1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Landlock - System call implementations and user space interfaces 4 * 5 * Copyright © 2016-2020 Mickaël Salaün <mic@digikod.net> 6 * Copyright © 2018-2020 ANSSI 7 * Copyright © 2021-2025 Microsoft Corporation 8 */ 9 10 #include <asm/current.h> 11 #include <linux/anon_inodes.h> 12 #include <linux/bitops.h> 13 #include <linux/build_bug.h> 14 #include <linux/capability.h> 15 #include <linux/cleanup.h> 16 #include <linux/compiler_types.h> 17 #include <linux/dcache.h> 18 #include <linux/err.h> 19 #include <linux/errno.h> 20 #include <linux/fs.h> 21 #include <linux/limits.h> 22 #include <linux/mount.h> 23 #include <linux/ns/ns_common_types.h> 24 #include <linux/path.h> 25 #include <linux/sched.h> 26 #include <linux/sched/signal.h> 27 #include <linux/security.h> 28 #include <linux/stddef.h> 29 #include <linux/syscalls.h> 30 #include <linux/types.h> 31 #include <linux/uaccess.h> 32 #include <uapi/linux/landlock.h> 33 34 #include "cap.h" 35 #include "cred.h" 36 #include "domain.h" 37 #include "fs.h" 38 #include "limits.h" 39 #include "net.h" 40 #include "ns.h" 41 #include "ruleset.h" 42 #include "setup.h" 43 #include "tsync.h" 44 45 #include <trace/events/landlock.h> 46 47 static bool is_initialized(void) 48 { 49 if (likely(landlock_initialized)) 50 return true; 51 52 pr_warn_once( 53 "Disabled but requested by user space. " 54 "You should enable Landlock at boot time: " 55 "https://docs.kernel.org/userspace-api/landlock.html#boot-time-configuration\n"); 56 return false; 57 } 58 59 /** 60 * copy_min_struct_from_user - Safe future-proof argument copying 61 * 62 * Extend copy_struct_from_user() to check for consistent user buffer. 63 * 64 * @dst: Kernel space pointer or NULL. 65 * @ksize: Actual size of the data pointed to by @dst. 66 * @ksize_min: Minimal required size to be copied. 67 * @src: User space pointer or NULL. 68 * @usize: (Alleged) size of the data pointed to by @src. 69 * 70 * Return: 0 on success, -errno on failure. 71 */ 72 static __always_inline int 73 copy_min_struct_from_user(void *const dst, const size_t ksize, 74 const size_t ksize_min, const void __user *const src, 75 const size_t usize) 76 { 77 /* Checks buffer inconsistencies. */ 78 BUILD_BUG_ON(!dst); 79 if (!src) 80 return -EFAULT; 81 82 /* Checks size ranges. */ 83 BUILD_BUG_ON(ksize <= 0); 84 BUILD_BUG_ON(ksize < ksize_min); 85 if (usize < ksize_min) 86 return -EINVAL; 87 if (usize > PAGE_SIZE) 88 return -E2BIG; 89 90 /* Copies user buffer and fills with zeros. */ 91 return copy_struct_from_user(dst, ksize, src, usize); 92 } 93 94 /* 95 * This function only contains arithmetic operations with constants, leading to 96 * BUILD_BUG_ON(). The related code is evaluated and checked at build time, 97 * but it is then ignored thanks to compiler optimizations. 98 */ 99 static void build_check_abi(void) 100 { 101 struct landlock_ruleset_attr ruleset_attr; 102 struct landlock_path_beneath_attr path_beneath_attr; 103 struct landlock_net_port_attr net_port_attr; 104 struct landlock_namespace_attr namespace_attr; 105 struct landlock_capability_attr capability_attr; 106 size_t ruleset_size, path_beneath_size, net_port_size; 107 size_t namespace_size, capability_size; 108 109 /* 110 * For each user space ABI structures, first checks that there is no 111 * hole in them, then checks that all architectures have the same 112 * struct size. 113 */ 114 ruleset_size = sizeof(ruleset_attr.handled_access_fs); 115 ruleset_size += sizeof(ruleset_attr.handled_access_net); 116 ruleset_size += sizeof(ruleset_attr.scoped); 117 ruleset_size += sizeof(ruleset_attr.quiet_access_fs); 118 ruleset_size += sizeof(ruleset_attr.quiet_access_net); 119 ruleset_size += sizeof(ruleset_attr.quiet_scoped); 120 ruleset_size += sizeof(ruleset_attr.handled_permissions); 121 BUILD_BUG_ON(sizeof(ruleset_attr) != ruleset_size); 122 BUILD_BUG_ON(sizeof(ruleset_attr) != 56); 123 124 path_beneath_size = sizeof(path_beneath_attr.allowed_access); 125 path_beneath_size += sizeof(path_beneath_attr.parent_fd); 126 BUILD_BUG_ON(sizeof(path_beneath_attr) != path_beneath_size); 