Unverified Commit b9f5ce27 authored by Günther Noack's avatar Günther Noack Committed by Mickaël Salaün
Browse files

landlock: Support file truncation 



Introduce the LANDLOCK_ACCESS_FS_TRUNCATE flag for file truncation.

This flag hooks into the path_truncate, file_truncate and
file_alloc_security LSM hooks and covers file truncation using
truncate(2), ftruncate(2), open(2) with O_TRUNC, as well as creat().

This change also increments the Landlock ABI version, updates
corresponding selftests, and updates code documentation to document
the flag.

In security/security.c, allocate security blobs at pointer-aligned
offsets. This fixes the problem where one LSM's security blob can
shift another LSM's security blob to an unaligned address (reported
by Nathan Chancellor).

The following operations are restricted:

open(2): requires the LANDLOCK_ACCESS_FS_TRUNCATE right if a file gets
implicitly truncated as part of the open() (e.g. using O_TRUNC).

Notable special cases:
* open(..., O_RDONLY|O_TRUNC) can truncate files as well in Linux
* open() with O_TRUNC does *not* need the TRUNCATE right when it
  creates a new file.

truncate(2) (on a path): requires the LANDLOCK_ACCESS_FS_TRUNCATE
right.

ftruncate(2) (on a file): requires that the file had the TRUNCATE
right when it was previously opened. File descriptors acquired by
other means than open(2) (e.g. memfd_create(2)) continue to support
truncation with ftruncate(2).

Cc: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: default avatarGünther Noack <gnoack3000@gmail.com>
Acked-by: Paul Moore <paul@paul-moore.com> (LSM)
Link: https://lore.kernel.org/r/20221018182216.301684-5-gnoack3000@gmail.com


Signed-off-by: default avatarMickaël Salaün <mic@digikod.net>
parent 52a13488

include/uapi/linux/landlock.h

+16 −5
Original line number Diff line number Diff line
@@ -95,8 +95,19 @@ struct landlock_path_beneath_attr { 
 * A file can only receive these access rights:

 *

 * - %LANDLOCK_ACCESS_FS_EXECUTE: Execute a file.

 * - %LANDLOCK_ACCESS_FS_WRITE_FILE: Open a file with write access.

 * - %LANDLOCK_ACCESS_FS_WRITE_FILE: Open a file with write access. Note that

 *   you might additionally need the %LANDLOCK_ACCESS_FS_TRUNCATE right in order

 *   to overwrite files with :manpage:`open(2)` using ``O_TRUNC`` or

 *   :manpage:`creat(2)`.

 * - %LANDLOCK_ACCESS_FS_READ_FILE: Open a file with read access.

 * - %LANDLOCK_ACCESS_FS_TRUNCATE: Truncate a file with :manpage:`truncate(2)`,

 *   :manpage:`ftruncate(2)`, :manpage:`creat(2)`, or :manpage:`open(2)` with

 *   ``O_TRUNC``. Whether an opened file can be truncated with

 *   :manpage:`ftruncate(2)` is determined during :manpage:`open(2)`, in the

 *   same way as read and write permissions are checked during

 *   :manpage:`open(2)` using %LANDLOCK_ACCESS_FS_READ_FILE and

 *   %LANDLOCK_ACCESS_FS_WRITE_FILE. This access right is available since the

 *   third version of the Landlock ABI.

 *

 * A directory can receive access rights related to files or directories.  The

 * following access right is applied to the directory itself, and the
@@ -139,10 +150,9 @@ struct landlock_path_beneath_attr { 
 *

 *   It is currently not possible to restrict some file-related actions

 *   accessible through these syscall families: :manpage:`chdir(2)`,

 *   :manpage:`truncate(2)`, :manpage:`stat(2)`, :manpage:`flock(2)`,

 *   :manpage:`chmod(2)`, :manpage:`chown(2)`, :manpage:`setxattr(2)`,

 *   :manpage:`utime(2)`, :manpage:`ioctl(2)`, :manpage:`fcntl(2)`,

 *   :manpage:`access(2)`.

 *   :manpage:`stat(2)`, :manpage:`flock(2)`, :manpage:`chmod(2)`,

 *   :manpage:`chown(2)`, :manpage:`setxattr(2)`, :manpage:`utime(2)`,

 *   :manpage:`ioctl(2)`, :manpage:`fcntl(2)`, :manpage:`access(2)`.

