From: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
To: <mic@digikod.net>
Cc: <willemdebruijn.kernel@gmail.com>, <gnoack3000@gmail.com>,
<linux-security-module@vger.kernel.org>, <netdev@vger.kernel.org>,
<netfilter-devel@vger.kernel.org>, <yusongping@huawei.com>,
<artem.kuzin@huawei.com>
Subject: [PATCH v13 06/12] landlock: Refactor layer helpers
Date: Mon, 16 Oct 2023 09:50:24 +0800 [thread overview]
Message-ID: <20231016015030.1684504-7-konstantin.meskhidze@huawei.com> (raw)
In-Reply-To: <20231016015030.1684504-1-konstantin.meskhidze@huawei.com>
Add new key_type argument to the landlock_init_layer_masks() helper.
Add a masks_array_size argument to the landlock_unmask_layers() helper.
These modifications support implementing new rule types in the next
Landlock versions.
Signed-off-by: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
Link: https://lore.kernel.org/r/20230920092641.832134-7-konstantin.meskhidze@huawei.com
Signed-off-by: Mickaël Salaün <mic@digikod.net>
---
Changes since v12:
* None.
Changes since v11:
* None.
Changes since v10:
* Minor fix.
Changes since v9:
* Refactors commit message.
Changes since v8:
* None.
Changes since v7:
* Refactors commit message, adds a co-developer.
* Minor fixes.
Changes since v6:
* Removes masks_size attribute from init_layer_masks().
* Refactors init_layer_masks() with new landlock_key_type.
Changes since v5:
* Splits commit.
* Formats code with clang-format-14.
Changes since v4:
* Refactors init_layer_masks(), get_handled_accesses()
and unmask_layers() functions to support multiple rule types.
* Refactors landlock_get_fs_access_mask() function with
LANDLOCK_MASK_ACCESS_FS mask.
Changes since v3:
* Splits commit.
* Refactors landlock_unmask_layers functions.
---
security/landlock/fs.c | 43 ++++++++++++++++++---------------
security/landlock/ruleset.c | 48 +++++++++++++++++++++++++------------
security/landlock/ruleset.h | 17 ++++++-------
3 files changed, 66 insertions(+), 42 deletions(-)
diff --git a/security/landlock/fs.c b/security/landlock/fs.c
index e6a19ff1765a..bc7c126deea2 100644
--- a/security/landlock/fs.c
+++ b/security/landlock/fs.c
@@ -442,20 +442,22 @@ static bool is_access_to_paths_allowed(
}
if (unlikely(dentry_child1)) {
- landlock_unmask_layers(find_rule(domain, dentry_child1),
- landlock_init_layer_masks(
- domain, LANDLOCK_MASK_ACCESS_FS,
- &_layer_masks_child1),
- &_layer_masks_child1);
+ landlock_unmask_layers(
+ find_rule(domain, dentry_child1),
+ landlock_init_layer_masks(
+ domain, LANDLOCK_MASK_ACCESS_FS,
+ &_layer_masks_child1, LANDLOCK_KEY_INODE),
+ &_layer_masks_child1, ARRAY_SIZE(_layer_masks_child1));
layer_masks_child1 = &_layer_masks_child1;
child1_is_directory = d_is_dir(dentry_child1);
}
if (unlikely(dentry_child2)) {
- landlock_unmask_layers(find_rule(domain, dentry_child2),
- landlock_init_layer_masks(
- domain, LANDLOCK_MASK_ACCESS_FS,
- &_layer_masks_child2),
- &_layer_masks_child2);
+ landlock_unmask_layers(
+ find_rule(domain, dentry_child2),
+ landlock_init_layer_masks(
+ domain, LANDLOCK_MASK_ACCESS_FS,
+ &_layer_masks_child2, LANDLOCK_KEY_INODE),
+ &_layer_masks_child2, ARRAY_SIZE(_layer_masks_child2));
layer_masks_child2 = &_layer_masks_child2;
child2_is_directory = d_is_dir(dentry_child2);
}
@@ -508,14 +510,15 @@ static bool is_access_to_paths_allowed(
