[PATCH v3 0/4] Implement LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS

Howdy

This series adds a new landlock_restrict_self(2) flag:
LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS.

The flag sets the no_new_privs attribute of the calling thread only
once the enforcement of the ruleset succeeded: no_new_privs is set if
and only if the landlock_restrict_self(2) call succeeds.  Following
Mickaël's feedback [2] on v2 [1], the "atomic" framing is gone: this is
an ordering guarantee, not atomicity, and the wording now reflects that
throughout the series.

Semantics:

A single call replaces the usual prctl(PR_SET_NO_NEW_PRIVS) +
landlock_restrict_self(2) pair.  Because no_new_privs is set by the
call itself, the no_new_privs/CAP_SYS_ADMIN precondition is fulfilled
by construction, so the flag is usable by unprivileged processes.  This
is safe for the same reason the prctl(2) pair is: the executed programs
can either gain privileges or be restricted, never both.

The two states cannot diverge.  A failed call (invalid ruleset FD,
E2BIG, ENOMEM, interrupted TSYNC, ...) leaves no_new_privs unchanged,
and a successful call never returns without no_new_privs set: the
attribute is set past the last point of failure, right before
commit_creds(), which cannot fail.

Combined with LANDLOCK_RESTRICT_SELF_TSYNC, no_new_privs is set on all
threads with the same guarantee: each sibling thread sets it in the
commit phase of the TSYNC protocol, after its all-or-nothing barrier,
so either every thread gets both the domain and no_new_privs, or none
does.  This also makes it possible to set no_new_privs process-wide in
one call, which prctl(2) cannot do.

The flag requires a ruleset: calls with a ruleset_fd of -1 are
rejected.  Such a call would be nothing more than a Landlock-flavored
prctl(PR_SET_NO_NEW_PRIVS), and rejecting it keeps the option of giving
it a meaning later.  As a consequence of the fulfilled precondition, an
unprivileged caller passing unknown flag bits together with this flag
receives EINVAL instead of EPERM; the selftests pin this error ordering
as well.

The Landlock ABI version is bumped to 11.

Test coverage:

base_test checks that a successful call sets no_new_privs without a
prior prctl(2) nor CAP_SYS_ADMIN, that a failed call (invalid ruleset
FD or layer maximum) leaves it unchanged, that the flag requires a
ruleset FD, and the updated EPERM/EINVAL ordering.  tsync_test checks
that TSYNC sets no_new_privs on sibling threads along with the domain,
and that a TSYNC call failing on the layer maximum leaves it unset on
every thread.

Changes since v2:

- Reworded "atomically" to the ordering guarantee in the commit
  messages, kdocs and documentation, per Mickaël's feedback.
- Explained the valid-ruleset requirement in the first patch's commit
  message.
- Ran clang-format on the selftests and added max-layers failure tests
  checking E2BIG and that no_new_privs stays unset.
- Mentioned the selftest renames in the commit message.
- Updated the documentation tutorial (restrict_flags gated on the ABI
  version, prctl(2) call skipped when the flag is used) and explained
  that not setting no_new_privs is risky even when it is not required.
- New patch: the sandboxer sample now uses the flag by default, gated
  on the ABI version, with a prctl(2) fallback.

Per-patch changelogs are below each patch.

[1] https://lore.kernel.org/linux-security-module/[email protected]/
[2] https://lore.kernel.org/linux-security-module/[email protected]/

Justin Suess (4):
  landlock: Add LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS
  selftests/landlock: Test LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS
  landlock: Document LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS
  samples/landlock: Add LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS to sampler

 Documentation/userspace-api/landlock.rst      | 47 +++++++--
 include/uapi/linux/landlock.h                 | 13 +++
 samples/landlock/sandboxer.c                  | 16 ++-
 security/landlock/limits.h                    |  2 +-
 security/landlock/syscalls.c                  | 28 ++++--
 security/landlock/tsync.c                     |  8 +-
 security/landlock/tsync.h                     |  4 +-
 tools/testing/selftests/landlock/base_test.c  | 99 ++++++++++++++++++-
 tools/testing/selftests/landlock/tsync_test.c | 72 ++++++++++++++
 9 files changed, 263 insertions(+), 26 deletions(-)


base-commit: 308bc78f1e577439ca61ec77842a5a3ba7e8bbce
-- 
2.54.0