mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-28 03:40:04 +00:00
cb2c7d1a17
Using Landlock objects and ruleset, it is possible to tag inodes according to a process's domain. To enable an unprivileged process to express a file hierarchy, it first needs to open a directory (or a file) and pass this file descriptor to the kernel through landlock_add_rule(2). When checking if a file access request is allowed, we walk from the requested dentry to the real root, following the different mount layers. The access to each "tagged" inodes are collected according to their rule layer level, and ANDed to create access to the requested file hierarchy. This makes possible to identify a lot of files without tagging every inodes nor modifying the filesystem, while still following the view and understanding the user has from the filesystem. Add a new ARCH_EPHEMERAL_INODES for UML because it currently does not keep the same struct inodes for the same inodes whereas these inodes are in use. This commit adds a minimal set of supported filesystem access-control which doesn't enable to restrict all file-related actions. This is the result of multiple discussions to minimize the code of Landlock to ease review. Thanks to the Landlock design, extending this access-control without breaking user space will not be a problem. Moreover, seccomp filters can be used to restrict the use of syscall families which may not be currently handled by Landlock. Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: Anton Ivanov <anton.ivanov@cambridgegreys.com> Cc: James Morris <jmorris@namei.org> Cc: Jann Horn <jannh@google.com> Cc: Jeff Dike <jdike@addtoit.com> Cc: Kees Cook <keescook@chromium.org> Cc: Richard Weinberger <richard@nod.at> Cc: Serge E. Hallyn <serge@hallyn.com> Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com> Link: https://lore.kernel.org/r/20210422154123.13086-8-mic@digikod.net Signed-off-by: James Morris <jamorris@linux.microsoft.com>
70 lines
2.1 KiB
C
70 lines
2.1 KiB
C
/* SPDX-License-Identifier: GPL-2.0-only */
|
|
/*
|
|
* Landlock LSM - Filesystem management and hooks
|
|
*
|
|
* Copyright © 2017-2020 Mickaël Salaün <mic@digikod.net>
|
|
* Copyright © 2018-2020 ANSSI
|
|
*/
|
|
|
|
#ifndef _SECURITY_LANDLOCK_FS_H
|
|
#define _SECURITY_LANDLOCK_FS_H
|
|
|
|
#include <linux/fs.h>
|
|
#include <linux/init.h>
|
|
#include <linux/rcupdate.h>
|
|
|
|
#include "ruleset.h"
|
|
#include "setup.h"
|
|
|
|
/**
|
|
* struct landlock_inode_security - Inode security blob
|
|
*
|
|
* Enable to reference a &struct landlock_object tied to an inode (i.e.
|
|
* underlying object).
|
|
*/
|
|
struct landlock_inode_security {
|
|
/**
|
|
* @object: Weak pointer to an allocated object. All assignments of a
|
|
* new object are protected by the underlying inode->i_lock. However,
|
|
* atomically disassociating @object from the inode is only protected
|
|
* by @object->lock, from the time @object's usage refcount drops to
|
|
* zero to the time this pointer is nulled out (cf. release_inode() and
|
|
* hook_sb_delete()). Indeed, such disassociation doesn't require
|
|
* inode->i_lock thanks to the careful rcu_access_pointer() check
|
|
* performed by get_inode_object().
|
|
*/
|
|
struct landlock_object __rcu *object;
|
|
};
|
|
|
|
/**
|
|
* struct landlock_superblock_security - Superblock security blob
|
|
*
|
|
* Enable hook_sb_delete() to wait for concurrent calls to release_inode().
|
|
*/
|
|
struct landlock_superblock_security {
|
|
/**
|
|
* @inode_refs: Number of pending inodes (from this superblock) that
|
|
* are being released by release_inode().
|
|
* Cf. struct super_block->s_fsnotify_inode_refs .
|
|
*/
|
|
atomic_long_t inode_refs;
|
|
};
|
|
|
|
static inline struct landlock_inode_security *landlock_inode(
|
|
const struct inode *const inode)
|
|
{
|
|
return inode->i_security + landlock_blob_sizes.lbs_inode;
|
|
}
|
|
|
|
static inline struct landlock_superblock_security *landlock_superblock(
|
|
const struct super_block *const superblock)
|
|
{
|
|
return superblock->s_security + landlock_blob_sizes.lbs_superblock;
|
|
}
|
|
|
|
__init void landlock_add_fs_hooks(void);
|
|
|
|
int landlock_append_fs_rule(struct landlock_ruleset *const ruleset,
|
|
const struct path *const path, u32 access_hierarchy);
|
|
|
|
#endif /* _SECURITY_LANDLOCK_FS_H */
|