1cb2c7d1aSMickaël Salaün /* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ 2cb2c7d1aSMickaël Salaün /* 3cb2c7d1aSMickaël Salaün * Landlock - User space API 4cb2c7d1aSMickaël Salaün * 5cb2c7d1aSMickaël Salaün * Copyright © 2017-2020 Mickaël Salaün <mic@digikod.net> 6cb2c7d1aSMickaël Salaün * Copyright © 2018-2020 ANSSI 7cb2c7d1aSMickaël Salaün */ 8cb2c7d1aSMickaël Salaün 9cb2c7d1aSMickaël Salaün #ifndef _UAPI_LINUX_LANDLOCK_H 10cb2c7d1aSMickaël Salaün #define _UAPI_LINUX_LANDLOCK_H 11cb2c7d1aSMickaël Salaün 12265885daSMickaël Salaün #include <linux/types.h> 13265885daSMickaël Salaün 14265885daSMickaël Salaün /** 15265885daSMickaël Salaün * struct landlock_ruleset_attr - Ruleset definition 16265885daSMickaël Salaün * 17265885daSMickaël Salaün * Argument of sys_landlock_create_ruleset(). This structure can grow in 18265885daSMickaël Salaün * future versions. 19265885daSMickaël Salaün */ 20265885daSMickaël Salaün struct landlock_ruleset_attr { 21265885daSMickaël Salaün /** 22265885daSMickaël Salaün * @handled_access_fs: Bitmask of actions (cf. `Filesystem flags`_) 23265885daSMickaël Salaün * that is handled by this ruleset and should then be forbidden if no 24b91c3e4eSMickaël Salaün * rule explicitly allow them: it is a deny-by-default list that should 25b91c3e4eSMickaël Salaün * contain as much Landlock access rights as possible. Indeed, all 26b91c3e4eSMickaël Salaün * Landlock filesystem access rights that are not part of 27b91c3e4eSMickaël Salaün * handled_access_fs are allowed. This is needed for backward 28b91c3e4eSMickaël Salaün * compatibility reasons. One exception is the 292fff00c8SMickaël Salaün * %LANDLOCK_ACCESS_FS_REFER access right, which is always implicitly 30b91c3e4eSMickaël Salaün * handled, but must still be explicitly handled to add new rules with 31b91c3e4eSMickaël Salaün * this access right. 32265885daSMickaël Salaün */ 33265885daSMickaël Salaün __u64 handled_access_fs; 34*fff69fb0SKonstantin Meskhidze /** 35*fff69fb0SKonstantin Meskhidze * @handled_access_net: Bitmask of actions (cf. `Network flags`_) 36*fff69fb0SKonstantin Meskhidze * that is handled by this ruleset and should then be forbidden if no 37*fff69fb0SKonstantin Meskhidze * rule explicitly allow them. 38*fff69fb0SKonstantin Meskhidze */ 39*fff69fb0SKonstantin Meskhidze __u64 handled_access_net; 40265885daSMickaël Salaün }; 41265885daSMickaël Salaün 423532b0b4SMickaël Salaün /* 433532b0b4SMickaël Salaün * sys_landlock_create_ruleset() flags: 443532b0b4SMickaël Salaün * 453532b0b4SMickaël Salaün * - %LANDLOCK_CREATE_RULESET_VERSION: Get the highest supported Landlock ABI 463532b0b4SMickaël Salaün * version. 473532b0b4SMickaël Salaün */ 486cc2df8eSMickaël Salaün /* clang-format off */ 493532b0b4SMickaël Salaün #define LANDLOCK_CREATE_RULESET_VERSION (1U << 0) 506cc2df8eSMickaël Salaün /* clang-format on */ 513532b0b4SMickaël Salaün 52265885daSMickaël Salaün /** 53265885daSMickaël Salaün * enum landlock_rule_type - Landlock rule type 54265885daSMickaël Salaün * 55265885daSMickaël Salaün * Argument of sys_landlock_add_rule(). 