127 BUILD_BUG_ON(sizeof(path_beneath_attr) != 12); 128 129 net_port_size = sizeof(net_port_attr.allowed_access); 130 net_port_size += sizeof(net_port_attr.port); 131 BUILD_BUG_ON(sizeof(net_port_attr) != net_port_size); 132 BUILD_BUG_ON(sizeof(net_port_attr) != 16); 133 134 namespace_size = sizeof(namespace_attr.permissions); 135 namespace_size += sizeof(namespace_attr.allowed_namespace_types); 136 namespace_size += sizeof(namespace_attr.quiet_namespace_types); 137 BUILD_BUG_ON(sizeof(namespace_attr) != namespace_size); 138 BUILD_BUG_ON(sizeof(namespace_attr) != 24); 139 140 capability_size = sizeof(capability_attr.permissions); 141 capability_size += sizeof(capability_attr.allowed_capabilities); 142 capability_size += sizeof(capability_attr.quiet_capabilities); 143 BUILD_BUG_ON(sizeof(capability_attr) != capability_size); 144 BUILD_BUG_ON(sizeof(capability_attr) != 24); 145 } 146 147 /* Ruleset handling */ 148 149 static int fop_ruleset_release(struct inode *const inode, 150 struct file *const filp) 151 { 152 struct landlock_ruleset *ruleset = filp->private_data; 153 154 landlock_put_ruleset(ruleset); 155 return 0; 156 } 157 158 static ssize_t fop_dummy_read(struct file *const filp, char __user *const buf, 159 const size_t size, loff_t *const ppos) 160 { 161 /* Dummy handler to enable FMODE_CAN_READ. */ 162 return -EINVAL; 163 } 164 165 static ssize_t fop_dummy_write(struct file *const filp, 166 const char __user *const buf, const size_t size, 167 loff_t *const ppos) 168 { 169 /* Dummy handler to enable FMODE_CAN_WRITE. */ 170 return -EINVAL; 171 } 172 173 /* 174 * A ruleset file descriptor enables to build a ruleset by adding (i.e. 175 * writing) rule after rule, without relying on the task's context. This 176 * reentrant design is also used in a read way to enforce the ruleset on the 177 * current task. 178 */ 179 static const struct file_operations ruleset_fops = { 180 .release = fop_ruleset_release, 181 .read = fop_dummy_read, 182 .write = fop_dummy_write, 183 }; 184 185 /* 186 * The Landlock ABI version should be incremented for each new Landlock-related 187 * user space visible change (e.g. Landlock syscalls). This version should 188 * only be incremented once per Linux release. When incrementing, the date in 189 * Documentation/userspace-api/landlock.rst should be updated to reflect the 190 * UAPI change. 191 * If the change involves a fix that requires userspace awareness, also update 192 * the errata documentation in Documentation/userspace-api/landlock.rst . 193 */ 194 const int landlock_abi_version = 12; 195 196 /** 197 * sys_landlock_create_ruleset - Create a new ruleset 198 * 199 * @attr: Pointer to a &struct landlock_ruleset_attr identifying the scope of 200 * the new ruleset. 201 * @size: Size of the pointed &struct landlock_ruleset_attr (needed for 202 * backward and forward compatibility). 203 * @flags: Supported values: 204 * 205 * - %LANDLOCK_CREATE_RULESET_VERSION 206 * - %LANDLOCK_CREATE_RULESET_ERRATA 207 * 208 * This system call enables to create a new Landlock ruleset. 209 * 210 * If %LANDLOCK_CREATE_RULESET_VERSION or %LANDLOCK_CREATE_RULESET_ERRATA is 211 * set, then @attr must be NULL and @size must be 0. 212 * 213 * Return: The ruleset file descriptor on success, the Landlock ABI version if 214 * %LANDLOCK_CREATE_RULESET_VERSION is set, the errata value if 215 * %LANDLOCK_CREATE_RULESET_ERRATA is set, or -errno on failure. Possible 216 * returned errors are: 217 * 218 * - %EOPNOTSUPP: Landlock is supported by the kernel but disabled at boot time; 219 * - %EINVAL: unknown @flags, access, scope, or permission, or too small @size; 220 * - %EINVAL: quiet_access_fs, quiet_access_net, or quiet_scoped is not a 221 * subset of the corresponding handled_access_fs, handled_access_net, or 222 * scoped; 223 * - %E2BIG: @attr or @size inconsistencies; 224 * - %EFAULT: @attr or @size inconsistencies; 225 * - %ENOMSG: all handled access, scope, and permission fields are empty. 