linux-stable/security/landlock
Mickaël Salaün f55f9e7ce6 landlock: Fix same-layer rule unions
commit 8ba0005ff4 upstream.

The original behavior was to check if the full set of requested accesses
was allowed by at least a rule of every relevant layer.  This didn't
take into account requests for multiple accesses and same-layer rules
allowing the union of these accesses in a complementary way.  As a
result, multiple accesses requested on a file hierarchy matching rules
that, together, allowed these accesses, but without a unique rule
allowing all of them, was illegitimately denied.  This case should be
rare in practice and it can only be triggered by the path_rename or
file_open hook implementations.

For instance, if, for the same layer, a rule allows execution
beneath /a/b and another rule allows read beneath /a, requesting access
to read and execute at the same time for /a/b should be allowed for this
layer.

This was an inconsistency because the union of same-layer rule accesses
was already allowed if requested once at a time anyway.

This fix changes the way allowed accesses are gathered over a path walk.
To take into account all these rule accesses, we store in a matrix all
layer granting the set of requested accesses, according to the handled
accesses.  To avoid heap allocation, we use an array on the stack which
is 2*13 bytes.  A following commit bringing the LANDLOCK_ACCESS_FS_REFER
access right will increase this size to reach 112 bytes (2*14*4) in case
of link or rename actions.

Add a new layout1.layer_rule_unions test to check that accesses from
different rules pertaining to the same layer are ORed in a file
hierarchy.  Also test that it is not the case for rules from different
layers.

Reviewed-by: Paul Moore <paul@paul-moore.com>
Link: https://lore.kernel.org/r/20220506161102.525323-5-mic@digikod.net
Cc: stable@vger.kernel.org
Signed-off-by: Mickaël Salaün <mic@digikod.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-09 10:23:24 +02:00
..
common.h landlock: Set up the security framework and manage credentials 2021-04-22 12:22:10 -07:00
cred.c landlock: Format with clang-format 2022-06-09 10:23:22 +02:00
cred.h landlock: Format with clang-format 2022-06-09 10:23:22 +02:00
fs.c landlock: Fix same-layer rule unions 2022-06-09 10:23:24 +02:00
fs.h landlock: Define access_mask_t to enforce a consistent access mask size 2022-06-09 10:23:24 +02:00
Kconfig landlock: Support filesystem access-control 2021-04-22 12:22:11 -07:00
limits.h landlock: Reduce the maximum number of layers to 16 2022-06-09 10:23:24 +02:00
Makefile landlock: Add syscall implementations 2021-04-22 12:22:11 -07:00
object.c landlock: Format with clang-format 2022-06-09 10:23:22 +02:00
object.h landlock: Format with clang-format 2022-06-09 10:23:22 +02:00
ptrace.c landlock: Format with clang-format 2022-06-09 10:23:22 +02:00
ptrace.h landlock: Add ptrace restrictions 2021-04-22 12:22:10 -07:00
ruleset.c landlock: Define access_mask_t to enforce a consistent access mask size 2022-06-09 10:23:24 +02:00
ruleset.h landlock: Fix same-layer rule unions 2022-06-09 10:23:24 +02:00
setup.c landlock: Support filesystem access-control 2021-04-22 12:22:11 -07:00
setup.h landlock: Support filesystem access-control 2021-04-22 12:22:11 -07:00
syscalls.c landlock: Change landlock_restrict_self(2) check ordering 2022-06-09 10:23:24 +02:00