This patchset fixes a bug in Landlock layering,
reported by Dwi Siswanto in [1] and [2]. (Thanks!)
The bug
=======
When Landlock initializes layer masks for path walk based checks, it
unconditionally adds the LANDLOCK_ACCESS_FS_REFER access right to the
handled access rights.
This leads to a wrong layer composition, in cases where the following
layers are stacked:
1. A FS layer restricting REFER, but also allowing REFER in a rule
(e.g., handle REFER, but allow REFER on /)
2. A non-FS layer (e.g., networking-only layer)
When these rulesets are enforced **individually**, there are REFER
operations that are allowed in both rulesets -- the ones that 1
allows.
When these rulesets are enforced **on top of each other**, the non-FS
layer starts enforcing REFER implicitly as well, and all REFER
operations are denied.
This patchset
=============
This patchset fixes the issue in three commits:
1) The fix, which should be backportable to older kernels
and which is CC'd to stable@.
2) Regression selftests.
3) A more elegant fix for newer kernels,
which is intentionally *not* CC'd to stable@,
because it would break on older kernels.
In newer kernels, we already add the "REFER" access right to the
handled access rights when we merge the ruleset into the new
domain, so there is no additional calculation to do for it.
4) A documentation update to clarify the situations where the *_REFER
right is implicit.
Please let me know what you think!
–Günther
[1] https://github.com/landlock-lsm/go-landlock/issues/66
[2] https://github.com/landlock-lsm/linux/issues/67
---
Changes in v2:
- Rebase on master and resolve conflicts
- Fixed documentation as pointed out by Dwi Siswanto in
https://lore.kernel.org/all/20261101125114.19009-1-me@dw1.io/ (local)
- Link to v1: https://patch.msgid.link/20261030102411.12985-1-gnoack3000@gmail.com (local)
---
Günther Noack (4):
landlock: Fix layer composition of LANDLOCK_ACCESS_FS_REFER
selftests/landlock: Test that layering does not break refer
landlock: Simplify landlock_get_fs_access_mask()
landlock: Clarify implicit handling of LANDLOCK_ACCESS_FS_REFER
include/uapi/linux/landlock.h | 17 +++++++------
security/landlock/access.h | 9 ++++---
security/landlock/domain.h | 9 ++++---
tools/testing/selftests/landlock/fs_test.c | 39 ++++++++++++++++++++++++++++++
4 files changed, 59 insertions(+), 15 deletions(-)
---
base-commit: fa4ad798f6f681031775266044ba1b0cf3c670bd
change-id: 20261108-b4-landlock-refer-nonfs-layer-fda8bcbe0b44
Best regards,
--
Günther Noack [off-list ref]