R/O protection for lower level dirs

R/O protection for lower level dirs

[Vitaly Chikunov]

Hi, 

I want to ensure that some deeper directory is write protected (as a non
security measure but so that some post-install processing do not
accidentally touch installed files).  Is there a way to achieve this
with Landlock?

For example, if we do R/W access to / (root tree is already protected
enough with DAC) and then R/O access to /home we still get full R/W access
everywhere and /home seems not restricted. Also, Landlock does not warn for
such configuration, silently accepting it as valid.

Practical example:

  ~$ LL_FS_RW=/ LL_FS_RO=/home sandboxer touch a
  Executing the sandboxed command...
  ~$ ls -l a
  -rw-r--r-- 1 vt vt 0 Apr  1 15:53 a

Thanks,

Re: R/O protection for lower level dirs

[Mickaël Salaün]

On Mon, Apr 01, 2024 at 07:06:14PM +0300, Vitaly Chikunov wrote:
> Hi, 

Hi Vitaly,

> 
> I want to ensure that some deeper directory is write protected (as a non
> security measure but so that some post-install processing do not
> accidentally touch installed files).  Is there a way to achieve this
> with Landlock?

Landlock follows a deny-by-default policy, which is a good practice for
access control.  In your example, you'll need to identify the set of
file hierarchies that should be legitimately allowed, and set the
appropriate access rights on them, not the other way around.

> 
> For example, if we do R/W access to / (root tree is already protected
> enough with DAC) and then R/O access to /home we still get full R/W access
> everywhere and /home seems not restricted. Also, Landlock does not warn for
> such configuration, silently accepting it as valid.
> 
> Practical example:
> 
>   ~$ LL_FS_RW=/ LL_FS_RO=/home sandboxer touch a
>   Executing the sandboxed command...
>   ~$ ls -l a
>   -rw-r--r-- 1 vt vt 0 Apr  1 15:53 a

Because there may have several ways to reach a file (e.g. hard links,
bind mounts), it would be difficult to get, remember, and track all the
related parent file hierarchies.

Landlock ties (ephemeral) permissions to inodes, which means that one
inode with enough rights in the file hierarchy is enough to grant access
for such rights to the files beneath it.  This is checked when accessing
a file, which makes security policies light and flexible (e.g. handles
file renaming, linking, and bind mounting).

In your example, / grants read-write access to all files beneath it, and
/home grants read access to all files beneath it.  When user space
request to write to /home/foo, / grants write permission.

This configuration is then valid, and it makes sure that the security
policy doesn't break user space because of unknown directories nesting
(e.g. setting different access rights on $HOME and $TMPDIR, for which
developers don't have a way to know which one is beneath the other).

For your use case, you'd need to have different file hierarchies and tie
them with specific permissions.  For instance, you could have /usr,
/var/tmp/pkg/postinst, /tmp, /etc .  Keep in mind that you can also
create nested sandboxes or run different stages of the package
installation in dedicated sandboxes (e.g. one for the install step with
access to /usr in read-write, another for the post installation with
access to /var/tmp/pkg/postinst in read-write and /usr in read).

Nicolas is working on a complementary way that would ease sandboxing for
some use cases: https://github.com/landlock-lsm/linux/issues/28
This will help users to quickly sandbox their application instances but
application developers should already be able to implement a more secure
deny-by-default policy without this feature.

> 
> Thanks,
> 

Re: R/O protection for lower level dirs

[Vitaly Chikunov]

