Lines Matching +full:current +full:- +full:path
1 // SPDX-License-Identifier: GPL-2.0-only
3 * Landlock - System call implementations and user space interfaces
5 * Copyright © 2016-2020 Mickaël Salaün <mic@digikod.net>
6 * Copyright © 2018-2020 ANSSI
7 * Copyright © 2021-2025 Microsoft Corporation
10 #include <asm/current.h>
23 #include <linux/path.h>
52 "https://docs.kernel.org/userspace-api/landlock.html#boot-time-configuration\n");
57 * copy_min_struct_from_user - Safe future-proof argument copying
67 * Return: 0 on success, -errno on failure.
77 return -EFAULT;
83 return -EINVAL;
85 return -E2BIG;
133 struct landlock_ruleset *ruleset = filp->private_data;
143 return -EINVAL;
151 return -EINVAL;
158 * current task.
167 * The Landlock ABI version should be incremented for each new Landlock-related
170 * Documentation/userspace-api/landlock.rst should be updated to reflect the
173 * the errata documentation in Documentation/userspace-api/landlock.rst .
178 * sys_landlock_create_ruleset - Create a new ruleset
186 * - %LANDLOCK_CREATE_RULESET_VERSION
187 * - %LANDLOCK_CREATE_RULESET_ERRATA
196 * %LANDLOCK_CREATE_RULESET_ERRATA is set, or -errno on failure. Possible
199 * - %EOPNOTSUPP: Landlock is supported by the kernel but disabled at boot time;
200 * - %EINVAL: unknown @flags, or unknown access, or unknown scope, or too small
202 * - %EINVAL: quiet_access_fs, quiet_access_net, or quiet_scoped is not a
205 * - %E2BIG: @attr or @size inconsistencies;
206 * - %EFAULT: @attr or @size inconsistencies;
207 * - %ENOMSG: empty &landlock_ruleset_attr.handled_access_fs.
209 * .. kernel-doc:: include/uapi/linux/landlock.h
220 /* Build-time checks. */
224 return -EOPNOTSUPP;
228 return -EINVAL;
236 return -EINVAL;
247 /* Checks content (and 32-bits cast). */
250 return -EINVAL;
252 /* Checks network content (and 32-bits cast). */
255 return -EINVAL;
257 /* Checks IPC scoping content (and 32-bits cast). */
259 return -EINVAL;
268 return -EINVAL;
271 return -EINVAL;
274 return -EINVAL;
283 ruleset->quiet_masks.fs = ruleset_attr.quiet_access_fs;
284 ruleset->quiet_masks.net = ruleset_attr.quiet_access_net;
285 ruleset->quiet_masks.scope = ruleset_attr.quiet_scoped;
297 ruleset_fd = anon_inode_getfd("[landlock-ruleset]", &ruleset_fops,
315 return ERR_PTR(-EBADF);
318 if (fd_file(ruleset_f)->f_op != &ruleset_fops)
319 return ERR_PTR(-EBADFD);
320 if (!(fd_file(ruleset_f)->f_mode & mode))
321 return ERR_PTR(-EPERM);
322 ruleset = fd_file(ruleset_f)->private_data;
327 /* Path handling */
330 * @path: Must call put_path(@path) after the call if it succeeded.
332 static int get_path_from_fd(const s32 fd, struct path *const path)
337 fd, ((struct landlock_path_beneath_attr *)NULL)->parent_fd));
340 return -EBADF;
346 if ((fd_file(f)->f_op == &ruleset_fops) ||
347 (fd_file(f)->f_path.mnt->mnt_flags & MNT_INTERNAL) ||
348 (fd_file(f)->f_path.dentry->d_sb->s_flags & SB_NOUSER) ||
349 IS_PRIVATE(d_backing_inode(fd_file(f)->f_path.dentry)))
350 return -EBADFD;
352 *path = fd_file(f)->f_path;
353 path_get(path);
361 struct path path;
369 return -EFAULT;
373 * are ignored in path walks. However, the rule is not useless if it is
377 return -ENOMSG;
380 mask = ruleset->handled_masks.fs;
382 return -EINVAL;
385 if (flags & LANDLOCK_ADD_RULE_QUIET && !ruleset->quiet_masks.fs)
386 return -EINVAL;
389 err = get_path_from_fd(path_beneath_attr.parent_fd, &path);
394 err = landlock_append_fs_rule(ruleset, &path,
396 path_put(&path);
410 return -EFAULT;
418 return -ENOMSG;
421 mask = ruleset->handled_masks.net;
423 return -EINVAL;
426 if (flags & LANDLOCK_ADD_RULE_QUIET && !ruleset->quiet_masks.net)
427 return -EINVAL;
431 return -EINVAL;
439 * sys_landlock_add_rule - Add a new rule to a ruleset
451 * Return: 0 on success, or -errno on failure. Possible returned errors are:
453 * - %EOPNOTSUPP: Landlock is supported by the kernel but disabled at boot time;
454 * - %EAFNOSUPPORT: @rule_type is %LANDLOCK_RULE_NET_PORT but TCP/IP is not
456 * - %EINVAL: @flags is not valid;
457 * - %EINVAL: The rule accesses are inconsistent (i.e.
