From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D362FC433E0 for ; Thu, 14 Jan 2021 19:07:55 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 7C23B23A58 for ; Thu, 14 Jan 2021 19:07:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728612AbhANTHz (ORCPT ); Thu, 14 Jan 2021 14:07:55 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40502 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726518AbhANTHy (ORCPT ); Thu, 14 Jan 2021 14:07:54 -0500 X-Greylist: delayed 392 seconds by postgrey-1.37 at lindbergh.monkeyblade.net; Thu, 14 Jan 2021 11:07:09 PST Received: from smtp-8fa9.mail.infomaniak.ch (smtp-8fa9.mail.infomaniak.ch [IPv6:2001:1600:3:17::8fa9]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7E4F5C061575 for ; Thu, 14 Jan 2021 11:07:09 -0800 (PST) Received: from smtp-3-0001.mail.infomaniak.ch (unknown [10.4.36.108]) by smtp-2-3000.mail.infomaniak.ch (Postfix) with ESMTPS id 4DGtsd3prKzMqNmw; Thu, 14 Jan 2021 19:59:49 +0100 (CET) Received: from ns3096276.ip-94-23-54.eu (unknown [23.97.221.149]) by smtp-3-0001.mail.infomaniak.ch (Postfix) with ESMTPA id 4DGtsb4TJWzlh8T8; Thu, 14 Jan 2021 19:59:47 +0100 (CET) Subject: Re: [PATCH v26 11/12] samples/landlock: Add a sandbox manager example To: Jann Horn Cc: James Morris , "Serge E . Hallyn" , Al Viro , Andy Lutomirski , Anton Ivanov , Arnd Bergmann , Casey Schaufler , Jeff Dike , Jonathan Corbet , Kees Cook , Michael Kerrisk , Richard Weinberger , Shuah Khan , Vincent Dagonneau , Kernel Hardening , Linux API , linux-arch , "open list:DOCUMENTATION" , linux-fsdevel , kernel list , "open list:KERNEL SELFTEST FRAMEWORK" , linux-security-module , the arch/x86 maintainers , =?UTF-8?Q?Micka=c3=abl_Sala=c3=bcn?= References: <20201209192839.1396820-1-mic@digikod.net> <20201209192839.1396820-12-mic@digikod.net> From: =?UTF-8?Q?Micka=c3=abl_Sala=c3=bcn?= Message-ID: Date: Thu, 14 Jan 2021 19:59:57 +0100 User-Agent: MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-api@vger.kernel.org On 14/01/2021 04:21, Jann Horn wrote: > On Wed, Dec 9, 2020 at 8:29 PM Mickaël Salaün wrote: >> Add a basic sandbox tool to launch a command which can only access a >> whitelist of file hierarchies in a read-only or read-write way. > > I have to admit that I didn't really look at this closely before > because it's just sample code... but I guess I should. You can add > > Reviewed-by: Jann Horn > > if you fix the following nits: OK, I will! > > [...] >> diff --git a/samples/Kconfig b/samples/Kconfig > [...] >> +config SAMPLE_LANDLOCK >> + bool "Build Landlock sample code" >> + depends on HEADERS_INSTALL >> + help >> + Build a simple Landlock sandbox manager able to launch a process >> + restricted by a user-defined filesystem access control. > > nit: s/filesystem access control/filesystem access control policy/ > > [...] >> diff --git a/samples/landlock/sandboxer.c b/samples/landlock/sandboxer.c > [...] >> +/* >> + * Simple Landlock sandbox manager able to launch a process restricted by a >> + * user-defined filesystem access control. > > nit: s/filesystem access control/filesystem access control policy/ > > [...] >> +int main(const int argc, char *const argv[], char *const *const envp) >> +{ > [...] >> + if (argc < 2) { > [...] >> + fprintf(stderr, "* %s: list of paths allowed to be used in a read-only way.\n", >> + ENV_FS_RO_NAME); >> + fprintf(stderr, "* %s: list of paths allowed to be used in a read-write way.\n", >> + ENV_FS_RO_NAME); > > s/ENV_FS_RO_NAME/ENV_FS_RW_NAME/ > >> + fprintf(stderr, "\nexample:\n" >> + "%s=\"/bin:/lib:/usr:/proc:/etc:/dev/urandom\" " >> + "%s=\"/dev/null:/dev/full:/dev/zero:/dev/pts:/tmp\" " >> + "%s bash -i\n", >> + ENV_FS_RO_NAME, ENV_FS_RW_NAME, argv[0]); >> + return 1; >> + } >> + >> + ruleset_fd = landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); >> + if (ruleset_fd < 0) { >> + perror("Failed to create a ruleset"); >> + switch (errno) { > > (Just as a note: In theory perror() can change the value of errno, as > far as I know - so AFAIK you'd theoretically have to do something > like: > > int errno_ = errno; > perror("..."); > switch (errno_) { > ... > } Indeed :) > > I'll almost certainly work fine as-is in practice though.) >