From: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
To: "Mickaël Salaün" <mic@digikod.net>, willemdebruijn.kernel@gmail.com
Cc: <linux-security-module@vger.kernel.org>, <netdev@vger.kernel.org>,
<netfilter-devel@vger.kernel.org>, <yusongping@huawei.com>,
<artem.kuzin@huawei.com>, <anton.sirazetdinov@huawei.com>
Subject: Re: [RFC PATCH v4 03/15] landlock: landlock_find/insert_rule refactoring
Date: Wed, 23 Mar 2022 11:41:32 +0300 [thread overview]
Message-ID: <212ac1b3-b78b-4030-1f3d-f5cd1001bb7d@huawei.com> (raw)
In-Reply-To: <90a20548-39f6-6e84-efb1-8ef3ad992255@digikod.net>
3/22/2022 4:24 PM, Mickaël Salaün пишет:
>
> On 22/03/2022 13:33, Konstantin Meskhidze wrote:
>>
>>
>> 3/18/2022 9:33 PM, Mickaël Salaün пишет:
>>>
>>> On 17/03/2022 15:29, Konstantin Meskhidze wrote:
>>>>
>>>>
>>>> 3/16/2022 11:27 AM, Mickaël Salaün пишет:
>>>>>
>>>>> On 09/03/2022 14:44, Konstantin Meskhidze wrote:
>>>>>> A new object union added to support a socket port
>>>>>> rule type. To support it landlock_insert_rule() and
>>>>>> landlock_find_rule() were refactored. Now adding
>>>>>> or searching a rule in a ruleset depends on a
>>>>>> rule_type argument provided in refactored
>>>>>> functions mentioned above.
>>>>>>
>>>>>> Signed-off-by: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
>>>>>> ---
>
> [...]
>
>>>>>> @@ -156,26 +166,38 @@ static void build_check_ruleset(void)
>>>>>> * access rights.
>>>>>> */
>>>>>> static int insert_rule(struct landlock_ruleset *const ruleset,
>>>>>> - struct landlock_object *const object,
>>>>>> + struct landlock_object *const object_ptr,
>>>>>> + const uintptr_t object_data,
>>>
>>> Can you move rule_type here for this function and similar ones? It
>>> makes sense to group object-related arguments.
>>
>> Just to group them together, not putting rule_type in the end?
>
> Yes
Ok. Got it.
>
> [...]
>
>>>>>> @@ -465,20 +501,28 @@ struct landlock_ruleset
>>>>>> *landlock_merge_ruleset(
>>>>>> */
>>>>>> const struct landlock_rule *landlock_find_rule(
>>>>>> const struct landlock_ruleset *const ruleset,
>>>>>> - const struct landlock_object *const object)
>>>>>> + const uintptr_t object_data, const u16 rule_type)
>>>>>> {
>>>>>> const struct rb_node *node;
>>>>>>
>>>>>> - if (!object)
>>>>>> + if (!object_data)
>>>>>
>>>>> object_data can be 0. You need to add a test with such value.
>>>>>
>>>>> We need to be sure that this change cannot affect the current FS code.
>>>>
>>>> I got it. I will refactor it.
>>>
>>> Well, 0 means a port 0, which might not be correct, but this check
>>> should not be performed by landlock_merge_ruleset().
>>>
>> Do you mean landlock_find_rule()?? Cause this check is not
>> performed in landlock_merge_ruleset().
>
> Yes, I was thinking about landlock_find_rule(). If you run your tests
> with the patch I proposed, you'll see that one of these tests will fail
> (when port equal 0). When creating a new network rule,
> add_rule_net_service() should check if the port value is valid. However,
> the above `if (!object_data)` is not correct anymore.
>
> The remaining question is: should we need to accept 0 as a valid TCP
> port? Can it be used? How does the kernel handle it?
I agree that must be a check for port 0 in add_rule_net_service(),
cause unlike most port numbers, port 0 is a reserved port in TCP/IP
networking, meaning that it should not be used in TCP or UDP messages.
Also network traffic sent across the internet to hosts listening on port
0 might be generated from network attackers or accidentally by
applications programmed incorrectly.
Source: https://www.lifewire.com/port-0-in-tcp-and-udp-818145
>
>>
>>>
>>>>>
>>>>>
>>>>>> return NULL;
>>>>>> - node = ruleset->root.rb_node;
>>>>>> +
>>>>>> + switch (rule_type) {
>>>>>> + case LANDLOCK_RULE_PATH_BENEATH:
>>>>>> + node = ruleset->root_inode.rb_node;
>>>>>> + break;
>>>>>> + default:
>>>>>> + return ERR_PTR(-EINVAL);
>>>>>
>>>>> This is a bug. There is no check for such value. You need to check
>>>>> and update all call sites to catch such errors. Same for all new
>>>>> use of ERR_PTR().
>>>>
>>>> Sorry, I did not get your point.
>>>> Do you mean I should check the correctness of rule_type in above
>>>> function which calls landlock_find_rule() ??? Why can't I add such
>>>> check here?
>>>
>>> landlock_find_rule() only returns NULL or a valid pointer, not an error.
>>
>> What about incorrect rule_type?? Return NULL? Or final rule_checl
>> must be in upper function?
>
> This case should never happen anyway. You should return NULL and call
> WARN_ON_ONCE(1) just before. The same kind of WARN_ON_ONCE(1) call
> should be part of all switch/cases of rule_type (except the two valid
> values of course).
Ok. I got it. Thanks.
