1 /* SPDX-License-Identifier: GPL-2.0-only */
2 /*
3 * Landlock LSM - Ruleset management
4 *
5 * Copyright © 2016-2020 Mickaël Salaün <mic@digikod.net>
6 * Copyright © 2018-2020 ANSSI
7 */
8
9 #ifndef _SECURITY_LANDLOCK_RULESET_H
10 #define _SECURITY_LANDLOCK_RULESET_H
11
12 #include <linux/bitops.h>
13 #include <linux/build_bug.h>
14 #include <linux/mutex.h>
15 #include <linux/rbtree.h>
16 #include <linux/refcount.h>
17 #include <linux/workqueue.h>
18
19 #include "limits.h"
20 #include "object.h"
21
22 typedef u16 access_mask_t;
23 /* Makes sure all filesystem access rights can be stored. */
24 static_assert(BITS_PER_TYPE(access_mask_t) >= LANDLOCK_NUM_ACCESS_FS);
25 /* Makes sure for_each_set_bit() and for_each_clear_bit() calls are OK. */
26 static_assert(sizeof(unsigned long) >= sizeof(access_mask_t));
27
28 typedef u16 layer_mask_t;
29 /* Makes sure all layers can be checked. */
30 static_assert(BITS_PER_TYPE(layer_mask_t) >= LANDLOCK_MAX_NUM_LAYERS);
31
32 /**
33 * struct landlock_layer - Access rights for a given layer
34 */
35 struct landlock_layer {
36 /**
37 * @level: Position of this layer in the layer stack.
38 */
39 u16 level;
40 /**
41 * @access: Bitfield of allowed actions on the kernel object. They are
42 * relative to the object type (e.g. %LANDLOCK_ACTION_FS_READ).
43 */
44 access_mask_t access;
45 };
46
47 /**
48 * struct landlock_rule - Access rights tied to an object
49 */
50 struct landlock_rule {
51 /**
52 * @node: Node in the ruleset's red-black tree.
53 */
54 struct rb_node node;
55 /**
56 * @object: Pointer to identify a kernel object (e.g. an inode). This
57 * is used as a key for this ruleset element. This pointer is set once
58 * and never modified. It always points to an allocated object because
59 * each rule increments the refcount of its object.
60 */
61 struct landlock_object *object;
62 /**
63 * @num_layers: Number of entries in @layers.
64 */
65 u32 num_layers;
66 /**
67 * @layers: Stack of layers, from the latest to the newest, implemented
68 * as a flexible array member (FAM).
69 */
70 struct landlock_layer layers[] __counted_by(num_layers);
71 };
72
73 /**
74 * struct landlock_hierarchy - Node in a ruleset hierarchy
75 */
76 struct landlock_hierarchy {
77 /**
78 * @parent: Pointer to the parent node, or NULL if it is a root
79 * Landlock domain.
80 */
81 struct landlock_hierarchy *parent;
82 /**
83 * @usage: Number of potential children domains plus their parent
84 * domain.
85 */
86 refcount_t usage;
87 };
88
89 /**
90 * struct landlock_ruleset - Landlock ruleset
91 *
92 * This data structure must contain unique entries, be updatable, and quick to
93 * match an object.
94 */
95 struct landlock_ruleset {
96 /**
97 * @root: Root of a red-black tree containing &struct landlock_rule
98 * nodes. Once a ruleset is tied to a process (i.e. as a domain), this
99 * tree is immutable until @usage reaches zero.
100 */
101 struct rb_root root;
102 /**
103 * @hierarchy: Enables hierarchy identification even when a parent
104 * domain vanishes. This is needed for the ptrace protection.
105 */
106 struct landlock_hierarchy *hierarchy;
107 union {
108 /**
109 * @work_free: Enables to free a ruleset within a lockless
110 * section. This is only used by
111 * landlock_put_ruleset_deferred() when @usage reaches zero.
112 * The fields @lock, @usage, @num_rules, @num_layers and
113 * @fs_access_masks are then unused.
114 */
115 struct work_struct work_free;
116 struct {
117 /**
118 * @lock: Protects against concurrent modifications of
119 * @root, if @usage is greater than zero.
120 */
121 struct mutex lock;
122 /**
123 * @usage: Number of processes (i.e. domains) or file
124 * descriptors referencing this ruleset.
125 */
126 refcount_t usage;
127 /**
128 * @num_rules: Number of non-overlapping (i.e. not for
129 * the same object) rules in this ruleset.
130 */
131 u32 num_rules;
132 /**
133 * @num_layers: Number of layers that are used in this
134 * ruleset. This enables to check that all the layers
135 * allow an access request. A value of 0 identifies a
136 * non-merged ruleset (i.e. not a domain).
137 */
138 u32 num_layers;
139 /**
140 * @fs_access_masks: Contains the subset of filesystem
141 * actions that are restricted by a ruleset. A domain
142 * saves all layers of merged rulesets in a stack
143 * (FAM), starting from the first layer to the last
144 * one. These layers are used when merging rulesets,
145 * for user space backward compatibility (i.e.
146 * future-proof), and to properly handle merged
147 * rulesets without overlapping access rights. These
148 * layers are set once and never changed for the
149 * lifetime of the ruleset.
150 */
151 access_mask_t fs_access_masks[];
152 };
153 };
154 };
155
156 struct landlock_ruleset *
157 landlock_create_ruleset(const access_mask_t fs_access_mask);
158
159 void landlock_put_ruleset(struct landlock_ruleset *const ruleset);
160 void landlock_put_ruleset_deferred(struct landlock_ruleset *const ruleset);
161
162 int landlock_insert_rule(struct landlock_ruleset *const ruleset,
163 struct landlock_object *const object,
164 const access_mask_t access);
165
166 struct landlock_ruleset *
167 landlock_merge_ruleset(struct landlock_ruleset *const parent,
168 struct landlock_ruleset *const ruleset);
169
170 const struct landlock_rule *
171 landlock_find_rule(const struct landlock_ruleset *const ruleset,
172 const struct landlock_object *const object);
173
landlock_get_ruleset(struct landlock_ruleset * const ruleset)174 static inline void landlock_get_ruleset(struct landlock_ruleset *const ruleset)
175 {
176 if (ruleset)
177 refcount_inc(&ruleset->usage);
178 }
179
180 #endif /* _SECURITY_LANDLOCK_RULESET_H */
181