Re: questions about ruleset and rule

On 2022-11-21T02:41:00.000+01:00, Anquan Wu <[email protected]> wrote:
>  hello, I have some questions about ruleset and rule, Can anyone help me=
=EF=BC=9F
>=20
>=20
>=20
> 1. From website https://www.kernel.org/doc/html/latest/userspace-api/land=
lock.html,
>=20
> it said that "We first need to define the ruleset that will contain our r=
ules. For this example, the ruleset will contain rules that only allow read=
 actions, but write actions will be denied. The ruleset then needs to handl=
e both of these kind of actions. This is required for backward and forward =
compatibility (i.e. the kernel and user space may not know each other=
=E2=80=99s supported restrictions), hence the need to be explicit about the=
 denied-by-default access rights.".
>=20
> Can I interpret this sentence in this way?
> -------------------------------------------------------------------------=
---------------------------------------------------------------------------=
-----------
> the fs_access_masks of ruleset is the default allow action=EF=BC=8Cthe ru=
le is the fine-grained rules.

The ruleset_attr.handled_access_fs is the set of actions that may be denied=
 by the ruleset. Without any rule added to this ruleset, the ruleset will d=
eny all these actions.

The rules tied to a ruleset describe exceptions for which an action may be =
allowed. Because rulesets can be nested/stacked, a rule allowing access to =
a specific file may not be enough because a parent ruleset may already deny=
 such actions: we can only add more restrictions with nested rulesets

>=20
> when a process opens a file, landlock enforces the fine-grained rules. If=
 there are no rules to match in the fine-grained rules=EF=BC=8C the default=
 police(fs_access_masks of ruleset) is executed.

This is correct, but by default all handled accesses are denied.


> _________________________________________________________________________=
___________________________________________________________________________=
_______________________
>=20
> If the above is right=EF=BC=8Cis the below LANDLOCK_ACCESS_FS_WRITE_FILE =
of ruleset_attr to be removed.
>=20
> struct landlock_ruleset_attr ruleset_attr =3D {
>     .handled_access_fs =3D
>         LANDLOCK_ACCESS_FS_EXECUTE |
>         LANDLOCK_ACCESS_FS_WRITE_FILE |    // here
>         LANDLOCK_ACCESS_FS_READ_FILE |
>         LANDLOCK_ACCESS_FS_READ_DIR |
>         LANDLOCK_ACCESS_FS_REMOVE_DIR |
>         LANDLOCK_ACCESS_FS_REMOVE_FILE |
>         LANDLOCK_ACCESS_FS_MAKE_CHAR |
>         LANDLOCK_ACCESS_FS_MAKE_DIR |
>         LANDLOCK_ACCESS_FS_MAKE_REG |
>         LANDLOCK_ACCESS_FS_MAKE_SOCK |
>         LANDLOCK_ACCESS_FS_MAKE_FIFO |
>         LANDLOCK_ACCESS_FS_MAKE_BLOCK |
>         LANDLOCK_ACCESS_FS_MAKE_SYM |
>         LANDLOCK_ACCESS_FS_REFER,
> };
> If not, How to understand the fs_access_masks of ruleset and rule?

The documentation example creates rules with LANDLOCK_ACCESS_FS_EXECUTE | L=
ANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_READ_DIR, which means that=
 LANDLOCK_ACCESS_FS_WRITE_FILE is never allowed, and then denied.

>=20
> 2. If there are no rules in the ruleset=EF=BC=8Cwhat actions for a proces=
s with the ruleset will landlock perform.

Without exception (i.e. rule), all ruleset's handled actions are denied.

>=20
> 3.=20
> If a rule ("/home/a.txt" , "rw") is for process P1 and P2 is a child proc=
ess of P1,
>=20
> Can P2 set a new rule("/home/a.txt", "ro")

Yes, P2 can set any rule, but this can only lead to a more restricted sandb=
ox (i.e. it cannot bypass its parent ruleset).
In this case, /home/a.txt is allowed to be read and written thanks to P1's =
ruleset, and P2's ruleset explicitly removes write access.

>=20
> If a rule ("/home/a.txt" , "ro") is for process P1 and P2 is a child proc=
ess of P1,
> Can P2 set a new rule("/home/a.txt", "rw")

P2 can set this rule (which will not create any error when calling landlock=
_add_rule), but the write permission will be ignored because P1's ruleset d=
enies this access.

>=20
> thanks.