| Message ID | 20231016015030.1684504-8-konstantin.meskhidze@huawei.com (mailing list archive) |
|---|---|
| State | Handled Elsewhere |
| Delegated to: | Paul Moore |
| Headers | show |
| Series | Network support for Landlock | expand |
On Mon, Oct 16, 2023 at 09:50:25AM +0800, Konstantin Meskhidze wrote: > Change the landlock_add_rule() syscall to support new rule types > in future Landlock versions. Add the add_rule_path_beneath() helper with next commits. Add the add_rule_path_beneath() helper > to support current filesystem rules.
On Mon, Oct 16, 2023 at 09:50:25AM +0800, Konstantin Meskhidze wrote: > Change the landlock_add_rule() syscall to support new rule types > in future Landlock versions. Add the add_rule_path_beneath() helper > to support current filesystem rules. > > Signed-off-by: Konstantin Meskhidze <konstantin.meskhidze@huawei.com> > Link: https://lore.kernel.org/r/20230920092641.832134-8-konstantin.meskhidze@huawei.com > Signed-off-by: Mickaël Salaün <mic@digikod.net> > --- > > Changes since v12: > * None. > > Changes since v11: > * None. > > Changes since v10: > * None. > > Changes since v9: > * Minor fixes: > - deletes unnecessary curly braces. > - deletes unnecessary empty line. > > Changes since v8: > * Refactors commit message. > * Minor fixes. > > Changes since v7: > * None > > Changes since v6: > * None > > Changes since v5: > * Refactors syscall landlock_add_rule() and add_rule_path_beneath() helper > to make argument check ordering consistent and get rid of partial revertings > in following patches. > * Rolls back refactoring base_test.c seltest. > * Formats code with clang-format-14. > > Changes since v4: > * Refactors add_rule_path_beneath() and landlock_add_rule() functions > to optimize code usage. > * Refactors base_test.c seltest: adds LANDLOCK_RULE_PATH_BENEATH > rule type in landlock_add_rule() call. > > Changes since v3: > * Split commit. > * Refactors landlock_add_rule syscall. > > --- > security/landlock/syscalls.c | 92 +++++++++++++++++++----------------- > 1 file changed, 48 insertions(+), 44 deletions(-) > > diff --git a/security/landlock/syscalls.c b/security/landlock/syscalls.c > index d35cd5d304db..8a54e87dbb17 100644 > --- a/security/landlock/syscalls.c > +++ b/security/landlock/syscalls.c > @@ -274,6 +274,47 @@ static int get_path_from_fd(const s32 fd, struct path *const path) > return err; > } > > +static int add_rule_path_beneath(struct landlock_ruleset *const ruleset, > + const void __user *const rule_attr) > +{ > + struct landlock_path_beneath_attr path_beneath_attr; > + struct path path; > + int res, err; > + access_mask_t mask; > + > + /* Copies raw user space buffer, only one type for now. */ > + res = copy_from_user(&path_beneath_attr, rule_attr, > + sizeof(path_beneath_attr)); > + if (res) > + return -EFAULT; > + > + /* > + * Informs about useless rule: empty allowed_access (i.e. deny rules) > + * are ignored in path walks. > + */ > + if (!path_beneath_attr.allowed_access) > + return -ENOMSG; > + > + /* > + * Checks that allowed_access matches the @ruleset constraints > + * (ruleset->access_masks[0] is automatically upgraded to 64-bits). > + */ You now can replace this comment block with that: + /* Checks that allowed_access matches the @ruleset constraints. */ > + mask = landlock_get_raw_fs_access_mask(ruleset, 0); > + if ((path_beneath_attr.allowed_access | mask) != mask) > + return -EINVAL; > + > + /* Gets and checks the new rule. */ > + err = get_path_from_fd(path_beneath_attr.parent_fd, &path); > + if (err) > + return err; > + > + /* Imports the new rule. */ > + err = landlock_append_fs_rule(ruleset, &path, > + path_beneath_attr.allowed_access); > + path_put(&path); > + return err; > +}
