1 // SPDX-License-Identifier: BSD-3-Clause 2 /* 3 * Simple Landlock sandbox manager able to launch a process restricted by a 4 * user-defined filesystem access control policy. 5 * 6 * Copyright © 2017-2020 Mickaël Salaün <mic@digikod.net> 7 * Copyright © 2020 ANSSI 8 */ 9 10 #define _GNU_SOURCE 11 #include <errno.h> 12 #include <fcntl.h> 13 #include <linux/landlock.h> 14 #include <linux/prctl.h> 15 #include <stddef.h> 16 #include <stdio.h> 17 #include <stdlib.h> 18 #include <string.h> 19 #include <sys/prctl.h> 20 #include <sys/stat.h> 21 #include <sys/syscall.h> 22 #include <unistd.h> 23 24 #ifndef landlock_create_ruleset 25 static inline int 26 landlock_create_ruleset(const struct landlock_ruleset_attr *const attr, 27 const size_t size, const __u32 flags) 28 { 29 return syscall(__NR_landlock_create_ruleset, attr, size, flags); 30 } 31 #endif 32 33 #ifndef landlock_add_rule 34 static inline int landlock_add_rule(const int ruleset_fd, 35 const enum landlock_rule_type rule_type, 36 const void *const rule_attr, 37 const __u32 flags) 38 { 39 return syscall(__NR_landlock_add_rule, ruleset_fd, rule_type, rule_attr, 40 flags); 41 } 42 #endif 43 44 #ifndef landlock_restrict_self 45 static inline int landlock_restrict_self(const int ruleset_fd, 46 const __u32 flags) 47 { 48 return syscall(__NR_landlock_restrict_self, ruleset_fd, flags); 49 } 50 #endif 51 52 #define ENV_FS_RO_NAME "LL_FS_RO" 53 #define ENV_FS_RW_NAME "LL_FS_RW" 54 #define ENV_PATH_TOKEN ":" 55 56 static int parse_path(char *env_path, const char ***const path_list) 57 { 58 int i, num_paths = 0; 59 60 if (env_path) { 61 num_paths++; 62 for (i = 0; env_path[i]; i++) { 63 if (env_path[i] == ENV_PATH_TOKEN[0]) 64 num_paths++; 65 } 66 } 67 *path_list = malloc(num_paths * sizeof(**path_list)); 68 for (i = 0; i < num_paths; i++) 69 (*path_list)[i] = strsep(&env_path, ENV_PATH_TOKEN); 70 71 return num_paths; 72 } 73 74 /* clang-format off */ 75 76 #define ACCESS_FILE ( \ 77 LANDLOCK_ACCESS_FS_EXECUTE | \ 78 LANDLOCK_ACCESS_FS_WRITE_FILE | \ 79 LANDLOCK_ACCESS_FS_READ_FILE) 80 81 /* clang-format on */ 82 83 static int populate_ruleset(const char *const env_var, const int ruleset_fd, 84 const __u64 allowed_access) 85 { 86 int num_paths, i, ret = 1; 87 char *env_path_name; 88 const char **path_list = NULL; 89 struct landlock_path_beneath_attr path_beneath = { 90 .parent_fd = -1, 91 }; 92 93 env_path_name = getenv(env_var); 94 if (!env_path_name) { 95 /* Prevents users to forget a setting. */ 96 fprintf(stderr, "Missing environment variable %s\n", env_var); 97 return 1; 98 } 99 env_path_name = strdup(env_path_name); 100 unsetenv(env_var); 101 num_paths = parse_path(env_path_name, &path_list); 102 if (num_paths == 1 && path_list[0][0] == '\0') { 103 /* 104 * Allows to not use all possible restrictions (e.g. use 105 * LL_FS_RO without LL_FS_RW). 106 */ 107 ret = 0; 108 goto out_free_name; 109 } 110 111 for (i = 0; i < num_paths; i++) { 112 struct stat statbuf; 113 114 path_beneath.parent_fd = open(path_list[i], O_PATH | O_CLOEXEC); 115 if (path_beneath.parent_fd < 0) { 116 fprintf(stderr, "Failed to open \"%s\": %s\n", 117 path_list[i], strerror(errno)); 118 goto out_free_name; 119 } 120 if (fstat(path_beneath.parent_fd, &statbuf)) { 121 close(path_beneath.parent_fd); 122 goto out_free_name; 123 } 124 path_beneath.allowed_access = allowed_access; 125 if (!S_ISDIR(statbuf.st_mode)) 126 path_beneath.allowed_access &= ACCESS_FILE; 127 if (landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH, 128 &path_beneath, 0)) { 129 fprintf(stderr, 130 "Failed to update the ruleset with \"%s\": %s\n", 131 path_list[i], strerror(errno)); 132 close(path_beneath.parent_fd); 133 goto out_free_name; 134 } 135 close(path_beneath.parent_fd); 136 } 137 ret = 0; 138 139 out_free_name: 140 free(path_list); 141 free(env_path_name); 142 return ret; 143 } 144 145 /* clang-format off */ 146 147 #define ACCESS_FS_ROUGHLY_READ ( \ 148 LANDLOCK_ACCESS_FS_EXECUTE | \ 149 LANDLOCK_ACCESS_FS_READ_FILE | \ 150 LANDLOCK_ACCESS_FS_READ_DIR) 151 152 #define ACCESS_FS_ROUGHLY_WRITE ( \ 153 LANDLOCK_ACCESS_FS_WRITE_FILE | \ 154 LANDLOCK_ACCESS_FS_REMOVE_DIR | \ 155 LANDLOCK_ACCESS_FS_REMOVE_FILE | \ 156 LANDLOCK_ACCESS_FS_MAKE_CHAR | \ 157 LANDLOCK_ACCESS_FS_MAKE_DIR | \ 158 LANDLOCK_ACCESS_FS_MAKE_REG | \ 159 LANDLOCK_ACCESS_FS_MAKE_SOCK | \ 160 LANDLOCK_ACCESS_FS_MAKE_FIFO | \ 161 LANDLOCK_ACCESS_FS_MAKE_BLOCK | \ 162 LANDLOCK_ACCESS_FS_MAKE_SYM | \ 163 LANDLOCK_ACCESS_FS_REFER) 164 165 /* clang-format on */ 166 167 #define LANDLOCK_ABI_LAST 2 168 169 int main(const int argc, char *const argv[], char *const *const envp) 170 { 171 const char *cmd_path; 172 char *const *cmd_argv; 173 int ruleset_fd, abi; 174 __u64 access_fs_ro = ACCESS_FS_ROUGHLY_READ, 175 access_fs_rw = ACCESS_FS_ROUGHLY_READ | ACCESS_FS_ROUGHLY_WRITE; 176 struct landlock_ruleset_attr ruleset_attr = { 177 .handled_access_fs = access_fs_rw, 178 }; 179 180 if (argc < 2) { 181 fprintf(stderr, 182 "usage: %s=\"...\" %s=\"...\" %s <cmd> [args]...\n\n", 183 ENV_FS_RO_NAME, ENV_FS_RW_NAME, argv[0]); 184 fprintf(stderr, 185 "Launch a command in a restricted environment.\n\n"); 186 fprintf(stderr, "Environment variables containing paths, " 187 "each separated by a colon:\n"); 188 fprintf(stderr, 189 "* %s: list of paths allowed to be used in a read-only way.\n", 190 ENV_FS_RO_NAME); 191 fprintf(stderr, 192 "* %s: list of paths allowed to be used in a read-write way.\n", 193 ENV_FS_RW_NAME); 194 fprintf(stderr, 195 "\nexample:\n" 196 "%s=\"/bin:/lib:/usr:/proc:/etc:/dev/urandom\" " 197 "%s=\"/dev/null:/dev/full:/dev/zero:/dev/pts:/tmp\" " 198 "%s bash -i\n\n", 199 ENV_FS_RO_NAME, ENV_FS_RW_NAME, argv[0]); 200 fprintf(stderr, 201 "This sandboxer can use Landlock features " 202 "up to ABI version %d.\n", 203 LANDLOCK_ABI_LAST); 204 return 1; 205 } 206 207 abi = landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_VERSION); 208 if (abi < 0) { 209 const int err = errno; 210 211 perror("Failed to check Landlock compatibility"); 212 switch (err) { 213 case ENOSYS: 214 fprintf(stderr, 215 "Hint: Landlock is not supported by the current kernel. " 216 "To support it, build the kernel with " 217 "CONFIG_SECURITY_LANDLOCK=y and prepend " 218 "\"landlock,\" to the content of CONFIG_LSM.\n"); 219 break; 220 case EOPNOTSUPP: 221 fprintf(stderr, 222 "Hint: Landlock is currently disabled. " 223 "It can be enabled in the kernel configuration by " 224 "prepending \"landlock,\" to the content of CONFIG_LSM, " 225 "or at boot time by setting the same content to the " 226 "\"lsm\" kernel parameter.\n"); 227 break; 228 } 229 return 1; 230 } 231 232 /* Best-effort security. */ 233 switch (abi) { 234 case 1: 235 /* Removes LANDLOCK_ACCESS_FS_REFER for ABI < 2 */ 236 ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_REFER; 237 238 fprintf(stderr, 239 "Hint: You should update the running kernel " 240 "to leverage Landlock features " 241 "provided by ABI version %d (instead of %d).\n", 242 LANDLOCK_ABI_LAST, abi); 243 __attribute__((fallthrough)); 244 case LANDLOCK_ABI_LAST: 245 break; 246 default: 247 fprintf(stderr, 248 "Hint: You should update this sandboxer " 249 "to leverage Landlock features " 250 "provided by ABI version %d (instead of %d).\n", 251 abi, LANDLOCK_ABI_LAST); 252 } 253 access_fs_ro &= ruleset_attr.handled_access_fs; 254 access_fs_rw &= ruleset_attr.handled_access_fs; 255 256 ruleset_fd = 257 landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); 258 if (ruleset_fd < 0) { 259 perror("Failed to create a ruleset"); 260 return 1; 261 } 262 if (populate_ruleset(ENV_FS_RO_NAME, ruleset_fd, access_fs_ro)) { 263 goto err_close_ruleset; 264 } 265 if (populate_ruleset(ENV_FS_RW_NAME, ruleset_fd, access_fs_rw)) { 266 goto err_close_ruleset; 267 } 268 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { 269 perror("Failed to restrict privileges"); 270 goto err_close_ruleset; 271 } 272 if (landlock_restrict_self(ruleset_fd, 0)) { 273 perror("Failed to enforce ruleset"); 274 goto err_close_ruleset; 275 } 276 close(ruleset_fd); 277 278 cmd_path = argv[1]; 279 cmd_argv = argv + 1; 280 execvpe(cmd_path, cmd_argv, envp); 281 fprintf(stderr, "Failed to execute \"%s\": %s\n", cmd_path, 282 strerror(errno)); 283 fprintf(stderr, "Hint: access to the binary, the interpreter or " 284 "shared libraries may be denied.\n"); 285 return 1; 286 287 err_close_ruleset: 288 close(ruleset_fd); 289 return 1; 290 } 291