mirror of
https://github.com/torvalds/linux.git
synced 2024-11-21 19:41:42 +00:00
Landlock security fix for v6.11-rc1
-----BEGIN PGP SIGNATURE----- iIYEABYKAC4WIQSVyBthFV4iTW/VU1/l49DojIL20gUCZqFEchAcbWljQGRpZ2lr b2QubmV0AAoJEOXj0OiMgvbSULcBAPEV5Viu/zox2FdS87EGTqWxEQJcBRvc3ahj MQk44WtMAP4o2CnwrOoMyZXeq9npteL5lQsVhEzeI+p8oN9C9bThBg== =zizo -----END PGP SIGNATURE----- Merge tag 'landlock-6.11-rc1-houdini-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux Pull landlock fix from Mickaël Salaün: "Jann Horn reported a sandbox bypass for Landlock. This includes the fix and new tests. This should be backported" * tag 'landlock-6.11-rc1-houdini-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux: selftests/landlock: Add cred_transfer test landlock: Don't lose track of restrictions on cred_transfer
This commit is contained in:
commit
86b405ad8d
@ -14,8 +14,8 @@
|
||||
#include "ruleset.h"
|
||||
#include "setup.h"
|
||||
|
||||
static int hook_cred_prepare(struct cred *const new,
|
||||
const struct cred *const old, const gfp_t gfp)
|
||||
static void hook_cred_transfer(struct cred *const new,
|
||||
const struct cred *const old)
|
||||
{
|
||||
struct landlock_ruleset *const old_dom = landlock_cred(old)->domain;
|
||||
|
||||
@ -23,6 +23,12 @@ static int hook_cred_prepare(struct cred *const new,
|
||||
landlock_get_ruleset(old_dom);
|
||||
landlock_cred(new)->domain = old_dom;
|
||||
}
|
||||
}
|
||||
|
||||
static int hook_cred_prepare(struct cred *const new,
|
||||
const struct cred *const old, const gfp_t gfp)
|
||||
{
|
||||
hook_cred_transfer(new, old);
|
||||
return 0;
|
||||
}
|
||||
|
||||
@ -36,6 +42,7 @@ static void hook_cred_free(struct cred *const cred)
|
||||
|
||||
static struct security_hook_list landlock_hooks[] __ro_after_init = {
|
||||
LSM_HOOK_INIT(cred_prepare, hook_cred_prepare),
|
||||
LSM_HOOK_INIT(cred_transfer, hook_cred_transfer),
|
||||
LSM_HOOK_INIT(cred_free, hook_cred_free),
|
||||
};
|
||||
|
||||
|
@ -9,6 +9,7 @@
|
||||
#define _GNU_SOURCE
|
||||
#include <errno.h>
|
||||
#include <fcntl.h>
|
||||
#include <linux/keyctl.h>
|
||||
#include <linux/landlock.h>
|
||||
#include <string.h>
|
||||
#include <sys/prctl.h>
|
||||
@ -326,4 +327,77 @@ TEST(ruleset_fd_transfer)
|
||||
ASSERT_EQ(EXIT_SUCCESS, WEXITSTATUS(status));
|
||||
}
|
||||
|
||||
TEST(cred_transfer)
|
||||
{
|
||||
struct landlock_ruleset_attr ruleset_attr = {
|
||||
.handled_access_fs = LANDLOCK_ACCESS_FS_READ_DIR,
|
||||
};
|
||||
int ruleset_fd, dir_fd;
|
||||
pid_t child;
|
||||
int status;
|
||||
|
||||
drop_caps(_metadata);
|
||||
|
||||
dir_fd = open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC);
|
||||
EXPECT_LE(0, dir_fd);
|
||||
EXPECT_EQ(0, close(dir_fd));
|
||||
|
||||
/* Denies opening directories. */
|
||||
ruleset_fd =
|
||||
landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
|
||||
ASSERT_LE(0, ruleset_fd);
|
||||
EXPECT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0));
|
||||
ASSERT_EQ(0, landlock_restrict_self(ruleset_fd, 0));
|
||||
EXPECT_EQ(0, close(ruleset_fd));
|
||||
|
||||
/* Checks ruleset enforcement. */
|
||||
EXPECT_EQ(-1, open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC));
|
||||
EXPECT_EQ(EACCES, errno);
|
||||
|
||||
/* Needed for KEYCTL_SESSION_TO_PARENT permission checks */
|
||||
EXPECT_NE(-1, syscall(__NR_keyctl, KEYCTL_JOIN_SESSION_KEYRING, NULL, 0,
|
||||
0, 0))
|
||||
{
|
||||
TH_LOG("Failed to join session keyring: %s", strerror(errno));
|
||||
}
|
||||
|
||||
child = fork();
|
||||
ASSERT_LE(0, child);
|
||||
if (child == 0) {
|
||||
/* Checks ruleset enforcement. */
|
||||
EXPECT_EQ(-1, open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC));
|
||||
EXPECT_EQ(EACCES, errno);
|
||||
|
||||
/*
|
||||
* KEYCTL_SESSION_TO_PARENT is a no-op unless we have a
|
||||
* different session keyring in the child, so make that happen.
|
||||
*/
|
||||
EXPECT_NE(-1, syscall(__NR_keyctl, KEYCTL_JOIN_SESSION_KEYRING,
|
||||
NULL, 0, 0, 0));
|
||||
|
||||
/*
|
||||
* KEYCTL_SESSION_TO_PARENT installs credentials on the parent
|
||||
* that never go through the cred_prepare hook, this path uses
|
||||
* cred_transfer instead.
|
||||
*/
|
||||
EXPECT_EQ(0, syscall(__NR_keyctl, KEYCTL_SESSION_TO_PARENT, 0,
|
||||
0, 0, 0));
|
||||
|
||||
/* Re-checks ruleset enforcement. */
|
||||
EXPECT_EQ(-1, open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC));
|
||||
EXPECT_EQ(EACCES, errno);
|
||||
|
||||
_exit(_metadata->exit_code);
|
||||
return;
|
||||
}
|
||||
|
||||
EXPECT_EQ(child, waitpid(child, &status, 0));
|
||||
EXPECT_EQ(1, WIFEXITED(status));
|
||||
EXPECT_EQ(EXIT_SUCCESS, WEXITSTATUS(status));
|
||||
|
||||
/* Re-checks ruleset enforcement. */
|
||||
EXPECT_EQ(-1, open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC));
|
||||
EXPECT_EQ(EACCES, errno);
|
||||
}
|
||||
|
||||
TEST_HARNESS_MAIN
|
||||
|
@ -2,6 +2,7 @@ CONFIG_CGROUPS=y
|
||||
CONFIG_CGROUP_SCHED=y
|
||||
CONFIG_INET=y
|
||||
CONFIG_IPV6=y
|
||||
CONFIG_KEYS=y
|
||||
CONFIG_NET=y
|
||||
CONFIG_NET_NS=y
|
||||
CONFIG_OVERLAY_FS=y
|
||||
|
Loading…
Reference in New Issue
Block a user