projects/linux·blob master · refs

251 lines · 6.3 KiB

1/* SPDX-License-Identifier: GPL-2.0-only */
2/*
3 * Landlock LSM - Ruleset management
4 *
5 * Copyright © 2016-2020 Mickaël Salaün <[email protected]>
6 * Copyright © 2018-2020 ANSSI
7 * Copyright © 2026 Cloudflare, Inc.
8 */
9
10#ifndef _SECURITY_LANDLOCK_RULESET_H
11#define _SECURITY_LANDLOCK_RULESET_H
12
13#include <linux/cleanup.h>
14#include <linux/err.h>
15#include <linux/mutex.h>
16#include <linux/rbtree.h>
17#include <linux/refcount.h>
18
19#include "access.h"
20#include "limits.h"
21#include "object.h"
22
23/**
24 * struct landlock_layer - Access rights for a given layer
25 */
26struct landlock_layer {
27 /**
28 * @level: Position of this layer in the layer stack. Starts from 1.
29 */
30 u8 level;
31 /**
32 * @flags: Bitfield for special flags attached to this rule.
33 */
34 struct {
35 /**
36 * @flags.quiet: Suppresses denial logs for the object covered by
37 * this rule in this domain. For filesystem rules, this inherits
38 * down the file hierarchy.
39 */
40 u8 quiet : 1;
41 } flags;
42 /**
43 * @access: Bitfield of allowed actions on the kernel object. They are
44 * relative to the object type (e.g. %LANDLOCK_ACTION_FS_READ).
45 */
46 access_mask_t access;
47};
48
49/**
50 * union landlock_key - Key of a ruleset's red-black tree
51 */
52union landlock_key {
53 /**
54 * @object: Pointer to identify a kernel object (e.g. an inode).
55 */
56 struct landlock_object *object;
57 /**
58 * @data: Raw data to identify an arbitrary 32-bit value
59 * (e.g. a TCP port).
60 */
61 uintptr_t data;
62};
63
64/**
65 * enum landlock_key_type - Type of &union landlock_key
66 */
67enum landlock_key_type {
68 /**
69 * @LANDLOCK_KEY_INODE: Type of &landlock_rules.root_inode's node keys.
70 */
71 LANDLOCK_KEY_INODE = 1,
72 /**
73 * @LANDLOCK_KEY_NET_PORT: Type of &landlock_rules.root_net_port's node
74 * keys.
75 */
76 LANDLOCK_KEY_NET_PORT,
77};
78
79/**
80 * struct landlock_id - Unique rule identifier for a ruleset
81 */
82struct landlock_id {
83 /**
84 * @key: Identifies either a kernel object (e.g. an inode) or
85 * a raw value (e.g. a TCP port).
86 */
87 union landlock_key key;
88 /**
89 * @type: Type of a landlock_ruleset's root tree.
90 */
91 const enum landlock_key_type type;
92};
93
94/**
95 * struct landlock_rule - Access rights tied to an object
96 */
97struct landlock_rule {
98 /**
99 * @node: Node in the ruleset's red-black tree.
100 */
101 struct rb_node node;
102 /**
103 * @key: A union to identify either a kernel object (e.g. an inode) or
104 * a raw data value (e.g. a network socket port). This is used as a key
105 * for this ruleset element. The pointer is set once and never
106 * modified. It always points to an allocated object because each rule
107 * increments the refcount of its object.
108 */
109 union landlock_key key;
110 /**
111 * @num_layers: Number of entries in @layers.
112 */
113 u32 num_layers;
114 /**
115 * @layers: Stack of layers, from the latest to the newest, implemented
116 * as a flexible array member (FAM).
117 */
118 struct landlock_layer layers[] __counted_by(num_layers);
119};
120
121/**
122 * struct landlock_rules - Red-black tree storage for Landlock rules
123 *
124 * This structure holds the rule trees shared by both rulesets and domains.
125 */
126struct landlock_rules {
127 /**
128 * @root_inode: Root of a red-black tree containing &struct
129 * landlock_rule nodes with inode object. Immutable for domains.
