xref: /linux/security/landlock/ruleset.h (revision 67f8bc848ee31831336bd478e57d2f993551902e)
1 /* SPDX-License-Identifier: GPL-2.0-only */
2 /*
3  * Landlock LSM - Ruleset management
4  *
5  * Copyright © 2016-2020 Mickaël Salaün <mic@digikod.net>
6  * Copyright © 2018-2020 ANSSI
7  * Copyright © 2026 Cloudflare, Inc.
8  */
9 
10 #ifndef _SECURITY_LANDLOCK_RULESET_H
11 #define _SECURITY_LANDLOCK_RULESET_H
12 
13 #include <linux/cleanup.h>
14 #include <linux/err.h>
15 #include <linux/mutex.h>
16 #include <linux/rbtree.h>
17 #include <linux/refcount.h>
18 
19 #include "access.h"
20 #include "limits.h"
21 #include "object.h"
22 
23 /**
24  * struct landlock_layer - Access rights for a given layer
25  */
26 struct landlock_layer {
27 	/**
28 	 * @level: Position of this layer in the layer stack.  Starts from 1.
29 	 */
30 	u8 level;
31 	/**
32 	 * @flags: Bitfield for special flags attached to this rule.
33 	 */
34 	struct {
35 		/**
36 		 * @flags.quiet: Suppresses denial logs for the object covered by
37 		 * this rule in this domain.  For filesystem rules, this inherits
38 		 * down the file hierarchy.
39 		 */
40 		u8 quiet : 1;
41 	} flags;
42 	/**
43 	 * @access: Bitfield of allowed actions on the kernel object.  They are
44 	 * relative to the object type (e.g. %LANDLOCK_ACTION_FS_READ).
45 	 */
46 	access_mask_t access;
47 };
48 
49 /**
50  * union landlock_key - Key of a ruleset's red-black tree
51  */
52 union landlock_key {
53 	/**
54 	 * @object: Pointer to identify a kernel object (e.g. an inode).
55 	 */
56 	struct landlock_object *object;
57 	/**
58 	 * @data: Raw data to identify an arbitrary 32-bit value
59 	 * (e.g. a TCP port).
60 	 */
61 	uintptr_t data;
62 };
63 
64 /**
65  * enum landlock_key_type - Type of &union landlock_key
66  */
67 enum landlock_key_type {
68 	/**
69 	 * @LANDLOCK_KEY_INODE: Type of &landlock_rules.root_inode's node keys.
70 	 */
71 	LANDLOCK_KEY_INODE = 1,
72 	/**
73 	 * @LANDLOCK_KEY_NET_PORT: Type of &landlock_rules.root_net_port's node
74 	 * keys.
75 	 */
76 	LANDLOCK_KEY_NET_PORT,
77 };
78 
79 /**
80  * struct landlock_id - Unique rule identifier for a ruleset
81  */
82 struct landlock_id {
83 	/**
84 	 * @key: Identifies either a kernel object (e.g. an inode) or
85 	 * a raw value (e.g. a TCP port).
86 	 */
87 	union landlock_key key;
88 	/**
89 	 * @type: Type of a landlock_ruleset's root tree.
90 	 */
91 	const enum landlock_key_type type;
92 };
93 
94 /**
95  * struct landlock_rule - Access rights tied to an object
96  */
97 struct landlock_rule {
98 	/**
99 	 * @node: Node in the ruleset's red-black tree.
100 	 */
101 	struct rb_node node;
102 	/**
103 	 * @key: A union to identify either a kernel object (e.g. an inode) or
104 	 * a raw data value (e.g. a network socket port). This is used as a key
105 	 * for this ruleset element.  The pointer is set once and never
106 	 * modified.  It always points to an allocated object because each rule
107 	 * increments the refcount of its object.
108 	 */
109 	union landlock_key key;
110 	/**
111 	 * @num_layers: Number of entries in @layers.
112 	 */
113 	u32 num_layers;
114 	/**
115 	 * @layers: Stack of layers, from the latest to the newest, implemented
116 	 * as a flexible array member (FAM).
117 	 */
118 	struct landlock_layer layers[] __counted_by(num_layers);
119 };
120 
121 /**
122  * struct landlock_rules - Red-black tree storage for Landlock rules
123  *
124  * This structure holds the rule trees shared by both rulesets and domains.
125  */
126 struct landlock_rules {
127 	/**
128 	 * @root_inode: Root of a red-black tree containing &struct
129 	 * landlock_rule nodes with inode object.  Immutable for domains.