226 * 227 * .. kernel-doc:: include/uapi/linux/landlock.h 228 * :identifiers: landlock_create_ruleset_flags 229 */ 230 SYSCALL_DEFINE3(landlock_create_ruleset, 231 const struct landlock_ruleset_attr __user *const, attr, 232 const size_t, size, const __u32, flags) 233 { 234 struct landlock_ruleset_attr ruleset_attr; 235 struct landlock_ruleset *ruleset; 236 int err, ruleset_fd; 237 238 /* Build-time checks. */ 239 build_check_abi(); 240 241 if (!is_initialized()) 242 return -EOPNOTSUPP; 243 244 if (flags) { 245 if (attr || size) 246 return -EINVAL; 247 248 if (flags == LANDLOCK_CREATE_RULESET_VERSION) 249 return landlock_abi_version; 250 251 if (flags == LANDLOCK_CREATE_RULESET_ERRATA) 252 return landlock_errata; 253 254 return -EINVAL; 255 } 256 257 /* Copies raw user space buffer. */ 258 err = copy_min_struct_from_user(&ruleset_attr, sizeof(ruleset_attr), 259 offsetofend(typeof(ruleset_attr), 260 handled_access_fs), 261 attr, size); 262 if (err) 263 return err; 264 265 /* Checks content (and 32-bits cast). */ 266 if ((ruleset_attr.handled_access_fs | LANDLOCK_MASK_ACCESS_FS) != 267 LANDLOCK_MASK_ACCESS_FS) 268 return -EINVAL; 269 270 /* Checks network content (and 32-bits cast). */ 271 if ((ruleset_attr.handled_access_net | LANDLOCK_MASK_ACCESS_NET) != 272 LANDLOCK_MASK_ACCESS_NET) 273 return -EINVAL; 274 275 /* Checks IPC scoping content (and 32-bits cast). */ 276 if ((ruleset_attr.scoped | LANDLOCK_MASK_SCOPE) != LANDLOCK_MASK_SCOPE) 277 return -EINVAL; 278 279 /* 280 * Check that quiet masks are subsets of the respective handled masks. 281 * Because of the checks above this is sufficient to also ensure that 282 * the quiet masks are valid access masks. 283 */ 284 if ((ruleset_attr.quiet_access_fs | ruleset_attr.handled_access_fs) != 285 ruleset_attr.handled_access_fs) 286 return -EINVAL; 287 if ((ruleset_attr.quiet_access_net | ruleset_attr.handled_access_net) != 288 ruleset_attr.handled_access_net) 289 return -EINVAL; 290 if ((ruleset_attr.quiet_scoped | ruleset_attr.scoped) != 291 ruleset_attr.scoped) 292 return -EINVAL; 293 294 /* Checks permission content (and 32-bits cast). */ 295 if ((ruleset_attr.handled_permissions | LANDLOCK_MASK_PERMISSION) != 296 LANDLOCK_MASK_PERMISSION) 297 return -EINVAL; 298 299 /* Checks arguments and transforms to kernel struct. */ 300 ruleset = landlock_create_ruleset(ruleset_attr.handled_access_fs, 301 ruleset_attr.handled_access_net, 302 ruleset_attr.scoped, 303 ruleset_attr.handled_permissions); 304 if (IS_ERR(ruleset)) 305 return PTR_ERR(ruleset); 306 307 ruleset->quiet_access.fs = ruleset_attr.quiet_access_fs; 308 ruleset->quiet_access.net = ruleset_attr.quiet_access_net; 309 ruleset->quiet_access.scope = ruleset_attr.quiet_scoped; 310 311 /* 312 * Emits before anon_inode_getfd() installs the file descriptor, while 313 * the ruleset is still private to this thread: no lock is needed, and 314 * the event cannot race a concurrent close() freeing the ruleset under 315 * the tracepoint's BTF read. This is the last point at which the 316 * ruleset is guaranteed alive and unshared. 317 */ 318 trace_landlock_create_ruleset(ruleset); 319 320 /* Creates anonymous FD referring to the ruleset. */ 321 ruleset_fd = anon_inode_getfd("[landlock-ruleset]", &ruleset_fops, 322 ruleset, O_RDWR | O_CLOEXEC); 323 if (ruleset_fd < 0) 324 landlock_put_ruleset(ruleset); 325 return ruleset_fd; 326 } 327 328 /* 329 * Returns an owned ruleset from a FD. It is thus needed to call 330 * landlock_put_ruleset() on the return value. 331 */ 332 static struct landlock_ruleset *get_ruleset_from_fd(const int fd, 333 const fmode_t mode) 334 { 335 CLASS(fd, ruleset_f)(fd); 336 struct landlock_ruleset *ruleset; 337 338 if (fd_empty(ruleset_f)) 339 return ERR_PTR(-EBADF); 340 341 /* Checks FD type and access right. */ 342 if (fd_file(ruleset_f)->f_op != &ruleset_fops) 343 return ERR_PTR(-EBADFD); 344 if (!(fd_file(ruleset_f)->f_mode & mode)) 345 return ERR_PTR(-EPERM); 346 ruleset = fd_file(ruleset_f)->private_data; 347 landlock_get_ruleset(ruleset); 348 return ruleset; 349 } 350 351 /* Path handling */ 352 353 /* 354 * @path: Must call put_path(@path) after the call if it succeeded. 