rule = find_rule(domain, walker_path.dentry);
allowed_parent1 = landlock_unmask_layers(
- rule, access_masked_parent1, layer_masks_parent1);
+ rule, access_masked_parent1, layer_masks_parent1,
+ ARRAY_SIZE(*layer_masks_parent1));
allowed_parent2 = landlock_unmask_layers(
- rule, access_masked_parent2, layer_masks_parent2);
+ rule, access_masked_parent2, layer_masks_parent2,
+ ARRAY_SIZE(*layer_masks_parent2));
/* Stops when a rule from each layer grants access. */
if (allowed_parent1 && allowed_parent2)
break;
-
jump_up:
if (walker_path.dentry == walker_path.mnt->mnt_root) {
if (follow_up(&walker_path)) {
@@ -554,8 +557,8 @@ static inline int check_access_path(const struct landlock_ruleset *const domain,
{
layer_mask_t layer_masks[LANDLOCK_NUM_ACCESS_FS] = {};
- access_request =
- landlock_init_layer_masks(domain, access_request, &layer_masks);
+ access_request = landlock_init_layer_masks(
+ domain, access_request, &layer_masks, LANDLOCK_KEY_INODE);
if (is_access_to_paths_allowed(domain, path, access_request,
&layer_masks, NULL, 0, NULL, NULL))
return 0;
@@ -641,7 +644,8 @@ static bool collect_domain_accesses(
return true;
access_dom = landlock_init_layer_masks(domain, LANDLOCK_MASK_ACCESS_FS,
- layer_masks_dom);
+ layer_masks_dom,
+ LANDLOCK_KEY_INODE);
dget(dir);
while (true) {
@@ -649,7 +653,8 @@ static bool collect_domain_accesses(
/* Gets all layers allowing all domain accesses. */
if (landlock_unmask_layers(find_rule(domain, dir), access_dom,
- layer_masks_dom)) {
+ layer_masks_dom,
+ ARRAY_SIZE(*layer_masks_dom))) {
/*
* Stops when all handled accesses are allowed by at
* least one rule in each layer.
@@ -764,7 +769,7 @@ static int current_check_refer_path(struct dentry *const old_dentry,
*/
access_request_parent1 = landlock_init_layer_masks(
dom, access_request_parent1 | access_request_parent2,
- &layer_masks_parent1);
+ &layer_masks_parent1, LANDLOCK_KEY_INODE);
if (is_access_to_paths_allowed(
dom, new_dir, access_request_parent1,
&layer_masks_parent1, NULL, 0, NULL, NULL))
@@ -1140,7 +1145,7 @@ static int hook_file_open(struct file *const file)
if (is_access_to_paths_allowed(
dom, &file->f_path,
landlock_init_layer_masks(dom, full_access_request,
- &layer_masks),
+ &layer_masks, LANDLOCK_KEY_INODE),
&layer_masks, NULL, 0, NULL, NULL)) {
allowed_access = full_access_request;
} else {
diff --git a/security/landlock/ruleset.c b/security/landlock/ruleset.c
index 1cf6ac7a3c2f..4c209acee01e 100644
--- a/security/landlock/ruleset.c
+++ b/security/landlock/ruleset.c
@@ -572,14 +572,15 @@ landlock_find_rule(const struct landlock_ruleset *const ruleset,
/*
* @layer_masks is read and may be updated according to the access request and
* the matching rule.
+ * @masks_array_size must be equal to ARRAY_SIZE(*layer_masks).
*
* Returns true if the request is allowed (i.e. relevant layer masks for the
* request are empty).
*/
-bool landlock_unmask_layers(
- const struct landlock_rule *const rule,
- const access_mask_t access_request,
- layer_mask_t (*const layer_masks)[LANDLOCK_NUM_ACCESS_FS])
+bool landlock_unmask_layers(const struct landlock_rule *const rule,
+ const access_mask_t access_request,
+ layer_mask_t (*const layer_masks)[],
+ const size_t masks_array_size)
{
size_t layer_level;
@@ -611,8 +612,7 @@ bool landlock_unmask_layers(
* requested access.