Mickaël,

On Tue, Apr 02, 2024 at 11:11:39AM +0200, Mickaël Salaün wrote:
> On Mon, Apr 01, 2024 at 07:06:14PM +0300, Vitaly Chikunov wrote:
> > 
> > I want to ensure that some deeper directory is write protected (as a non
> > security measure but so that some post-install processing do not
> > accidentally touch installed files).  Is there a way to achieve this
> > with Landlock?
> 
> Landlock follows a deny-by-default policy, which is a good practice for
> access control.  In your example, you'll need to identify the set of
> file hierarchies that should be legitimately allowed, and set the
> appropriate access rights on them, not the other way around.
> 
> > 
> > For example, if we do R/W access to / (root tree is already protected
> > enough with DAC) and then R/O access to /home we still get full R/W access
> > everywhere and /home seems not restricted. Also, Landlock does not warn for
> > such configuration, silently accepting it as valid.
> > 
> > Practical example:
> > 
> >   ~$ LL_FS_RW=/ LL_FS_RO=/home sandboxer touch a
> >   Executing the sandboxed command...
> >   ~$ ls -l a
> >   -rw-r--r-- 1 vt vt 0 Apr  1 15:53 a
> 
> Because there may have several ways to reach a file (e.g. hard links,
> bind mounts), it would be difficult to get, remember, and track all the
> related parent file hierarchies.
> 
> Landlock ties (ephemeral) permissions to inodes, which means that one
> inode with enough rights in the file hierarchy is enough to grant access
> for such rights to the files beneath it.  This is checked when accessing
> a file, which makes security policies light and flexible (e.g. handles
> file renaming, linking, and bind mounting).
> 
> In your example, / grants read-write access to all files beneath it, and
> /home grants read access to all files beneath it.  When user space
> request to write to /home/foo, / grants write permission.
> 
> This configuration is then valid, and it makes sure that the security
> policy doesn't break user space because of unknown directories nesting
> (e.g. setting different access rights on $HOME and $TMPDIR, for which
> developers don't have a way to know which one is beneath the other).
> 
> For your use case, you'd need to have different file hierarchies and tie
> them with specific permissions.  For instance, you could have /usr,
> /var/tmp/pkg/postinst, /tmp, /etc .  Keep in mind that you can also
> create nested sandboxes or run different stages of the package
> installation in dedicated sandboxes (e.g. one for the install step with
> access to /usr in read-write, another for the post installation with
> access to /var/tmp/pkg/postinst in read-write and /usr in read).
> 
> Nicolas is working on a complementary way that would ease sandboxing for
> some use cases: https://github.com/landlock-lsm/linux/issues/28
> This will help users to quickly sandbox their application instances but
> application developers should already be able to implement a more secure
> deny-by-default policy without this feature.

Thanks for the answer.

Looks like it's currently impossible to create more restricted hierarchy
inside of less restricted. I think this isn't consequence of 'deny by
default' approach but sort of additivity of allowed permissions.
Positive permissions of wider hierarchy will be added to more
restrictive sub-hierarchy and supersede them.

To add more detail, what I tried to achieve: rpmbuild installs into so
called 'buildroot', which is (for ALT) '/usr/src/tmp/name-buildroot'
directory inside of '/usr/src/tmp' TMPDIR (and '/usr/src' is a HONE). When
%check section is performed some scripts may inadvertently modify
buildroot content which I thought to block. But because TMPDIR should be
unrestricted (and / and HOME are not need to be restricted) it is not
possible by any means to restrict buildroot.

It is not possible, for example, to permit R/W to all existing entities
of TMPDIR excluding 'name-buildroot', because in that case TMPDIR itself
should have R/O permissions (it's needed to not supersede
name-buildroot) and this will defy TMPDIR purpose.

That work of Nicolas looks promising for the goal I wanted to achieve
and overall Landlock flexibility.

Thanks,


> 
> > 
> > Thanks,
> > 

Re: R/O protection for lower level dirs

[Mickaël Salaün]

