From: "Konstantin Meskhidze (A)" <konstantin.meskhidze@huawei.com>
To: "Mickaël Salaün" <mic@digikod.net>
Cc: <willemdebruijn.kernel@gmail.com>, <gnoack3000@gmail.com>,
<linux-security-module@vger.kernel.org>, <netdev@vger.kernel.org>,
<netfilter-devel@vger.kernel.org>, <yusongping@huawei.com>,
<artem.kuzin@huawei.com>
Subject: Re: [PATCH v9 05/12] landlock: Move and rename umask_layers() and init_layer_masks()
Date: Tue, 14 Feb 2023 13:15:51 +0300 [thread overview]
Message-ID: <b07d85d2-4d26-2843-a079-f888d1f6426e@huawei.com> (raw)
In-Reply-To: <dcb11989-fa8d-3966-77da-2ff5fab2ef32@digikod.net>
2/10/2023 8:37 PM, Mickaël Salaün пишет:
>
> On 16/01/2023 09:58, Konstantin Meskhidze wrote:
>> This patch renames and moves unmask_layers() and init_layer_masks()
>> helpers to ruleset.c to share them with Landlock network implementation
>> in following commits.
>>
>> Signed-off-by: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
>> ---
>>
>> Changes since v8:
>> * Refactors commit message.
>> * Adds "landlock_" prefix for moved helpers.
>>
>> Changes since v7:
>> * Refactors commit message.
>>
>> Changes since v6:
>> * Moves get_handled_accesses() helper from ruleset.c back to fs.c,
>> cause it's not used in coming network commits.
>>
>> Changes since v5:
>> * Splits commit.
>> * Moves init_layer_masks() and get_handled_accesses() helpers
>> to ruleset.c and makes then non-static.
>> * Formats code with clang-format-14.
>>
>> ---
>
> [...]
>
>> diff --git a/security/landlock/ruleset.c b/security/landlock/ruleset.c
>> index 3e1cffda128e..22590cac3d56 100644
>> --- a/security/landlock/ruleset.c
>> +++ b/security/landlock/ruleset.c
>> @@ -572,3 +572,101 @@ landlock_find_rule(const struct landlock_ruleset *const ruleset,
>> }
>> return NULL;
>> }
>> +
>> +/*
>> + * @layer_masks is read and may be updated according to the access request and
>> + * the matching rule.
>> + *
>> + * Returns true if the request is allowed (i.e. relevant layer masks for the
>> + * request are empty).
>> + */
>> +bool landlock_unmask_layers(
>> + const struct landlock_rule *const rule,
>> + const access_mask_t access_request,
>> + layer_mask_t (*const layer_masks)[LANDLOCK_NUM_ACCESS_FS])
>> +{
>> + size_t layer_level;
>> +
>> + if (!access_request || !layer_masks)
>> + return true;
>> + if (!rule)
>> + return false;
>> +
>> + /*
>> + * An access is granted if, for each policy layer, at least one rule
>> + * encountered on the pathwalk grants the requested access,
>> + * regardless of its position in the layer stack. We must then check
>> + * the remaining layers for each inode, from the first added layer to
>> + * the last one. When there is multiple requested accesses, for each
>> + * policy layer, the full set of requested accesses may not be granted
>> + * by only one rule, but by the union (binary OR) of multiple rules.
>> + * E.g. /a/b <execute> + /a <read> => /a/b <execute + read>
>> + */
>> + for (layer_level = 0; layer_level < rule->num_layers; layer_level++) {
>> + const struct landlock_layer *const layer =
>> + &rule->layers[layer_level];
>> + const layer_mask_t layer_bit = BIT_ULL(layer->level - 1);
>> + const unsigned long access_req = access_request;
>> + unsigned long access_bit;
>> + bool is_empty;
>> +
>> + /*
>> + * Records in @layer_masks which layer grants access to each
>> + * requested access.
>> + */
>> + is_empty = true;
>> + for_each_set_bit(access_bit, &access_req,
>> + ARRAY_SIZE(*layer_masks)) {
>> + if (layer->access & BIT_ULL(access_bit))
>> + (*layer_masks)[access_bit] &= ~layer_bit;
>> + is_empty = is_empty && !(*layer_masks)[access_bit];
>> + }
>> + if (is_empty)
>> + return true;
>> + }
>> + return false;
>> +}
>> +
>> +/*
>
> Please keep the original "/**"
Got it. Thanks.
>
>
>> + * init_layer_masks - Initialize layer masks from an access request
>> + *
>> + * Populates @layer_masks such that for each access right in @access_request,
>> + * the bits for all the layers are set where this access right is handled.
>> + *
>> + * @domain: The domain that defines the current restrictions.
>> + * @access_request: The requested access rights to check.
>> + * @layer_masks: The layer masks to populate.
>> + *
>> + * Returns: An access mask where each access right bit is set which is handled
>> + * in any of the active layers in @domain.