*/
is_empty = true;
- for_each_set_bit(access_bit, &access_req,
- ARRAY_SIZE(*layer_masks)) {
+ for_each_set_bit(access_bit, &access_req, masks_array_size) {
if (layer->access & BIT_ULL(access_bit))
(*layer_masks)[access_bit] &= ~layer_bit;
is_empty = is_empty && !(*layer_masks)[access_bit];
@@ -623,6 +623,10 @@ bool landlock_unmask_layers(
return false;
}
+typedef access_mask_t
+get_access_mask_t(const struct landlock_ruleset *const ruleset,
+ const u16 layer_level);
+
/**
* landlock_init_layer_masks - Initialize layer masks from an access request
*
@@ -632,19 +636,34 @@ bool landlock_unmask_layers(
* @domain: The domain that defines the current restrictions.
* @access_request: The requested access rights to check.
* @layer_masks: The layer masks to populate.
+ * @key_type: The key type to switch between access masks of different types.
*
* Returns: An access mask where each access right bit is set which is handled
* in any of the active layers in @domain.
*/
-access_mask_t landlock_init_layer_masks(
- const struct landlock_ruleset *const domain,
- const access_mask_t access_request,
- layer_mask_t (*const layer_masks)[LANDLOCK_NUM_ACCESS_FS])
+access_mask_t
+landlock_init_layer_masks(const struct landlock_ruleset *const domain,
+ const access_mask_t access_request,
+ layer_mask_t (*const layer_masks)[],
+ const enum landlock_key_type key_type)
{
access_mask_t handled_accesses = 0;
- size_t layer_level;
+ size_t layer_level, num_access;
+ get_access_mask_t *get_access_mask;
+
+ switch (key_type) {
+ case LANDLOCK_KEY_INODE:
+ get_access_mask = landlock_get_fs_access_mask;
+ num_access = LANDLOCK_NUM_ACCESS_FS;
+ break;
+ default:
+ WARN_ON_ONCE(1);
+ return 0;
+ }
+
+ memset(layer_masks, 0,
+ array_size(sizeof((*layer_masks)[0]), num_access));
- memset(layer_masks, 0, sizeof(*layer_masks));
/* An empty access request can happen because of O_WRONLY | O_RDWR. */
if (!access_request)
return 0;
@@ -654,10 +673,9 @@ access_mask_t landlock_init_layer_masks(
const unsigned long access_req = access_request;
unsigned long access_bit;
- for_each_set_bit(access_bit, &access_req,
- ARRAY_SIZE(*layer_masks)) {
+ for_each_set_bit(access_bit, &access_req, num_access) {
if (BIT_ULL(access_bit) &
- landlock_get_fs_access_mask(domain, layer_level)) {
+ get_access_mask(domain, layer_level)) {
(*layer_masks)[access_bit] |=
BIT_ULL(layer_level);
handled_accesses |= BIT_ULL(access_bit);
diff --git a/security/landlock/ruleset.h b/security/landlock/ruleset.h
index 3a7f03b39d4f..1ede2b9a79b7 100644
--- a/security/landlock/ruleset.h
+++ b/security/landlock/ruleset.h
@@ -266,14 +266,15 @@ landlock_get_fs_access_mask(const struct landlock_ruleset *const ruleset,
return landlock_get_raw_fs_access_mask(ruleset, layer_level) |
LANDLOCK_ACCESS_FS_INITIALLY_DENIED;
}
-bool landlock_unmask_layers(
- const struct landlock_rule *const rule,
- const access_mask_t access_request,
- layer_mask_t (*const layer_masks)[LANDLOCK_NUM_ACCESS_FS]);
+bool landlock_unmask_layers(const struct landlock_rule *const rule,
+ const access_mask_t access_request,
+ layer_mask_t (*const layer_masks)[],
+ const size_t masks_array_size);
-access_mask_t landlock_init_layer_masks(
- const struct landlock_ruleset *const domain,
- const access_mask_t access_request,
- layer_mask_t (*const layer_masks)[LANDLOCK_NUM_ACCESS_FS]);
+access_mask_t
