[PATCH 0/3] landlock: Fix REFER in layered domains

["Günther Noack" <gnoack3000@gmail.com>]

This patchset fixes a bug in Landlock layering,
reported by Dwi Siswanto in [1] and [2].  (Thanks!)

The bug
=======

When Landlock initializes layer masks for path walk based checks, it
unconditionally adds the LANDLOCK_ACCESS_FS_REFER access right to the
handled access rights.

This leads to a wrong layer composition, in cases where the following
layers are stacked:

1. A FS layer restricting REFER, but also allowing REFER in a rule
   (e.g., handle REFER, but allow REFER on /)
2. A non-FS layer (e.g., networking-only layer)

When these rulesets are enforced **individually**, there are REFER
operations that are allowed in both rulesets -- the ones that 1
allows.

When these rulesets are enforced **on top of each other**, the non-FS
layer starts enforcing REFER implicitly as well, and all REFER
operations are denied.

This patchset
=============

This patchset fixes the issue in three commits:

1) The fix, which should be backportable to older kernels
   and which is CC'd to stable@.
2) Regression selftests.
3) A more elegant fix for newer kernels,
   which is intentionally *not* CC'd to stable@,
   because it would break on older kernels.

   In newer kernels, we already add the "REFER" access right to the
   handled access rights when we merge the ruleset into the new
   domain, so there is no additional calculation to do for it.


Please let me know what you think!

–Günther


[1] https://github.com/landlock-lsm/go-landlock/issues/66
[2] https://github.com/landlock-lsm/linux/issues/67

Günther Noack (3):
  landlock: Fix layer composition of LANDLOCK_ACCESS_FS_REFER
  selftests/landlock: Test that layering does not break refer
  landlock: Simplify landlock_get_fs_access_mask()

 security/landlock/domain.h                 |  9 +++--
 tools/testing/selftests/landlock/fs_test.c | 39 ++++++++++++++++++++++
 2 files changed, 45 insertions(+), 3 deletions(-)

-- 
2.56.0