Re: [PATCH v11 0/8] Landlock: Add abstract UNIX socket restriction

On Fri, Sep 13, 2024 at 06:33:05PM +0200, Mickaël Salaün wrote:
> I have reworked a bit the patches, including the signal scoping ones,
> and they are here:
> https://git.kernel.org/pub/scm/linux/kernel/git/mic/linux.git/log/?h=next

I pushed a last few changes to add drop_caps() calls to all the signal
tests.  The top commit is b530ec46a0dbe8889b35909ae51f2dacbd18f0f5

> 
> This is based on a manual merge of some VFS changes and LSM changes
> required for this patch series:
> https://git.kernel.org/pub/scm/linux/kernel/git/mic/linux.git/commit/?h=next&id=24dfe95e493086a99acf7df1ef23d9f21f8cdec7
> 
> My changes are explained in the "[mic: ...]" part of the commit
> messages. Please send two last patch series, with this changes and reply
> to it with your comments if any.
> 
> On Wed, Sep 04, 2024 at 06:13:54PM -0600, Tahera Fahimi wrote:
> > This patch series adds scoping mechanism for abstract UNIX sockets.
> > Closes: https://github.com/landlock-lsm/linux/issues/7
> > 
> > Problem
> > =======
> > 
> > Abstract UNIX sockets are used for local inter-process communications
> > independent of the filesystem. Currently, a sandboxed process can
> > connect to a socket outside of the sandboxed environment, since Landlock
> > has no restriction for connecting to an abstract socket address(see more
> > details in [1,2]). Access to such sockets for a sandboxed process should
> > be scoped the same way ptrace is limited.
> > 
> > [1] https://lore.kernel.org/all/[email protected]/
> > [2] https://lore.kernel.org/all/[email protected]/
> > 
> > Solution
> > ========
> > 
> > To solve this issue, we extend the user space interface by adding a new
> > "scoped" field to Landlock ruleset attribute structure. This field can
> > contains different rights to restrict different functionalities. For
> > abstract UNIX sockets, we introduce
> > "LANDLOCK_SCOPED_ABSTRACT_UNIX_SOCKET" field to specify that a ruleset
> > will deny any connection from within the sandbox domain to its parent
> > (i.e. any parent sandbox or non-sandbox processes).
> > 
> > Example
> > =======
> > 
> > Starting a listening socket with socat(1):
> >         socat abstract-listen:mysocket -
> > 
> > Starting a sandboxed shell from $HOME with samples/landlock/sandboxer:
> >         LL_FS_RO=/ LL_FS_RW=. LL_SCOPED="a" ./sandboxer /bin/bash
> > 
> > If we try to connect to the listening socket, the connection gets
> > refused.
> >         socat - abstract-connect:mysocket --> fails
> > 
> > 
> > Notes of Implementation
> > =======================
> > 
> > * Using the "scoped" field provides enough compatibility and flexibility
> >   to extend the scoping mechanism for other IPCs(e.g. signals).
> > 
> > * To access the domain of a socket, we use its credentials of the file's
> >   FD which point to the credentials of the process that created the
> >   socket (see more details in [3]). Cases where the process using the
> >   socket has a different domain than the process created it are covered
> >   in the "outside_socket" test.
> > 
> > [3]https://lore.kernel.org/all/[email protected]/
> > 
> > Previous Versions
> > =================
> > v10:https://lore.kernel.org/all/[email protected]/
> > v9: https://lore.kernel.org/all/[email protected]/
> > v8: https://lore.kernel.org/all/[email protected]/
> > v7: https://lore.kernel.org/all/[email protected]/
> > v6: https://lore.kernel.org/all/Zn32CYZiu7pY+rdI@tahera-OptiPlex-5000/
> > and https://lore.kernel.org/all/Zn32KKIJrY7Zi51K@tahera-OptiPlex-5000/
> > v5: https://lore.kernel.org/all/ZnSZnhGBiprI6FRk@tahera-OptiPlex-5000/
> > v4: https://lore.kernel.org/all/ZnNcE3ph2SWi1qmd@tahera-OptiPlex-5000/
> > v3: https://lore.kernel.org/all/ZmJJ7lZdQuQop7e5@tahera-OptiPlex-5000/
> > v2: https://lore.kernel.org/all/ZgX5TRTrSDPrJFfF@tahera-OptiPlex-5000/
> > v1: https://lore.kernel.org/all/ZgXN5fi6A1YQKiAQ@tahera-OptiPlex-5000/
> > 
> > Tahera Fahimi (8):
> >   Landlock: Add abstract UNIX socket restriction
> >   selftests/landlock: Add test for handling unknown scope
> >   selftests/landlock: Add abstract UNIX socket restriction tests
> >   selftests/landlock: Add tests for UNIX sockets with any address
> >     formats
> >   selftests/landlock: Test connected vs non-connected datagram UNIX
> >     socket
> >   selftests/landlock: Restrict inherited datagram UNIX socket to connect
> >   sample/landlock: Add support abstract UNIX socket restriction
> >   Landlock: Document LANDLOCK_SCOPED_ABSTRACT_UNIX_SOCKET and ABI
> >     version
> > 
> >  Documentation/userspace-api/landlock.rst      |  45 +-
> >  include/uapi/linux/landlock.h                 |  28 +
> >  samples/landlock/sandboxer.c                  |  61 +-
> >  security/landlock/limits.h                    |   3 +
> >  security/landlock/ruleset.c                   |   7 +-
> >  security/landlock/ruleset.h                   |  24 +-
> >  security/landlock/syscalls.c                  |  17 +-
> >  security/landlock/task.c                      | 136 +++
> >  tools/testing/selftests/landlock/base_test.c  |   2 +-
> >  tools/testing/selftests/landlock/common.h     |  38 +
> >  tools/testing/selftests/landlock/net_test.c   |  31 +-
> >  .../landlock/scoped_abstract_unix_test.c      | 993 ++++++++++++++++++
> >  .../selftests/landlock/scoped_base_variants.h | 154 +++
> >  .../selftests/landlock/scoped_common.h        |  28 +
> >  .../scoped_multiple_domain_variants.h         | 154 +++
> >  .../testing/selftests/landlock/scoped_test.c  |  33 +
> >  16 files changed, 1709 insertions(+), 45 deletions(-)
> >  create mode 100644 tools/testing/selftests/landlock/scoped_abstract_unix_test.c
> >  create mode 100644 tools/testing/selftests/landlock/scoped_base_variants.h
> >  create mode 100644 tools/testing/selftests/landlock/scoped_common.h
> >  create mode 100644 tools/testing/selftests/landlock/scoped_multiple_domain_variants.h
> >  create mode 100644 tools/testing/selftests/landlock/scoped_test.c
> > 
> > -- 
> > 2.34.1
> >