linux

mirror of https://github.com/torvalds/linux.git synced 2024-09-21 15:33:19 +00:00

A mirror of the official Linux kernel repository just in case

Go to file

Mickaël Salaün 55e55920bb landlock: Fix file reparenting without explicit LANDLOCK_ACCESS_FS_REFER This change fixes a mis-handling of the LANDLOCK_ACCESS_FS_REFER right when multiple rulesets/domains are stacked. The expected behaviour was that an additional ruleset can only restrict the set of permitted operations, but in this particular case, it was potentially possible to re-gain the LANDLOCK_ACCESS_FS_REFER right. With the introduction of LANDLOCK_ACCESS_FS_REFER, we added the first globally denied-by-default access right. Indeed, this lifted an initial Landlock limitation to rename and link files, which was initially always denied when the source or the destination were different directories. This led to an inconsistent backward compatibility behavior which was only taken into account if no domain layer were using the new LANDLOCK_ACCESS_FS_REFER right. However, when restricting a thread with a new ruleset handling LANDLOCK_ACCESS_FS_REFER, all inherited parent rulesets/layers not explicitly handling LANDLOCK_ACCESS_FS_REFER would behave as if they were handling this access right and with all their rules allowing it. This means that renaming and linking files could became allowed by these parent layers, but all the other required accesses must also be granted: all layers must allow file removal or creation, and renaming and linking operations cannot lead to privilege escalation according to the Landlock policy. See detailed explanation in commit `b91c3e4ea7` ("landlock: Add support for file reparenting with LANDLOCK_ACCESS_FS_REFER"). To say it another way, this bug may lift the renaming and linking limitations of the initial Landlock version, and a same ruleset can enforce different restrictions depending on previous or next enforced ruleset (i.e. inconsistent behavior). The LANDLOCK_ACCESS_FS_REFER right cannot give access to data not already allowed, but this doesn't follow the contract of the first Landlock ABI. This fix puts back the limitation for sandboxes that didn't opt-in for this additional right. For instance, if a first ruleset allows LANDLOCK_ACCESS_FS_MAKE_REG on /dst and LANDLOCK_ACCESS_FS_REMOVE_FILE on /src, renaming /src/file to /dst/file is denied. However, without this fix, stacking a new ruleset which allows LANDLOCK_ACCESS_FS_REFER on / would now permit the sandboxed thread to rename /src/file to /dst/file . This change fixes the (absolute) rule access rights, which now always forbid LANDLOCK_ACCESS_FS_REFER except when it is explicitly allowed when creating a rule. Making all domain handle LANDLOCK_ACCESS_FS_REFER was an initial approach but there is two downsides: * it makes the code more complex because we still want to check that a rule allowing LANDLOCK_ACCESS_FS_REFER is legitimate according to the ruleset's handled access rights (i.e. ABI v1 != ABI v2); * it would not allow to identify if the user created a ruleset explicitly handling LANDLOCK_ACCESS_FS_REFER or not, which will be an issue to audit Landlock. Instead, this change adds an ACCESS_INITIALLY_DENIED list of denied-by-default rights, which (only) contains LANDLOCK_ACCESS_FS_REFER. All domains are treated as if they are also handling this list, but without modifying their fs_access_masks field. A side effect is that the errno code returned by rename(2) or link(2) may be changed from EXDEV to EACCES according to the enforced restrictions. Indeed, we now have the mechanic to identify if an access is denied because of a required right (e.g. LANDLOCK_ACCESS_FS_MAKE_REG, LANDLOCK_ACCESS_FS_REMOVE_FILE) or if it is denied because of missing LANDLOCK_ACCESS_FS_REFER rights. This may result in different errno codes than for the initial Landlock version, but this approach is more consistent and better for rename/link compatibility reasons, and it wasn't possible before (hence no backport to ABI v1). The layout1.rename_file test