1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Landlock LSM - Ruleset management 4 * 5 * Copyright © 2016-2020 Mickaël Salaün <mic@digikod.net> 6 * Copyright © 2018-2020 ANSSI 7 * Copyright © 2026 Cloudflare, Inc. 8 */ 9 10 #include <linux/bits.h> 11 #include <linux/bug.h> 12 #include <linux/cleanup.h> 13 #include <linux/compiler_types.h> 14 #include <linux/err.h> 15 #include <linux/errno.h> 16 #include <linux/kernel.h> 17 #include <linux/lockdep.h> 18 #include <linux/mutex.h> 19 #include <linux/overflow.h> 20 #include <linux/rbtree.h> 21 #include <linux/refcount.h> 22 #include <linux/slab.h> 23 #include <linux/spinlock.h> 24 #include <uapi/linux/landlock.h> 25 26 #include "access.h" 27 #include "id.h" 28 #include "limits.h" 29 #include "object.h" 30 #include "ruleset.h" 31 32 #include <trace/events/landlock.h> 33 34 struct landlock_ruleset * 35 landlock_create_ruleset(const access_mask_t fs_access_mask, 36 const access_mask_t net_access_mask, 37 const access_mask_t scope_mask) 38 { 39 struct landlock_ruleset *new_ruleset; 40 41 /* Informs about useless ruleset. */ 42 if (!fs_access_mask && !net_access_mask && !scope_mask) 43 return ERR_PTR(-ENOMSG); 44 45 new_ruleset = kzalloc_obj(*new_ruleset, GFP_KERNEL_ACCOUNT); 46 if (!new_ruleset) 47 return ERR_PTR(-ENOMEM); 48 49 refcount_set(&new_ruleset->usage, 1); 50 mutex_init(&new_ruleset->lock); 51 new_ruleset->rules.root_inode = RB_ROOT; 52 53 #if IS_ENABLED(CONFIG_INET) 54 new_ruleset->rules.root_net_port = RB_ROOT; 55 #endif /* IS_ENABLED(CONFIG_INET) */ 56 57 #ifdef CONFIG_TRACEPOINTS 58 new_ruleset->id = landlock_get_id_range(1); 59 #endif /* CONFIG_TRACEPOINTS */ 60 61 /* The caller must only pass supported access rights and scopes. */ 62 if (fs_access_mask) { 63 const access_mask_t mask = fs_access_mask & 64 LANDLOCK_MASK_ACCESS_FS; 65 66 WARN_ON_ONCE(fs_access_mask != mask); 67 new_ruleset->handled_masks.fs |= mask; 68 } 69 if (net_access_mask) { 70 const access_mask_t mask = net_access_mask & 71 LANDLOCK_MASK_ACCESS_NET; 72 73 WARN_ON_ONCE(net_access_mask != mask); 74 new_ruleset->handled_masks.net |= mask; 75 } 76 if (scope_mask) { 77 const access_mask_t mask = scope_mask & LANDLOCK_MASK_SCOPE; 78 79 WARN_ON_ONCE(scope_mask != mask); 80 new_ruleset->handled_masks.scope |= mask; 81 } 82 return new_ruleset; 83 } 84 85 static void build_check_rule(void) 86 { 87 const struct landlock_rule rule = { 88 .num_layers = ~0, 89 }; 90 91 /* 92 * Checks that .num_layers is large enough for at least 93 * LANDLOCK_MAX_NUM_LAYERS layers. 94 */ 95 BUILD_BUG_ON(rule.num_layers < LANDLOCK_MAX_NUM_LAYERS); 96 } 97 98 static bool is_object_pointer(const enum landlock_key_type key_type) 99 { 100 switch (key_type) { 101 case LANDLOCK_KEY_INODE: 102 return true; 103 104 #if IS_ENABLED(CONFIG_INET) 105 case LANDLOCK_KEY_NET_PORT: 106 return false; 107 #endif /* IS_ENABLED(CONFIG_INET) */ 108 109 default: 110 WARN_ON_ONCE(1); 111 return false; 112 } 113 } 114 115 static struct landlock_rule * 116 create_rule(const struct landlock_id id, 117 const struct landlock_layer (*layers)[], const u32 num_layers, 118 const struct landlock_layer *const new_layer) 119 { 120 struct landlock_rule *new_rule; 121 u32 new_num_layers; 122 123 build_check_rule(); 124 if (new_layer) { 125 /* Should already be checked by landlock_merge_ruleset(). */ 126 if (WARN_ON_ONCE(num_layers >= LANDLOCK_MAX_NUM_LAYERS)) 127 return ERR_PTR(-E2BIG); 