10/18/2023 7:34 PM, Mickaël Salaün пишет: > On Mon, Oct 16, 2023 at 09:50:25AM +0800, Konstantin Meskhidze wrote: >> Change the landlock_add_rule() syscall to support new rule types >> in future Landlock versions. Add the add_rule_path_beneath() helper >> to support current filesystem rules. >> >> Signed-off-by: Konstantin Meskhidze <konstantin.meskhidze@huawei.com> >> Link: https://lore.kernel.org/r/20230920092641.832134-8-konstantin.meskhidze@huawei.com >> Signed-off-by: Mickaël Salaün <mic@digikod.net> >> --- >> >> Changes since v12: >> * None. >> >> Changes since v11: >> * None. >> >> Changes since v10: >> * None. >> >> Changes since v9: >> * Minor fixes: >> - deletes unnecessary curly braces. >> - deletes unnecessary empty line. >> >> Changes since v8: >> * Refactors commit message. >> * Minor fixes. >> >> Changes since v7: >> * None >> >> Changes since v6: >> * None >> >> Changes since v5: >> * Refactors syscall landlock_add_rule() and add_rule_path_beneath() helper >> to make argument check ordering consistent and get rid of partial revertings >> in following patches. >> * Rolls back refactoring base_test.c seltest. >> * Formats code with clang-format-14. >> >> Changes since v4: >> * Refactors add_rule_path_beneath() and landlock_add_rule() functions >> to optimize code usage. >> * Refactors base_test.c seltest: adds LANDLOCK_RULE_PATH_BENEATH >> rule type in landlock_add_rule() call. >> >> Changes since v3: >> * Split commit. >> * Refactors landlock_add_rule syscall. >> >> --- >> security/landlock/syscalls.c | 92 +++++++++++++++++++----------------- >> 1 file changed, 48 insertions(+), 44 deletions(-) >> >> diff --git a/security/landlock/syscalls.c b/security/landlock/syscalls.c >> index d35cd5d304db..8a54e87dbb17 100644 >> --- a/security/landlock/syscalls.c >> +++ b/security/landlock/syscalls.c >> @@ -274,6 +274,47 @@ static int get_path_from_fd(const s32 fd, struct path *const path) >> return err; >> } >> >> +static int add_rule_path_beneath(struct landlock_ruleset *const ruleset, >> + const void __user *const rule_attr) >> +{ >> + struct landlock_path_beneath_attr path_beneath_attr; >> + struct path path; >> + int res, err; >> + access_mask_t mask; >> + >> + /* Copies raw user space buffer, only one type for now. */ >> + res = copy_from_user(&path_beneath_attr, rule_attr, >> + sizeof(path_beneath_attr)); >> + if (res) >> + return -EFAULT; >> + >> + /* >> + * Informs about useless rule: empty allowed_access (i.e. deny rules) >> + * are ignored in path walks. >> + */ >> + if (!path_beneath_attr.allowed_access) >> + return -ENOMSG; >> + >> + /* >> + * Checks that allowed_access matches the @ruleset constraints >> + * (ruleset->access_masks[0] is automatically upgraded to 64-bits). >> + */ > > You now can replace this comment block with that: > + /* Checks that allowed_access matches the @ruleset constraints. */ Done. > >> + mask = landlock_get_raw_fs_access_mask(ruleset, 0); >> + if ((path_beneath_attr.allowed_access | mask) != mask) >> + return -EINVAL; >> + >> + /* Gets and checks the new rule. */ >> + err = get_path_from_fd(path_beneath_attr.parent_fd, &path); >> + if (err) >> + return err; >> + >> + /* Imports the new rule. */ >> + err = landlock_append_fs_rule(ruleset, &path, >> + path_beneath_attr.allowed_access); >> + path_put(&path); >> + return err; >> +} > .
