1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * Landlock LSM - Network management and hooks
4 *
5 * Copyright © 2022-2023 Huawei Tech. Co., Ltd.
6 * Copyright © 2022-2023 Microsoft Corporation
7 */
8
9 #include <linux/in.h>
10 #include <linux/net.h>
11 #include <linux/socket.h>
12 #include <net/ipv6.h>
13
14 #include "common.h"
15 #include "cred.h"
16 #include "limits.h"
17 #include "net.h"
18 #include "ruleset.h"
19
landlock_append_net_rule(struct landlock_ruleset * const ruleset,const u16 port,access_mask_t access_rights)20 int landlock_append_net_rule(struct landlock_ruleset *const ruleset,
21 const u16 port, access_mask_t access_rights)
22 {
23 int err;
24 const struct landlock_id id = {
25 .key.data = (__force uintptr_t)htons(port),
26 .type = LANDLOCK_KEY_NET_PORT,
27 };
28
29 BUILD_BUG_ON(sizeof(port) > sizeof(id.key.data));
30
31 /* Transforms relative access rights to absolute ones. */
32 access_rights |= LANDLOCK_MASK_ACCESS_NET &
33 ~landlock_get_net_access_mask(ruleset, 0);
34
35 mutex_lock(&ruleset->lock);
36 err = landlock_insert_rule(ruleset, id, access_rights);
37 mutex_unlock(&ruleset->lock);
38
39 return err;
40 }
41
42 static const struct access_masks any_net = {
43 .net = ~0,
44 };
45
current_check_access_socket(struct socket * const sock,struct sockaddr * const address,const int addrlen,access_mask_t access_request)46 static int current_check_access_socket(struct socket *const sock,
47 struct sockaddr *const address,
48 const int addrlen,
49 access_mask_t access_request)
50 {
51 __be16 port;
52 layer_mask_t layer_masks[LANDLOCK_NUM_ACCESS_NET] = {};
53 const struct landlock_rule *rule;
54 struct landlock_id id = {
55 .type = LANDLOCK_KEY_NET_PORT,
56 };
57 const struct landlock_ruleset *const dom =
58 landlock_get_applicable_domain(landlock_get_current_domain(),
59 any_net);
60
61 if (!dom)
62 return 0;
63 if (WARN_ON_ONCE(dom->num_layers < 1))
64 return -EACCES;
65
66 if (!sk_is_tcp(sock->sk))
67 return 0;
68
69 /* Checks for minimal header length to safely read sa_family. */
70 if (addrlen < offsetofend(typeof(*address), sa_family))
71 return -EINVAL;
72
73 switch (address->sa_family) {
74 case AF_UNSPEC:
75 case AF_INET:
76 if (addrlen < sizeof(struct sockaddr_in))
77 return -EINVAL;
78 port = ((struct sockaddr_in *)address)->sin_port;
79 break;
80
81 #if IS_ENABLED(CONFIG_IPV6)
82 case AF_INET6:
83 if (addrlen < SIN6_LEN_RFC2133)
84 return -EINVAL;
85 port = ((struct sockaddr_in6 *)address)->sin6_port;
86 break;
87 #endif /* IS_ENABLED(CONFIG_IPV6) */
88
89 default:
90 return 0;
91 }
92
93 /* Specific AF_UNSPEC handling. */
94 if (address->sa_family == AF_UNSPEC) {
95 /*
96 * Connecting to an address with AF_UNSPEC dissolves the TCP
97 * association, which have the same effect as closing the
98 * connection while retaining the socket object (i.e., the file
99 * descriptor). As for dropping privileges, closing
100 * connections is always allowed.
101 *
102 * For a TCP access control system, this request is legitimate.
103 * Let the network stack handle potential inconsistencies and
104 * return -EINVAL if needed.
105 */
106 if (access_request == LANDLOCK_ACCESS_NET_CONNECT_TCP)
107 return 0;
108
109 /*
110 * For compatibility reason, accept AF_UNSPEC for bind
111 * accesses (mapped to AF_INET) only if the address is
112 * INADDR_ANY (cf. __inet_bind). Checking the address is
113 * required to not wrongfully return -EACCES instead of
114 * -EAFNOSUPPORT.
115 *
116 * We could return 0 and let the network stack handle these
117 * checks, but it is safer to return a proper error and test
118 * consistency thanks to kselftest.
119 */
120 if (access_request == LANDLOCK_ACCESS_NET_BIND_TCP) {
121 /* addrlen has already been checked for AF_UNSPEC. */
122 const struct sockaddr_in *const sockaddr =
123 (struct sockaddr_in *)address;
124
125 if (sock->sk->__sk_common.skc_family != AF_INET)
126 return -EINVAL;
127
128 if (sockaddr->sin_addr.s_addr != htonl(INADDR_ANY))
129 return -EAFNOSUPPORT;
130 }
131 } else {
132 /*
133 * Checks sa_family consistency to not wrongfully return
134 * -EACCES instead of -EINVAL. Valid sa_family changes are
135 * only (from AF_INET or AF_INET6) to AF_UNSPEC.
136 *
137 * We could return 0 and let the network stack handle this
138 * check, but it is safer to return a proper error and test
139 * consistency thanks to kselftest.
140 */
141 if (address->sa_family != sock->sk->__sk_common.skc_family)
142 return -EINVAL;
143 }
144
145 id.key.data = (__force uintptr_t)port;
146 BUILD_BUG_ON(sizeof(port) > sizeof(id.key.data));
147
148 rule = landlock_find_rule(dom, id);
149 access_request = landlock_init_layer_masks(
150 dom, access_request, &layer_masks, LANDLOCK_KEY_NET_PORT);
151 if (landlock_unmask_layers(rule, access_request, &layer_masks,
152 ARRAY_SIZE(layer_masks)))
153 return 0;
154
155 return -EACCES;
156 }
157
hook_socket_bind(struct socket * const sock,struct sockaddr * const address,const int addrlen)158 static int hook_socket_bind(struct socket *const sock,
159 struct sockaddr *const address, const int addrlen)
160 {
161 return current_check_access_socket(sock, address, addrlen,
162 LANDLOCK_ACCESS_NET_BIND_TCP);
163 }
164
hook_socket_connect(struct socket * const sock,struct sockaddr * const address,const int addrlen)165 static int hook_socket_connect(struct socket *const sock,
166 struct sockaddr *const address,
167 const int addrlen)
168 {
169 return current_check_access_socket(sock, address, addrlen,
170 LANDLOCK_ACCESS_NET_CONNECT_TCP);
171 }
172
173 static struct security_hook_list landlock_hooks[] __ro_after_init = {
174 LSM_HOOK_INIT(socket_bind, hook_socket_bind),
175 LSM_HOOK_INIT(socket_connect, hook_socket_connect),
176 };
177
landlock_add_net_hooks(void)178 __init void landlock_add_net_hooks(void)
179 {
180 security_add_hooks(landlock_hooks, ARRAY_SIZE(landlock_hooks),
181 &landlock_lsmid);
182 }
183