>> + */
> .
next prev parent reply other threads:[~2023-02-14 10:15 UTC|newest]
Thread overview: 74+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-01-16 8:58 [PATCH v9 00/12] Network support for Landlock Konstantin Meskhidze
2023-01-16 8:58 ` [PATCH v9 01/12] landlock: Make ruleset's access masks more generic Konstantin Meskhidze
2023-01-16 8:58 ` [PATCH v9 02/12] landlock: Allow filesystem layout changes for domains without such rule type Konstantin Meskhidze
2023-02-10 17:34 ` Mickaël Salaün
2023-02-14 8:51 ` Konstantin Meskhidze (A)
2023-02-14 12:07 ` Mickaël Salaün
2023-02-14 12:57 ` Konstantin Meskhidze (A)
2023-01-16 8:58 ` [PATCH v9 03/12] landlock: Refactor landlock_find_rule/insert_rule Konstantin Meskhidze
2023-02-10 17:36 ` Mickaël Salaün
2023-02-14 10:15 ` Konstantin Meskhidze (A)
2023-02-14 12:09 ` Mickaël Salaün
2023-02-14 13:28 ` Konstantin Meskhidze (A)
2023-01-16 8:58 ` [PATCH v9 04/12] landlock: Refactor merge/inherit_ruleset functions Konstantin Meskhidze
2023-01-16 8:58 ` [PATCH v9 05/12] landlock: Move and rename umask_layers() and init_layer_masks() Konstantin Meskhidze
2023-02-10 17:37 ` Mickaël Salaün
2023-02-14 10:15 ` Konstantin Meskhidze (A) [this message]
2023-01-16 8:58 ` [PATCH v9 06/12] landlock: Refactor _unmask_layers() and _init_layer_masks() Konstantin Meskhidze
2023-02-10 17:38 ` Mickaël Salaün
2023-02-14 10:16 ` Konstantin Meskhidze (A)
2023-02-21 18:07 ` Mickaël Salaün
2023-03-06 7:52 ` Konstantin Meskhidze (A)
2023-01-16 8:58 ` [PATCH v9 07/12] landlock: Refactor landlock_add_rule() syscall Konstantin Meskhidze
2023-02-10 17:38 ` Mickaël Salaün
2023-02-14 10:18 ` Konstantin Meskhidze (A)
2023-01-16 8:58 ` [PATCH v9 08/12] landlock: Add network rules and TCP hooks support Konstantin Meskhidze
2023-02-10 17:39 ` Mickaël Salaün
2023-02-14 10:19 ` Konstantin Meskhidze (A)
2023-03-13 9:33 ` Konstantin Meskhidze (A)
2023-03-14 12:13 ` Mickaël Salaün
2023-03-14 14:38 ` Konstantin Meskhidze (A)
2023-02-21 18:04 ` Mickaël Salaün
2023-03-06 10:18 ` Konstantin Meskhidze (A)
2023-01-16 8:58 ` [PATCH v9 09/12] selftests/landlock: Share enforce_ruleset() Konstantin Meskhidze
2023-01-16 8:58 ` [PATCH v9 10/12] selftests/landlock: Add 10 new test suites dedicated to network Konstantin Meskhidze
2023-02-10 17:40 ` Mickaël Salaün
2023-02-14 10:36 ` Konstantin Meskhidze (A)
2023-02-14 12:13 ` Mickaël Salaün
2023-02-14 13:28 ` Konstantin Meskhidze (A)
2023-02-21 18:05 ` Mickaël Salaün
2023-03-06 12:03 ` Konstantin Meskhidze (A)
2023-03-06 16:00 ` Mickaël Salaün
2023-03-06 18:13 ` Konstantin Meskhidze (A)
2023-01-16 8:58 ` [PATCH v9 11/12] samples/landlock: Add network demo Konstantin Meskhidze
2023-01-16 8:58 ` [PATCH v9 12/12] landlock: Document Landlock's network support Konstantin Meskhidze
2023-01-21 23:07 ` Günther Noack
2023-01-23 9:38 ` Konstantin Meskhidze (A)
2023-01-27 18:22 ` Mickaël Salaün
2023-01-30 10:03 ` Konstantin Meskhidze (A)
2023-02-21 16:16 ` Mickaël Salaün
2023-03-06 13:43 ` Konstantin Meskhidze (A)
2023-03-06 16:09 ` Mickaël Salaün
2023-03-06 17:55 ` Konstantin Meskhidze (A)
2023-01-30 12:26 ` Konstantin Meskhidze (A)
2023-02-23 22:17 ` [PATCH v9 00/12] Network support for Landlock Günther Noack
2023-03-06 7:45 ` Konstantin Meskhidze (A)
2023-03-13 17:16 ` Konstantin Meskhidze (A)
2023-03-14 13:28 ` Mickaël Salaün
2023-06-26 15:29 ` [PATCH v9 00/12] Network support for Landlock - allowed list of protocols Mickaël Salaün
2023-06-28 2:33 ` Jeff Xu
2023-06-28 19:03 ` Mickaël Salaün
2023-06-28 21:56 ` Jeff Xu
2023-06-28 8:44 ` Günther Noack
2023-06-28 17:03 ` Jeff Xu
2023-06-28 19:29 ` Mickaël Salaün
2023-06-29 3:18 ` Jeff Xu
2023-06-29 11:07 ` Mickaël Salaün
2023-06-30 4:18 ` Jeff Xu
2023-06-30 18:23 ` Mickaël Salaün
2023-07-05 15:00 ` Jeff Xu
2023-07-12 11:30 ` Mickaël Salaün
2023-07-13 13:20 ` Konstantin Meskhidze (A)
2023-07-13 14:52 ` Mickaël Salaün
2023-07-13 11:44 ` Konstantin Meskhidze (A)
2023-06-28 19:07 ` Mickaël Salaün
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=b07d85d2-4d26-2843-a079-f888d1f6426e@huawei.com \
--to=konstantin.meskhidze@huawei.com \
--cc=artem.kuzin@huawei.com \
--cc=gnoack3000@gmail.com \
--cc=linux-security-module@vger.kernel.org \
--cc=mic@digikod.net \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=willemdebruijn.kernel@gmail.com \
--cc=yusongping@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).