355 */ 356 static int get_path_from_fd(const s32 fd, struct path *const path) 357 { 358 CLASS(fd_raw, f)(fd); 359 360 BUILD_BUG_ON(!__same_type( 361 fd, ((struct landlock_path_beneath_attr *)NULL)->parent_fd)); 362 363 if (fd_empty(f)) 364 return -EBADF; 365 /* 366 * Forbids ruleset FDs, internal filesystems (e.g. nsfs), including 367 * pseudo filesystems that will never be mountable (e.g. sockfs, 368 * pipefs). 369 */ 370 if ((fd_file(f)->f_op == &ruleset_fops) || 371 (fd_file(f)->f_path.mnt->mnt_flags & MNT_INTERNAL) || 372 (fd_file(f)->f_path.dentry->d_sb->s_flags & SB_NOUSER) || 373 IS_PRIVATE(d_backing_inode(fd_file(f)->f_path.dentry))) 374 return -EBADFD; 375 376 *path = fd_file(f)->f_path; 377 path_get(path); 378 return 0; 379 } 380 381 static int add_rule_path_beneath(struct landlock_ruleset *const ruleset, 382 const void __user *const rule_attr, u32 flags) 383 { 384 struct landlock_path_beneath_attr path_beneath_attr; 385 struct path path; 386 int res, err; 387 access_mask_t mask; 388 389 /* Copies raw user space buffer. */ 390 res = copy_from_user(&path_beneath_attr, rule_attr, 391 sizeof(path_beneath_attr)); 392 if (res) 393 return -EFAULT; 394 395 /* 396 * Informs about useless rule: empty allowed_access (i.e. deny rules) 397 * are ignored in path walks. However, the rule is not useless if it is 398 * there to hold a quiet flag. 399 */ 400 if (!flags && !path_beneath_attr.allowed_access) 401 return -ENOMSG; 402 403 /* Checks that allowed_access matches the @ruleset constraints. */ 404 mask = ruleset->layer.handled.fs; 405 if ((path_beneath_attr.allowed_access | mask) != mask) 406 return -EINVAL; 407 408 /* Checks for useless quiet flag. */ 409 if (flags & LANDLOCK_ADD_RULE_QUIET && !ruleset->quiet_access.fs) 410 return -EINVAL; 411 412 /* Gets and checks the new rule. */ 413 err = get_path_from_fd(path_beneath_attr.parent_fd, &path); 414 if (err) 415 return err; 416 417 /* Imports the new rule. */ 418 err = landlock_append_fs_rule(ruleset, &path, 419 path_beneath_attr.allowed_access, flags); 420 path_put(&path); 421 return err; 422 } 423 424 static int add_rule_net_port(struct landlock_ruleset *ruleset, 425 const void __user *const rule_attr, u32 flags) 426 { 427 struct landlock_net_port_attr net_port_attr; 428 int res; 429 access_mask_t mask; 430 431 /* Copies raw user space buffer. */ 432 res = copy_from_user(&net_port_attr, rule_attr, sizeof(net_port_attr)); 433 if (res) 434 return -EFAULT; 435 436 /* 437 * Informs about useless rule: empty allowed_access (i.e. deny rules) 438 * are ignored by network actions. However, the rule is not useless if 439 * it is there to hold a quiet flag. 440 */ 441 if (!flags && !net_port_attr.allowed_access) 442 return -ENOMSG; 443 444 /* Checks that allowed_access matches the @ruleset constraints. */ 445 mask = ruleset->layer.handled.net; 446 if ((net_port_attr.allowed_access | mask) != mask) 447 return -EINVAL; 448 449 /* Checks for useless quiet flag. */ 450 if (flags & LANDLOCK_ADD_RULE_QUIET && !ruleset->quiet_access.net) 451 return -EINVAL; 452 453 /* Denies inserting a rule with port greater than 65535. */ 454 if (net_port_attr.port > U16_MAX) 455 return -EINVAL; 456 457 /* Imports the new rule. */ 458 return landlock_append_net_rule(ruleset, net_port_attr.port, 459 net_port_attr.allowed_access, flags); 460 } 461 462 static int add_rule_namespace(struct landlock_ruleset *const ruleset, 463 const void __user *const rule_attr, 464 const u32 flags) 465 { 466 struct landlock_namespace_attr ns_attr; 467 access_mask_t mask; 468 u64 allowed_types, quiet_types; 469 int ret; 470 471 /* 472 * Namespace rules support no add-rule flags. In particular, 473 * LANDLOCK_ADD_RULE_QUIET is filesystem/network only. 474 */ 475 if (flags) 476 return -EINVAL; 477 478 /* Copies raw user space buffer. */ 479 ret = copy_from_user(&ns_attr, rule_attr, sizeof(ns_attr)); 480 if (ret) 481 return -EFAULT; 482 483 /* Informs about useless rule: empty permissions. */ 484 if (!ns_attr.permissions) 485 return -ENOMSG; 486 487 /* 488 * The permissions selector must match 489 * LANDLOCK_PERMISSION_NAMESPACE_USE. The valid set is a single bit 490 * today, so this is an exact match now; the check broadens to a subset 491 * test once another supported permission is added. 