On Wed, Aug 14, 2024 at 11:01:51AM +0800, Mikhail Ivanov wrote:
> Extend sample with TCP listen control logic.
>
> Signed-off-by: Mikhail Ivanov <ivanov.mikhail1@xxxxxxxxxxxxxxxxxxx>
> ---
> samples/landlock/sandboxer.c | 31 ++++++++++++++++++++++++++-----
> 1 file changed, 26 insertions(+), 5 deletions(-)
>
> diff --git a/samples/landlock/sandboxer.c b/samples/landlock/sandboxer.c
> index e8223c3e781a..3f50cb3f8039 100644
> --- a/samples/landlock/sandboxer.c
> +++ b/samples/landlock/sandboxer.c
> @@ -55,6 +55,7 @@ static inline int landlock_restrict_self(const int ruleset_fd,
> #define ENV_FS_RW_NAME "LL_FS_RW"
> #define ENV_TCP_BIND_NAME "LL_TCP_BIND"
> #define ENV_TCP_CONNECT_NAME "LL_TCP_CONNECT"
> +#define ENV_TCP_LISTEN_NAME "LL_TCP_LISTEN"
> #define ENV_DELIMITER ":"
>
> static int parse_path(char *env_path, const char ***const path_list)
> @@ -208,7 +209,7 @@ static int populate_ruleset_net(const char *const env_var, const int ruleset_fd,
>
> /* clang-format on */
>
> -#define LANDLOCK_ABI_LAST 5
> +#define LANDLOCK_ABI_LAST 6
>
> int main(const int argc, char *const argv[], char *const *const envp)
> {
> @@ -222,15 +223,16 @@ int main(const int argc, char *const argv[], char *const *const envp)
> struct landlock_ruleset_attr ruleset_attr = {
> .handled_access_fs = access_fs_rw,
> .handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP |
> - LANDLOCK_ACCESS_NET_CONNECT_TCP,
> + LANDLOCK_ACCESS_NET_CONNECT_TCP |
> + LANDLOCK_ACCESS_NET_LISTEN_TCP,
> };
>
> if (argc < 2) {
> fprintf(stderr,
> - "usage: %s=\"...\" %s=\"...\" %s=\"...\" %s=\"...\"%s "
> + "usage: %s=\"...\" %s=\"...\" %s=\"...\" %s=\"...\" %s=\"...\"%s "
> "<cmd> [args]...\n\n",
> ENV_FS_RO_NAME, ENV_FS_RW_NAME, ENV_TCP_BIND_NAME,
> - ENV_TCP_CONNECT_NAME, argv[0]);
> + ENV_TCP_CONNECT_NAME, ENV_TCP_LISTEN_NAME, argv[0]);
> fprintf(stderr,
> "Execute a command in a restricted environment.\n\n");
> fprintf(stderr,
> @@ -251,15 +253,19 @@ int main(const int argc, char *const argv[], char *const *const envp)
> fprintf(stderr,
> "* %s: list of ports allowed to connect (client).\n",
> ENV_TCP_CONNECT_NAME);
> + fprintf(stderr,
> + "* %s: list of ports allowed to listen (server).\n",
> + ENV_TCP_LISTEN_NAME);
> fprintf(stderr,
> "\nexample:\n"
> "%s=\"${PATH}:/lib:/usr:/proc:/etc:/dev/urandom\" "
> "%s=\"/dev/null:/dev/full:/dev/zero:/dev/pts:/tmp\" "
> "%s=\"9418\" "
> "%s=\"80:443\" "
> + "%s=\"9418\" "
> "%s bash -i\n\n",
> ENV_FS_RO_NAME, ENV_FS_RW_NAME, ENV_TCP_BIND_NAME,
> - ENV_TCP_CONNECT_NAME, argv[0]);
> + ENV_TCP_CONNECT_NAME, ENV_TCP_LISTEN_NAME, argv[0]);
> fprintf(stderr,
> "This sandboxer can use Landlock features "
> "up to ABI version %d.\n",
> @@ -326,6 +332,11 @@ int main(const int argc, char *const argv[], char *const *const envp)
> case 4:
> /* Removes LANDLOCK_ACCESS_FS_IOCTL_DEV for ABI < 5 */
> ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_IOCTL_DEV;
> + __attribute__((fallthrough));
> + case 5:
> + /* Removes LANDLOCK_ACCESS_NET_LISTEN support for ABI < 6 */
> + ruleset_attr.handled_access_net &=
> + ~(LANDLOCK_ACCESS_NET_LISTEN_TCP);
(same remark as on other patch set)
ABI version has shifted by one in the meantime.
>
> fprintf(stderr,
> "Hint: You should update the running kernel "
> @@ -357,6 +368,12 @@ int main(const int argc, char *const argv[], char *const *const envp)
> ruleset_attr.handled_access_net &=
> ~LANDLOCK_ACCESS_NET_CONNECT_TCP;
> }
> + /* Removes listen access attribute if not supported by a user. */
(also same remark as on other patch set)
Please s/supported/requested/, for consistency.
> + env_port_name = getenv(ENV_TCP_LISTEN_NAME);
> + if (!env_port_name) {
> + ruleset_attr.handled_access_net &=
> + ~LANDLOCK_ACCESS_NET_LISTEN_TCP;
> + }
>
> ruleset_fd =
> landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
> @@ -380,6 +397,10 @@ int main(const int argc, char *const argv[], char *const *const envp)
> LANDLOCK_ACCESS_NET_CONNECT_TCP)) {
> goto err_close_ruleset;
> }
> + if (populate_ruleset_net(ENV_TCP_LISTEN_NAME, ruleset_fd,
> + LANDLOCK_ACCESS_NET_LISTEN_TCP)) {
> + goto err_close_ruleset;
> + }
>
> if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
> perror("Failed to restrict privileges");
> --
> 2.34.1
>
Reviewed-by: Günther Noack <gnoack3000@xxxxxxxxx>
