mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson
synced 2025-08-31 14:13:39 +00:00
2a794ee613
Check that a domain is not tied to the executable file that created it. For instance, that could happen if a Landlock domain took a reference to a struct path. Move global path names to common.h and replace copy_binary() with a more generic copy_file() helper. Test coverage for security/landlock is 92.7% of 1133 lines according to gcc/gcov-14. Cc: Günther Noack <gnoack@google.com> Link: https://lore.kernel.org/r/20250108154338.1129069-23-mic@digikod.net [mic: Update date and add test coverage] Signed-off-by: Mickaël Salaün <mic@digikod.net>
83 lines
1.7 KiB
C
83 lines
1.7 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
/*
|
|
* Sandbox itself and execute another program (in a different mount point).
|
|
*
|
|
* Used by layout1.umount_sandboxer from fs_test.c
|
|
*
|
|
* Copyright © 2024-2025 Microsoft Corporation
|
|
*/
|
|
|
|
#define _GNU_SOURCE
|
|
#include <errno.h>
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <sys/prctl.h>
|
|
#include <unistd.h>
|
|
|
|
#include "wrappers.h"
|
|
|
|
int main(int argc, char *argv[])
|
|
{
|
|
struct landlock_ruleset_attr ruleset_attr = {
|
|
.scoped = LANDLOCK_SCOPE_SIGNAL,
|
|
};
|
|
int pipe_child, pipe_parent, ruleset_fd;
|
|
char buf;
|
|
|
|
/*
|
|
* The first argument must be the file descriptor number of a pipe.
|
|
* The second argument must be the program to execute.
|
|
*/
|
|
if (argc != 4) {
|
|
fprintf(stderr, "Wrong number of arguments (not three)\n");
|
|
return 1;
|
|
}
|
|
|
|
pipe_child = atoi(argv[2]);
|
|
pipe_parent = atoi(argv[3]);
|
|
|
|
ruleset_fd =
|
|
landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
|
|
if (ruleset_fd < 0) {
|
|
perror("Failed to create ruleset");
|
|
return 1;
|
|
}
|
|
|
|
if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
|
|
perror("Failed to call prctl()");
|
|
return 1;
|
|
}
|
|
|
|
if (landlock_restrict_self(ruleset_fd, 0)) {
|
|
perror("Failed to restrict self");
|
|
return 1;
|
|
}
|
|
|
|
if (close(ruleset_fd)) {
|
|
perror("Failed to close ruleset");
|
|
return 1;
|
|
}
|
|
|
|
/* Signals that we are sandboxed. */
|
|
errno = 0;
|
|
if (write(pipe_child, ".", 1) != 1) {
|
|
perror("Failed to write to the second argument");
|
|
return 1;
|
|
}
|
|
|
|
/* Waits for the parent to try to umount. */
|
|
if (read(pipe_parent, &buf, 1) != 1) {
|
|
perror("Failed to write to the third argument");
|
|
return 1;
|
|
}
|
|
|
|
/* Shifts arguments. */
|
|
argv[0] = argv[1];
|
|
argv[1] = argv[2];
|
|
argv[2] = argv[3];
|
|
argv[3] = NULL;
|
|
execve(argv[0], argv, NULL);
|
|
perror("Failed to execute the provided binary");
|
|
return 1;
|
|
}
|