1 /* SPDX-License-Identifier: GPL-2.0-only */ 2 /* 3 * Landlock LSM - Ruleset management 4 * 5 * Copyright © 2016-2020 Mickaël Salaün <mic@digikod.net> 6 * Copyright © 2018-2020 ANSSI 7 * Copyright © 2026 Cloudflare, Inc. 8 */ 9 10 #ifndef _SECURITY_LANDLOCK_RULESET_H 11 #define _SECURITY_LANDLOCK_RULESET_H 12 13 #include <linux/cleanup.h> 14 #include <linux/err.h> 15 #include <linux/mutex.h> 16 #include <linux/rbtree.h> 17 #include <linux/refcount.h> 18 19 #include "access.h" 20 #include "limits.h" 21 #include "object.h" 22 23 /** 24 * struct landlock_layer - Access rights for a given layer 25 */ 26 struct landlock_layer { 27 /** 28 * @level: Position of this layer in the layer stack. Starts from 1. 29 */ 30 u8 level; 31 /** 32 * @flags: Bitfield for special flags attached to this rule. 33 */ 34 struct { 35 /** 36 * @flags.quiet: Suppresses denial logs for the object covered by 37 * this rule in this domain. For filesystem rules, this inherits 38 * down the file hierarchy. 39 */ 40 u8 quiet : 1; 41 } flags; 42 /** 43 * @access: Bitfield of allowed actions on the kernel object. They are 44 * relative to the object type (e.g. %LANDLOCK_ACTION_FS_READ). 45 */ 46 access_mask_t access; 47 }; 48 49 /** 50 * union landlock_key - Key of a ruleset's red-black tree 51 */ 52 union landlock_key { 53 /** 54 * @object: Pointer to identify a kernel object (e.g. an inode). 55 */ 56 struct landlock_object *object; 57 /** 58 * @data: Raw data to identify an arbitrary 32-bit value 59 * (e.g. a TCP port). 60 */ 61 uintptr_t data; 62 }; 63 64 /** 65 * enum landlock_key_type - Type of &union landlock_key 66 */ 67 enum landlock_key_type { 68 /** 69 * @LANDLOCK_KEY_INODE: Type of &landlock_rules.root_inode's node keys. 70 */ 71 LANDLOCK_KEY_INODE = 1, 72 /** 73 * @LANDLOCK_KEY_NET_PORT: Type of &landlock_rules.root_net_port's node 74 * keys. 75 */ 76 LANDLOCK_KEY_NET_PORT, 77 }; 78 79 /** 80 * struct landlock_id - Unique rule identifier for a ruleset 81 */ 82 struct landlock_id { 83 /** 84 * @key: Identifies either a kernel object (e.g. an inode) or 85 * a raw value (e.g. a TCP port). 86 */ 87 union landlock_key key; 88 /** 89 * @type: Type of a landlock_ruleset's root tree. 90 */ 91 const enum landlock_key_type type; 92 }; 93 94 /** 95 * struct landlock_rule - Access rights tied to an object 96 */ 97 struct landlock_rule { 98 /** 99 * @node: Node in the ruleset's red-black tree. 100 */ 101 struct rb_node node; 102 /** 103 * @key: A union to identify either a kernel object (e.g. an inode) or 104 * a raw data value (e.g. a network socket port). This is used as a key 105 * for this ruleset element. The pointer is set once and never 106 * modified. It always points to an allocated object because each rule 107 * increments the refcount of its object. 108 */ 109 union landlock_key key; 110 /** 111 * @num_layers: Number of entries in @layers. 112 */ 113 u32 num_layers; 114 /** 115 * @layers: Stack of layers, from the latest to the newest, implemented 116 * as a flexible array member (FAM). 117 */ 118 struct landlock_layer layers[] __counted_by(num_layers); 119 }; 120 121 /** 122 * struct landlock_rules - Red-black tree storage for Landlock rules 123 * 124 * This structure holds the rule trees shared by both rulesets and domains. 125 */ 126 struct landlock_rules { 127 /** 128 * @root_inode: Root of a red-black tree containing &struct 129 * landlock_rule nodes with inode object. Immutable for domains. 