On Wed, Apr 03, 2024 at 06:20:43PM +0300, Vitaly Chikunov wrote:
> Mickaël,
> 
> On Tue, Apr 02, 2024 at 11:11:39AM +0200, Mickaël Salaün wrote:
> > On Mon, Apr 01, 2024 at 07:06:14PM +0300, Vitaly Chikunov wrote:
> > > 
> > > I want to ensure that some deeper directory is write protected (as a non
> > > security measure but so that some post-install processing do not
> > > accidentally touch installed files).  Is there a way to achieve this
> > > with Landlock?
> > 
> > Landlock follows a deny-by-default policy, which is a good practice for
> > access control.  In your example, you'll need to identify the set of
> > file hierarchies that should be legitimately allowed, and set the
> > appropriate access rights on them, not the other way around.
> > 
> > > 
> > > For example, if we do R/W access to / (root tree is already protected
> > > enough with DAC) and then R/O access to /home we still get full R/W access
> > > everywhere and /home seems not restricted. Also, Landlock does not warn for
> > > such configuration, silently accepting it as valid.
> > > 
> > > Practical example:
> > > 
> > >   ~$ LL_FS_RW=/ LL_FS_RO=/home sandboxer touch a
> > >   Executing the sandboxed command...
> > >   ~$ ls -l a
> > >   -rw-r--r-- 1 vt vt 0 Apr  1 15:53 a
> > 
> > Because there may have several ways to reach a file (e.g. hard links,
> > bind mounts), it would be difficult to get, remember, and track all the
> > related parent file hierarchies.
> > 
> > Landlock ties (ephemeral) permissions to inodes, which means that one
> > inode with enough rights in the file hierarchy is enough to grant access
> > for such rights to the files beneath it.  This is checked when accessing
> > a file, which makes security policies light and flexible (e.g. handles
> > file renaming, linking, and bind mounting).
> > 
> > In your example, / grants read-write access to all files beneath it, and
> > /home grants read access to all files beneath it.  When user space
> > request to write to /home/foo, / grants write permission.
> > 
> > This configuration is then valid, and it makes sure that the security
> > policy doesn't break user space because of unknown directories nesting
> > (e.g. setting different access rights on $HOME and $TMPDIR, for which
> > developers don't have a way to know which one is beneath the other).
> > 
> > For your use case, you'd need to have different file hierarchies and tie
> > them with specific permissions.  For instance, you could have /usr,
> > /var/tmp/pkg/postinst, /tmp, /etc .  Keep in mind that you can also
> > create nested sandboxes or run different stages of the package
> > installation in dedicated sandboxes (e.g. one for the install step with
> > access to /usr in read-write, another for the post installation with
> > access to /var/tmp/pkg/postinst in read-write and /usr in read).
> > 
> > Nicolas is working on a complementary way that would ease sandboxing for
> > some use cases: https://github.com/landlock-lsm/linux/issues/28
> > This will help users to quickly sandbox their application instances but
> > application developers should already be able to implement a more secure
> > deny-by-default policy without this feature.
> 
> Thanks for the answer.
> 
> Looks like it's currently impossible to create more restricted hierarchy
> inside of less restricted. I think this isn't consequence of 'deny by
> default' approach but sort of additivity of allowed permissions.
> Positive permissions of wider hierarchy will be added to more
> restrictive sub-hierarchy and supersede them.

Correct for the same ruleset.

All rules in the same ruleset are ORed whatever their file hierarchy,
but nested sandboxes (i.e. sequential calls to landlock_restrict_self())
can only add more restrictions in relation to their parent sandboxes.

> 
> To add more detail, what I tried to achieve: rpmbuild installs into so
> called 'buildroot', which is (for ALT) '/usr/src/tmp/name-buildroot'
> directory inside of '/usr/src/tmp' TMPDIR (and '/usr/src' is a HONE). When
> %check section is performed some scripts may inadvertently modify
> buildroot content which I thought to block. But because TMPDIR should be
> unrestricted (and / and HOME are not need to be restricted) it is not
> possible by any means to restrict buildroot.

The issue is that tmp is nested in src (and of course everything is
nested in /).  What about using different file hierarchies like this:
* /usr/pkg/src
* /usr/pkg/tmp
* /usr/pkg/root (which would be a bind mount of /, if this is really
  needed)

I'm wondering why buildroot needs access to / though.  Could we identify
which resources it really needs?

> 
> It is not possible, for example, to permit R/W to all existing entities
> of TMPDIR excluding 'name-buildroot', because in that case TMPDIR itself
> should have R/O permissions (it's needed to not supersede
> name-buildroot) and this will defy TMPDIR purpose.

What about creating dedicated directories beneath TMPDIR?

