63HjONaSHLJRY3WiQRflouxrLT9NwVPxz1nK pmyELJ2fRqWYsVlfkZfcRrb0mZ5t94KgSKRUUpLqexkjQGqO6Pw4Qp+C3J/cu1ejGE1z qZV8cSVdYzsSKM50uOgCRW4WxG8Q3nrC+kUvapZP/lIN/mWY+ZAZQj1uvDuu85zyfuSv X8LFBms9mdkV7E4ZrLBXniQOnMirfN+Qa2E87wYOP5Erj5zIjEH7kMGCfIEEaqQsHY26 FMGg== X-Gm-Message-State: AOJu0YwkjyADUhix9jnCfxbrJU2HZhowDNgMp5D/QZXPxOiReSkv+0pS XltqhN8dI7KUc4MbKinOuNtPbly7qzTNHN1WSvNIfTz8KFkPrZNlS+RGkgdE7yqWwvHuIWgiYW3 bB1dDdn0+ffHdtzPA6l0kCg70slTzrtOk+MAIX9/2UWO3unQnPwm7jCTVW2au7NnMdvoZkkXBIc oarBrM7Q== X-Google-Smtp-Source: AGHT+IHmqMu/X9mmCiJCAAI9Pit6YQDW4JrH5hSYyJasXbkHuB54lsl2W5ZNCk/WmrELpo/GXDLWDp8pH9c= X-Received: from sport.zrh.corp.google.com ([2a00:79e0:9d:4:9ca9:bbb1:765a:e929]) (user=gnoack job=sendgmr) by 2002:a50:9e48:0:b0:525:4afe:dd7f with SMTP id z66-20020a509e48000000b005254afedd7fmr41439ede.6.1692034134651; Mon, 14 Aug 2023 10:28:54 -0700 (PDT) Date: Mon, 14 Aug 2023 19:28:16 +0200 In-Reply-To: <20230814172816.3907299-1-gnoack@google.com> Message-Id: <20230814172816.3907299-6-gnoack@google.com> Mime-Version: 1.0 References: <20230814172816.3907299-1-gnoack@google.com> X-Mailer: git-send-email 2.41.0.694.ge786442a9b-goog Subject: [PATCH v3 5/5] landlock: Document ioctl support From: " =?utf-8?q?G=C3=BCnther_Noack?= " To: linux-security-module@vger.kernel.org, " =?utf-8?q?Micka=C3=ABl_Sala?= =?utf-8?q?=C3=BCn?= " Cc: Jeff Xu , Jorge Lucangeli Obes , Allen Webb , Dmitry Torokhov , Paul Moore , Konstantin Meskhidze , Matt Bobrowski , linux-fsdevel@vger.kernel.org, " =?utf-8?q?G=C3=BCnther_Noack?= " Precedence: bulk List-ID: In the paragraph above the fallback logic, use the shorter phrasing from the landlock(7) man page. Signed-off-by: Günther Noack --- Documentation/userspace-api/landlock.rst | 74 ++++++++++++++++++------ 1 file changed, 57 insertions(+), 17 deletions(-) diff --git a/Documentation/userspace-api/landlock.rst b/Documentation/userspace-api/landlock.rst index d8cd8cd9ce25..e0e35e474307 100644 --- a/Documentation/userspace-api/landlock.rst +++ b/Documentation/userspace-api/landlock.rst @@ -61,18 +61,17 @@ the need to be explicit about the denied-by-default access rights. LANDLOCK_ACCESS_FS_MAKE_BLOCK | LANDLOCK_ACCESS_FS_MAKE_SYM | LANDLOCK_ACCESS_FS_REFER | - LANDLOCK_ACCESS_FS_TRUNCATE, + LANDLOCK_ACCESS_FS_TRUNCATE | + LANDLOCK_ACCESS_FS_IOCTL, }; Because we may not know on which kernel version an application will be executed, it is safer to follow a best-effort security approach. Indeed, we should try to protect users as much as possible whatever the kernel they are -using. To avoid binary enforcement (i.e. either all security features or -none), we can leverage a dedicated Landlock command to get the current version -of the Landlock ABI and adapt the handled accesses. Let's check if we should -remove the ``LANDLOCK_ACCESS_FS_REFER`` or ``LANDLOCK_ACCESS_FS_TRUNCATE`` -access rights, which are only supported starting with the second and third -version of the ABI. +using. + +To be compatible with older Linux versions, we detect the available Landlock ABI +version, and only use the available subset of access rights: .. code-block:: c @@ -92,6 +91,9 @@ version of the ABI. case 2: /* Removes LANDLOCK_ACCESS_FS_TRUNCATE for ABI < 3 */ ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_TRUNCATE; + case 3: + /* Removes LANDLOCK_ACCESS_FS_IOCTL for ABI < 4 */ + ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_IOCTL; } This enables to create an inclusive ruleset that will contain our rules. @@ -190,6 +192,7 @@ access rights per directory enables to change the location of such directory without relying on the destination directory access rights (except those that are required for this operation, see ``LANDLOCK_ACCESS_FS_REFER`` documentation). + Having self-sufficient hierarchies also helps to tighten the required access rights to the minimal set of data. This also helps avoid sinkhole directories, i.e. directories where data