+landlock_init_layer_masks(const struct landlock_ruleset *const domain,
+ const access_mask_t access_request,
+ layer_mask_t (*const layer_masks)[],
+ const enum landlock_key_type key_type);
#endif /* _SECURITY_LANDLOCK_RULESET_H */
--
2.25.1
next prev parent reply other threads:[~2023-10-16 1:50 UTC|newest]
Thread overview: 45+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-10-16 1:50 [PATCH v13 00/12] Network support for Landlock Konstantin Meskhidze
2023-10-16 1:50 ` [PATCH v13 01/12] landlock: Make ruleset's access masks more generic Konstantin Meskhidze
2023-10-18 12:28 ` Mickaël Salaün
2023-10-19 1:45 ` Konstantin Meskhidze (A)
2023-10-16 1:50 ` [PATCH v13 02/12] landlock: Allow FS topology changes for domains without such rule type Konstantin Meskhidze
2023-10-16 1:50 ` [PATCH v13 03/12] landlock: Refactor landlock_find_rule/insert_rule Konstantin Meskhidze
2023-10-16 1:50 ` [PATCH v13 04/12] landlock: Refactor merge/inherit_ruleset functions Konstantin Meskhidze
2023-10-16 1:50 ` [PATCH v13 05/12] landlock: Move and rename layer helpers Konstantin Meskhidze
2023-10-16 1:50 ` Konstantin Meskhidze [this message]
2023-10-16 1:50 ` [PATCH v13 07/12] landlock: Refactor landlock_add_rule() syscall Konstantin Meskhidze
2023-10-18 12:28 ` Mickaël Salaün
2023-10-19 11:59 ` Konstantin Meskhidze (A)
2023-10-18 16:34 ` Mickaël Salaün
2023-10-19 11:57 ` Konstantin Meskhidze (A)
2023-10-16 1:50 ` [PATCH v13 08/12] landlock: Add network rules and TCP hooks support Konstantin Meskhidze
2023-10-18 12:29 ` Mickaël Salaün
2023-10-20 4:08 ` Konstantin Meskhidze (A)
2023-10-20 9:49 ` Mickaël Salaün
2023-10-20 11:58 ` Konstantin Meskhidze (A)
2023-10-20 15:41 ` Mickaël Salaün
2023-10-23 7:23 ` Konstantin Meskhidze (A)
2023-10-23 8:30 ` Mickaël Salaün
2023-10-23 8:56 ` Konstantin Meskhidze (A)
2023-10-24 2:51 ` Konstantin Meskhidze (A)
2023-10-24 3:18 ` Konstantin Meskhidze (A)
2023-10-24 9:03 ` Mickaël Salaün
2023-10-24 9:12 ` Konstantin Meskhidze (A)
2023-10-25 11:29 ` Mickaël Salaün
2023-10-26 2:02 ` Konstantin Meskhidze (A)
2023-10-18 16:34 ` Mickaël Salaün
2023-10-20 9:40 ` Konstantin Meskhidze (A)
2023-10-16 1:50 ` [PATCH v13 09/12] selftests/landlock: Share enforce_ruleset() Konstantin Meskhidze
2023-10-16 1:50 ` [PATCH v13 10/12] selftests/landlock: Add 7 new test variants dedicated to network Konstantin Meskhidze
2023-10-18 12:32 ` Mickaël Salaün
2023-10-20 11:41 ` Konstantin Meskhidze (A)
2023-10-20 15:40 ` Mickaël Salaün
2023-10-23 7:09 ` Konstantin Meskhidze (A)
2023-10-23 8:44 ` Mickaël Salaün
2023-10-23 9:15 ` Konstantin Meskhidze (A)
2023-10-16 1:50 ` [PATCH v13 11/12] samples/landlock: Add network demo Konstantin Meskhidze
2023-10-18 12:33 ` Mickaël Salaün
2023-10-20 11:59 ` Konstantin Meskhidze (A)
2023-10-16 1:50 ` [PATCH v13 12/12] landlock: Document Landlock's network support Konstantin Meskhidze
2023-10-18 12:34 ` Mickaël Salaün
2023-10-20 12:17 ` Konstantin Meskhidze (A)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20231016015030.1684504-7-konstantin.meskhidze@huawei.com \
--to=konstantin.meskhidze@huawei.com \
--cc=artem.kuzin@huawei.com \
--cc=gnoack3000@gmail.com \
--cc=linux-security-module@vger.kernel.org \
--cc=mic@digikod.net \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=willemdebruijn.kernel@gmail.com \
--cc=yusongping@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.