> 
> That work of Nicolas looks promising for the goal I wanted to achieve
> and overall Landlock flexibility.
> 
> Thanks,
> 
> 
> > 
> > > 
> > > Thanks,
> > > 
> 

Re: R/O protection for lower level dirs

[Vitaly Chikunov]

Mickaël, Simon,

On Wed, Apr 03, 2024 at 06:57:06PM +0200, Mickaël Salaün wrote:
> On Wed, Apr 03, 2024 at 06:20:43PM +0300, Vitaly Chikunov wrote:
> > On Tue, Apr 02, 2024 at 11:11:39AM +0200, Mickaël Salaün wrote:
> > > On Mon, Apr 01, 2024 at 07:06:14PM +0300, Vitaly Chikunov wrote:
> > > > 
> > > > I want to ensure that some deeper directory is write protected (as a non
> > > > security measure but so that some post-install processing do not
> > > > accidentally touch installed files).  Is there a way to achieve this
> > > > with Landlock?
> > > 
> > > Landlock follows a deny-by-default policy, which is a good practice for
> > > access control.  In your example, you'll need to identify the set of
> > > file hierarchies that should be legitimately allowed, and set the
> > > appropriate access rights on them, not the other way around.
> > > 
> > > > 
> > > > For example, if we do R/W access to / (root tree is already protected
> > > > enough with DAC) and then R/O access to /home we still get full R/W access
> > > > everywhere and /home seems not restricted. Also, Landlock does not warn for
> > > > such configuration, silently accepting it as valid.
> > > > 
> > > > Practical example:
> > > > 
> > > >   ~$ LL_FS_RW=/ LL_FS_RO=/home sandboxer touch a
> > > >   Executing the sandboxed command...
> > > >   ~$ ls -l a
> > > >   -rw-r--r-- 1 vt vt 0 Apr  1 15:53 a
> > > 
> > > Because there may have several ways to reach a file (e.g. hard links,
> > > bind mounts), it would be difficult to get, remember, and track all the
> > > related parent file hierarchies.
> > > 
> > > Landlock ties (ephemeral) permissions to inodes, which means that one
> > > inode with enough rights in the file hierarchy is enough to grant access
> > > for such rights to the files beneath it.  This is checked when accessing
> > > a file, which makes security policies light and flexible (e.g. handles
> > > file renaming, linking, and bind mounting).
> > > 
> > > In your example, / grants read-write access to all files beneath it, and
> > > /home grants read access to all files beneath it.  When user space
> > > request to write to /home/foo, / grants write permission.
> > > 
> > > This configuration is then valid, and it makes sure that the security
> > > policy doesn't break user space because of unknown directories nesting
> > > (e.g. setting different access rights on $HOME and $TMPDIR, for which
> > > developers don't have a way to know which one is beneath the other).
> > > 
> > > For your use case, you'd need to have different file hierarchies and tie
> > > them with specific permissions.  For instance, you could have /usr,
> > > /var/tmp/pkg/postinst, /tmp, /etc .  Keep in mind that you can also
> > > create nested sandboxes or run different stages of the package
> > > installation in dedicated sandboxes (e.g. one for the install step with
> > > access to /usr in read-write, another for the post installation with
> > > access to /var/tmp/pkg/postinst in read-write and /usr in read).
> > > 
> > > Nicolas is working on a complementary way that would ease sandboxing for
> > > some use cases: https://github.com/landlock-lsm/linux/issues/28
> > > This will help users to quickly sandbox their application instances but
> > > application developers should already be able to implement a more secure
> > > deny-by-default policy without this feature.
> > 
> > Thanks for the answer.
> > 
> > Looks like it's currently impossible to create more restricted hierarchy
> > inside of less restricted. I think this isn't consequence of 'deny by
> > default' approach but sort of additivity of allowed permissions.
> > Positive permissions of wider hierarchy will be added to more
> > restrictive sub-hierarchy and supersede them.
> 
> Correct for the same ruleset.
> 
> All rules in the same ruleset are ORed whatever their file hierarchy,
> but nested sandboxes (i.e. sequential calls to landlock_restrict_self())
> can only add more restrictions in relation to their parent sandboxes.
> 
> > 
> > To add more detail, what I tried to achieve: rpmbuild installs into so
> > called 'buildroot', which is (for ALT) '/usr/src/tmp/name-buildroot'
> > directory inside of '/usr/src/tmp' TMPDIR (and '/usr/src' is a HONE). When
> > %check section is performed some scripts may inadvertently modify
> > buildroot content which I thought to block. But because TMPDIR should be
> > unrestricted (and / and HOME are not need to be restricted) it is not
> > possible by any means to restrict buildroot.
> 
> The issue is that tmp is nested in src (and of course everything is
> nested in /).  What about using different file hierarchies like this:
> * /usr/pkg/src
> * /usr/pkg/tmp
> * /usr/pkg/root (which would be a bind mount of /, if this is really
>   needed)

