From 2f3c16ff202947ee7671f5b36c2cd294449ff26f Mon Sep 17 00:00:00 2001 From: Mickaël Salaün Date: Tue, 10 Oct 2023 18:28:59 +0200 Subject: sys/linux: add the Landlock network rule type and access rights MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add the new lanlock_net_port_attr struct and related LANDLOCK_ACCESS_NET_{BIND,CONNECT}_TCP flags for TCP access control. Add landlock_ruleset_attr's handled_access_net field and fix handled_access_fs name. Update tests with the new landlock_ruleset_attr's handled_access_net field. Signed-off-by: Mickaël Salaün --- sys/linux/landlock.txt | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) (limited to 'sys/linux/landlock.txt') diff --git a/sys/linux/landlock.txt b/sys/linux/landlock.txt index 6b225cf40..62980b764 100644 --- a/sys/linux/landlock.txt +++ b/sys/linux/landlock.txt @@ -6,16 +6,28 @@ include resource fd_ruleset[fd] landlock_create_ruleset(attr ptr[in, landlock_ruleset_attr], size bytesize[attr], flags const[0]) fd_ruleset + landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(ruleset_fd fd_ruleset, rule_type const[LANDLOCK_RULE_PATH_BENEATH], rule_attr ptr[in, landlock_path_beneath_attr], flags const[0]) + +landlock_add_rule$LANDLOCK_RULE_NET_PORT(ruleset_fd fd_ruleset, rule_type const[LANDLOCK_RULE_NET_PORT], rule_attr ptr[in, landlock_net_port_attr], flags const[0]) + landlock_restrict_self(ruleset_fd fd_ruleset, flags const[0]) landlock_ruleset_attr { - handled_fs_access flags[landlock_access_flags, int64] + handled_access_fs flags[landlock_access_fs_flags, int64] + handled_access_net flags[landlock_access_net_flags, int64] } landlock_path_beneath_attr { - allowed_access flags[landlock_access_flags, int64] + allowed_access flags[landlock_access_fs_flags, int64] parent_fd fd } [packed] -landlock_access_flags = LANDLOCK_ACCESS_FS_EXECUTE, LANDLOCK_ACCESS_FS_MAKE_BLOCK, LANDLOCK_ACCESS_FS_MAKE_CHAR, LANDLOCK_ACCESS_FS_MAKE_DIR, LANDLOCK_ACCESS_FS_MAKE_FIFO, LANDLOCK_ACCESS_FS_MAKE_REG, LANDLOCK_ACCESS_FS_MAKE_SOCK, LANDLOCK_ACCESS_FS_MAKE_SYM, LANDLOCK_ACCESS_FS_READ_DIR, LANDLOCK_ACCESS_FS_READ_FILE, LANDLOCK_ACCESS_FS_REFER, LANDLOCK_ACCESS_FS_REMOVE_DIR, LANDLOCK_ACCESS_FS_REMOVE_FILE, LANDLOCK_ACCESS_FS_TRUNCATE, LANDLOCK_ACCESS_FS_WRITE_FILE +landlock_net_port_attr { + allowed_access flags[landlock_access_net_flags, int64] + port int64 +} + +landlock_access_fs_flags = LANDLOCK_ACCESS_FS_EXECUTE, LANDLOCK_ACCESS_FS_MAKE_BLOCK, LANDLOCK_ACCESS_FS_MAKE_CHAR, LANDLOCK_ACCESS_FS_MAKE_DIR, LANDLOCK_ACCESS_FS_MAKE_FIFO, LANDLOCK_ACCESS_FS_MAKE_REG, LANDLOCK_ACCESS_FS_MAKE_SOCK, LANDLOCK_ACCESS_FS_MAKE_SYM, LANDLOCK_ACCESS_FS_READ_DIR, LANDLOCK_ACCESS_FS_READ_FILE, LANDLOCK_ACCESS_FS_REFER, LANDLOCK_ACCESS_FS_REMOVE_DIR, LANDLOCK_ACCESS_FS_REMOVE_FILE, LANDLOCK_ACCESS_FS_TRUNCATE, LANDLOCK_ACCESS_FS_WRITE_FILE + +landlock_access_net_flags = LANDLOCK_ACCESS_NET_BIND_TCP, LANDLOCK_ACCESS_NET_CONNECT_TCP -- cgit mrf-deployment