492 */ 493 if (ns_attr.permissions != LANDLOCK_PERMISSION_NAMESPACE_USE) 494 return -EINVAL; 495 496 /* 497 * Checks that permissions match the ruleset constraints. This also 498 * makes quieting require the category to be handled. 499 */ 500 mask = landlock_get_permission_mask(ruleset); 501 if (!(mask & LANDLOCK_PERMISSION_NAMESPACE_USE)) 502 return -EINVAL; 503 504 /* 505 * Informs about useless rule: neither allows nor quiets anything. A 506 * quiet-only rule (empty allowed set) is legal. 507 */ 508 if (!ns_attr.allowed_namespace_types && !ns_attr.quiet_namespace_types) 509 return -ENOMSG; 510 511 /* 512 * Stores only the namespace types this kernel knows about. Unknown 513 * bits are silently accepted for forward compatibility: user space 514 * compiled against newer headers can pass new CLONE_NEW* flags without 515 * getting EINVAL on older kernels. Unknown bits have no effect because 516 * no hook checks them. The quiet bitmask suppresses logging of denials 517 * attributed to this layer; see landlock_log_denial(). 518 */ 519 allowed_types = ns_attr.allowed_namespace_types & CLONE_NS_ALL; 520 quiet_types = ns_attr.quiet_namespace_types & CLONE_NS_ALL; 521 522 mutex_lock(&ruleset->lock); 523 ruleset->layer.allowed.ns_types |= 524 landlock_ns_types_to_bits(allowed_types); 525 #ifdef CONFIG_SECURITY_LANDLOCK_LOG 526 ruleset->quiet_permission.ns_types |= 527 landlock_ns_types_to_bits(quiet_types); 528 #endif /* CONFIG_SECURITY_LANDLOCK_LOG */ 529 #ifdef CONFIG_TRACEPOINTS 530 ruleset->version++; 531 #endif /* CONFIG_TRACEPOINTS */ 532 trace_landlock_add_rule_namespace(ruleset, flags, ns_attr.permissions, 533 allowed_types, quiet_types); 534 mutex_unlock(&ruleset->lock); 535 return 0; 536 } 537 538 static int add_rule_capability(struct landlock_ruleset *const ruleset, 539 const void __user *const rule_attr, 540 const u32 flags) 541 { 542 struct landlock_capability_attr cap_attr; 543 access_mask_t mask; 544 u64 allowed_caps, quiet_caps; 545 int ret; 546 547 /* 548 * Capability rules support no add-rule flags. In particular, 549 * LANDLOCK_ADD_RULE_QUIET is filesystem/network only. 550 */ 551 if (flags) 552 return -EINVAL; 553 554 /* Copies raw user space buffer. */ 555 ret = copy_from_user(&cap_attr, rule_attr, sizeof(cap_attr)); 556 if (ret) 557 return -EFAULT; 558 559 /* Informs about useless rule: empty permissions. */ 560 if (!cap_attr.permissions) 561 return -ENOMSG; 562 563 /* 564 * The permissions selector must match 565 * LANDLOCK_PERMISSION_CAPABILITY_USE. The valid set is a single bit 566 * today, so this is an exact match now; the check broadens to a subset 567 * test once another supported permission is added. 568 */ 569 if (cap_attr.permissions != LANDLOCK_PERMISSION_CAPABILITY_USE) 570 return -EINVAL; 571 572 /* 573 * Checks that permissions match the ruleset constraints. This also 574 * makes quieting require the category to be handled. 575 */ 576 mask = landlock_get_permission_mask(ruleset); 577 if (!(mask & LANDLOCK_PERMISSION_CAPABILITY_USE)) 578 return -EINVAL; 579 580 /* 581 * Informs about useless rule: neither allows nor quiets anything. A 582 * quiet-only rule (empty allowed set) is legal. 583 */ 584 if (!cap_attr.allowed_capabilities && !cap_attr.quiet_capabilities) 585 return -ENOMSG; 586 587 /* 588 * Stores only the capabilities this kernel knows about. Unknown bits 589 * are silently accepted for forward compatibility: user space compiled 590 * against newer headers can pass new CAP_* bits without getting EINVAL 591 * on older kernels. Unknown bits have no effect because no hook checks 592 * them. The quiet bitmask suppresses logging of denials attributed to 593 * this layer; see landlock_log_denial(). 