[PATCH 0/6] landlock: Add POSIX message queue scoping

[Oxana Kharitonova <oxana@cloudflare.com>]

Hi,

This series adds landlock support for scoping POSIX message queuesi [1].
 
Landlock already supports scoped IPC restrictions for signals and abstract
UNIX sockets. These restrictions make it possible to prevent a sandboxed
task from interacting with IPC objects outside of its Landlock domain,
while still allowing communication within the same domain or with nested
domains.
 
This series extends the same model to POSIX message queues with a new
LANDLOCK_SCOPE_POSIX_MSG_QUEUE scope. When this scope is enforced, a task
can only open POSIX message queues that were created by a task in the same
landlock domain or in a nested domain.
 
The implementation tags mqueuefs inodes at creation time with the creator's
landlock domain. This domain is kept alive for the lifetime of the inode
and is checked when the queue is opened.
 
The series also exposes the mqueuefs magic number through the shared UAPI
magic header, bumps the Landlock ABI, updates documentation, adds sandboxer
support, and adds selftests.
 
The new behavior is:
 
- a task restricted with LANDLOCK_SCOPE_POSIX_MSG_QUEUE cannot open a queue
  created outside of its Landlock scope;
- a task can still open a queue created within its own Landlock domain;
- queues created outside of any Landlock domain are treated as outside the
  scope for a scoped opener.

[1] https://man7.org/linux/man-pages/man7/mq_overview.7.html

Oxana Kharitonova (6):
  ipc: Move mqueue fs magic to uapi magic header
  landlock: Scope POSIX message queue opens
  landlock: Bump ABI for LANDLOCK_SCOPE_POSIX_MSG_QUEUE
  selftests/landlock: Test POSIX message queue scoping
  samples/landlock: Support POSIX message queue scoping
  landlock: Document POSIX message queue scoping

 Documentation/admin-guide/LSM/landlock.rst    |   6 +-
 Documentation/userspace-api/landlock.rst      |  11 +-
 include/uapi/linux/landlock.h                 |   7 +-
 include/uapi/linux/magic.h                    |   2 +
 ipc/mqueue.c                                  |   2 +-
 samples/landlock/sandboxer.c                  |  16 +-
 security/landlock/audit.c                     |   9 +
 security/landlock/audit.h                     |   1 +
 security/landlock/fs.c                        |  35 +++
 security/landlock/fs.h                        |  15 ++
 security/landlock/limits.h                    |   2 +-
 security/landlock/ruleset.c                   |   1 -
 security/landlock/syscalls.c                  |   2 +-
 security/landlock/task.c                      |  43 ++++
 security/landlock/task.h                      |   4 +
 tools/testing/selftests/landlock/base_test.c  |   2 +-
 .../landlock/scoped_posix_msg_queue_test.c    | 223 ++++++++++++++++++
 .../testing/selftests/landlock/scoped_test.c  |   2 +-
 18 files changed, 371 insertions(+), 12 deletions(-)
 create mode 100644 tools/testing/selftests/landlock/scoped_posix_msg_queue_test.c

-- 
2.50.1 (Apple Git-155)