> .
next prev parent reply other threads:[~2022-03-23 8:41 UTC|newest]
Thread overview: 63+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-03-09 13:44 [RFC PATCH v4 00/15] Landlock LSM Konstantin Meskhidze
2022-03-09 13:44 ` [RFC PATCH v4 01/15] landlock: access mask renaming Konstantin Meskhidze
2022-04-01 16:47 ` Mickaël Salaün
2022-04-04 8:17 ` Konstantin Meskhidze
2022-03-09 13:44 ` [RFC PATCH v4 02/15] landlock: filesystem access mask helpers Konstantin Meskhidze
2022-03-15 17:48 ` Mickaël Salaün
2022-03-17 13:25 ` Konstantin Meskhidze
2022-03-17 18:03 ` Mickaël Salaün
2022-03-18 11:36 ` Konstantin Meskhidze
2022-03-09 13:44 ` [RFC PATCH v4 03/15] landlock: landlock_find/insert_rule refactoring Konstantin Meskhidze
2022-03-16 8:27 ` Mickaël Salaün
2022-03-17 14:29 ` Konstantin Meskhidze
2022-03-18 18:33 ` Mickaël Salaün
2022-03-22 12:33 ` Konstantin Meskhidze
2022-03-22 13:24 ` Mickaël Salaün
2022-03-23 8:41 ` Konstantin Meskhidze [this message]
2022-04-12 11:07 ` [RFC PATCH v4 03/15] landlock: landlock_find/insert_rule refactoring (TCP port 0) Mickaël Salaün
2022-04-26 9:15 ` Konstantin Meskhidze
2022-03-09 13:44 ` [RFC PATCH v4 04/15] landlock: merge and inherit function refactoring Konstantin Meskhidze
2022-03-09 13:44 ` [RFC PATCH v4 05/15] landlock: unmask_layers() " Konstantin Meskhidze
2022-03-09 13:44 ` [RFC PATCH v4 06/15] landlock: landlock_add_rule syscall refactoring Konstantin Meskhidze
2022-04-12 11:12 ` Mickaël Salaün
2022-04-26 8:30 ` Konstantin Meskhidze
2022-03-09 13:44 ` [RFC PATCH v4 07/15] landlock: user space API network support Konstantin Meskhidze
2022-04-12 11:21 ` Mickaël Salaün
2022-04-12 13:48 ` Mickaël Salaün
2022-04-12 14:05 ` Konstantin Meskhidze
2022-04-12 16:10 ` Mickaël Salaün
2022-04-26 10:17 ` Konstantin Meskhidze
2022-04-25 14:29 ` Konstantin Meskhidze
2022-03-09 13:44 ` [RFC PATCH v4 08/15] landlock: add support network rules Konstantin Meskhidze
2022-04-08 16:30 ` Mickaël Salaün
2022-04-11 13:44 ` Konstantin Meskhidze
2022-04-11 16:20 ` Mickaël Salaün
2022-04-12 8:38 ` Konstantin Meskhidze
2022-03-09 13:44 ` [RFC PATCH v4 09/15] landlock: TCP network hooks implementation Konstantin Meskhidze
2022-04-11 16:24 ` Mickaël Salaün
2022-04-26 8:36 ` Konstantin Meskhidze
2022-03-09 13:44 ` [RFC PATCH v4 10/15] seltest/landlock: add tests for bind() hooks Konstantin Meskhidze
2022-04-01 16:52 ` Mickaël Salaün
2022-04-04 8:28 ` Konstantin Meskhidze
2022-04-04 9:44 ` Mickaël Salaün
2022-04-06 14:12 ` Konstantin Meskhidze
2022-04-08 16:41 ` Mickaël Salaün
2022-04-26 9:35 ` Konstantin Meskhidze
2022-05-16 10:10 ` Mickaël Salaün
2022-05-16 10:22 ` Konstantin Meskhidze
2022-04-04 18:32 ` Mickaël Salaün
2022-04-06 14:17 ` Konstantin Meskhidze
2022-03-09 13:44 ` [RFC PATCH v4 11/15] seltest/landlock: add tests for connect() hooks Konstantin Meskhidze
2022-03-09 13:44 ` [RFC PATCH v4 12/15] seltest/landlock: connect() with AF_UNSPEC tests Konstantin Meskhidze
2022-03-09 13:44 ` [RFC PATCH v4 13/15] seltest/landlock: rules overlapping test Konstantin Meskhidze
2022-03-09 13:44 ` [RFC PATCH v4 14/15] seltest/landlock: ruleset expanding test Konstantin Meskhidze
2022-03-09 13:44 ` [RFC PATCH v4 15/15] seltest/landlock: invalid user input data test Konstantin Meskhidze
2022-03-15 17:02 ` [RFC PATCH v4 00/15] Landlock LSM Mickaël Salaün
2022-03-17 13:01 ` Konstantin Meskhidze
2022-03-17 17:26 ` Mickaël Salaün
2022-03-18 15:55 ` Konstantin Meskhidze
2022-03-23 16:30 ` Konstantin Meskhidze
2022-03-24 12:27 ` Mickaël Salaün
2022-03-24 13:34 ` Konstantin Meskhidze
2022-03-24 15:30 ` Mickaël Salaün
2022-03-24 16:19 ` Konstantin Meskhidze
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=212ac1b3-b78b-4030-1f3d-f5cd1001bb7d@huawei.com \
--to=konstantin.meskhidze@huawei.com \
--cc=anton.sirazetdinov@huawei.com \
--cc=artem.kuzin@huawei.com \
--cc=linux-security-module@vger.kernel.org \
--cc=mic@digikod.net \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=willemdebruijn.kernel@gmail.com \
--cc=yusongping@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).