128 new_num_layers = num_layers + 1; 129 } else { 130 new_num_layers = num_layers; 131 } 132 new_rule = kzalloc_flex(*new_rule, layers, new_num_layers, 133 GFP_KERNEL_ACCOUNT); 134 if (!new_rule) 135 return ERR_PTR(-ENOMEM); 136 RB_CLEAR_NODE(&new_rule->node); 137 if (is_object_pointer(id.type)) { 138 /* This should have been caught by landlock_store_rule(). */ 139 WARN_ON_ONCE(!id.key.object); 140 landlock_get_object(id.key.object); 141 } 142 143 new_rule->key = id.key; 144 new_rule->num_layers = new_num_layers; 145 /* Copies the original layer stack. */ 146 memcpy(new_rule->layers, layers, 147 flex_array_size(new_rule, layers, num_layers)); 148 if (new_layer) 149 /* Adds a copy of @new_layer on the layer stack. */ 150 new_rule->layers[new_rule->num_layers - 1] = *new_layer; 151 return new_rule; 152 } 153 154 static void free_rule(struct landlock_rule *const rule, 155 const enum landlock_key_type key_type) 156 { 157 might_sleep(); 158 if (!rule) 159 return; 160 if (is_object_pointer(key_type)) 161 landlock_put_object(rule->key.object); 162 kfree(rule); 163 } 164 165 static void build_check_ruleset(void) 166 { 167 const struct landlock_rules rules = { 168 .num_rules = ~0, 169 }; 170 171 BUILD_BUG_ON(rules.num_rules < LANDLOCK_MAX_NUM_RULES); 172 } 173 174 /** 175 * landlock_store_rule - Create and insert a rule into the rule storage 176 * 177 * @rules: The rule storage to be updated. The caller is responsible for 178 * any required locking. For rulesets, this means holding 179 * &landlock_ruleset.lock. For domains under construction, no lock is 180 * needed because the domain is not yet visible to other tasks. 181 * @id: The ID to build the new rule with. The underlying kernel object, if 182 * any, must be held by the caller. 183 * @layers: One or multiple layers to be copied into the new rule. 184 * @num_layers: The number of @layers entries. 185 * 186 * When user space requests to add a new rule to a ruleset, @layers only 187 * contains one entry and this entry is not assigned to any level. In this 188 * case, the new rule will extend @rules, similarly to a boolean OR between 189 * access rights. 190 * 191 * When merging a ruleset in a domain, or copying a domain, @layers will be 192 * added to @rules as new constraints, similarly to a boolean AND between access 193 * rights. 194 * 195 * Return: 0 on success, -errno on failure. 196 */ 197 int landlock_store_rule(struct landlock_rules *const rules, 198 const struct landlock_id id, 199 const struct landlock_layer (*layers)[], 200 const size_t num_layers) 201 { 202 struct rb_node **walker_node; 203 struct rb_node *parent_node = NULL; 204 struct landlock_rule *new_rule; 205 struct rb_root *root; 206 207 might_sleep(); 208 if (WARN_ON_ONCE(!layers)) 209 return -ENOENT; 210 211 if (is_object_pointer(id.type) && WARN_ON_ONCE(!id.key.object)) 212 return -ENOENT; 213 214 root = landlock_get_rule_root(rules, id.type); 215 if (IS_ERR(root)) 216 return PTR_ERR(root); 217 218 walker_node = &root->rb_node; 219 while (*walker_node) { 220 struct landlock_rule *const this = 221 rb_entry(*walker_node, struct landlock_rule, node); 222 223 if (this->key.data != id.key.data) { 224 parent_node = *walker_node; 225 if (this->key.data < id.key.data) 226 walker_node = &((*walker_node)->rb_right); 227 else 228 walker_node = &((*walker_node)->rb_left); 229 continue; 230 } 231 232 /* Only a single-level layer should match an existing rule. */ 233 if (WARN_ON_ONCE(num_layers != 1)) 234 return -EINVAL; 235 236 /* If there is a matching rule, updates it. */ 237 if ((*layers)[0].level == 0) { 238 /* 239 * Extends access rights when the request comes from 240 * landlock_add_rule(2), i.e. @rules is not a domain. 