Mickaël Salaün b91c3e4ea7 landlock: Add support for file reparenting with LANDLOCK_ACCESS_FS_REFER ... Add a new LANDLOCK_ACCESS_FS_REFER access right to enable policy writers to allow sandboxed processes to link and rename files from and to a specific set of file hierarchies. This access right should be composed with LANDLOCK_ACCESS_FS_MAKE_* for the destination of a link or rename, and with LANDLOCK_ACCESS_FS_REMOVE_* for a source of a rename. This lift a Landlock limitation that always denied changing the parent of an inode. Renaming or linking to the same directory is still always allowed, whatever LANDLOCK_ACCESS_FS_REFER is used or not, because it is not considered a threat to user data. However, creating multiple links or renaming to a different parent directory may lead to privilege escalations if not handled properly. Indeed, we must be sure that the source doesn't gain more privileges by being accessible from the destination. This is handled by making sure that the source hierarchy (including the referenced file or directory itself) restricts at least as much the destination hierarchy. If it is not the case, an EXDEV error is returned, making it potentially possible for user space to copy the file hierarchy instead of moving or linking it. Instead of creating different access rights for the source and the destination, we choose to make it simple and consistent for users. Indeed, considering the previous constraint, it would be weird to require such destination access right to be also granted to the source (to make it a superset). Moreover, RENAME_EXCHANGE would also add to the confusion because of paths being both a source and a destination. See the provided documentation for additional details. New tests are provided with a following commit. Reviewed-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Mickaël Salaün <mic@digikod.net> Link: https://lore.kernel.org/r/20220506161102.525323-8-mic@digikod.net		2022-05-23 13:27:59 +02:00
..
common.h	landlock: Set up the security framework and manage credentials	2021-04-22 12:22:10 -07:00
cred.c	landlock: Format with clang-format	2022-05-09 12:31:10 +02:00
cred.h	landlock: Format with clang-format	2022-05-09 12:31:10 +02:00
fs.c	landlock: Add support for file reparenting with LANDLOCK_ACCESS_FS_REFER	2022-05-23 13:27:59 +02:00
fs.h	landlock: Define access_mask_t to enforce a consistent access mask size	2022-05-23 13:27:55 +02:00
Kconfig	landlock: Support filesystem access-control	2021-04-22 12:22:11 -07:00
limits.h	landlock: Add support for file reparenting with LANDLOCK_ACCESS_FS_REFER	2022-05-23 13:27:59 +02:00
Makefile	landlock: Add syscall implementations	2021-04-22 12:22:11 -07:00
object.c	landlock: Format with clang-format	2022-05-09 12:31:10 +02:00
object.h	landlock: Format with clang-format	2022-05-09 12:31:10 +02:00
ptrace.c	landlock: Format with clang-format	2022-05-09 12:31:10 +02:00
ptrace.h	landlock: Add ptrace restrictions	2021-04-22 12:22:10 -07:00
ruleset.c	landlock: Define access_mask_t to enforce a consistent access mask size	2022-05-23 13:27:55 +02:00
ruleset.h	landlock: Fix same-layer rule unions	2022-05-23 13:27:57 +02:00
setup.c	landlock: Support filesystem access-control	2021-04-22 12:22:11 -07:00
setup.h	landlock: Support filesystem access-control	2021-04-22 12:22:11 -07:00
syscalls.c	landlock: Add support for file reparenting with LANDLOCK_ACCESS_FS_REFER	2022-05-23 13:27:59 +02:00