This patchset fixes a bug in Landlock layering,
reported by Dwi Siswanto in [1] and [2]. (Thanks!)
The bug
=======
When Landlock initializes layer masks for path walk based checks, it
unconditionally adds the LANDLOCK_ACCESS_FS_REFER access right to the
handled access rights.
This leads to a wrong layer composition, in cases where the following
layers are stacked:
1. A FS layer restricting REFER, but also allowing REFER in a rule
(e.g., handle REFER, but allow REFER on /)
2. A non-FS layer (e.g., networking-only layer)
When these rulesets are enforced **individually**, there are REFER
operations that are allowed in both rulesets -- the ones that 1
allows.
When these rulesets are enforced **on top of each other**, the non-FS
layer starts enforcing REFER implicitly as well, and all REFER
operations are denied.
This patchset
=============
This patchset fixes the issue in five commits:
1) The fix, which should be backportable to older kernels
and which is CC'd to stable@.
2) KUnit test.
3) Regression selftests.
4) A more elegant fix for newer kernels,
which is intentionally *not* CC'd to stable@,
because it would break on older kernels.
In newer kernels, we already add the "REFER" access right to the
handled access rights when we merge the ruleset into the new
domain, so there is no additional calculation to do for it.
5) A documentation update to clarify the situations where the *_REFER
right is implicit.
Both the selftest and the KUnit test are built to fail before commit
1, work after commit 1 and continue working after commit 4.
Please let me know what you think!
–Günther
[1] https://github.com/landlock-lsm/go-landlock/issues/66
[2] https://github.com/landlock-lsm/linux/issues/67
---
Changes in v3:
- Add erratum 5 describing the issue
- Add KUnit test
- Selftests: Test the scenarios where layers are enforced in the other order
- access.h, fs_test.c: Update some remaining misdocumentation of the REFER right
- Link to v2: https://patch.msgid.link/20261108-b4-landlock-refer-nonfs-layer-v2-0-2b405fc1b3aa@gmail.com (local)
Changes in v2:
- Rebase on master and resolve conflicts
- Fixed documentation as pointed out by Dwi Siswanto in
https://lore.kernel.org/all/20261101125114.19009-1-me@dw1.io/ (local)
- Link to v1: https://patch.msgid.link/20261030102411.12985-1-gnoack3000@gmail.com (local)
---
Günther Noack (5):
landlock: Fix layer composition of LANDLOCK_ACCESS_FS_REFER
landlock: Add KUnit test for landlock_get_fs_access_mask()
selftests/landlock: Test that layering does not break refer
landlock: Simplify landlock_get_fs_access_mask()
landlock: Clarify implicit handling of LANDLOCK_ACCESS_FS_REFER
include/uapi/linux/landlock.h | 17 +++++----
security/landlock/access.h | 13 ++++---
security/landlock/domain.c | 44 +++++++++++++++++++++
security/landlock/domain.h | 9 +++--
security/landlock/errata/abi-4.h | 21 ++++++++++
tools/testing/selftests/landlock/fs_test.c | 61 ++++++++++++++++++++++++++++--
6 files changed, 145 insertions(+), 20 deletions(-)
---
base-commit: fa4ad798f6f681031775266044ba1b0cf3c670bd
change-id: 20261108-b4-landlock-refer-nonfs-layer-fda8bcbe0b44
Best regards,
--
Günther Noack [off-list ref]