mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson
synced 2025-08-28 00:19:36 +00:00
a0623b2a1d
The new SECBIT_EXEC_RESTRICT_FILE, SECBIT_EXEC_DENY_INTERACTIVE, and their *_LOCKED counterparts are designed to be set by processes setting up an execution environment, such as a user session, a container, or a security sandbox. Unlike other securebits, these ones can be set by unprivileged processes. Like seccomp filters or Landlock domains, the securebits are inherited across processes. When SECBIT_EXEC_RESTRICT_FILE is set, programs interpreting code should control executable resources according to execveat(2) + AT_EXECVE_CHECK (see previous commit). When SECBIT_EXEC_DENY_INTERACTIVE is set, a process should deny execution of user interactive commands (which excludes executable regular files). Being able to configure each of these securebits enables system administrators or owner of image containers to gradually validate the related changes and to identify potential issues (e.g. with interpreter or audit logs). It should be noted that unlike other security bits, the SECBIT_EXEC_RESTRICT_FILE and SECBIT_EXEC_DENY_INTERACTIVE bits are dedicated to user space willing to restrict itself. Because of that, they only make sense in the context of a trusted environment (e.g. sandbox, container, user session, full system) where the process changing its behavior (according to these bits) and all its parent processes are trusted. Otherwise, any parent process could just execute its own malicious code (interpreting a script or not), or even enforce a seccomp filter to mask these bits. Such a secure environment can be achieved with an appropriate access control (e.g. mount's noexec option, file access rights, LSM policy) and an enlighten ld.so checking that libraries are allowed for execution e.g., to protect against illegitimate use of LD_PRELOAD. Ptrace restrictions according to these securebits would not make sense because of the processes' trust assumption. Scripts may need some changes to deal with untrusted data (e.g. stdin, environment variables), but that is outside the scope of the kernel. See chromeOS's documentation about script execution control and the related threat model: https://www.chromium.org/chromium-os/developer-library/guides/security/noexec-shell-scripts/ Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: Andy Lutomirski <luto@amacapital.net> Cc: Christian Brauner <brauner@kernel.org> Cc: Kees Cook <keescook@chromium.org> Cc: Paul Moore <paul@paul-moore.com> Reviewed-by: Serge Hallyn <serge@hallyn.com> Reviewed-by: Jeff Xu <jeffxu@chromium.org> Tested-by: Jeff Xu <jeffxu@chromium.org> Signed-off-by: Mickaël Salaün <mic@digikod.net> Link: https://lore.kernel.org/r/20241212174223.389435-3-mic@digikod.net Signed-off-by: Kees Cook <kees@kernel.org>
84 lines
3.6 KiB
C
84 lines
3.6 KiB
C
/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
|
|
#ifndef _UAPI_LINUX_SECUREBITS_H
|
|
#define _UAPI_LINUX_SECUREBITS_H
|
|
|
|
/* Each securesetting is implemented using two bits. One bit specifies
|
|
whether the setting is on or off. The other bit specify whether the
|
|
setting is locked or not. A setting which is locked cannot be
|
|
changed from user-level. */
|
|
#define issecure_mask(X) (1 << (X))
|
|
|
|
#define SECUREBITS_DEFAULT 0x00000000
|
|
|
|
/* When set UID 0 has no special privileges. When unset, we support
|
|
inheritance of root-permissions and suid-root executable under
|
|
compatibility mode. We raise the effective and inheritable bitmasks
|
|
*of the executable file* if the effective uid of the new process is
|
|
0. If the real uid is 0, we raise the effective (legacy) bit of the
|
|
executable file. */
|
|
#define SECURE_NOROOT 0
|
|
#define SECURE_NOROOT_LOCKED 1 /* make bit-0 immutable */
|
|
|
|
#define SECBIT_NOROOT (issecure_mask(SECURE_NOROOT))
|
|
#define SECBIT_NOROOT_LOCKED (issecure_mask(SECURE_NOROOT_LOCKED))
|
|
|
|
/* When set, setuid to/from uid 0 does not trigger capability-"fixup".