 *   Future Landlock evolutions will enable to restrict them.

 */

/* clang-format off */
@@ -160,6 +170,7 @@ struct landlock_path_beneath_attr { 
#define LANDLOCK_ACCESS_FS_MAKE_BLOCK			(1ULL << 11)

#define LANDLOCK_ACCESS_FS_MAKE_SYM			(1ULL << 12)

#define LANDLOCK_ACCESS_FS_REFER			(1ULL << 13)

#define LANDLOCK_ACCESS_FS_TRUNCATE			(1ULL << 14)

/* clang-format on */



#endif /* _UAPI_LINUX_LANDLOCK_H */

security/landlock/fs.c

+99 −5
Original line number Diff line number Diff line
@@ -146,7 +146,8 @@ static struct landlock_object *get_inode_object(struct inode *const inode) 
#define ACCESS_FILE ( \

	LANDLOCK_ACCESS_FS_EXECUTE | \

	LANDLOCK_ACCESS_FS_WRITE_FILE | \

	LANDLOCK_ACCESS_FS_READ_FILE)

	LANDLOCK_ACCESS_FS_READ_FILE | \

	LANDLOCK_ACCESS_FS_TRUNCATE)

/* clang-format on */



/*
@@ -1154,9 +1155,23 @@ static int hook_path_rmdir(const struct path *const dir, 
	return current_check_access_path(dir, LANDLOCK_ACCESS_FS_REMOVE_DIR);

}



static int hook_path_truncate(const struct path *const path)

{

	return current_check_access_path(path, LANDLOCK_ACCESS_FS_TRUNCATE);

}



/* File hooks */



static inline access_mask_t get_file_access(const struct file *const file)

/**

 * get_required_file_open_access - Get access needed to open a file

 *

 * @file: File being opened.

 *

 * Returns the access rights that are required for opening the given file,

 * depending on the file type and open mode.

 */

static inline access_mask_t

get_required_file_open_access(const struct file *const file)

{

	access_mask_t access = 0;
@@ -1174,19 +1189,95 @@ static inline access_mask_t get_file_access(const struct file *const file) 
	return access;

}



static int hook_file_alloc_security(struct file *const file)

{

	/*

	 * Grants all access rights, even if most of them are not checked later

	 * on. It is more consistent.

	 *

	 * Notably, file descriptors for regular files can also be acquired

	 * without going through the file_open hook, for example when using

	 * memfd_create(2).

	 */

	landlock_file(file)->allowed_access = LANDLOCK_MASK_ACCESS_FS;

	return 0;

}



static int hook_file_open(struct file *const file)

{

	layer_mask_t layer_masks[LANDLOCK_NUM_ACCESS_FS] = {};

	access_mask_t open_access_request, full_access_request, allowed_access;

	const access_mask_t optional_access = LANDLOCK_ACCESS_FS_TRUNCATE;

	const struct landlock_ruleset *const dom =

		landlock_get_current_domain();



	if (!dom)

		return 0;



	/*

	 * Because a file may be opened with O_PATH, get_file_access() may

	 * return 0.  This case will be handled with a future Landlock

	 * Because a file may be opened with O_PATH, get_required_file_open_access()

	 * may return 0.  This case will be handled with a future Landlock

	 * evolution.

	 */

	return check_access_path(dom, &file->f_path, get_file_access(file));

	open_access_request = get_required_file_open_access(file);



	/*

	 * We look up more access than what we immediately need for open(), so

	 * that we can later authorize operations on opened files.

	 */

	full_access_request = open_access_request | optional_access;



	if (is_access_to_paths_allowed(

		    dom, &file->f_path,

		    init_layer_masks(dom, full_access_request, &layer_masks),

		    &layer_masks, NULL, 0, NULL, NULL)) {

		allowed_access = full_access_request;

	} else {

		unsigned long access_bit;

		const unsigned long access_req = full_access_request;



		/*

		 * Calculate the actual allowed access rights from layer_masks.

		 * Add each access right to allowed_access which has not been

		 * vetoed by any layer.