56265885daSMickaël Salaün */ 57265885daSMickaël Salaün enum landlock_rule_type { 58265885daSMickaël Salaün /** 59265885daSMickaël Salaün * @LANDLOCK_RULE_PATH_BENEATH: Type of a &struct 60265885daSMickaël Salaün * landlock_path_beneath_attr . 61265885daSMickaël Salaün */ 62265885daSMickaël Salaün LANDLOCK_RULE_PATH_BENEATH = 1, 63*fff69fb0SKonstantin Meskhidze /** 64*fff69fb0SKonstantin Meskhidze * @LANDLOCK_RULE_NET_PORT: Type of a &struct 65*fff69fb0SKonstantin Meskhidze * landlock_net_port_attr . 66*fff69fb0SKonstantin Meskhidze */ 67*fff69fb0SKonstantin Meskhidze LANDLOCK_RULE_NET_PORT, 68265885daSMickaël Salaün }; 69265885daSMickaël Salaün 70265885daSMickaël Salaün /** 71265885daSMickaël Salaün * struct landlock_path_beneath_attr - Path hierarchy definition 72265885daSMickaël Salaün * 73265885daSMickaël Salaün * Argument of sys_landlock_add_rule(). 74265885daSMickaël Salaün */ 75265885daSMickaël Salaün struct landlock_path_beneath_attr { 76265885daSMickaël Salaün /** 77265885daSMickaël Salaün * @allowed_access: Bitmask of allowed actions for this file hierarchy 78265885daSMickaël Salaün * (cf. `Filesystem flags`_). 79265885daSMickaël Salaün */ 80265885daSMickaël Salaün __u64 allowed_access; 81265885daSMickaël Salaün /** 82a13e248fSMickaël Salaün * @parent_fd: File descriptor, preferably opened with ``O_PATH``, 83a13e248fSMickaël Salaün * which identifies the parent directory of a file hierarchy, or just a 84a13e248fSMickaël Salaün * file. 85265885daSMickaël Salaün */ 86265885daSMickaël Salaün __s32 parent_fd; 87265885daSMickaël Salaün /* 88265885daSMickaël Salaün * This struct is packed to avoid trailing reserved members. 89265885daSMickaël Salaün * Cf. security/landlock/syscalls.c:build_check_abi() 90265885daSMickaël Salaün */ 91265885daSMickaël Salaün } __attribute__((packed)); 92265885daSMickaël Salaün 93cb2c7d1aSMickaël Salaün /** 94*fff69fb0SKonstantin Meskhidze * struct landlock_net_port_attr - Network port definition 95*fff69fb0SKonstantin Meskhidze * 96*fff69fb0SKonstantin Meskhidze * Argument of sys_landlock_add_rule(). 97*fff69fb0SKonstantin Meskhidze */ 98*fff69fb0SKonstantin Meskhidze struct landlock_net_port_attr { 99*fff69fb0SKonstantin Meskhidze /** 100*fff69fb0SKonstantin Meskhidze * @allowed_access: Bitmask of allowed access network for a port 101*fff69fb0SKonstantin Meskhidze * (cf. `Network flags`_). 102*fff69fb0SKonstantin Meskhidze */ 103*fff69fb0SKonstantin Meskhidze __u64 allowed_access; 104*fff69fb0SKonstantin Meskhidze /** 105*fff69fb0SKonstantin Meskhidze * @port: Network port in host endianness. 106*fff69fb0SKonstantin Meskhidze * 107*fff69fb0SKonstantin Meskhidze * It should be noted that port 0 passed to :manpage:`bind(2)` will 108*fff69fb0SKonstantin Meskhidze * bind to an available port from a specific port range. This can be 109*fff69fb0SKonstantin Meskhidze * configured thanks to the ``/proc/sys/net/ipv4/ip_local_port_range`` 110*fff69fb0SKonstantin Meskhidze * sysctl (also used for IPv6). A Landlock rule with port 0 and the 111*fff69fb0SKonstantin Meskhidze * ``LANDLOCK_ACCESS_NET_BIND_TCP`` right means that requesting to bind 112*fff69fb0SKonstantin Meskhidze * on port 0 is allowed and it will automatically translate to binding 113*fff69fb0SKonstantin Meskhidze * on the related port range. 