compat/landlock.c

   1 /*
   2  * Copyright (c) 2021 Omar Polo <op@openbsd.org>
   3  *
   4  * Permission to use, copy, modify, and distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 #include <linux/landlock.h>
  18
  19 #include <sys/prctl.h>
  20 #include <sys/syscall.h>
  21
  22 #include <errno.h>
  23 #include <unistd.h>
  24
  25 #include "got_compat.h"
  26
  27 /*
  28  * What's the deal with landlock?  While distro with linux >= 5.13
  29  * have the struct declarations, libc wrappers are missing.  The
  30  * sample landlock code provided by the authors includes these "shims"
  31  * in their example for the landlock API until libc provides them.
  32  */
  33
  34 #ifndef landlock_create_ruleset
  35 static inline int
  36 landlock_create_ruleset(const struct landlock_ruleset_attr *attr, size_t size,
  37     __u32 flags)
  38 {
  39         return syscall(__NR_landlock_create_ruleset, attr, size, flags);
  40 }
  41 #endif
  42
  43 #ifndef landlock_add_rule
  44 static inline int
  45 landlock_add_rule(int ruleset_fd, enum landlock_rule_type type,
  46     const void *attr, __u32 flags)
  47 {
  48         return syscall(__NR_landlock_add_rule, ruleset_fd, type, attr, flags);
  49 }
  50 #endif
  51
  52 #ifndef landlock_restrict_self
  53 static inline int
  54 landlock_restrict_self(int ruleset_fd, __u32 flags)
  55 {
  56         return syscall(__NR_landlock_restrict_self, ruleset_fd, flags);
  57 }
  58 #endif
  59
  60 /*
  61  * Revoke any fs access.
  62  */
  63 int
  64 landlock_no_fs(void)
  65 {
  66         struct landlock_ruleset_attr rattr = {
  67                 /*
  68                  * List all capabilities currently defined by landlock.
  69                  * Failure in doing so will implicitly allow those actions
  70                  * (i.e. omitting READ_FILE will allow to read _any_ file.)
  71                  */
  72                 .handled_access_fs = LANDLOCK_ACCESS_FS_EXECUTE | \
  73                                      LANDLOCK_ACCESS_FS_READ_FILE | \
  74                                      LANDLOCK_ACCESS_FS_READ_DIR | \
  75                                      LANDLOCK_ACCESS_FS_WRITE_FILE | \
  76                                      LANDLOCK_ACCESS_FS_REMOVE_DIR | \
  77                                      LANDLOCK_ACCESS_FS_REMOVE_FILE | \
  78                                      LANDLOCK_ACCESS_FS_MAKE_CHAR | \
  79                                      LANDLOCK_ACCESS_FS_MAKE_DIR | \
  80                                      LANDLOCK_ACCESS_FS_MAKE_REG | \
  81                                      LANDLOCK_ACCESS_FS_MAKE_SOCK | \
  82                                      LANDLOCK_ACCESS_FS_MAKE_FIFO | \
  83                                      LANDLOCK_ACCESS_FS_MAKE_BLOCK | \
  84                                      LANDLOCK_ACCESS_FS_MAKE_SYM,
  85         };
  86         int fd, saved_errno;
  87
  88         if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) == -1)
  89                 return -1;
  90
  91         fd = landlock_create_ruleset(&rattr, sizeof(rattr), 0);
  92         if (fd == -1) {
  93                 /* this kernel doesn't have landlock built in */
  94                 if (errno == ENOSYS || errno == EOPNOTSUPP)
  95                         return 0;
  96                 return -1;
  97         }
  98
  99         if (landlock_restrict_self(fd, 0)) {
 100                 saved_errno = errno;
 101                 close(fd);
 102                 errno = saved_errno;
 103                 return -1;
 104         }
 105
 106         close(fd);
 107         return 0;
 108 }