1 // SPDX-License-Identifier: BSD-3-Clause 2 /* 3 * Simple Landlock sandbox manager able to launch a process restricted by a 4 * user-defined filesystem access control policy. 5 * 6 * Copyright © 2017-2020 Mickaël Salaün <mic@digikod.net> 7 * Copyright © 2020 ANSSI 8 */ 9 10 #define _GNU_SOURCE 11 #include <errno.h> 12 #include <fcntl.h> 13 #include <linux/landlock.h> 14 #include <linux/prctl.h> 15 #include <stddef.h> 16 #include <stdio.h> 17 #include <stdlib.h> 18 #include <string.h> 19 #include <sys/prctl.h> 20 #include <sys/stat.h> 21 #include <sys/syscall.h> 22 #include <unistd.h> 23 24 #ifndef landlock_create_ruleset 25 static inline int landlock_create_ruleset( 26 const struct landlock_ruleset_attr *const attr, 27 const size_t size, const __u32 flags) 28 { 29 return syscall(__NR_landlock_create_ruleset, attr, size, flags); 30 } 31 #endif 32 33 #ifndef landlock_add_rule 34 static inline int landlock_add_rule(const int ruleset_fd, 35 const enum landlock_rule_type rule_type, 36 const void *const rule_attr, const __u32 flags) 37 { 38 return syscall(__NR_landlock_add_rule, ruleset_fd, rule_type, 39 rule_attr, flags); 40 } 41 #endif 42 43 #ifndef landlock_restrict_self 44 static inline int landlock_restrict_self(const int ruleset_fd, 45 const __u32 flags) 46 { 47 return syscall(__NR_landlock_restrict_self, ruleset_fd, flags); 48 } 49 #endif 50 51 #define ENV_FS_RO_NAME "LL_FS_RO" 52 #define ENV_FS_RW_NAME "LL_FS_RW" 53 #define ENV_PATH_TOKEN ":" 54 55 static int parse_path(char *env_path, const char ***const path_list) 56 { 57 int i, num_paths = 0; 58 59 if (env_path) { 60 num_paths++; 61 for (i = 0; env_path[i]; i++) { 62 if (env_path[i] == ENV_PATH_TOKEN[0]) 63 num_paths++; 64 } 65 } 66 *path_list = malloc(num_paths * sizeof(**path_list)); 67 for (i = 0; i < num_paths; i++) 68 (*path_list)[i] = strsep(&env_path, ENV_PATH_TOKEN); 69 70 return num_paths; 71 } 72 73 #define ACCESS_FILE ( \ 74 LANDLOCK_ACCESS_FS_EXECUTE | \ 75 LANDLOCK_ACCESS_FS_WRITE_FILE | \ 76 LANDLOCK_ACCESS_FS_READ_FILE) 77 78 static int populate_ruleset( 79 const char *const env_var, const int ruleset_fd, 80 const __u64 allowed_access) 81 { 82 int num_paths, i, ret = 1; 83 char *env_path_name; 84 const char **path_list = NULL; 85 struct landlock_path_beneath_attr path_beneath = { 86 .parent_fd = -1, 87 }; 88 89 env_path_name = getenv(env_var); 90 if (!env_path_name) { 91 /* Prevents users to forget a setting. */ 92 fprintf(stderr, "Missing environment variable %s\n", env_var); 93 return 1; 94 } 95 env_path_name = strdup(env_path_name); 96 unsetenv(env_var); 97 num_paths = parse_path(env_path_name, &path_list); 98 if (num_paths == 1 && path_list[0][0] == '\0') { 99 /* 100 * Allows to not use all possible restrictions (e.g. use 101 * LL_FS_RO without LL_FS_RW). 102 */ 103 ret = 0; 104 goto out_free_name; 105 } 106 107 for (i = 0; i < num_paths; i++) { 108 struct stat statbuf; 109 110 path_beneath.parent_fd = open(path_list[i], O_PATH | 111 O_CLOEXEC); 112 if (path_beneath.parent_fd < 0) { 113 fprintf(stderr, "Failed to open \"%s\": %s\n", 114 path_list[i], 115 strerror(errno)); 116 goto out_free_name; 117 } 118 if (fstat(path_beneath.parent_fd, &statbuf)) { 119 close(path_beneath.parent_fd); 120 goto out_free_name; 121 } 122 path_beneath.allowed_access = allowed_access; 123 if (!S_ISDIR(statbuf.st_mode)) 124 path_beneath.allowed_access &= ACCESS_FILE; 125 if (landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH, 126 &path_beneath, 0)) { 127 fprintf(stderr, "Failed to update the ruleset with \"%s\": %s\n", 128 