114*fff69fb0SKonstantin Meskhidze */ 115*fff69fb0SKonstantin Meskhidze __u64 port; 116*fff69fb0SKonstantin Meskhidze }; 117*fff69fb0SKonstantin Meskhidze 118*fff69fb0SKonstantin Meskhidze /** 119cb2c7d1aSMickaël Salaün * DOC: fs_access 120cb2c7d1aSMickaël Salaün * 121cb2c7d1aSMickaël Salaün * A set of actions on kernel objects may be defined by an attribute (e.g. 122cb2c7d1aSMickaël Salaün * &struct landlock_path_beneath_attr) including a bitmask of access. 123cb2c7d1aSMickaël Salaün * 124cb2c7d1aSMickaël Salaün * Filesystem flags 125cb2c7d1aSMickaël Salaün * ~~~~~~~~~~~~~~~~ 126cb2c7d1aSMickaël Salaün * 127cb2c7d1aSMickaël Salaün * These flags enable to restrict a sandboxed process to a set of actions on 128cb2c7d1aSMickaël Salaün * files and directories. Files or directories opened before the sandboxing 129cb2c7d1aSMickaël Salaün * are not subject to these restrictions. 130cb2c7d1aSMickaël Salaün * 131cb2c7d1aSMickaël Salaün * A file can only receive these access rights: 132cb2c7d1aSMickaël Salaün * 133cb2c7d1aSMickaël Salaün * - %LANDLOCK_ACCESS_FS_EXECUTE: Execute a file. 134b9f5ce27SGünther Noack * - %LANDLOCK_ACCESS_FS_WRITE_FILE: Open a file with write access. Note that 135b9f5ce27SGünther Noack * you might additionally need the %LANDLOCK_ACCESS_FS_TRUNCATE right in order 136b9f5ce27SGünther Noack * to overwrite files with :manpage:`open(2)` using ``O_TRUNC`` or 137b9f5ce27SGünther Noack * :manpage:`creat(2)`. 138cb2c7d1aSMickaël Salaün * - %LANDLOCK_ACCESS_FS_READ_FILE: Open a file with read access. 139b9f5ce27SGünther Noack * - %LANDLOCK_ACCESS_FS_TRUNCATE: Truncate a file with :manpage:`truncate(2)`, 140b9f5ce27SGünther Noack * :manpage:`ftruncate(2)`, :manpage:`creat(2)`, or :manpage:`open(2)` with 141b9f5ce27SGünther Noack * ``O_TRUNC``. Whether an opened file can be truncated with 142b9f5ce27SGünther Noack * :manpage:`ftruncate(2)` is determined during :manpage:`open(2)`, in the 143b9f5ce27SGünther Noack * same way as read and write permissions are checked during 144b9f5ce27SGünther Noack * :manpage:`open(2)` using %LANDLOCK_ACCESS_FS_READ_FILE and 145b9f5ce27SGünther Noack * %LANDLOCK_ACCESS_FS_WRITE_FILE. This access right is available since the 146b9f5ce27SGünther Noack * third version of the Landlock ABI. 147cb2c7d1aSMickaël Salaün * 148cb2c7d1aSMickaël Salaün * A directory can receive access rights related to files or directories. The 149cb2c7d1aSMickaël Salaün * following access right is applied to the directory itself, and the 150cb2c7d1aSMickaël Salaün * directories beneath it: 151cb2c7d1aSMickaël Salaün * 152cb2c7d1aSMickaël Salaün * - %LANDLOCK_ACCESS_FS_READ_DIR: Open a directory or list its content. 153cb2c7d1aSMickaël Salaün * 154cb2c7d1aSMickaël Salaün * However, the following access rights only apply to the content of a 155cb2c7d1aSMickaël Salaün * directory, not the directory itself: 156cb2c7d1aSMickaël Salaün * 157cb2c7d1aSMickaël Salaün * - %LANDLOCK_ACCESS_FS_REMOVE_DIR: Remove an empty directory or rename one. 158cb2c7d1aSMickaël Salaün * - %LANDLOCK_ACCESS_FS_REMOVE_FILE: Unlink (or rename) a file. 159cb2c7d1aSMickaël Salaün * - %LANDLOCK_ACCESS_FS_MAKE_CHAR: Create (or rename or link) a character 160cb2c7d1aSMickaël Salaün * device. 