1 // SPDX-License-Identifier: BSD-3-Clause 2 /* 3 * Simple Landlock sandbox manager able to launch a process restricted by a 4 * user-defined filesystem access control policy. 5 * 6 * Copyright © 2017-2020 Mickaël Salaün <mic@digikod.net> 7 * Copyright © 2020 ANSSI 8 */ 9 10 #define _GNU_SOURCE 11 #include <errno.h> 12 #include <fcntl.h> 13 #include <linux/landlock.h> 14 #include <linux/prctl.h> 15 #include <stddef.h> 16 #include <stdio.h> 17 #include <stdlib.h> 18 #include <string.h> 19 #include <sys/prctl.h> 20 #include <sys/stat.h> 21 #include <sys/syscall.h> 22 #include <unistd.h> 23 24 #ifndef landlock_create_ruleset 25 static inline int 26 landlock_create_ruleset(const struct landlock_ruleset_attr *const attr, 27 const size_t size, const __u32 flags) 28 { 29 return syscall(__NR_landlock_create_ruleset, attr, size, flags); 30 } 31 #endif 32 33 #ifndef landlock_add_rule 34 static inline int landlock_add_rule(const int ruleset_fd, 35 const enum landlock_rule_type rule_type, 36 const void *const rule_attr, 37 const __u32 flags) 38 { 39 return syscall(__NR_landlock_add_rule, ruleset_fd, rule_type, rule_attr, 40 flags); 41 } 42 #endif 43 44 #ifndef landlock_restrict_self 45 static inline int landlock_restrict_self(const int ruleset_fd, 46 const __u32 flags) 47 { 48 return syscall(__NR_landlock_restrict_self, ruleset_fd, flags); 49 } 50 #endif 51 52 #define ENV_FS_RO_NAME "LL_FS_RO" 53 #define ENV_FS_RW_NAME "LL_FS_RW" 54 #define ENV_PATH_TOKEN ":" 55 56 static int parse_path(char *env_path, const char ***const path_list) 57 { 58 int i, num_paths = 0; 59 60 if (env_path) { 61 num_paths++; 62 for (i = 0; env_path[i]; i++) { 63 if (env_path[i] == ENV_PATH_TOKEN[0]) 64 num_paths++; 65 } 66 } 67 *path_list = malloc(num_paths * sizeof(**path_list)); 68 for (i = 0; i < num_paths; i++) 69 (*path_list)[i] = strsep(&env_path, ENV_PATH_TOKEN); 70 71 return num_paths; 72 } 73 74 /* clang-format off */ 75 76 #define ACCESS_FILE ( \ 77 LANDLOCK_ACCESS_FS_EXECUTE | \ 78 LANDLOCK_ACCESS_FS_WRITE_FILE | \ 79 LANDLOCK_ACCESS_FS_READ_FILE) 80 81 /* clang-format on */ 82 83 static int populate_ruleset(const char *const env_var, const int ruleset_fd, 84 const __u64 allowed_access) 85 { 86 int num_paths, i, ret = 1; 87 char *env_path_name; 88 const char **path_list = NULL; 89 struct landlock_path_beneath_attr path_beneath = { 90 .parent_fd = -1, 91 }; 92 93 env_path_name = getenv(env_var); 94 if (!env_path_name) { 95 /* Prevents users to forget a setting. */ 96 fprintf(stderr, "Missing environment variable %s\n", env_var); 97 return 1; 98 } 99 env_path_name = strdup(env_path_name); 100 unsetenv(env_var); 101 num_paths = parse_path(env_path_name, &path_list); 102 if (num_paths == 1 && path_list[0][0] == '\0') { 103 /* 104 * Allows to not use all possible restrictions (e.g. use 105 * LL_FS_RO without LL_FS_RW). 106 */ 107 ret = 0; 108 goto out_free_name; 109 } 110 111 for (i = 0; i < num_paths; i++) { 112 struct stat statbuf; 113 114 path_beneath.parent_fd = open(path_list[i], O_PATH | O_CLOEXEC); 115 if (path_beneath.parent_fd < 0) { 116 fprintf(stderr, "Failed to open \"%s\": %s\n", 117 path_list[i], strerror(errno)); 118 goto out_free_name; 119 } 120 if (fstat(path_beneath.parent_fd, &statbuf)) { 121 close(path_beneath.parent_fd); 122 goto out_free_name; 123 } 124 path_beneath.allowed_access = allowed_access; 125 if (!S_ISDIR(statbuf.st_mode)) 126 path_beneath.allowed_access &= ACCESS_FILE; 127 if (landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH, 128 &path_beneath, 0)) { 129 fprintf(stderr, 130 "Failed to update the ruleset with \"%s\": %s\n", 131 path_list[i], strerror(errno)); 