path_list[i], strerror(errno)); 129 close(path_beneath.parent_fd); 130 goto out_free_name; 131 } 132 close(path_beneath.parent_fd); 133 } 134 ret = 0; 135 136 out_free_name: 137 free(path_list); 138 free(env_path_name); 139 return ret; 140 } 141 142 #define ACCESS_FS_ROUGHLY_READ ( \ 143 LANDLOCK_ACCESS_FS_EXECUTE | \ 144 LANDLOCK_ACCESS_FS_READ_FILE | \ 145 LANDLOCK_ACCESS_FS_READ_DIR) 146 147 #define ACCESS_FS_ROUGHLY_WRITE ( \ 148 LANDLOCK_ACCESS_FS_WRITE_FILE | \ 149 LANDLOCK_ACCESS_FS_REMOVE_DIR | \ 150 LANDLOCK_ACCESS_FS_REMOVE_FILE | \ 151 LANDLOCK_ACCESS_FS_MAKE_CHAR | \ 152 LANDLOCK_ACCESS_FS_MAKE_DIR | \ 153 LANDLOCK_ACCESS_FS_MAKE_REG | \ 154 LANDLOCK_ACCESS_FS_MAKE_SOCK | \ 155 LANDLOCK_ACCESS_FS_MAKE_FIFO | \ 156 LANDLOCK_ACCESS_FS_MAKE_BLOCK | \ 157 LANDLOCK_ACCESS_FS_MAKE_SYM) 158 159 int main(const int argc, char *const argv[], char *const *const envp) 160 { 161 const char *cmd_path; 162 char *const *cmd_argv; 163 int ruleset_fd; 164 struct landlock_ruleset_attr ruleset_attr = { 165 .handled_access_fs = ACCESS_FS_ROUGHLY_READ | 166 ACCESS_FS_ROUGHLY_WRITE, 167 }; 168 169 if (argc < 2) { 170 fprintf(stderr, "usage: %s=\"...\" %s=\"...\" %s <cmd> [args]...\n\n", 171 ENV_FS_RO_NAME, ENV_FS_RW_NAME, argv[0]); 172 fprintf(stderr, "Launch a command in a restricted environment.\n\n"); 173 fprintf(stderr, "Environment variables containing paths, " 174 "each separated by a colon:\n"); 175 fprintf(stderr, "* %s: list of paths allowed to be used in a read-only way.\n", 176 ENV_FS_RO_NAME); 177 fprintf(stderr, "* %s: list of paths allowed to be used in a read-write way.\n", 178 ENV_FS_RW_NAME); 179 fprintf(stderr, "\nexample:\n" 180 "%s=\"/bin:/lib:/usr:/proc:/etc:/dev/urandom\" " 181 "%s=\"/dev/null:/dev/full:/dev/zero:/dev/pts:/tmp\" " 182 "%s bash -i\n", 183 ENV_FS_RO_NAME, ENV_FS_RW_NAME, argv[0]); 184 return 1; 185 } 186 187 ruleset_fd = landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); 188 if (ruleset_fd < 0) { 189 const int err = errno; 190 191 perror("Failed to create a ruleset"); 192 switch (err) { 193 case ENOSYS: 194 fprintf(stderr, "Hint: Landlock is not supported by the current kernel. " 195 "To support it, build the kernel with " 196 "CONFIG_SECURITY_LANDLOCK=y and prepend " 197 "\"landlock,\" to the content of CONFIG_LSM.\n"); 198 break; 199 case EOPNOTSUPP: 200 fprintf(stderr, "Hint: Landlock is currently disabled. " 201 "It can be enabled in the kernel configuration by " 202 "prepending \"landlock,\" to the content of CONFIG_LSM, " 203 "or at boot time by setting the same content to the " 204 "\"lsm\" kernel parameter.\n"); 205 break; 206 } 207 return 1; 208 } 209 if (populate_ruleset(ENV_FS_RO_NAME, ruleset_fd, 210 ACCESS_FS_ROUGHLY_READ)) { 211 goto err_close_ruleset; 212 } 213 if (populate_ruleset(ENV_FS_RW_NAME, ruleset_fd, 214 ACCESS_FS_ROUGHLY_READ | ACCESS_FS_ROUGHLY_WRITE)) { 215 goto err_close_ruleset; 216 } 217 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { 218 perror("Failed to restrict privileges"); 219 goto err_close_ruleset; 220 } 221 if (landlock_restrict_self(ruleset_fd, 0)) { 222 perror("Failed to enforce ruleset"); 223 goto err_close_ruleset; 224 } 225 close(ruleset_fd); 226 227 cmd_path = argv[1]; 228 cmd_argv = argv + 1; 229 execvpe(cmd_path, cmd_argv, envp); 230 fprintf(stderr, "Failed to execute \"%s\": %s\n", cmd_path, 231 strerror(errno)); 232 fprintf(stderr, "Hint: access to the binary, the interpreter or " 233 "shared libraries may be denied.\n"); 234 return 1; 235 236 err_close_ruleset: 237 close(ruleset_fd); 238 return 1; 239 } 240