This will require redesign of existing build setup (which is time-
proven) instead of just applying Landlock layer over existing.

I think Landlock flexibility would greatly benefit if it will allow to
set mode where it do not OR other rules from the ruleset into a rule.

Rationale: If user will need other rules OR'ed (like the current behavior)
she could just OR allowed_access from other rules when setting the rule.
So with this addition old behavior is still reproducible.
Without this addition (currently) the behavior we talking about (more
restrictive hierarchy inside of less restrictive) is just not possible
by design.

To implement this (from my theoretical point of view) only OR'ing
part needs to be skipped (when applying rules) based on some flag
(new rule_type or flags field from landlock_add_rule could be used).

> 
> I'm wondering why buildroot needs access to / though.  Could we identify
> which resources it really needs?

To run executables, libraries, access /tmp (yes, in addition to TMPDIR,
because we cannot dictate upstreams what tmp to use), /usr/lib, etc
whatever normal system need to run anything. Build and test processes
are usually just do anything. And we don't need protecting / because
it's already protected enough with DAC.

R/O overlay (such as bind mount) Simon's idea require some root
capabilities (setuip, user namespaces) which secure build env just don't
have (by design). In that context self-restriction mechanisms like
seccomp and Landlock looked attractive.

> 
> > 
> > It is not possible, for example, to permit R/W to all existing entities
> > of TMPDIR excluding 'name-buildroot', because in that case TMPDIR itself
> > should have R/O permissions (it's needed to not supersede
> > name-buildroot) and this will defy TMPDIR purpose.
> 
> What about creating dedicated directories beneath TMPDIR?

We cannot restrict TMPDIR because upstream scripts (as in "anything")
may use it as a normal TMPDIR to store anything. That aforementioned
idea of using `/usr/pkg/tmp` as a additional TMPDIR used solely for
buildroot looked reasonable. But.

Thanks,

> 
> > 
> > That work of Nicolas looks promising for the goal I wanted to achieve
> > and overall Landlock flexibility.
> > 
> > Thanks,
> > 
> > 
> > > 
> > > > 
> > > > Thanks,
> > > > 
> > 

Re: R/O protection for lower level dirs

[Mickaël Salaün]