132 close(path_beneath.parent_fd); 133 goto out_free_name; 134 } 135 close(path_beneath.parent_fd); 136 } 137 ret = 0; 138 139 out_free_name: 140 free(path_list); 141 free(env_path_name); 142 return ret; 143 } 144 145 /* clang-format off */ 146 147 #define ACCESS_FS_ROUGHLY_READ ( \ 148 LANDLOCK_ACCESS_FS_EXECUTE | \ 149 LANDLOCK_ACCESS_FS_READ_FILE | \ 150 LANDLOCK_ACCESS_FS_READ_DIR) 151 152 #define ACCESS_FS_ROUGHLY_WRITE ( \ 153 LANDLOCK_ACCESS_FS_WRITE_FILE | \ 154 LANDLOCK_ACCESS_FS_REMOVE_DIR | \ 155 LANDLOCK_ACCESS_FS_REMOVE_FILE | \ 156 LANDLOCK_ACCESS_FS_MAKE_CHAR | \ 157 LANDLOCK_ACCESS_FS_MAKE_DIR | \ 158 LANDLOCK_ACCESS_FS_MAKE_REG | \ 159 LANDLOCK_ACCESS_FS_MAKE_SOCK | \ 160 LANDLOCK_ACCESS_FS_MAKE_FIFO | \ 161 LANDLOCK_ACCESS_FS_MAKE_BLOCK | \ 162 LANDLOCK_ACCESS_FS_MAKE_SYM) 163 164 /* clang-format on */ 165 166 int main(const int argc, char *const argv[], char *const *const envp) 167 { 168 const char *cmd_path; 169 char *const *cmd_argv; 170 int ruleset_fd; 171 struct landlock_ruleset_attr ruleset_attr = { 172 .handled_access_fs = ACCESS_FS_ROUGHLY_READ | 173 ACCESS_FS_ROUGHLY_WRITE, 174 }; 175 176 if (argc < 2) { 177 fprintf(stderr, 178 "usage: %s=\"...\" %s=\"...\" %s <cmd> [args]...\n\n", 179 ENV_FS_RO_NAME, ENV_FS_RW_NAME, argv[0]); 180 fprintf(stderr, 181 "Launch a command in a restricted environment.\n\n"); 182 fprintf(stderr, "Environment variables containing paths, " 183 "each separated by a colon:\n"); 184 fprintf(stderr, 185 "* %s: list of paths allowed to be used in a read-only way.\n", 186 ENV_FS_RO_NAME); 187 fprintf(stderr, 188 "* %s: list of paths allowed to be used in a read-write way.\n", 189 ENV_FS_RW_NAME); 190 fprintf(stderr, 191 "\nexample:\n" 192 "%s=\"/bin:/lib:/usr:/proc:/etc:/dev/urandom\" " 193 "%s=\"/dev/null:/dev/full:/dev/zero:/dev/pts:/tmp\" " 194 "%s bash -i\n", 195 ENV_FS_RO_NAME, ENV_FS_RW_NAME, argv[0]); 196 return 1; 197 } 198 199 ruleset_fd = 200 landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); 201 if (ruleset_fd < 0) { 202 const int err = errno; 203 204 perror("Failed to create a ruleset"); 205 switch (err) { 206 case ENOSYS: 207 fprintf(stderr, 208 "Hint: Landlock is not supported by the current kernel. " 209 "To support it, build the kernel with " 210 "CONFIG_SECURITY_LANDLOCK=y and prepend " 211 "\"landlock,\" to the content of CONFIG_LSM.\n"); 212 break; 213 case EOPNOTSUPP: 214 fprintf(stderr, 215 "Hint: Landlock is currently disabled. " 216 "It can be enabled in the kernel configuration by " 217 "prepending \"landlock,\" to the content of CONFIG_LSM, " 218 "or at boot time by setting the same content to the " 219 "\"lsm\" kernel parameter.\n"); 220 break; 221 } 222 return 1; 223 } 224 if (populate_ruleset(ENV_FS_RO_NAME, ruleset_fd, 225 ACCESS_FS_ROUGHLY_READ)) { 226 goto err_close_ruleset; 227 } 228 if (populate_ruleset(ENV_FS_RW_NAME, ruleset_fd, 229 ACCESS_FS_ROUGHLY_READ | 230 ACCESS_FS_ROUGHLY_WRITE)) { 231 goto err_close_ruleset; 232 } 233 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { 234 perror("Failed to restrict privileges"); 235 goto err_close_ruleset; 236 } 237 if (landlock_restrict_self(ruleset_fd, 0)) { 238 perror("Failed to enforce ruleset"); 239 goto err_close_ruleset; 240 } 241 close(ruleset_fd); 242 243 cmd_path = argv[1]; 244 cmd_argv = argv + 1; 245 execvpe(cmd_path, cmd_argv, envp); 246 fprintf(stderr, "Failed to execute \"%s\": %s\n", cmd_path, 247 strerror(errno)); 248 fprintf(stderr, "Hint: access to the binary, the interpreter or " 249 "shared libraries may be denied.\n"); 250 return 1; 251 252 err_close_ruleset: 253 close(ruleset_fd); 254 return 1; 255 } 256