161cb2c7d1aSMickaël Salaün * - %LANDLOCK_ACCESS_FS_MAKE_DIR: Create (or rename) a directory. 162cb2c7d1aSMickaël Salaün * - %LANDLOCK_ACCESS_FS_MAKE_REG: Create (or rename or link) a regular file. 163cb2c7d1aSMickaël Salaün * - %LANDLOCK_ACCESS_FS_MAKE_SOCK: Create (or rename or link) a UNIX domain 164cb2c7d1aSMickaël Salaün * socket. 165cb2c7d1aSMickaël Salaün * - %LANDLOCK_ACCESS_FS_MAKE_FIFO: Create (or rename or link) a named pipe. 166cb2c7d1aSMickaël Salaün * - %LANDLOCK_ACCESS_FS_MAKE_BLOCK: Create (or rename or link) a block device. 167cb2c7d1aSMickaël Salaün * - %LANDLOCK_ACCESS_FS_MAKE_SYM: Create (or rename or link) a symbolic link. 168b91c3e4eSMickaël Salaün * - %LANDLOCK_ACCESS_FS_REFER: Link or rename a file from or to a different 169ed35e2f2SGünther Noack * directory (i.e. reparent a file hierarchy). 170ed35e2f2SGünther Noack * 171ed35e2f2SGünther Noack * This access right is available since the second version of the Landlock 172ed35e2f2SGünther Noack * ABI. 173ed35e2f2SGünther Noack * 174ed35e2f2SGünther Noack * This is the only access right which is denied by default by any ruleset, 175ed35e2f2SGünther Noack * even if the right is not specified as handled at ruleset creation time. 176ed35e2f2SGünther Noack * The only way to make a ruleset grant this right is to explicitly allow it 177ed35e2f2SGünther Noack * for a specific directory by adding a matching rule to the ruleset. 178ed35e2f2SGünther Noack * 179ed35e2f2SGünther Noack * In particular, when using the first Landlock ABI version, Landlock will 180ed35e2f2SGünther Noack * always deny attempts to reparent files between different directories. 181ed35e2f2SGünther Noack * 182ed35e2f2SGünther Noack * In addition to the source and destination directories having the 183ed35e2f2SGünther Noack * %LANDLOCK_ACCESS_FS_REFER access right, the attempted link or rename 184ed35e2f2SGünther Noack * operation must meet the following constraints: 185ed35e2f2SGünther Noack * 186ed35e2f2SGünther Noack * * The reparented file may not gain more access rights in the destination 187ed35e2f2SGünther Noack * directory than it previously had in the source directory. If this is 188ed35e2f2SGünther Noack * attempted, the operation results in an ``EXDEV`` error. 189ed35e2f2SGünther Noack * 190ed35e2f2SGünther Noack * * When linking or renaming, the ``LANDLOCK_ACCESS_FS_MAKE_*`` right for the 191ed35e2f2SGünther Noack * respective file type must be granted for the destination directory. 192ed35e2f2SGünther Noack * Otherwise, the operation results in an ``EACCES`` error. 193ed35e2f2SGünther Noack * 194ed35e2f2SGünther Noack * * When renaming, the ``LANDLOCK_ACCESS_FS_REMOVE_*`` right for the 195ed35e2f2SGünther Noack * respective file type must be granted for the source directory. Otherwise, 196ed35e2f2SGünther Noack * the operation results in an ``EACCES`` error. 197ed35e2f2SGünther Noack * 198ed35e2f2SGünther Noack * If multiple requirements are not met, the ``EACCES`` error code takes 199ed35e2f2SGünther Noack * precedence over ``EXDEV``. 