Re: [PATCH 2/6] landlock: Mediate CAP_SYS_RAWIO for mappings below mmap_min_addr

[sashiko-bot@kernel.org]

> Until now, a process in a domain that denies CAP_SYS_RAWIO could still
> map memory below the vm.mmap_min_addr limit if it held this capability.
> cap_mmap_addr() is commoncap's mmap_addr hook, and it checks
> CAP_SYS_RAWIO with cap_capable(), not security_capable(), so the check
> never reaches hook_capable().  Mapping the lowest pages is what this
> limit protects against, because it helps to exploit kernel NULL pointer
> dereferences.
> 
> Add a Landlock mmap_addr hook that checks CAP_SYS_RAWIO against the
> domain under the same condition as cap_mmap_addr().  With the same
> vm.mmap_min_addr value, the hook only denies mappings for which
> commoncap required the capability.  security_mmap_addr() stops at
> commoncap's error, so processes without the capability get the same
> result as before.  This also covers the x86 vm86() syscalls, which use
> the same check for address 0.
> 
> Making cap_mmap_addr() call capable() would also fix this, but it would
> send every low mapping through the capable hook of all LSMs (SELinux,
> AppArmor, SafeSetID, BPF LSM programs), adding capability checks that
> their policies never had to handle.  For instance, SELinux checks
> mmap_zero in its own mmap_addr hook and keeps it separate from the
> capability on purpose.  LSMs with their own policy for low mappings
> implement it in this hook, so Landlock does the same.
> 
> Cc: Günther Noack <gnoack@google.com>
> Cc: Paul Moore <paul@paul-moore.com>
> Cc: Serge Hallyn <serge@hallyn.com>
> Reported-by: Ada Smith <adasmithgt@gmail.com>
> Fixes: 97c8386f1d74 ("landlock: Enforce capability restrictions")
> Signed-off-by: Mickaël Salaün <mic@digikod.net>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261110202436.2408244-1-mic@digikod.net?part=2