compat/landlock.c

   1 /*
   2  * Copyright (c) 2021 Omar Polo <op@openbsd.org>
   3  *
   4  * Permission to use, copy, modify, and distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 #include <linux/landlock.h>
  18
  19 #include <sys/prctl.h>
  20 #include <sys/syscall.h>
  21
  22 #include <errno.h>
  23 #include <unistd.h>
  24
  25 #include "got_compat.h"
  26
  27 /*
  28  * What's the deal with landlock?  While distro with linux >= 5.13
  29  * have the struct declarations, libc wrappers are missing.  The
  30  * sample landlock code provided by the authors includes these "shims"
  31  * in their example for the landlock API until libc provides them.
  32  */
  33
  34 #ifndef landlock_create_ruleset
  35 static inline int
  36 landlock_create_ruleset(const struct landlock_ruleset_attr *attr, size_t size,
  37     __u32 flags)
  38 {
  39         return syscall(__NR_landlock_create_ruleset, attr, size, flags);
  40 }
  41 #endif
  42
  43 #ifndef landlock_add_rule
  44 static inline int
  45 landlock_add_rule(int ruleset_fd, enum landlock_rule_type type,
  46     const void *attr, __u32 flags)
  47 {
  48         return syscall(__NR_landlock_add_rule, ruleset_fd, type, attr, flags);
  49 }
  50 #endif
  51
  52 #ifndef landlock_restrict_self
  53 static inline int
  54 landlock_restrict_self(int ruleset_fd, __u32 flags)
  55 {
  56         return syscall(__NR_landlock_restrict_self, ruleset_fd, flags);
  57 }
  58 #endif
  59
  60 /*
  61  * Maybe we should ship with a full copy of the linux headers because
  62  * you never know...
  63  */
  64
  65 #ifndef LANDLOCK_ACCESS_FS_REFER
  66 #define LANDLOCK_ACCESS_FS_REFER        (1ULL << 13)
  67 #endif
  68
  69 #ifndef LANDLOCK_ACCESS_FS_TRUNCATE
  70 #define LANDLOCK_ACCESS_FS_TRUNCATE     (1ULL << 14)
  71 #endif
  72
  73 /*
  74  * Revoke any fs access.
  75  */
  76 int
  77 landlock_no_fs(void)
  78 {
  79         struct landlock_ruleset_attr rattr = {
  80                 /*
  81                  * List all capabilities currently defined by landlock.
  82                  * Failure in doing so will implicitly allow those actions
  83                  * (i.e. omitting READ_FILE will allow to read _any_ file.)
  84                  */
  85                 .handled_access_fs =
  86                     LANDLOCK_ACCESS_FS_EXECUTE |
  87                     LANDLOCK_ACCESS_FS_READ_FILE |
  88                     LANDLOCK_ACCESS_FS_READ_DIR |
  89                     LANDLOCK_ACCESS_FS_WRITE_FILE |
  90                     LANDLOCK_ACCESS_FS_REMOVE_DIR |
  91                     LANDLOCK_ACCESS_FS_REMOVE_FILE |
  92                     LANDLOCK_ACCESS_FS_MAKE_CHAR |
  93                     LANDLOCK_ACCESS_FS_MAKE_DIR |
  94                     LANDLOCK_ACCESS_FS_MAKE_REG |
  95                     LANDLOCK_ACCESS_FS_MAKE_SOCK |
  96                     LANDLOCK_ACCESS_FS_MAKE_FIFO |
  97                     LANDLOCK_ACCESS_FS_MAKE_BLOCK |
  98                     LANDLOCK_ACCESS_FS_MAKE_SYM |
  99                     LANDLOCK_ACCESS_FS_REFER |
 100                     LANDLOCK_ACCESS_FS_TRUNCATE,
 101         };
 102         int fd, abi, saved_errno;
 103
 104         if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) == -1)
 105                 return -1;
 106
 107         abi = landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_VERSION);
 108         if (abi == -1) {
 109                 /* this kernel doesn't have landlock built in */
 110                 if (errno == ENOSYS || errno == EOPNOTSUPP)
 111                         return 0;
 112                 return -1;
 113         }
 114         if (abi < 2)
 115                 rattr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_REFER;
 116         if (abi < 3)
 117                 rattr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_TRUNCATE;
 118
 119         fd = landlock_create_ruleset(&rattr, sizeof(rattr), 0);
 120         if (fd == -1)
 121                 return -1;
 122
 123         if (landlock_restrict_self(fd, 0)) {
 124                 saved_errno = errno;
 125                 close(fd);
 126                 errno = saved_errno;
 127                 return -1;
 128         }
 129
 130         close(fd);
 131         return 0;
 132 }