On Fri, Apr 05, 2024 at 07:04:09PM +0300, Vitaly Chikunov wrote:
> Mickaël, Simon,
> 
> On Wed, Apr 03, 2024 at 06:57:06PM +0200, Mickaël Salaün wrote:
> > On Wed, Apr 03, 2024 at 06:20:43PM +0300, Vitaly Chikunov wrote:
> > > On Tue, Apr 02, 2024 at 11:11:39AM +0200, Mickaël Salaün wrote:
> > > > On Mon, Apr 01, 2024 at 07:06:14PM +0300, Vitaly Chikunov wrote:
> > > > > 
> > > > > I want to ensure that some deeper directory is write protected (as a non
> > > > > security measure but so that some post-install processing do not
> > > > > accidentally touch installed files).  Is there a way to achieve this
> > > > > with Landlock?
> > > > 
> > > > Landlock follows a deny-by-default policy, which is a good practice for
> > > > access control.  In your example, you'll need to identify the set of
> > > > file hierarchies that should be legitimately allowed, and set the
> > > > appropriate access rights on them, not the other way around.
> > > > 
> > > > > 
> > > > > For example, if we do R/W access to / (root tree is already protected
> > > > > enough with DAC) and then R/O access to /home we still get full R/W access
> > > > > everywhere and /home seems not restricted. Also, Landlock does not warn for
> > > > > such configuration, silently accepting it as valid.
> > > > > 
> > > > > Practical example:
> > > > > 
> > > > >   ~$ LL_FS_RW=/ LL_FS_RO=/home sandboxer touch a
> > > > >   Executing the sandboxed command...
> > > > >   ~$ ls -l a
> > > > >   -rw-r--r-- 1 vt vt 0 Apr  1 15:53 a
> > > > 
> > > > Because there may have several ways to reach a file (e.g. hard links,
> > > > bind mounts), it would be difficult to get, remember, and track all the
> > > > related parent file hierarchies.
> > > > 
> > > > Landlock ties (ephemeral) permissions to inodes, which means that one
> > > > inode with enough rights in the file hierarchy is enough to grant access
> > > > for such rights to the files beneath it.  This is checked when accessing
> > > > a file, which makes security policies light and flexible (e.g. handles
> > > > file renaming, linking, and bind mounting).
> > > > 
> > > > In your example, / grants read-write access to all files beneath it, and
> > > > /home grants read access to all files beneath it.  When user space
> > > > request to write to /home/foo, / grants write permission.
> > > > 
> > > > This configuration is then valid, and it makes sure that the security
> > > > policy doesn't break user space because of unknown directories nesting
> > > > (e.g. setting different access rights on $HOME and $TMPDIR, for which
> > > > developers don't have a way to know which one is beneath the other).
> > > > 
> > > > For your use case, you'd need to have different file hierarchies and tie
> > > > them with specific permissions.  For instance, you could have /usr,
> > > > /var/tmp/pkg/postinst, /tmp, /etc .  Keep in mind that you can also
> > > > create nested sandboxes or run different stages of the package
> > > > installation in dedicated sandboxes (e.g. one for the install step with
> > > > access to /usr in read-write, another for the post installation with
> > > > access to /var/tmp/pkg/postinst in read-write and /usr in read).
> > > > 
> > > > Nicolas is working on a complementary way that would ease sandboxing for
> > > > some use cases: https://github.com/landlock-lsm/linux/issues/28
> > > > This will help users to quickly sandbox their application instances but
> > > > application developers should already be able to implement a more secure
> > > > deny-by-default policy without this feature.
> > > 
> > > Thanks for the answer.
> > > 
> > > Looks like it's currently impossible to create more restricted hierarchy
> > > inside of less restricted. I think this isn't consequence of 'deny by
> > > default' approach but sort of additivity of allowed permissions.
> > > Positive permissions of wider hierarchy will be added to more
> > > restrictive sub-hierarchy and supersede them.
> > 
> > Correct for the same ruleset.
> > 
> > All rules in the same ruleset are ORed whatever their file hierarchy,
> > but nested sandboxes (i.e. sequential calls to landlock_restrict_self())
> > can only add more restrictions in relation to their parent sandboxes.
> > 
> > > 
> > > To add more detail, what I tried to achieve: rpmbuild installs into so
> > > called 'buildroot', which is (for ALT) '/usr/src/tmp/name-buildroot'
> > > directory inside of '/usr/src/tmp' TMPDIR (and '/usr/src' is a HONE). When
> > > %check section is performed some scripts may inadvertently modify
> > > buildroot content which I thought to block. But because TMPDIR should be
> > > unrestricted (and / and HOME are not need to be restricted) it is not
> > > possible by any means to restrict buildroot.
> > 
> > The issue is that tmp is nested in src (and of course everything is
> > nested in /).  What about using different file hierarchies like this:
> > * /usr/pkg/src
> > * /usr/pkg/tmp
> > * /usr/pkg/root (which would be a bind mount of /, if this is really
> >   needed)
> 
> This will require redesign of existing build setup (which is time-
> proven) instead of just applying Landlock layer over existing.

Indeed, it has a cost.

