From: "Mickaël Salaün" <mic@digikod.net>
To: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
Cc: linux-security-module@vger.kernel.org, netdev@vger.kernel.org,
netfilter@vger.kernel.org, yusongping@huawei.com,
artem.kuzin@huawei.com
Subject: Re: [RFC PATCH 0/2] landlock network implementation cover letter
Date: Tue, 1 Feb 2022 18:53:18 +0100 [thread overview]
Message-ID: <85450679-51fd-e5ae-b994-74bda3041739@digikod.net> (raw)
In-Reply-To: <20220124080215.265538-1-konstantin.meskhidze@huawei.com>
On 24/01/2022 09:02, Konstantin Meskhidze wrote:
> Hi, all!
>
> This is a new bunch of RFC patches related to Landlock LSM network confinement.
> Here are previous discussions:
> 1. https://lore.kernel.org/linux-security-module/20211210072123.386713-1-konstantin.meskhidze@huawei.com/
> 2. https://lore.kernel.org/linux-security-module/20211228115212.703084-1-konstantin.meskhidze@huawei.com/
>
> As in previous RFCs, 2 hooks are supported:
> - hook_socket_bind()
> - hook_socket_connect()
>
> Selftest are provided in tools/testing/selftests/landlock/network_test.c;
> Implementation was tested in QEMU invironment with 5.13 kernel version:
Again, you need to base your work on the latest kernel version.
> 1. base_test - passed all tests
> 2. fs_test - passed 44/46 tests. 2 tests related to overlayfs failed.
> Probably, I have wrong config options for overlayfs.
The minimal required configuration is listed in the "config" file. You
need to update it for the network tests as well. You missed the
ptrace_test. To test everything you can run:
fakeroot make -C tools/testing/selftests TARGETS=landlock gen_tar
and then extract
tools/testing/selftests/kselftest_install/kselftest-packages/kselftest.tar.gz
and execute run_kselftest.sh on your VM.
> 3. network_test - passed all tests.
> Please give your suggestions about test cover in network_test.c
>
> Implementation related issues
> =============================
It is more a changelog than issues. ;)
>
> 1. Access masks array refactored into 1D one and changed
> to 32 bits. Filesystem masks occupy 16 lower bits and network
> masks reside in 16 upper bits.
>
> struct landlock_ruleset {
> ...
> ...
> u32 access_masks[];
> }
>
> 2. Refactor API functions in ruleset.c:
> 1. Add (void *)object argument.
> 2. Add u16 rule_type argument.
>
> - In filesystem case the "object" is defined by underlying inode.
> In network case the "object" is defined by a port. There is
> a union containing either a struct landlock_object pointer or a
> raw data (here a u16 port):
> union {
> struct landlock_object *ptr;
> uintptr_t data;
> } object;
>
> - Everytime when a rule is inserted it's needed to provide a rule type:
>
> landlock_insert_rule(ruleset, (void *)object, access, rule_type)
> 1. A rule_type could be or LANDLOCK_RULE_NET_SERVICE or
> LANDLOCK_RULE_PATH_BENEATH;
> 2. (void *) object - is either landlock_object *ptr or port value;
>
> 3. Use two rb_trees in ruleset structure:
> 1. root_inode - for filesystem objects (inodes).
> 2. root_net_port - for network port objects.
Thanks for these explanations!
>
> Konstantin Meskhidze (2):
> landlock: TCP network hooks implementation
> landlock: selftests for bind and connect hooks
>
> include/uapi/linux/landlock.h | 52 +++
> security/landlock/Makefile | 2 +-
> security/landlock/fs.c | 12 +-
> security/landlock/limits.h | 6 +
> security/landlock/net.c | 175 +++++++++
> security/landlock/net.h | 21 ++
> security/landlock/ruleset.c | 167 ++++++---
> security/landlock/ruleset.h | 40 +-
> security/landlock/setup.c | 3 +
> security/landlock/syscalls.c | 142 ++++---
> .../testing/selftests/landlock/network_test.c | 346 ++++++++++++++++++
> 11 files changed, 860 insertions(+), 106 deletions(-)
> create mode 100644 security/landlock/net.c
> create mode 100644 security/landlock/net.h
> create mode 100644 tools/testing/selftests/landlock/network_test.c
>
> --
> 2.25.1
>
next prev parent reply other threads:[~2022-02-01 17:53 UTC|newest]
Thread overview: 38+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-01-24 8:02 [RFC PATCH 0/2] landlock network implementation cover letter Konstantin Meskhidze
2022-01-24 8:02 ` [RFC PATCH 1/2] landlock: TCP network hooks implementation Konstantin Meskhidze
2022-01-25 14:17 ` Willem de Bruijn
2022-01-26 8:05 ` Konstantin Meskhidze
2022-01-26 14:15 ` Willem de Bruijn
2022-01-29 3:12 ` Konstantin Meskhidze
2022-01-31 17:14 ` Willem de Bruijn
2022-02-01 12:33 ` Mickaël Salaün
2022-02-07 2:31 ` Konstantin Meskhidze
2022-02-07 16:00 ` Willem de Bruijn
2022-02-07 16:17 ` Willem de Bruijn
2022-02-10 2:05 ` Konstantin Meskhidze
2022-02-10 2:04 ` Konstantin Meskhidze
2022-02-01 12:28 ` Mickaël Salaün
2022-02-07 2:35 ` Konstantin Meskhidze
2022-02-01 12:13 ` Mickaël Salaün
2022-02-07 13:09 ` Konstantin Meskhidze
2022-02-07 14:17 ` Mickaël Salaün
2022-02-08 7:55 ` Konstantin Meskhidze
2022-02-08 12:09 ` Mickaël Salaün
2022-02-09 3:06 ` Konstantin Meskhidze
2022-01-24 8:02 ` [RFC PATCH 2/2] landlock: selftests for bind and connect hooks Konstantin Meskhidze
2022-02-01 18:31 ` Mickaël Salaün
2022-02-07 7:11 ` Konstantin Meskhidze
2022-02-07 12:49 ` Mickaël Salaün
2022-02-08 3:01 ` Konstantin Meskhidze
2022-02-08 12:17 ` Mickaël Salaün
2022-02-09 3:03 ` Konstantin Meskhidze
2022-02-10 10:16 ` Mickaël Salaün
2022-02-24 3:18 ` Konstantin Meskhidze
2022-02-24 9:55 ` Mickaël Salaün
2022-02-24 12:03 ` Konstantin Meskhidze
2022-02-24 14:15 ` Mickaël Salaün
2022-02-25 2:44 ` Konstantin Meskhidze
2022-02-01 17:53 ` Mickaël Salaün [this message]
2022-02-07 13:18 ` [RFC PATCH 0/2] landlock network implementation cover letter Konstantin Meskhidze
2022-02-07 13:35 ` Mickaël Salaün
2022-02-08 3:53 ` Konstantin Meskhidze
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=85450679-51fd-e5ae-b994-74bda3041739@digikod.net \
--to=mic@digikod.net \
--cc=artem.kuzin@huawei.com \
--cc=konstantin.meskhidze@huawei.com \
--cc=linux-security-module@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=netfilter@vger.kernel.org \
--cc=yusongping@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).