10/18/2023 3:28 PM, Mickaël Salaün пишет: > On Mon, Oct 16, 2023 at 09:50:25AM +0800, Konstantin Meskhidze wrote: >> Change the landlock_add_rule() syscall to support new rule types >> in future Landlock versions. Add the add_rule_path_beneath() helper > > with next commits. Add the add_rule_path_beneath() helper Done. > >> to support current filesystem rules. > .
diff --git a/security/landlock/syscalls.c b/security/landlock/syscalls.c index d35cd5d304db..8a54e87dbb17 100644 --- a/security/landlock/syscalls.c +++ b/security/landlock/syscalls.c @@ -274,6 +274,47 @@ static int get_path_from_fd(const s32 fd, struct path *const path) return err; } +static int add_rule_path_beneath(struct landlock_ruleset *const ruleset, + const void __user *const rule_attr) +{ + struct landlock_path_beneath_attr path_beneath_attr; + struct path path; + int res, err; + access_mask_t mask; + + /* Copies raw user space buffer, only one type for now. */ + res = copy_from_user(&path_beneath_attr, rule_attr, + sizeof(path_beneath_attr)); + if (res) + return -EFAULT; + + /* + * Informs about useless rule: empty allowed_access (i.e. deny rules) + * are ignored in path walks. + */ + if (!path_beneath_attr.allowed_access) + return -ENOMSG; + + /* + * Checks that allowed_access matches the @ruleset constraints + * (ruleset->access_masks[0] is automatically upgraded to 64-bits). + */ + mask = landlock_get_raw_fs_access_mask(ruleset, 0); + if ((path_beneath_attr.allowed_access | mask) != mask) + return -EINVAL; + + /* Gets and checks the new rule. */ + err = get_path_from_fd(path_beneath_attr.parent_fd, &path); + if (err) + return err; + + /* Imports the new rule. */ + err = landlock_append_fs_rule(ruleset, &path, + path_beneath_attr.allowed_access); + path_put(&path); + return err; +} + /** * sys_landlock_add_rule - Add a new rule to a ruleset * @@ -306,11 +347,8 @@ SYSCALL_DEFINE4(landlock_add_rule, const int, ruleset_fd, const enum landlock_rule_type, rule_type, const void __user *const, rule_attr, const __u32, flags) { - struct landlock_path_beneath_attr path_beneath_attr; - struct path path; struct landlock_ruleset *ruleset; - int res, err; - access_mask_t mask; + int err; if (!landlock_initialized) return -EOPNOTSUPP; @@ -324,48 +362,14 @@ SYSCALL_DEFINE4(landlock_add_rule, const int, ruleset_fd, if (IS_ERR(ruleset)) return PTR_ERR(ruleset); - if (rule_type != LANDLOCK_RULE_PATH_BENEATH) { + switch (rule_type) { + case LANDLOCK_RULE_PATH_BENEATH: + err = add_rule_path_beneath(ruleset, rule_attr); + break; + default: err = -EINVAL; - goto out_put_ruleset; - } - - /* Copies raw user space buffer, only one type for now. */ - res = copy_from_user(&path_beneath_attr, rule_attr, - sizeof(path_beneath_attr)); - if (res) { - err = -EFAULT; - goto out_put_ruleset; + break; } - - /* - * Informs about useless rule: empty allowed_access (i.e. deny rules) - * are ignored in path walks. - */ - if (!path_beneath_attr.allowed_access) { - err = -ENOMSG; - goto out_put_ruleset; - } - /* - * Checks that allowed_access matches the @ruleset constraints - * (ruleset->access_masks[0] is automatically upgraded to 64-bits). - */ - mask = landlock_get_raw_fs_access_mask(ruleset, 0); - if ((path_beneath_attr.allowed_access | mask) != mask) { - err = -EINVAL; - goto out_put_ruleset; - } - - /* Gets and checks the new rule. */ - err = get_path_from_fd(path_beneath_attr.parent_fd, &path); - if (err) - goto out_put_ruleset; - - /* Imports the new rule. */ - err = landlock_append_fs_rule(ruleset, &path, - path_beneath_attr.allowed_access); - path_put(&path); - -out_put_ruleset: landlock_put_ruleset(ruleset); return err; }