> 
> I think Landlock flexibility would greatly benefit if it will allow to
> set mode where it do not OR other rules from the ruleset into a rule.
> 
> Rationale: If user will need other rules OR'ed (like the current behavior)
> she could just OR allowed_access from other rules when setting the rule.
> So with this addition old behavior is still reproducible.
> Without this addition (currently) the behavior we talking about (more
> restrictive hierarchy inside of less restrictive) is just not possible
> by design.
> 
> To implement this (from my theoretical point of view) only OR'ing
> part needs to be skipped (when applying rules) based on some flag
> (new rule_type or flags field from landlock_add_rule could be used).

The ORing part would indeed be one solution.  Another solution would be
to have a denied_access field as explained in the related issue:
https://github.com/landlock-lsm/linux/issues/28
Anyway, we also need to deal with multiple rules on the same inode/path
(not only the file hierarchy): either OR them or error out.

> 
> > 
> > I'm wondering why buildroot needs access to / though.  Could we identify
> > which resources it really needs?
> 
> To run executables, libraries, access /tmp (yes, in addition to TMPDIR,
> because we cannot dictate upstreams what tmp to use), /usr/lib, etc
> whatever normal system need to run anything. Build and test processes
> are usually just do anything. And we don't need protecting / because
> it's already protected enough with DAC.
> 
> R/O overlay (such as bind mount) Simon's idea require some root
> capabilities (setuip, user namespaces) which secure build env just don't
> have (by design). In that context self-restriction mechanisms like
> seccomp and Landlock looked attractive.

OK

> 
> > 
> > > 
> > > It is not possible, for example, to permit R/W to all existing entities
> > > of TMPDIR excluding 'name-buildroot', because in that case TMPDIR itself
> > > should have R/O permissions (it's needed to not supersede
> > > name-buildroot) and this will defy TMPDIR purpose.
> > 
> > What about creating dedicated directories beneath TMPDIR?
> 
> We cannot restrict TMPDIR because upstream scripts (as in "anything")
> may use it as a normal TMPDIR to store anything. That aforementioned
> idea of using `/usr/pkg/tmp` as a additional TMPDIR used solely for
> buildroot looked reasonable. But.
> 
> Thanks,
> 
> > 
> > > 
> > > That work of Nicolas looks promising for the goal I wanted to achieve
> > > and overall Landlock flexibility.
> > > 
> > > Thanks,
> > > 
> > > 
> > > > 
> > > > > 
> > > > > Thanks,
> > > > > 
> > > 
> 

Re: R/O protection for lower level dirs

[Justin Suess]

Hi,

I have a working tree that implements this feature. It's implemented in 
a flag named LANDLOCK_ADD_RULE_NO_INHERIT.

It's the successor to the first patch I submitted here:

v1: 
https://lore.kernel.org/linux-security-module/20251105180019.1432367-1-utilityemal77@gmail.com/T/#t

The above first implemented version patch implemented the flag without 
any parent directory protections.

Both the old version of the patch and my new version build on Tingmao 
Wang's patch to add LANDLOCK_ADD_RULE_QUIET, which helpfully added a 
rule with similar flag propagation logic.

v3: 
https://lore.kernel.org/linux-security-module/cover.1761511023.git.m@maowtm.org/

I still have to break it out into a patch and implement the kunit and 
flesh out the selftests, but you can find my new implementation and 
build it yourself here: 
https://github.com/RazeLighter777/linux-landlock-no-inherit

And you can see the relevant recent discussion on this issue: 
https://github.com/landlock-lsm/linux/issues/28

There is a newer version of Tingmao Wang's patch (v4) that I will rebase 
off soon, but it mostly concerned adding new tests so it shouldn't be 
difficult.

Rules tagged with LANDLOCK_ADD_RULE_NO_INHERIT attribute have the 
following properties:

1.  Access grants from a rule on a parent inode on the same 
mountpoint will not be propagated downward to child inodes. So a grant 
on /a = rw and /a/b = ro + LANDLOCK_ADD_RULE_NO_INHERIT will not grant 
/a/b write permissions.

2. Refer operations in the direct parent path of the inode (up to the 
mountpoint root) will be blocked if they operate directly on said path. 
So if /a/b/c/d = ro + LANDLOCK_ADD_RULE_NO_INHERIT, moving a,b,c or d, 
creating links to these files, renaming them, or removing them will be 
disallowed. This prevents breaking the file topology and preventing 
sandbox restart attacks.