241 */ 242 if (WARN_ON_ONCE(this->num_layers != 1)) 243 return -EINVAL; 244 if (WARN_ON_ONCE(this->layers[0].level != 0)) 245 return -EINVAL; 246 this->layers[0].access |= (*layers)[0].access; 247 this->layers[0].flags.quiet |= (*layers)[0].flags.quiet; 248 return 0; 249 } 250 251 if (WARN_ON_ONCE(this->layers[0].level == 0)) 252 return -EINVAL; 253 254 /* 255 * Intersects access rights when it is a merge between a 256 * ruleset and a domain. 257 */ 258 new_rule = create_rule(id, &this->layers, this->num_layers, 259 &(*layers)[0]); 260 if (IS_ERR(new_rule)) 261 return PTR_ERR(new_rule); 262 rb_replace_node(&this->node, &new_rule->node, root); 263 free_rule(this, id.type); 264 return 0; 265 } 266 267 /* There is no match for @id. */ 268 build_check_ruleset(); 269 if (rules->num_rules >= LANDLOCK_MAX_NUM_RULES) 270 return -E2BIG; 271 new_rule = create_rule(id, layers, num_layers, NULL); 272 if (IS_ERR(new_rule)) 273 return PTR_ERR(new_rule); 274 rb_link_node(&new_rule->node, parent_node, walker_node); 275 rb_insert_color(&new_rule->node, root); 276 rules->num_rules++; 277 return 0; 278 } 279 280 static void build_check_layer(void) 281 { 282 const struct landlock_layer layer = { 283 .level = ~0, 284 .access = ~0, 285 }; 286 287 /* 288 * Checks that .level and .access are large enough to contain their expected 289 * maximum values. 290 */ 291 BUILD_BUG_ON(layer.level < LANDLOCK_MAX_NUM_LAYERS); 292 BUILD_BUG_ON(layer.access < LANDLOCK_MASK_ACCESS_FS); 293 } 294 295 /* @ruleset must be locked by the caller. */ 296 int landlock_insert_rule(struct landlock_ruleset *const ruleset, 297 const struct landlock_id id, 298 const access_mask_t access, const u32 flags) 299 { 300 struct landlock_layer layers[] = { { 301 .access = access, 302 /* 303 * When @level is zero, landlock_store_rule() extends @ruleset. 304 */ 305 .level = 0, 306 .flags = { 307 .quiet = !!(flags & LANDLOCK_ADD_RULE_QUIET), 308 }, 309 } }; 310 int err; 311 312 build_check_layer(); 313 lockdep_assert_held(&ruleset->lock); 314 err = landlock_store_rule(&ruleset->rules, id, &layers, 315 ARRAY_SIZE(layers)); 316 317 #ifdef CONFIG_TRACEPOINTS 318 if (!err) 319 ruleset->version++; 320 #endif /* CONFIG_TRACEPOINTS */ 321 322 return err; 323 } 324 325 void landlock_free_rules(struct landlock_rules *const rules) 326 { 327 struct landlock_rule *freeme, *next; 328 329 might_sleep(); 330 rbtree_postorder_for_each_entry_safe(freeme, next, &rules->root_inode, 331 node) 332 free_rule(freeme, LANDLOCK_KEY_INODE); 333 334 #if IS_ENABLED(CONFIG_INET) 335 rbtree_postorder_for_each_entry_safe(freeme, next, 336 &rules->root_net_port, node) 337 free_rule(freeme, LANDLOCK_KEY_NET_PORT); 338 #endif /* IS_ENABLED(CONFIG_INET) */ 339 } 340 341 static void free_ruleset(struct landlock_ruleset *const ruleset) 342 { 343 might_sleep(); 344 trace_landlock_free_ruleset(ruleset); 345 landlock_free_rules(&ruleset->rules); 346 kfree(ruleset); 347 } 348 349 void landlock_put_ruleset(struct landlock_ruleset *const ruleset) 350 { 351 might_sleep(); 352 if (ruleset && refcount_dec_and_test(&ruleset->usage)) 353 free_ruleset(ruleset); 354 } 355