461 * - %EINVAL: &landlock_net_port_attr.port is greater than 65535;
462 * - %EINVAL: LANDLOCK_ADD_RULE_QUIET is passed but the ruleset has no
464 * - %ENOMSG: Empty accesses (e.g. &landlock_path_beneath_attr.allowed_access is
466 * - %EBADF: @ruleset_fd is not a file descriptor for the current thread, or a
468 * - %EBADFD: @ruleset_fd is not a ruleset file descriptor, or a member of
470 * - %EPERM: @ruleset_fd has no write access to the underlying ruleset;
471 * - %EFAULT: @rule_attr was not a valid address.
473 * .. kernel-doc:: include/uapi/linux/landlock.h
483 return -EOPNOTSUPP;
486 return -EINVAL;
499 return -EINVAL;
506 * sys_landlock_restrict_self - Enforce a ruleset on the calling thread
511 * - %LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF
512 * - %LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON
513 * - %LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF
514 * - %LANDLOCK_RESTRICT_SELF_TSYNC
515 * - %LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS
517 * This system call enforces a Landlock ruleset on the current thread.
527 * Return: 0 on success, or -errno on failure. Possible returned errors are:
529 * - %EOPNOTSUPP: Landlock is supported by the kernel but disabled at boot time;
530 * - %EINVAL: @flags contains an unknown bit.
531 * - %EBADF: @ruleset_fd is not a file descriptor for the current thread;
532 * - %EBADFD: @ruleset_fd is not a ruleset file descriptor;
533 * - %EPERM: @ruleset_fd has no read access to the underlying ruleset, or
534 * %LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS is not set while the current thread
537 * - %E2BIG: The maximum number of stacked rulesets is reached for the current
540 * .. kernel-doc:: include/uapi/linux/landlock.h
555 return -EOPNOTSUPP;
559 return -EINVAL;
562 * Similar checks as for seccomp(2), except that an -EPERM may be
567 !task_no_new_privs(current) &&
569 return -EPERM;
580 * -1 as ruleset_fd, optionally combined with
584 if (!(ruleset_fd == -1 &&
596 return -ENOMEM;
601 prev_log_subdomains = !new_llcred->log_subdomains_off;
602 new_llcred->log_subdomains_off = !prev_log_subdomains ||
609 * LANDLOCK_RESTRICT_SELF_TSYNC) and ruleset_fd is -1. We could
616 * manipulating the current credentials because they are
619 mutex_lock(&ruleset->lock);
620 new_dom = landlock_merge_ruleset(new_llcred->domain, ruleset);
622 mutex_unlock(&ruleset->lock);
627 * Emits the domain-creation event while @ruleset->lock is still
634 * This must come before the thread-sync wait below. Holding
635 * @ruleset->lock across landlock_restrict_sibling_threads()
637 * on the same @ruleset->lock cannot run the task_work that
638 * thread-sync waits for (the lock wait is uninterruptible).
639 * Emitting here keeps the lock off the thread-sync path.
641 * The trade-off is that the event fires for a domain that a
642 * later (rare) thread-sync failure aborts. That path emits the
644 * balanced (see the thread-sync error path below).
647 mutex_unlock(&ruleset->lock);
650 new_dom->hierarchy->log_same_exec = log_same_exec;
651 new_dom->hierarchy->log_new_exec = log_new_exec;
655 * too, even if a thread-sync failure aborts it below. Audit
660 new_dom->hierarchy->log_status = LANDLOCK_LOG_DISABLED;
662 new_dom->hierarchy->log_status = LANDLOCK_LOG_PENDING;
666 landlock_put_domain(new_llcred->domain);
667 new_llcred->domain = new_dom;
670 new_llcred->domain_exec |= BIT(new_dom->num_layers - 1);
679 * Thread-sync failed (rare), so the new domain is
693 task_set_no_new_privs(current);
695 /* Whole process: thread-sync swept siblings, or single-threaded. */
697 get_nr_threads(current) == 1;
703 task_no_new_privs(current));