3. LANDLOCK_ADD_RULE_NO_INHERIT propagates to child layers and is merged 
correctly across domains.

The use cases for this patch could be:

1. Granting access to /home/user, but restricting sensitive directories 
like /home/user/.ssh

2. More fine grained restrictions on USB or other devices in /dev. So 
you could a program to allow /dev/usb, but forbid a specific device 
/dev/usb/hiddev3 for instance.

Here's a demo of the patch. LL_FS_RO_NO_INHERIT is a landlock-sandboxer 
environment variable I added in which just creates an ro + 
LANDLOCK_ADD_RULE_NO_INHERIT rule on an inode.

Demo:

~ # LL_FS_RO="" LL_FS_RW="/" LL_FS_RO_NO_INHERIT="/a/b/c" 
landlock-sandboxer sh
Executing the sandboxed command...
~ # ls
a      dev    init   root   sys    tmp
bin    etc    proc   sbin   tests  usr
~ # rm -rf a/
rm: can't remove 'a/b/c': Permission denied
~ # mv a b
mv: can't rename 'a': Permission denied
~ # cd a/
/a # ls
b
/a # mv b bad
mv: can't rename 'b': Permission denied
/a # ln b bad
ln: bad: Operation not permitted
/a # ln bad b
ln: bad: No such file or directory
/a # rm -rf b
rm: can't remove 'b/c': Permission denied
/a # cd b
/a/b # ls
c
/a/b # rm -rf c
rm: can't remove 'c': Permission denied
/a/b # mv c bad
mv: can't rename 'c': Permission denied
/a/b # touch c/bad
touch: c/bad: Permission denied
/a/b # cd c
/a/b/c # ls
/a/b/c # ls -al
total 0
drwxr-xr-x    2 0        0               40 Nov  9 14:46 .
drwxr-xr-x    3 0        0               60 Nov  9 14:46 ..
/a/b/c # mount --bind /tmp .
mount: permission denied (are you root?)
/a/b/c # cd ..
/a/b # touch fi
/a/b # ls
c   fi
/a/b # mkdir good
/a/b # touch good/test
/a/b # rm -rf good/
/a/b #

Some things I'd like to hear feedback on:

1. Should parent directory refer operation restrictions apply on parent 
directories above the mountpoint? Currently they only propagate up to 
the mountpoint, so you if you had /a/b/c = ro + 
LANDLOCK_ADD_RULE_NO_INHERIT and / = rw, if /a/b was on a different 
mountpoint than /, you could still move /a to /unrelated for instance. 
This wouldn't be difficult to fix, but would add some complexity.

2. Potential for extension to other scopes? It's unclear how this flag 
could be useful for other cases such as network and signal restrictions, 
but if somebody can think of something interesting it might be worth a look.

3. Any edge cases that should be tested for that I might have missed / 
that need addressing.

I'd also love to hear feedback from Nicholas and see their work and 
incorporate any lessons learned from them.

Kind Regards,

Justin Suess

Re: R/O protection for lower level dirs

[Simon de Vlieger]

Hey Vitaly,

On Wed, Apr 3, 2024, at 5:20 PM, Vitaly Chikunov wrote:

> To add more detail, what I tried to achieve: rpmbuild installs into so
> called 'buildroot', which is (for ALT) '/usr/src/tmp/name-buildroot'
> directory inside of '/usr/src/tmp' TMPDIR (and '/usr/src' is a HONE). When
> %check section is performed some scripts may inadvertently modify
> buildroot content which I thought to block. But because TMPDIR should be
> unrestricted (and / and HOME are not need to be restricted) it is not
> possible by any means to restrict buildroot.

As Mickaël mentions this can be achieved by re-arranging the directory
structure. However I'd like to point out a second option (which doesn't
directly involve landlock) and that is to create a new overlay between
`%build` and `%check` which you throw away again before `%install`.

Any inadvertent changes during `%check` would then be irrelevant for the
`%install` section.

Regards,

Simon