130 */
131 struct rb_root root_inode;
132
133#if IS_ENABLED(CONFIG_INET)
134 /**
135 * @root_net_port: Root of a red-black tree containing &struct
136 * landlock_rule nodes with network port. Immutable for domains.
137 */
138 struct rb_root root_net_port;
139#endif /* IS_ENABLED(CONFIG_INET) */
140
141 /**
142 * @num_rules: Number of non-overlapping (i.e. not for the same object)
143 * rules in this tree storage.
144 */
145 u32 num_rules;
146};
147
148/**
149 * struct landlock_ruleset - Landlock ruleset
150 *
151 * This data structure must contain unique entries, be updatable, and quick to
152 * match an object.
153 */
154struct landlock_ruleset {
155 /**
156 * @rules: Red-black tree storage for rules.
157 */
158 struct landlock_rules rules;
159 /**
160 * @lock: Protects against concurrent modifications of @rules, if @usage
161 * is greater than zero.
162 */
163 struct mutex lock;
164 /**
165 * @usage: Number of file descriptors referencing this ruleset.
166 */
167 refcount_t usage;
168
169#ifdef CONFIG_TRACEPOINTS
170 /**
171 * @version: Counter incremented on each successful
172 * landlock_add_rule(2), including when it only extends an existing
173 * rule's access rights. Used by tracepoints to correlate a domain with
174 * the exact successful rule history it was created from. Protected by
175 * @lock.
176 */
177 u64 version;
178 /**
179 * @id: Unique identifier for this ruleset, used for tracing.
180 */
181 u64 id;
182#endif /* CONFIG_TRACEPOINTS */
183
184 /**
185 * @quiet_masks: Stores the quiet flags for an unmerged ruleset. For a
186 * merged domain, this is stored in each layer's struct
187 * landlock_hierarchy instead.
188 */
189 struct access_masks quiet_masks;
190 /**
191 * @handled_masks: Contains the subset of filesystem and network actions
192 * that are handled by this ruleset.
193 */
194 struct access_masks handled_masks;
195};
196
197struct landlock_ruleset *
198landlock_create_ruleset(const access_mask_t access_mask_fs,
199 const access_mask_t access_mask_net,
200 const access_mask_t scope_mask);
201
202void landlock_put_ruleset(struct landlock_ruleset *const ruleset);
203
204DEFINE_FREE(landlock_put_ruleset, struct landlock_ruleset *,
205 if (!IS_ERR_OR_NULL(_T)) landlock_put_ruleset(_T))
206
207int landlock_insert_rule(struct landlock_ruleset *const ruleset,
208 const struct landlock_id id,
209 const access_mask_t access, const u32 flags);
210
211int landlock_store_rule(struct landlock_rules *const rules,
212 const struct landlock_id id,
213 const struct landlock_layer (*layers)[],
214 const size_t num_layers);
215
216void landlock_free_rules(struct landlock_rules *const rules);
217
218/**
219 * landlock_get_rule_root - Get the root of a rule tree by key type
220 *
221 * @rules: The rules storage to look up.
222 * @key_type: The type of key to select the tree for.
223 *
224 * Return: A pointer to the rb_root, or ERR_PTR(-EINVAL) on unknown type.
225 */
226static inline struct rb_root *
227landlock_get_rule_root(struct landlock_rules *const rules,
228 const enum landlock_key_type key_type)
229{
230 switch (key_type) {
231 case LANDLOCK_KEY_INODE:
232 return &rules->root_inode;
233
234#if IS_ENABLED(CONFIG_INET)
235 case LANDLOCK_KEY_NET_PORT:
236 return &rules->root_net_port;
237#endif /* IS_ENABLED(CONFIG_INET) */
238
239 default:
240 WARN_ON_ONCE(1);
241 return ERR_PTR(-EINVAL);
242 }
243}
244
245static inline void landlock_get_ruleset(struct landlock_ruleset *const ruleset)
246{
247 if (ruleset)
248 refcount_inc(&ruleset->usage);
249}
250
251#endif /* _SECURITY_LANDLOCK_RULESET_H */