130 	 */
131 	struct rb_root root_inode;
132 
133 #if IS_ENABLED(CONFIG_INET)
134 	/**
135 	 * @root_net_port: Root of a red-black tree containing &struct
136 	 * landlock_rule nodes with network port.  Immutable for domains.
137 	 */
138 	struct rb_root root_net_port;
139 #endif /* IS_ENABLED(CONFIG_INET) */
140 
141 	/**
142 	 * @num_rules: Number of non-overlapping (i.e. not for the same object)
143 	 * rules in this tree storage.
144 	 */
145 	u32 num_rules;
146 };
147 
148 /**
149  * struct landlock_ruleset - Landlock ruleset
150  *
151  * This data structure must contain unique entries, be updatable, and quick to
152  * match an object.
153  */
154 struct landlock_ruleset {
155 	/**
156 	 * @rules: Red-black tree storage for rules.
157 	 */
158 	struct landlock_rules rules;
159 	/**
160 	 * @lock: Protects against concurrent modifications of @rules, if @usage
161 	 * is greater than zero.
162 	 */
163 	struct mutex lock;
164 	/**
165 	 * @usage: Number of file descriptors referencing this ruleset.
166 	 */
167 	refcount_t usage;
168 
169 #ifdef CONFIG_TRACEPOINTS
170 	/**
171 	 * @version: Counter incremented on each successful
172 	 * landlock_add_rule(2), including when it only extends an existing
173 	 * rule's access rights.  Used by tracepoints to correlate a domain with
174 	 * the exact ruleset state it was created from.  Protected by @lock.
175 	 */
176 	u32 version;
177 	/**
178 	 * @id: Unique identifier for this ruleset, used for tracing.
179 	 */
180 	u64 id;
181 #endif /* CONFIG_TRACEPOINTS */
182 
183 	/**
184 	 * @quiet_masks: Stores the quiet flags for an unmerged ruleset.  For a
185 	 * merged domain, this is stored in each layer's struct
186 	 * landlock_hierarchy instead.
187 	 */
188 	struct access_masks quiet_masks;
189 	/**
190 	 * @handled_masks: Contains the subset of filesystem and network actions
191 	 * that are handled by this ruleset.
192 	 */
193 	struct access_masks handled_masks;
194 };
195 
196 struct landlock_ruleset *
197 landlock_create_ruleset(const access_mask_t access_mask_fs,
198 			const access_mask_t access_mask_net,
199 			const access_mask_t scope_mask);
200 
201 void landlock_put_ruleset(struct landlock_ruleset *const ruleset);
202 
203 DEFINE_FREE(landlock_put_ruleset, struct landlock_ruleset *,
204 	    if (!IS_ERR_OR_NULL(_T)) landlock_put_ruleset(_T))
205 
206 int landlock_insert_rule(struct landlock_ruleset *const ruleset,
207 			 const struct landlock_id id,
208 			 const access_mask_t access, const u32 flags);
209 
210 int landlock_store_rule(struct landlock_rules *const rules,
211 			const struct landlock_id id,
212 			const struct landlock_layer (*layers)[],
213 			const size_t num_layers);
214 
215 void landlock_free_rules(struct landlock_rules *const rules);
216 
217 /**
218  * landlock_get_rule_root - Get the root of a rule tree by key type
219  *
220  * @rules: The rules storage to look up.
221  * @key_type: The type of key to select the tree for.
222  *
223  * Return: A pointer to the rb_root, or ERR_PTR(-EINVAL) on unknown type.
224  */
225 static inline struct rb_root *
226 landlock_get_rule_root(struct landlock_rules *const rules,
227 		       const enum landlock_key_type key_type)
228 {
229 	switch (key_type) {
230 	case LANDLOCK_KEY_INODE:
231 		return &rules->root_inode;
232 
233 #if IS_ENABLED(CONFIG_INET)
234 	case LANDLOCK_KEY_NET_PORT:
235 		return &rules->root_net_port;
236 #endif /* IS_ENABLED(CONFIG_INET) */
237 
238 	default:
239 		WARN_ON_ONCE(1);
240 		return ERR_PTR(-EINVAL);
241 	}
242 }
243 
244 static inline void landlock_get_ruleset(struct landlock_ruleset *const ruleset)
245 {
246 	if (ruleset)
247 		refcount_inc(&ruleset->usage);
248 }
249 
250 #endif /* _SECURITY_LANDLOCK_RULESET_H */
251