594 */ 595 allowed_caps = cap_attr.allowed_capabilities & CAP_VALID_MASK; 596 quiet_caps = cap_attr.quiet_capabilities & CAP_VALID_MASK; 597 598 mutex_lock(&ruleset->lock); 599 ruleset->layer.allowed.caps |= landlock_caps_to_bits(allowed_caps); 600 #ifdef CONFIG_SECURITY_LANDLOCK_LOG 601 ruleset->quiet_permission.caps |= landlock_caps_to_bits(quiet_caps); 602 #endif /* CONFIG_SECURITY_LANDLOCK_LOG */ 603 #ifdef CONFIG_TRACEPOINTS 604 ruleset->version++; 605 #endif /* CONFIG_TRACEPOINTS */ 606 trace_landlock_add_rule_capability(ruleset, flags, cap_attr.permissions, 607 allowed_caps, quiet_caps); 608 mutex_unlock(&ruleset->lock); 609 return 0; 610 } 611 612 /** 613 * sys_landlock_add_rule - Add a new rule to a ruleset 614 * 615 * @ruleset_fd: File descriptor tied to the ruleset that should be extended 616 * with the new rule. 617 * @rule_type: Identify the structure type pointed to by @rule_attr: 618 * %LANDLOCK_RULE_PATH_BENEATH, %LANDLOCK_RULE_NET_PORT, 619 * %LANDLOCK_RULE_NAMESPACE, or %LANDLOCK_RULE_CAPABILITY. 620 * @rule_attr: Pointer to a rule (matching the @rule_type). 621 * @flags: Must be 0 or %LANDLOCK_ADD_RULE_QUIET. 622 * 623 * This system call enables to define a new rule and add it to an existing 624 * ruleset. 625 * 626 * Return: 0 on success, or -errno on failure. Possible returned errors are: 627 * 628 * - %EOPNOTSUPP: Landlock is supported by the kernel but disabled at boot time; 629 * - %EAFNOSUPPORT: @rule_type is %LANDLOCK_RULE_NET_PORT but TCP/IP is not 630 * supported by the running kernel; 631 * - %EINVAL: @flags is not valid; 632 * - %EINVAL: The rule accesses are inconsistent (i.e. 633 * &landlock_path_beneath_attr.allowed_access or 634 * &landlock_net_port_attr.allowed_access is not a subset of the ruleset 635 * handled accesses) 636 * - %EINVAL: A nonzero &landlock_namespace_attr.permissions is not 637 * %LANDLOCK_PERMISSION_NAMESPACE_USE or is not handled by the ruleset; 638 * - %EINVAL: A nonzero &landlock_capability_attr.permissions is not 639 * %LANDLOCK_PERMISSION_CAPABILITY_USE or is not handled by the ruleset; 640 * - %EINVAL: &landlock_net_port_attr.port is greater than 65535; 641 * - %EINVAL: LANDLOCK_ADD_RULE_QUIET is passed but the ruleset has no 642 * quiet access bits set for the corresponding rule type. 643 * - %ENOMSG: Empty accesses (e.g. &landlock_path_beneath_attr.allowed_access is 644 * 0) and no flags; 645 * - %ENOMSG: &landlock_namespace_attr.permissions is 0, or both 646 * &landlock_namespace_attr.allowed_namespace_types and 647 * &landlock_namespace_attr.quiet_namespace_types are 0; 648 * - %ENOMSG: &landlock_capability_attr.permissions is 0, or both 649 * &landlock_capability_attr.allowed_capabilities and 650 * &landlock_capability_attr.quiet_capabilities are 0; 651 * - %EBADF: @ruleset_fd is not a file descriptor for the current thread, or a 652 * member of @rule_attr is not a file descriptor as expected; 653 * - %EBADFD: @ruleset_fd is not a ruleset file descriptor, or a member of 654 * @rule_attr is not the expected file descriptor type; 655 * - %EPERM: @ruleset_fd has no write access to the underlying ruleset; 656 * - %EFAULT: @rule_attr was not a valid address. 657 * 658 * .. kernel-doc:: include/uapi/linux/landlock.h 659 * :identifiers: landlock_add_rule_flags 660 */ 661 SYSCALL_DEFINE4(landlock_add_rule, const int, ruleset_fd, 662 const enum landlock_rule_type, rule_type, 663 const void __user *const, rule_attr, const __u32, flags) 664 { 665 struct landlock_ruleset *ruleset __free(landlock_put_ruleset) = NULL; 666 667 if (!is_initialized()) 668 return -EOPNOTSUPP; 669 670 if (flags && flags != LANDLOCK_ADD_RULE_QUIET) 671 return -EINVAL; 672 673 /* Gets and checks the ruleset. */ 674 ruleset = get_ruleset_from_fd(ruleset_fd, FMODE_CAN_WRITE); 675 if (IS_ERR(ruleset)) 676 return PTR_ERR(ruleset); 677 678 switch (rule_type) { 679 case LANDLOCK_RULE_PATH_BENEATH: 680 return add_rule_path_beneath(ruleset, rule_attr, flags); 681 case LANDLOCK_RULE_NET_PORT: 682 return add_rule_net_port(ruleset, rule_attr, flags); 683 case LANDLOCK_RULE_NAMESPACE: 684 return add_rule_namespace(ruleset, rule_attr, flags); 685 case LANDLOCK_RULE_CAPABILITY: 686 return add_rule_capability(ruleset, rule_attr, flags); 687 default: 688 return -EINVAL; 689 } 690 } 691 692 /* Enforcement */ 693 694 /** 695 * sys_landlock_restrict_self - Enforce a ruleset on the calling thread 696 * 697 * @ruleset_fd: File descriptor tied to the ruleset to merge with the target. 