		 */

		allowed_access = 0;

		for_each_set_bit(access_bit, &access_req,

				 ARRAY_SIZE(layer_masks)) {

			if (!layer_masks[access_bit])

				allowed_access |= BIT_ULL(access_bit);

		}

	}



	/*

	 * For operations on already opened files (i.e. ftruncate()), it is the

	 * access rights at the time of open() which decide whether the

	 * operation is permitted. Therefore, we record the relevant subset of

	 * file access rights in the opened struct file.

	 */

	landlock_file(file)->allowed_access = allowed_access;



	if ((open_access_request & allowed_access) == open_access_request)

		return 0;



	return -EACCES;

}



static int hook_file_truncate(struct file *const file)

{

	/*

	 * Allows truncation if the truncate right was available at the time of

	 * opening the file, to get a consistent access check as for read, write

	 * and execute operations.

	 *

	 * Note: For checks done based on the file's Landlock allowed access, we

	 * enforce them independently of whether the current thread is in a

	 * Landlock domain, so that open files passed between independent

	 * processes retain their behaviour.

	 */

	if (landlock_file(file)->allowed_access & LANDLOCK_ACCESS_FS_TRUNCATE)

		return 0;

	return -EACCES;

}



static struct security_hook_list landlock_hooks[] __lsm_ro_after_init = {
@@ -1206,8 +1297,11 @@ static struct security_hook_list landlock_hooks[] __lsm_ro_after_init = { 
	LSM_HOOK_INIT(path_symlink, hook_path_symlink),

	LSM_HOOK_INIT(path_unlink, hook_path_unlink),

	LSM_HOOK_INIT(path_rmdir, hook_path_rmdir),

	LSM_HOOK_INIT(path_truncate, hook_path_truncate),



	LSM_HOOK_INIT(file_alloc_security, hook_file_alloc_security),

	LSM_HOOK_INIT(file_open, hook_file_open),

	LSM_HOOK_INIT(file_truncate, hook_file_truncate),

};



__init void landlock_add_fs_hooks(void)

security/landlock/fs.h

+24 −0
Original line number Diff line number Diff line
@@ -36,6 +36,24 @@ struct landlock_inode_security { 
	struct landlock_object __rcu *object;

};



/**

 * struct landlock_file_security - File security blob

 *

 * This information is populated when opening a file in hook_file_open, and

 * tracks the relevant Landlock access rights that were available at the time

 * of opening the file. Other LSM hooks use these rights in order to authorize

 * operations on already opened files.

 */

struct landlock_file_security {

	/**

	 * @allowed_access: Access rights that were available at the time of

	 * opening the file. This is not necessarily the full set of access

	 * rights available at that time, but it's the necessary subset as

	 * needed to authorize later operations on the open file.

	 */

	access_mask_t allowed_access;

};



/**

 * struct landlock_superblock_security - Superblock security blob

 *
@@ -50,6 +68,12 @@ struct landlock_superblock_security { 
	atomic_long_t inode_refs;

};



static inline struct landlock_file_security *

landlock_file(const struct file *const file)

{

	return file->f_security + landlock_blob_sizes.lbs_file;

}



static inline struct landlock_inode_security *

landlock_inode(const struct inode *const inode)

{

security/landlock/limits.h

+1 −1
Original line number Diff line number Diff line
@@ -18,7 +18,7 @@ 
#define LANDLOCK_MAX_NUM_LAYERS		16

#define LANDLOCK_MAX_NUM_RULES		U32_MAX



#define LANDLOCK_LAST_ACCESS_FS		LANDLOCK_ACCESS_FS_REFER

#define LANDLOCK_LAST_ACCESS_FS		LANDLOCK_ACCESS_FS_TRUNCATE

#define LANDLOCK_MASK_ACCESS_FS		((LANDLOCK_LAST_ACCESS_FS << 1) - 1)

#define LANDLOCK_NUM_ACCESS_FS		__const_hweight64(LANDLOCK_MASK_ACCESS_FS)

security/landlock/setup.c

+1 −0
Original line number Diff line number Diff line
@@ -19,6 +19,7 @@ bool landlock_initialized __lsm_ro_after_init = false; 


struct lsm_blob_sizes landlock_blob_sizes __lsm_ro_after_init = {

	.lbs_cred = sizeof(struct landlock_cred_security),

	.lbs_file = sizeof(struct landlock_file_security),

	.lbs_inode = sizeof(struct landlock_inode_security),

	.lbs_superblock = sizeof(struct landlock_superblock_security),

};