|
|
When unset, to provide compatiblility with old programs relying on
|
|
set*uid to gain/lose privilege, transitions to/from uid 0 cause
|
|
capabilities to be gained/lost. */
|
|
#define SECURE_NO_SETUID_FIXUP 2
|
|
#define SECURE_NO_SETUID_FIXUP_LOCKED 3 /* make bit-2 immutable */
|
|
|
|
#define SECBIT_NO_SETUID_FIXUP (issecure_mask(SECURE_NO_SETUID_FIXUP))
|
|
#define SECBIT_NO_SETUID_FIXUP_LOCKED \
|
|
(issecure_mask(SECURE_NO_SETUID_FIXUP_LOCKED))
|
|
|
|
/* When set, a process can retain its capabilities even after
|
|
transitioning to a non-root user (the set-uid fixup suppressed by
|
|
bit 2). Bit-4 is cleared when a process calls exec(); setting both
|
|
bit 4 and 5 will create a barrier through exec that no exec()'d
|
|
child can use this feature again. */
|
|
#define SECURE_KEEP_CAPS 4
|
|
#define SECURE_KEEP_CAPS_LOCKED 5 /* make bit-4 immutable */
|
|
|
|
#define SECBIT_KEEP_CAPS (issecure_mask(SECURE_KEEP_CAPS))
|
|
#define SECBIT_KEEP_CAPS_LOCKED (issecure_mask(SECURE_KEEP_CAPS_LOCKED))
|
|
|
|
/* When set, a process cannot add new capabilities to its ambient set. */
|
|
#define SECURE_NO_CAP_AMBIENT_RAISE 6
|
|
#define SECURE_NO_CAP_AMBIENT_RAISE_LOCKED 7 /* make bit-6 immutable */
|
|
|
|
#define SECBIT_NO_CAP_AMBIENT_RAISE (issecure_mask(SECURE_NO_CAP_AMBIENT_RAISE))
|
|
#define SECBIT_NO_CAP_AMBIENT_RAISE_LOCKED \
|
|
(issecure_mask(SECURE_NO_CAP_AMBIENT_RAISE_LOCKED))
|
|
|
|
/* See Documentation/userspace-api/check_exec.rst */
|
|
#define SECURE_EXEC_RESTRICT_FILE 8
|
|
#define SECURE_EXEC_RESTRICT_FILE_LOCKED 9 /* make bit-8 immutable */
|
|
|
|
#define SECBIT_EXEC_RESTRICT_FILE (issecure_mask(SECURE_EXEC_RESTRICT_FILE))
|
|
#define SECBIT_EXEC_RESTRICT_FILE_LOCKED \
|
|
(issecure_mask(SECURE_EXEC_RESTRICT_FILE_LOCKED))
|
|
|
|
/* See Documentation/userspace-api/check_exec.rst */
|
|
#define SECURE_EXEC_DENY_INTERACTIVE 10
|
|
#define SECURE_EXEC_DENY_INTERACTIVE_LOCKED 11 /* make bit-10 immutable */
|
|
|
|
#define SECBIT_EXEC_DENY_INTERACTIVE \
|
|
(issecure_mask(SECURE_EXEC_DENY_INTERACTIVE))
|
|
#define SECBIT_EXEC_DENY_INTERACTIVE_LOCKED \
|
|
(issecure_mask(SECURE_EXEC_DENY_INTERACTIVE_LOCKED))
|
|
|
|
#define SECURE_ALL_BITS (issecure_mask(SECURE_NOROOT) | \
|
|
issecure_mask(SECURE_NO_SETUID_FIXUP) | \
|
|
issecure_mask(SECURE_KEEP_CAPS) | \
|
|
issecure_mask(SECURE_NO_CAP_AMBIENT_RAISE) | \
|
|
issecure_mask(SECURE_EXEC_RESTRICT_FILE) | \
|
|
issecure_mask(SECURE_EXEC_DENY_INTERACTIVE))
|
|
#define SECURE_ALL_LOCKS (SECURE_ALL_BITS << 1)
|
|
|
|
#define SECURE_ALL_UNPRIVILEGED (issecure_mask(SECURE_EXEC_RESTRICT_FILE) | \
|
|
issecure_mask(SECURE_EXEC_DENY_INTERACTIVE))
|
|
|
|
#endif /* _UAPI_LINUX_SECUREBITS_H */
|