reflects this change. Add 4 layout1.refer_denied_by_default* test suites to check that the behavior of a ruleset not handling LANDLOCK_ACCESS_FS_REFER (ABI v1) is unchanged even if another layer handles LANDLOCK_ACCESS_FS_REFER (i.e. ABI v1 precedence). Make sure rule's absolute access rights are correct by testing with and without a matching path. Add test_rename() and test_exchange() helpers. Extend layout1.inval tests to check that a denied-by-default access right is not necessarily part of a domain's handled access rights. Test coverage for security/landlock is 95.3% of 599 lines according to gcc/gcov-11. Fixes: `b91c3e4ea7` ("landlock: Add support for file reparenting with LANDLOCK_ACCESS_FS_REFER") Reviewed-by: Paul Moore <paul@paul-moore.com> Reviewed-by: Günther Noack <gnoack3000@gmail.com> Link: https://lore.kernel.org/r/20220831203840.1370732-1-mic@digikod.net Cc: stable@vger.kernel.org [mic: Constify and slightly simplify test helpers] Signed-off-by: Mickaël Salaün <mic@digikod.net>		2022-09-02 15:29:08 +02:00
arch	- Update the mitigations= kernel param documentation	2022-07-31 09:26:53 -07:00
block	block: fix missing blkcg_bio_issue_init	2022-07-14 10:54:49 -06:00
certs	certs: make system keyring depend on x509 parser	2022-07-24 12:53:55 -07:00
crypto	crypto: s390 - do not depend on CRYPTO_HW for SIMD implementations	2022-07-06 20:04:06 -07:00
Documentation	- Update the mitigations= kernel param documentation	2022-07-31 09:26:53 -07:00
drivers	Fix a NULL pointer deref in the Allwinner clk driver with a one liner.	2022-07-31 09:52:20 -07:00
fs	Thirteen hotfixes, Eight are cc:stable and the remainder are for post-5.18	2022-07-26 19:38:46 -07:00
include	LoongArch fixes for v5.19-final	2022-07-29 10:10:30 -07:00
init	gcc-12: disable '-Warray-bounds' universally for now	2022-06-09 10:11:12 -07:00
ipc	ipc: Free mq_sysctls if ipc namespace creation failed	2022-06-22 17:47:41 -05:00
kernel	- Update the mitigations= kernel param documentation	2022-07-31 09:26:53 -07:00
lib	ubsan: disable UBSAN_DIV_ZERO for clang	2022-07-14 15:45:26 -07:00
LICENSES	LICENSES/LGPL-2.1: Add LGPL-2.1-or-later as valid identifiers	2021-12-16 14:33:10 +01:00
mm	Two hotfixes, both cc:stable.	2022-07-29 21:02:35 -07:00
net	net: ping6: Fix memleak in ipv6_renew_options().	2022-07-28 10:42:08 -07:00
samples	Fixes and minor clean ups for tracing:	2022-07-12 16:17:40 -07:00
scripts	scripts/gdb: Fix gdb 'lx-symbols' command	2022-07-21 10:40:55 -07:00
security	landlock: Fix file reparenting without explicit LANDLOCK_ACCESS_FS_REFER	2022-09-02 15:29:08 +02:00
sound	ASoC: Drop Rockchip BCLK management for v5.19	2022-07-15 12:31:07 +02:00
tools	landlock: Fix file reparenting without explicit LANDLOCK_ACCESS_FS_REFER	2022-09-02 15:29:08 +02:00
usr	Not a lot of material this cycle. Many singleton patches against various	2022-05-27 11:22:03 -07:00
virt	KVM: x86: disable preemption around the call to kvm_arch_vcpu_{un\|}blocking	2022-06-09 10:52:20 -04:00
.clang-format	clang-format: Fix space after for_each macros	2022-05-20 19:27:16 +02:00
.cocciconfig
.get_maintainer.ignore	Opt out of scripts/get_maintainer.pl	2019-05-16 10:53:40 -07:00
.gitattributes	.gitattributes: use 'dts' diff driver for dts files	2019-12-04 19:44:11 -08:00
.gitignore	kbuild: split the second line of .mod into .usyms	2022-05-08 03:16:59 +09:00
.mailmap	ARM: SoC fixes for 5.19, part 4	2022-07-27 09:43:07 -07:00
COPYING	COPYING: state that all contributions really are covered by this file	2020-02-10 13:32:20 -08:00
CREDITS	MAINTAINERS: mark ARM/PALM TREO SUPPORT orphan	2022-07-07 15:17:00 +02:00
Kbuild	kbuild: rename hostprogs-y/always to hostprogs/always-y	2020-02-04 01:53:07 +09:00
Kconfig	kbuild: ensure full rebuild when the compiler is updated	2020-05-12 13:28:33 +09:00
MAINTAINERS	Pin control fixes for the v5.19 kernel cycle:	2022-07-22 12:24:04 -07:00
Makefile	Linux 5.19	2022-07-31 14:03:01 -07:00
README	Drop all 00-INDEX files from Documentation/	2018-09-09 15:08:58 -06:00

README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.