[RFC PATCH v2 9/9] samples/landlock: Support LANDLOCK_ACCESS_NET_LISTEN

[Mikhail Ivanov]

On 10/5/2024 7:57 PM, Günther Noack wrote:
> On Wed, Aug 14, 2024 at 11:01:51AM +0800, Mikhail Ivanov wrote:
>> Extend sample with TCP listen control logic.
>>
>> Signed-off-by: Mikhail Ivanov <ivanov.mikhail1 at huawei-partners.com>
>> ---
>>   samples/landlock/sandboxer.c | 31 ++++++++++++++++++++++++++-----
>>   1 file changed, 26 insertions(+), 5 deletions(-)
>>
>> diff --git a/samples/landlock/sandboxer.c b/samples/landlock/sandboxer.c
>> index e8223c3e781a..3f50cb3f8039 100644
>> --- a/samples/landlock/sandboxer.c
>> +++ b/samples/landlock/sandboxer.c
>> @@ -55,6 +55,7 @@ static inline int landlock_restrict_self(const int ruleset_fd,
>>   #define ENV_FS_RW_NAME "LL_FS_RW"
>>   #define ENV_TCP_BIND_NAME "LL_TCP_BIND"
>>   #define ENV_TCP_CONNECT_NAME "LL_TCP_CONNECT"
>> +#define ENV_TCP_LISTEN_NAME "LL_TCP_LISTEN"
>>   #define ENV_DELIMITER ":"
>>   
>>   static int parse_path(char *env_path, const char ***const path_list)
>> @@ -208,7 +209,7 @@ static int populate_ruleset_net(const char *const env_var, const int ruleset_fd,
>>   
>>   /* clang-format on */
>>   
>> -#define LANDLOCK_ABI_LAST 5
>> +#define LANDLOCK_ABI_LAST 6
>>   
>>   int main(const int argc, char *const argv[], char *const *const envp)
>>   {
>> @@ -222,15 +223,16 @@ int main(const int argc, char *const argv[], char *const *const envp)
>>   	struct landlock_ruleset_attr ruleset_attr = {
>>   		.handled_access_fs = access_fs_rw,
>>   		.handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP |
>> -				      LANDLOCK_ACCESS_NET_CONNECT_TCP,
>> +				      LANDLOCK_ACCESS_NET_CONNECT_TCP |
>> +				      LANDLOCK_ACCESS_NET_LISTEN_TCP,
>>   	};
>>   
>>   	if (argc < 2) {
>>   		fprintf(stderr,
>> -			"usage: %s=\"...\" %s=\"...\" %s=\"...\" %s=\"...\"%s "
>> +			"usage: %s=\"...\" %s=\"...\" %s=\"...\" %s=\"...\" %s=\"...\"%s "
>>   			"<cmd> [args]...\n\n",
>>   			ENV_FS_RO_NAME, ENV_FS_RW_NAME, ENV_TCP_BIND_NAME,
>> -			ENV_TCP_CONNECT_NAME, argv[0]);
>> +			ENV_TCP_CONNECT_NAME, ENV_TCP_LISTEN_NAME, argv[0]);
>>   		fprintf(stderr,
>>   			"Execute a command in a restricted environment.\n\n");
>>   		fprintf(stderr,
>> @@ -251,15 +253,19 @@ int main(const int argc, char *const argv[], char *const *const envp)
>>   		fprintf(stderr,
>>   			"* %s: list of ports allowed to connect (client).\n",
>>   			ENV_TCP_CONNECT_NAME);
>> +		fprintf(stderr,
>> +			"* %s: list of ports allowed to listen (server).\n",
>> +			ENV_TCP_LISTEN_NAME);
>>   		fprintf(stderr,
>>   			"\nexample:\n"
>>   			"%s=\"${PATH}:/lib:/usr:/proc:/etc:/dev/urandom\" "
>>   			"%s=\"/dev/null:/dev/full:/dev/zero:/dev/pts:/tmp\" "
>>   			"%s=\"9418\" "
>>   			"%s=\"80:443\" "
>> +			"%s=\"9418\" "
>>   			"%s bash -i\n\n",
>>   			ENV_FS_RO_NAME, ENV_FS_RW_NAME, ENV_TCP_BIND_NAME,
>> -			ENV_TCP_CONNECT_NAME, argv[0]);
>> +			ENV_TCP_CONNECT_NAME, ENV_TCP_LISTEN_NAME, argv[0]);
>>   		fprintf(stderr,
>>   			"This sandboxer can use Landlock features "
>>   			"up to ABI version %d.\n",
>> @@ -326,6 +332,11 @@ int main(const int argc, char *const argv[], char *const *const envp)
>>   	case 4:
>>   		/* Removes LANDLOCK_ACCESS_FS_IOCTL_DEV for ABI < 5 */
>>   		ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_IOCTL_DEV;
>> +		__attribute__((fallthrough));
>> +	case 5:
>> +		/* Removes LANDLOCK_ACCESS_NET_LISTEN support for ABI < 6 */
>> +		ruleset_attr.handled_access_net &=
>> +			~(LANDLOCK_ACCESS_NET_LISTEN_TCP);
> 
> (same remark as on other patch set)
> 
> ABI version has shifted by one in the meantime.

Thanks, I'll update it for the next version.

> 
>>   
>>   		fprintf(stderr,
>>   			"Hint: You should update the running kernel "
>> @@ -357,6 +368,12 @@ int main(const int argc, char *const argv[], char *const *const envp)
>>   		ruleset_attr.handled_access_net &=
>>   			~LANDLOCK_ACCESS_NET_CONNECT_TCP;
>>   	}
>> +	/* Removes listen access attribute if not supported by a user. */
> 
> (also same remark as on other patch set)
> 
> Please s/supported/requested/, for consistency.

Ok, thanks!

> 
>> +	env_port_name = getenv(ENV_TCP_LISTEN_NAME);
>> +	if (!env_port_name) {
>> +		ruleset_attr.handled_access_net &=
>> +			~LANDLOCK_ACCESS_NET_LISTEN_TCP;
>> +	}
>>   
>>   	ruleset_fd =
>>   		landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
>> @@ -380,6 +397,10 @@ int main(const int argc, char *const argv[], char *const *const envp)
>>   				 LANDLOCK_ACCESS_NET_CONNECT_TCP)) {
>>   		goto err_close_ruleset;
>>   	}
>> +	if (populate_ruleset_net(ENV_TCP_LISTEN_NAME, ruleset_fd,
>> +				 LANDLOCK_ACCESS_NET_LISTEN_TCP)) {
>> +		goto err_close_ruleset;
>> +	}
>>   
>>   	if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
>>   		perror("Failed to restrict privileges");
>> -- 
>> 2.34.1
>>
> 
> Reviewed-by: Günther Noack <gnoack3000 at gmail.com>