698 * @flags: Supported values: 699 * 700 * - %LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF 701 * - %LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON 702 * - %LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF 703 * - %LANDLOCK_RESTRICT_SELF_TSYNC 704 * - %LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS 705 * 706 * This system call enforces a Landlock ruleset on the current thread. 707 * Enforcing a ruleset requires that the task has %CAP_SYS_ADMIN in its 708 * namespace or is running with no_new_privs. This avoids scenarios where 709 * unprivileged tasks can affect the behavior of privileged children. 710 * 711 * With %LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS, the no_new_privs attribute of the 712 * calling thread is set only once the enforcement of the ruleset succeeded, 713 * which fulfills the above requirement: no_new_privs is set if and only if the 714 * call succeeds. 715 * 716 * Return: 0 on success, or -errno on failure. Possible returned errors are: 717 * 718 * - %EOPNOTSUPP: Landlock is supported by the kernel but disabled at boot time; 719 * - %EINVAL: @flags contains an unknown bit. 720 * - %EBADF: @ruleset_fd is not a file descriptor for the current thread; 721 * - %EBADFD: @ruleset_fd is not a ruleset file descriptor; 722 * - %EPERM: @ruleset_fd has no read access to the underlying ruleset, or 723 * %LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS is not set while the current thread 724 * is not running with no_new_privs and doesn't have %CAP_SYS_ADMIN in its 725 * namespace. 726 * - %E2BIG: The maximum number of stacked rulesets is reached for the current 727 * thread. 728 * 729 * .. kernel-doc:: include/uapi/linux/landlock.h 730 * :identifiers: landlock_restrict_self_flags 731 */ 732 SYSCALL_DEFINE2(landlock_restrict_self, const int, ruleset_fd, const __u32, 733 flags) 734 { 735 struct landlock_ruleset *ruleset __free(landlock_put_ruleset) = NULL; 736 struct landlock_domain *new_dom = NULL; 737 struct cred *new_cred; 738 struct landlock_cred_security *new_llcred; 739 bool process_wide; 740 bool __maybe_unused log_same_exec, log_new_exec, log_subdomains, 741 prev_log_subdomains; 742 743 if (!is_initialized()) 744 return -EOPNOTSUPP; 745 746 if ((flags | LANDLOCK_MASK_RESTRICT_SELF) != 747 LANDLOCK_MASK_RESTRICT_SELF) 748 return -EINVAL; 749 750 /* 751 * Similar checks as for seccomp(2), except that an -EPERM may be 752 * returned. LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS fulfills this 753 * requirement. 754 */ 755 if (!(flags & LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS) && 756 !task_no_new_privs(current) && 757 !ns_capable_noaudit(current_user_ns(), CAP_SYS_ADMIN)) 758 return -EPERM; 759 760 /* Translates "off" flag to boolean. */ 761 log_same_exec = !(flags & LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF); 762 /* Translates "on" flag to boolean. */ 763 log_new_exec = !!(flags & LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON); 764 /* Translates "off" flag to boolean. */ 765 log_subdomains = !(flags & LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF); 766 767 /* 768 * It is allowed to set LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF with 769 * -1 as ruleset_fd, optionally combined with 770 * LANDLOCK_RESTRICT_SELF_TSYNC to propagate this configuration to all 771 * threads. No other flag must be set. 772 */ 773 if (!