can be linked to but not linked from. However, @@ -283,18 +286,24 @@ It should also be noted that truncating files does not require the system call, this can also be done through :manpage:`open(2)` with the flags ``O_RDONLY | O_TRUNC``. -When opening a file, the availability of the ``LANDLOCK_ACCESS_FS_TRUNCATE`` -right is associated with the newly created file descriptor and will be used for -subsequent truncation attempts using :manpage:`ftruncate(2)`. The behavior is -similar to opening a file for reading or writing, where permissions are checked -during :manpage:`open(2)`, but not during the subsequent :manpage:`read(2)` and +The truncate right is associated with the opened file (see below). + +Rights associated with file descriptors +--------------------------------------- + +When opening a file, the availability of the ``LANDLOCK_ACCESS_FS_TRUNCATE`` and +``LANDLOCK_ACCESS_FS_IOCTL`` rights is associated with the newly created file +descriptor and will be used for subsequent truncation and ioctl attempts using +:manpage:`ftruncate(2)` and :manpage:`ioctl(2)`. The behavior is similar to +opening a file for reading or writing, where permissions are checked during +:manpage:`open(2)`, but not during the subsequent :manpage:`read(2)` and :manpage:`write(2)` calls. -As a consequence, it is possible to have multiple open file descriptors for the -same file, where one grants the right to truncate the file and the other does -not. It is also possible to pass such file descriptors between processes, -keeping their Landlock properties, even when these processes do not have an -enforced Landlock ruleset. +As a consequence, it is possible to have multiple open file descriptors +referring to the same file, where one grants the truncate or ioctl right and the +other does not. It is also possible to pass such file descriptors between +processes, keeping their Landlock properties, even when these processes do not +have an enforced Landlock ruleset. Compatibility ============= @@ -422,6 +431,27 @@ Memory usage Kernel memory allocated to create rulesets is accounted and can be restricted by the Documentation/admin-guide/cgroup-v1/memory.rst. +IOCTL support +------------- + +The ``LANDLOCK_ACCESS_FS_IOCTL`` access right restricts the use of +:manpage:`ioctl(2)`, but it only applies to newly opened files. This means +specifically that pre-existing file descriptors like STDIN, STDOUT and STDERR +are unaffected. + +Users should be aware that TTY devices have traditionally permitted to control +other processes on the same TTY through the ``TIOCSTI`` and ``TIOCLINUX`` IOCTL +commands. It is therefore recommended to close inherited TTY file descriptors. +The :manpage:`isatty(3)` function checks whether a given file descriptor is a +TTY. + +Landlock's IOCTL support is coarse-grained at the moment, but may become more +fine-grained in the future. Until then, users are advised to establish the +guarantees that they need through the file hierarchy, by only permitting the +``LANDLOCK_ACCESS_FS_IOCTL`` right on files where it is really harmless. In +cases where you can control the mounts, the ``nodev`` mount option can help to +rule out that device files can be accessed. + Previous limitations ==================== @@ -451,6 +481,16 @@ always allowed when using a kernel that only supports the first or second ABI. Starting with the Landlock ABI version 3, it is now possible to securely control truncation thanks to the new ``LANDLOCK_ACCESS_FS_TRUNCATE`` access right. +Ioctl (ABI < 4) +--------------- + +IOCTL operations could not be denied before the fourth Landlock ABI, so +:manpage:`ioctl(2)` is always allowed when using a kernel that only supports an +earlier ABI. + +Starting with the Landlock ABI version 4, it is possible to restrict the use of +:manpage:`ioctl(2)` using the new ``LANDLOCK_ACCESS_FS_IOCTL`` access right. + .. _kernel_support: Kernel support