130 */ 131 struct rb_root root_inode; 132 133 #if IS_ENABLED(CONFIG_INET) 134 /** 135 * @root_net_port: Root of a red-black tree containing &struct 136 * landlock_rule nodes with network port. Immutable for domains. 137 */ 138 struct rb_root root_net_port; 139 #endif /* IS_ENABLED(CONFIG_INET) */ 140 141 /** 142 * @num_rules: Number of non-overlapping (i.e. not for the same object) 143 * rules in this tree storage. 144 */ 145 u32 num_rules; 146 }; 147 148 /** 149 * struct landlock_ruleset - Landlock ruleset 150 * 151 * This data structure must contain unique entries, be updatable, and quick to 152 * match an object. 153 */ 154 struct landlock_ruleset { 155 /** 156 * @rules: Red-black tree storage for rules. 157 */ 158 struct landlock_rules rules; 159 /** 160 * @lock: Protects against concurrent modifications of @rules, if @usage 161 * is greater than zero. 162 */ 163 struct mutex lock; 164 /** 165 * @usage: Number of file descriptors referencing this ruleset. 166 */ 167 refcount_t usage; 168 169 #ifdef CONFIG_TRACEPOINTS 170 /** 171 * @version: Counter incremented on each successful 172 * landlock_add_rule(2), including when it only extends an existing 173 * rule's access rights. Used by tracepoints to correlate a domain with 174 * the exact ruleset state it was created from. Protected by @lock. 175 */ 176 u32 version; 177 /** 178 * @id: Unique identifier for this ruleset, used for tracing. 179 */ 180 u64 id; 181 #endif /* CONFIG_TRACEPOINTS */ 182 183 /** 184 * @quiet_masks: Stores the quiet flags for an unmerged ruleset. For a 185 * merged domain, this is stored in each layer's struct 186 * landlock_hierarchy instead. 187 */ 188 struct access_masks quiet_masks; 189 /** 190 * @handled_masks: Contains the subset of filesystem and network actions 191 * that are handled by this ruleset. 192 */ 193 struct access_masks handled_masks; 194 }; 195 196 struct landlock_ruleset * 197 landlock_create_ruleset(const access_mask_t access_mask_fs, 198 const access_mask_t access_mask_net, 199 const access_mask_t scope_mask); 200 201 void landlock_put_ruleset(struct landlock_ruleset *const ruleset); 202 203 DEFINE_FREE(landlock_put_ruleset, struct landlock_ruleset *, 204 if (!IS_ERR_OR_NULL(_T)) landlock_put_ruleset(_T)) 205 206 int landlock_insert_rule(struct landlock_ruleset *const ruleset, 207 const struct landlock_id id, 208 const access_mask_t access, const u32 flags); 209 210 int landlock_store_rule(struct landlock_rules *const rules, 211 const struct landlock_id id, 212 const struct landlock_layer (*layers)[], 213 const size_t num_layers); 214 215 void landlock_free_rules(struct landlock_rules *const rules); 216 217 /** 218 * landlock_get_rule_root - Get the root of a rule tree by key type 219 * 220 * @rules: The rules storage to look up. 221 * @key_type: The type of key to select the tree for. 222 * 223 * Return: A pointer to the rb_root, or ERR_PTR(-EINVAL) on unknown type. 224 */ 225 static inline struct rb_root * 226 landlock_get_rule_root(struct landlock_rules *const rules, 227 const enum landlock_key_type key_type) 228 { 229 switch (key_type) { 230 case LANDLOCK_KEY_INODE: 231 return &rules->root_inode; 232 233 #if IS_ENABLED(CONFIG_INET) 234 case LANDLOCK_KEY_NET_PORT: 235 return &rules->root_net_port; 236 #endif /* IS_ENABLED(CONFIG_INET) */ 237 238 default: 239 WARN_ON_ONCE(1); 240 return ERR_PTR(-EINVAL); 241 } 242 } 243 244 static inline void landlock_get_ruleset(struct landlock_ruleset *const ruleset) 245 { 246 if (ruleset) 247 refcount_inc(&ruleset->usage); 248 } 249 250 #endif /* _SECURITY_LANDLOCK_RULESET_H */ 251