Re: [PATCH v3] landlock: Add abstract unix socket connect restriction
From: Simon Horman <horms@kernel.org>
Date: 2024-06-07 13:24:15
Also in:
lkml, netdev
On Wed, Jun 05, 2024 at 10:36:11PM -0600, Tahera Fahimi wrote:
Abstract unix sockets are used for local inter-process communications without on a filesystem. Currently a sandboxed process can connect to a socket outside of the sandboxed environment, since landlock has no restriction for connecting to a unix socket in the abstract namespace. Access to such sockets for a sandboxed process should be scoped the same way ptrace is limited. Because of compatibility reasons and since landlock should be flexible, we extend the user space interface by adding a new "scoped" field. This field optionally contains a "LANDLOCK_SCOPED_ABSTRACT_UNIX_SOCKET" to specify that the ruleset will deny any connection from within the sandbox to its parents(i.e. any parent sandbox or non-sandbox processes) Closes: https://github.com/landlock-lsm/linux/issues/7 Signed-off-by: Tahera Fahimi <redacted>
...
quoted hunk ↗ jump to hunk
diff --git a/include/uapi/linux/landlock.h b/include/uapi/linux/landlock.h index 68625e728f43..1641aeb9eeaa 100644 --- a/include/uapi/linux/landlock.h +++ b/include/uapi/linux/landlock.h@@ -37,6 +37,12 @@ struct landlock_ruleset_attr { * rule explicitly allow them. */ __u64 handled_access_net; + /** + * scoped: Bitmask of actions (cf. `Scope access flags`_)
nit: s/scoped: /@scoped: /
Flagged by ./scripts/kernel-doc -none
+ * that is handled by this ruleset and should be permitted + * by default if no rule explicitly deny them. + */ + __u64 scoped; }; /*
...