200cb2c7d1aSMickaël Salaün * 201cb2c7d1aSMickaël Salaün * .. warning:: 202cb2c7d1aSMickaël Salaün * 203cb2c7d1aSMickaël Salaün * It is currently not possible to restrict some file-related actions 204cb2c7d1aSMickaël Salaün * accessible through these syscall families: :manpage:`chdir(2)`, 205b9f5ce27SGünther Noack * :manpage:`stat(2)`, :manpage:`flock(2)`, :manpage:`chmod(2)`, 206b9f5ce27SGünther Noack * :manpage:`chown(2)`, :manpage:`setxattr(2)`, :manpage:`utime(2)`, 207b9f5ce27SGünther Noack * :manpage:`ioctl(2)`, :manpage:`fcntl(2)`, :manpage:`access(2)`. 208cb2c7d1aSMickaël Salaün * Future Landlock evolutions will enable to restrict them. 209cb2c7d1aSMickaël Salaün */ 2106cc2df8eSMickaël Salaün /* clang-format off */ 211cb2c7d1aSMickaël Salaün #define LANDLOCK_ACCESS_FS_EXECUTE (1ULL << 0) 212cb2c7d1aSMickaël Salaün #define LANDLOCK_ACCESS_FS_WRITE_FILE (1ULL << 1) 213cb2c7d1aSMickaël Salaün #define LANDLOCK_ACCESS_FS_READ_FILE (1ULL << 2) 214cb2c7d1aSMickaël Salaün #define LANDLOCK_ACCESS_FS_READ_DIR (1ULL << 3) 215cb2c7d1aSMickaël Salaün #define LANDLOCK_ACCESS_FS_REMOVE_DIR (1ULL << 4) 216cb2c7d1aSMickaël Salaün #define LANDLOCK_ACCESS_FS_REMOVE_FILE (1ULL << 5) 217cb2c7d1aSMickaël Salaün #define LANDLOCK_ACCESS_FS_MAKE_CHAR (1ULL << 6) 218cb2c7d1aSMickaël Salaün #define LANDLOCK_ACCESS_FS_MAKE_DIR (1ULL << 7) 219cb2c7d1aSMickaël Salaün #define LANDLOCK_ACCESS_FS_MAKE_REG (1ULL << 8) 220cb2c7d1aSMickaël Salaün #define LANDLOCK_ACCESS_FS_MAKE_SOCK (1ULL << 9) 221cb2c7d1aSMickaël Salaün #define LANDLOCK_ACCESS_FS_MAKE_FIFO (1ULL << 10) 222cb2c7d1aSMickaël Salaün #define LANDLOCK_ACCESS_FS_MAKE_BLOCK (1ULL << 11) 223cb2c7d1aSMickaël Salaün #define LANDLOCK_ACCESS_FS_MAKE_SYM (1ULL << 12) 224b91c3e4eSMickaël Salaün #define LANDLOCK_ACCESS_FS_REFER (1ULL << 13) 225b9f5ce27SGünther Noack #define LANDLOCK_ACCESS_FS_TRUNCATE (1ULL << 14) 2266cc2df8eSMickaël Salaün /* clang-format on */ 227cb2c7d1aSMickaël Salaün 228*fff69fb0SKonstantin Meskhidze /** 229*fff69fb0SKonstantin Meskhidze * DOC: net_access 230*fff69fb0SKonstantin Meskhidze * 231*fff69fb0SKonstantin Meskhidze * Network flags 232*fff69fb0SKonstantin Meskhidze * ~~~~~~~~~~~~~~~~ 233*fff69fb0SKonstantin Meskhidze * 234*fff69fb0SKonstantin Meskhidze * These flags enable to restrict a sandboxed process to a set of network 235*fff69fb0SKonstantin Meskhidze * actions. This is supported since the Landlock ABI version 4. 236*fff69fb0SKonstantin Meskhidze * 237*fff69fb0SKonstantin Meskhidze * TCP sockets with allowed actions: 238*fff69fb0SKonstantin Meskhidze * 239*fff69fb0SKonstantin Meskhidze * - %LANDLOCK_ACCESS_NET_BIND_TCP: Bind a TCP socket to a local port. 240*fff69fb0SKonstantin Meskhidze * - %LANDLOCK_ACCESS_NET_CONNECT_TCP: Connect an active TCP socket to 241*fff69fb0SKonstantin Meskhidze * a remote port. 242*fff69fb0SKonstantin Meskhidze */ 243*fff69fb0SKonstantin Meskhidze /* clang-format off */ 244*fff69fb0SKonstantin Meskhidze #define LANDLOCK_ACCESS_NET_BIND_TCP (1ULL << 0) 245*fff69fb0SKonstantin Meskhidze #define LANDLOCK_ACCESS_NET_CONNECT_TCP (1ULL << 1) 246*fff69fb0SKonstantin Meskhidze /* clang-format on */ 247cb2c7d1aSMickaël Salaün #endif /* _UAPI_LINUX_LANDLOCK_H */ 248