Re: [PATCH v6 17/17] samples/landlock: adds network demo

From: "Konstantin Meskhidze (A)" <konstantin.meskhidze@huawei.com>
To: "Mickaël Salaün" <mic@digikod.net>
Cc: <willemdebruijn.kernel@gmail.com>,
	<linux-security-module@vger.kernel.org>, <netdev@vger.kernel.org>,
	<netfilter-devel@vger.kernel.org>, <yusongping@huawei.com>,
	<anton.sirazetdinov@huawei.com>
Subject: Re: [PATCH v6 17/17] samples/landlock: adds network demo
Date: Thu, 28 Jul 2022 12:21:55 +0300	[thread overview]
Message-ID: <10ddbfb4-c92e-4b16-5a04-64af3fa59c15@huawei.com> (raw)
In-Reply-To: <78b7cd69-46d2-2868-8c9c-f4f29958a679@digikod.net>


7/27/2022 11:26 PM, Mickaël Salaün пишет:
> 
> On 21/06/2022 10:23, Konstantin Meskhidze wrote:
>> This commit adds network demo. It's possible to
>> allow a sandoxer to bind/connect to a list of
>> particular ports restricting networks actions to
>> the rest of ports.
>> 
>> Signed-off-by: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
>> ---
>> 
>> Changes since v5:
>> * Makes network ports sandboxing optional.
>> * Fixes some logic errors.
>> * Formats code with clang-format-14.
>> 
>> Changes since v4:
>> * Adds ENV_TCP_BIND_NAME "LL_TCP_BIND" and
>> ENV_TCP_CONNECT_NAME "LL_TCP_CONNECT" variables
>> to insert TCP ports.
>> * Renames populate_ruleset() to populate_ruleset_fs().
>> * Adds populate_ruleset_net() and parse_port_num() helpers.
>> * Refactors main() to support network sandboxing.
>> 
>> ---
>>   samples/landlock/sandboxer.c | 118 +++++++++++++++++++++++++++++++----
>>   1 file changed, 107 insertions(+), 11 deletions(-)
>> 
>> diff --git a/samples/landlock/sandboxer.c b/samples/landlock/sandboxer.c
>> index 3e404e51ec64..0606c676fded 100644
>> --- a/samples/landlock/sandboxer.c
>> +++ b/samples/landlock/sandboxer.c
> 
> 
> [...]
> 
>> @@ -232,16 +308,36 @@ int main(const int argc, char *const argv[], char *const *const envp)
>>   		access_fs_rw &= ~ACCESS_ABI_2;
> 
> We need to check the ABI to make this sample work without a kernel
> supporting Landlock network access rights, and error out if the user
> explicitely asked for it anyway (with the environement variable).
> 
   Good point. Thanks for that.
   I will check it.
> 
>>   	}
>> 
>> +	/* Adds optionally network bind() support. */
>> +	env_port_name = getenv(ENV_TCP_BIND_NAME);
>> +	if (env_port_name) {
>> +		access_net_tcp |= LANDLOCK_ACCESS_NET_BIND_TCP;
>> +	}
>> +	/* Adds optionally network connect() support. */
>> +	env_port_name = getenv(ENV_TCP_CONNECT_NAME);
>> +	if (env_port_name) {
>> +		access_net_tcp |= LANDLOCK_ACCESS_NET_CONNECT_TCP;
>> +	}
>> +	ruleset_attr.handled_access_net = access_net_tcp;
>> +
>>   	ruleset_fd =
>>   		landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
>>   	if (ruleset_fd < 0) {
>>   		perror("Failed to create a ruleset");
>>   		return 1;
>>   	}
>> -	if (populate_ruleset(ENV_FS_RO_NAME, ruleset_fd, access_fs_ro)) {
>> +	if (populate_ruleset_fs(ENV_FS_RO_NAME, ruleset_fd, access_fs_ro)) {
>> +		goto err_close_ruleset;
>> +	}
>> +	if (populate_ruleset_fs(ENV_FS_RW_NAME, ruleset_fd, access_fs_rw)) {
>> +		goto err_close_ruleset;
>> +	}
>> +	if (populate_ruleset_net(ENV_TCP_BIND_NAME, ruleset_fd,
>> +				 LANDLOCK_ACCESS_NET_BIND_TCP)) {
>>   		goto err_close_ruleset;
>>   	}
>> -	if (populate_ruleset(ENV_FS_RW_NAME, ruleset_fd, access_fs_rw)) {
>> +	if (populate_ruleset_net(ENV_TCP_CONNECT_NAME, ruleset_fd,
>> +				 LANDLOCK_ACCESS_NET_CONNECT_TCP)) {
>>   		goto err_close_ruleset;
>>   	}
>>   	if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
>> --
>> 2.25.1
>> 
> .