(ruleset_fd == -1 && 774 (flags & ~LANDLOCK_RESTRICT_SELF_TSYNC) == 775 LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF)) { 776 /* Gets and checks the ruleset. */ 777 ruleset = get_ruleset_from_fd(ruleset_fd, FMODE_CAN_READ); 778 if (IS_ERR(ruleset)) 779 return PTR_ERR(ruleset); 780 } 781 782 /* Prepares new credentials. */ 783 new_cred = prepare_creds(); 784 if (!new_cred) 785 return -ENOMEM; 786 787 new_llcred = landlock_cred(new_cred); 788 789 #ifdef CONFIG_SECURITY_LANDLOCK_LOG 790 prev_log_subdomains = !new_llcred->log_subdomains_off; 791 new_llcred->log_subdomains_off = !prev_log_subdomains || 792 !log_subdomains; 793 #endif /* CONFIG_SECURITY_LANDLOCK_LOG */ 794 795 /* 796 * The only case when a ruleset may not be set is if 797 * LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF is set (optionally with 798 * LANDLOCK_RESTRICT_SELF_TSYNC) and ruleset_fd is -1. We could 799 * optimize this case by not calling commit_creds() if this flag was 800 * already set, but it is not worth the complexity. 801 */ 802 if (ruleset) { 803 /* 804 * There is no possible race condition while copying and 805 * manipulating the current credentials because they are 806 * dedicated per thread. 807 */ 808 mutex_lock(&ruleset->lock); 809 new_dom = landlock_merge_ruleset(new_llcred->domain, ruleset); 810 if (IS_ERR(new_dom)) { 811 mutex_unlock(&ruleset->lock); 812 abort_creds(new_cred); 813 return PTR_ERR(new_dom); 814 } 815 /* 816 * Emits the domain-creation event while @ruleset->lock is still 817 * held, right after the merge, so an eBPF program attached to 818 * the tracepoint reads the exact ruleset that was merged into 819 * the domain: a consistent snapshot that a concurrent 820 * landlock_add_rule() (which holds the same lock) cannot 821 * modify. 822 * 823 * This must come before the thread-sync wait below. Holding 824 * @ruleset->lock across landlock_restrict_sibling_threads() 825 * would hang: a sibling thread blocked in landlock_add_rule() 826 * on the same @ruleset->lock cannot run the task_work that 827 * thread-sync waits for (the lock wait is uninterruptible). 828 * Emitting here keeps the lock off the thread-sync path. 829 * 830 * The trade-off is that the event fires for a domain that a 831 * later (rare) thread-sync failure aborts. That path emits the 832 * matching free_domain event so the create/free pair stays 833 * balanced (see the thread-sync error path below). 834 */ 835 trace_landlock_create_domain(new_dom, ruleset); 836 mutex_unlock(&ruleset->lock); 837 838 #ifdef CONFIG_SECURITY_LANDLOCK_LOG 839 new_dom->hierarchy->log_same_exec = log_same_exec; 840 new_dom->hierarchy->log_new_exec = log_new_exec; 841 /* 842 * The creation event fired above, so move the domain out of 843 * LANDLOCK_LOG_UNCOMMITTED: its free_domain event must fire 844 * too, even if a thread-sync failure aborts it below. Audit 845 * logging may still be disabled (DISABLED); tracing observes it 846 * anyway. 847 */ 848 if ((!log_same_exec && !log_new_exec) || !prev_log_subdomains) 849 new_dom->hierarchy->log_status = LANDLOCK_LOG_DISABLED; 850 else 851 new_dom->hierarchy->log_status = LANDLOCK_LOG_PENDING; 852 #endif /* CONFIG_SECURITY_LANDLOCK_LOG */ 853 854 /* Replaces the old (prepared) domain. */ 855 landlock_put_domain(new_llcred->domain); 856 new_llcred->domain = new_dom; 857 858 #ifdef CONFIG_SECURITY_LANDLOCK_LOG 859 new_llcred->domain_exec |= BIT(new_dom->num_layers - 1); 860 #endif /* CONFIG_SECURITY_LANDLOCK_LOG */ 861 } 862 863 if (flags & LANDLOCK_RESTRICT_SELF_TSYNC) { 864 const int err = landlock_restrict_sibling_threads( 865 current_cred(), new_cred, flags); 866 if (err) { 867 /* 868 * Thread-sync failed (rare), so the new domain is 869 * aborted instead of committed. Its creation event 870 * already fired above, so the imminent free must emit 871 * the matching free_domain event to keep the 872 * create/free pair balanced; no special log_status is 873 * set here. 874 */ 875 abort_creds(new_cred); 876 return err; 877 } 878 } 879 880 /* Sets no_new_privs past the last point of failure. */ 881 if (flags & LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS) 882 task_set_no_new_privs(current); 883 884 /* Whole process: thread-sync swept siblings, or single-threaded. */ 885 process_wide = (flags & LANDLOCK_RESTRICT_SELF_TSYNC) || 886 get_nr_threads(current) == 1; 887 commit_creds(new_cred); 888 889 /* The caller commits last, so its event concludes the operation. */ 890 if (ruleset) 891 trace_landlock_enforce_domain(new_dom, true, process_wide, 892 task_no_new_privs(current)); 893 894 return 0; 895 } 896