| Message ID | 20210202162710.657398-5-mic@digikod.net |
|---|---|
| State | Superseded |
| Headers | show |
| Series | Landlock LSM | expand |
On Tue, Feb 02, 2021 at 05:27:02PM +0100, Mickaël Salaün wrote: > From: Mickaël Salaün <mic@linux.microsoft.com> > > Using ptrace(2) and related debug features on a target process can lead > to a privilege escalation. Indeed, ptrace(2) can be used by an attacker > to impersonate another task and to remain undetected while performing > malicious activities. Thanks to ptrace_may_access(), various part of > the kernel can check if a tracer is more privileged than a tracee. > > A landlocked process has fewer privileges than a non-landlocked process > and must then be subject to additional restrictions when manipulating > processes. To be allowed to use ptrace(2) and related syscalls on a > target process, a landlocked process must have a subset of the target > process's rules (i.e. the tracee must be in a sub-domain of the tracer). > > Cc: James Morris <jmorris@namei.org> > Cc: Kees Cook <keescook@chromium.org> > Cc: Serge E. Hallyn <serge@hallyn.com> Acked-by: Serge Hallyn <serge@hallyn.com> Thanks, I appreciate that things are well named and easy to reason about. > Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com> > Reviewed-by: Jann Horn <jannh@google.com> > --- > > Changes since v25: > * Rename function to landlock_add_ptrace_hooks(). > > Changes since v22: > * Add Reviewed-by: Jann Horn <jannh@google.com> > > Changes since v21: > * Fix copyright dates. > > Changes since v14: > * Constify variables. > > Changes since v13: > * Make the ptrace restriction mandatory, like in the v10. > * Remove the eBPF dependency. > > Previous changes: > https://lore.kernel.org/lkml/20191104172146.30797-5-mic@digikod.net/ > --- > security/landlock/Makefile | 2 +- > security/landlock/ptrace.c | 120 +++++++++++++++++++++++++++++++++++++ > security/landlock/ptrace.h | 14 +++++ > security/landlock/setup.c | 2 + > 4 files changed, 137 insertions(+), 1 deletion(-) > create mode 100644 security/landlock/ptrace.c > create mode 100644 security/landlock/ptrace.h > > diff --git a/security/landlock/Makefile b/security/landlock/Makefile > index 041ea242e627..f1d1eb72fa76 100644 > --- a/security/landlock/Makefile > +++ b/security/landlock/Makefile > @@ -1,4 +1,4 @@ > obj-$(CONFIG_SECURITY_LANDLOCK) := landlock.o > > landlock-y := setup.o object.o ruleset.o \ > - cred.o > + cred.o ptrace.o > diff --git a/security/landlock/ptrace.c b/security/landlock/ptrace.c > new file mode 100644 > index 000000000000..f55b82446de2 > --- /dev/null > +++ b/security/landlock/ptrace.c > @@ -0,0 +1,120 @@ > +// SPDX-License-Identifier: GPL-2.0-only > +/* > + * Landlock LSM - Ptrace hooks > + * > + * Copyright © 2017-2020 Mickaël Salaün <mic@digikod.net> > + * Copyright © 2019-2020 ANSSI > + */ > + > +#include <asm/current.h> > +#include <linux/cred.h> > +#include <linux/errno.h> > +#include <linux/kernel.h> > +#include <linux/lsm_hooks.h> > +#include <linux/rcupdate.h> > +#include <linux/sched.h> > + > +#include "common.h" > +#include "cred.h" > +#include "ptrace.h" > +#include "ruleset.h" > +#include "setup.h" > + > +/** > + * domain_scope_le - Checks domain ordering for scoped ptrace > + * > + * @parent: Parent domain. > + * @child: Potential child of @parent. > + * > + * Checks if the @parent domain is less or equal to (i.e. an ancestor, which > + * means a subset of) the @child domain. > + */ > +static bool domain_scope_le(const struct landlock_ruleset *const parent, > + const struct landlock_ruleset *const child) > +{ > + const struct landlock_hierarchy *walker; > + > + if (!parent) > + return true; > + if (!child) > + return false; > + for (walker = child->hierarchy; walker; walker = walker->parent) { > + if (walker == parent->hierarchy) > + /* @parent is in the scoped hierarchy of @child. */ > + return true; > + } > + /* There is no relationship between @parent and @child. */ > + return false; > +} > + > +static bool task_is_scoped(const struct task_struct *const parent, > + const struct task_struct *const child) > +{ > + bool is_scoped; > + const struct landlock_ruleset *dom_parent, *dom_child; > + > + rcu_read_lock(); > + dom_parent = landlock_get_task_domain(parent); > + dom_child = landlock_get_task_domain(child); > + is_scoped = domain_scope_le(dom_parent, dom_child); > + rcu_read_unlock(); > + return is_scoped; > +} > + > +static int task_ptrace(const struct task_struct *const parent, > + const struct task_struct *const child) > +{ > + /* Quick return for non-landlocked tasks. */ > + if (!landlocked(parent)) > + return 0; > + if (task_is_scoped(parent, child)) > + return 0; > + return -EPERM; > +} > + > +/** > + * hook_ptrace_access_check - Determines whether the current process may access > + * another > + * > + * @child: Process to be accessed. > + * @mode: Mode of attachment. > + * > + * If the current task has Landlock rules, then the child must have at least > + * the same rules. Else denied. > + * > + * Determines whether a process may access another, returning 0 if permission > + * granted, -errno if denied. > + */ > +static int hook_ptrace_access_check(struct task_struct *const child, > + const unsigned int mode) > +{ > + return task_ptrace(current, child); > +} > + > +/** > + * hook_ptrace_traceme - Determines whether another process may trace the > + * current one > + * > + * @parent: Task proposed to be the tracer. > + * > + * If the parent has Landlock rules, then the current task must have the same > + * or more rules. Else denied. > + * > + * Determines whether the nominated task is permitted to trace the current > + * process, returning 0 if permission is granted, -errno if denied. > + */ > +static int hook_ptrace_traceme(struct task_struct *const parent) > +{ > + return task_ptrace(parent, current); > +} > + > +static struct security_hook_list landlock_hooks[] __lsm_ro_after_init = { > + LSM_HOOK_INIT(ptrace_access_check, hook_ptrace_access_check), > + LSM_HOOK_INIT(ptrace_traceme, hook_ptrace_traceme), > +}; > + > +__init void landlock_add_ptrace_hooks(void) > +{ > + security_add_hooks(landlock_hooks, ARRAY_SIZE(landlock_hooks), > + LANDLOCK_NAME); > +} > diff --git a/security/landlock/ptrace.h b/security/landlock/ptrace.h > new file mode 100644 > index 000000000000..265b220ae3bf > --- /dev/null > +++ b/security/landlock/ptrace.h > @@ -0,0 +1,14 @@ > +/* SPDX-License-Identifier: GPL-2.0-only */ > +/* > + * Landlock LSM - Ptrace hooks > + * > + * Copyright © 2017-2019 Mickaël Salaün <mic@digikod.net> > + * Copyright © 2019 ANSSI > + */ > + > +#ifndef _SECURITY_LANDLOCK_PTRACE_H > +#define _SECURITY_LANDLOCK_PTRACE_H > + > +__init void landlock_add_ptrace_hooks(void); > + > +#endif /* _SECURITY_LANDLOCK_PTRACE_H */ > diff --git a/security/landlock/setup.c b/security/landlock/setup.c > index 8661112fb238..a5d6ef334991 100644 > --- a/security/landlock/setup.c > +++ b/security/landlock/setup.c > @@ -11,6 +11,7 @@ > > #include "common.h" > #include "cred.h" > +#include "ptrace.h" > #include "setup.h" > > struct lsm_blob_sizes landlock_blob_sizes __lsm_ro_after_init = { > @@ -20,6 +21,7 @@ struct lsm_blob_sizes landlock_blob_sizes __lsm_ro_after_init = { > static int __init landlock_init(void) > { > landlock_add_cred_hooks(); > + landlock_add_ptrace_hooks(); > pr_info("Up and running.\n"); > return 0; > } > -- > 2.30.0
diff --git a/security/landlock/Makefile b/security/landlock/Makefile index 041ea242e627..f1d1eb72fa76 100644 --- a/security/landlock/Makefile +++ b/security/landlock/Makefile @@ -1,4 +1,4 @@ obj-$(CONFIG_SECURITY_LANDLOCK) := landlock.o landlock-y := setup.o object.o ruleset.o \ - cred.o + cred.o ptrace.o diff --git a/security/landlock/ptrace.c b/security/landlock/ptrace.c new file mode 100644 index 000000000000..f55b82446de2 --- /dev/null +++ b/security/landlock/ptrace.c @@ -0,0 +1,120 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * Landlock LSM - Ptrace hooks + * + * Copyright © 2017-2020 Mickaël Salaün <mic@digikod.net> + * Copyright © 2019-2020 ANSSI + */ + +#include <asm/current.h> +#include <linux/cred.h> +#include <linux/errno.h> +#include <linux/kernel.h> +#include <linux/lsm_hooks.h> +#include <linux/rcupdate.h> +#include <linux/sched.h> + +#include "common.h" +#include "cred.h" +#include "ptrace.h" +#include "ruleset.h" +#include "setup.h" + +/** + * domain_scope_le - Checks domain ordering for scoped ptrace + * + * @parent: Parent domain. + * @child: Potential child of @parent. + * + * Checks if the @parent domain is less or equal to (i.e. an ancestor, which + * means a subset of) the @child domain. + */ +static bool domain_scope_le(const struct landlock_ruleset *const parent, + const struct landlock_ruleset *const child) +{ + const struct landlock_hierarchy *walker; + + if (!parent) + return true; + if (!child) + return false; + for (walker = child->hierarchy; walker; walker = walker->parent) { + if (walker == parent->hierarchy) + /* @parent is in the scoped hierarchy of @child. */ + return true; + } + /* There is no relationship between @parent and @child. */ + return false; +} + +static bool task_is_scoped(const struct task_struct *const parent, + const struct task_struct *const child) +{ + bool is_scoped; + const struct landlock_ruleset *dom_parent, *dom_child; + + rcu_read_lock(); + dom_parent = landlock_get_task_domain(parent); + dom_child = landlock_get_task_domain(child); + is_scoped = domain_scope_le(dom_parent, dom_child); + rcu_read_unlock(); + return is_scoped; +} + +static int task_ptrace(const struct task_struct *const parent, + const struct task_struct *const child) +{ + /* Quick return for non-landlocked tasks. */ + if (!landlocked(parent)) + return 0; + if (task_is_scoped(parent, child)) + return 0; + return -EPERM; +} + +/** + * hook_ptrace_access_check - Determines whether the current process may access + * another + * + * @child: Process to be accessed. + * @mode: Mode of attachment. + * + * If the current task has Landlock rules, then the child must have at least + * the same rules. Else denied. + * + * Determines whether a process may access another, returning 0 if permission + * granted, -errno if denied. + */ +static int hook_ptrace_access_check(struct task_struct *const child, + const unsigned int mode) +{ + return task_ptrace(current, child); +} + +/** + * hook_ptrace_traceme - Determines whether another process may trace the + * current one + * + * @parent: Task proposed to be the tracer. + * + * If the parent has Landlock rules, then the current task must have the same + * or more rules. Else denied. + * + * Determines whether the nominated task is permitted to trace the current + * process, returning 0 if permission is granted, -errno if denied. + */ +static int hook_ptrace_traceme(struct task_struct *const parent) +{ + return task_ptrace(parent, current); +} + +static struct security_hook_list landlock_hooks[] __lsm_ro_after_init = { + LSM_HOOK_INIT(ptrace_access_check, hook_ptrace_access_check), + LSM_HOOK_INIT(ptrace_traceme, hook_ptrace_traceme), +}; + +__init void landlock_add_ptrace_hooks(void) +{ + security_add_hooks(landlock_hooks, ARRAY_SIZE(landlock_hooks), + LANDLOCK_NAME); +} diff --git a/security/landlock/ptrace.h b/security/landlock/ptrace.h new file mode 100644 index 000000000000..265b220ae3bf --- /dev/null +++ b/security/landlock/ptrace.h @@ -0,0 +1,14 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +/* + * Landlock LSM - Ptrace hooks + * + * Copyright © 2017-2019 Mickaël Salaün <mic@digikod.net> + * Copyright © 2019 ANSSI + */ + +#ifndef _SECURITY_LANDLOCK_PTRACE_H +#define _SECURITY_LANDLOCK_PTRACE_H + +__init void landlock_add_ptrace_hooks(void); + +#endif /* _SECURITY_LANDLOCK_PTRACE_H */ diff --git a/security/landlock/setup.c b/security/landlock/setup.c index 8661112fb238..a5d6ef334991 100644 --- a/security/landlock/setup.c +++ b/security/landlock/setup.c @@ -11,6 +11,7 @@ #include "common.h" #include "cred.h" +#include "ptrace.h" #include "setup.h" struct lsm_blob_sizes landlock_blob_sizes __lsm_ro_after_init = { @@ -20,6 +21,7 @@ struct lsm_blob_sizes landlock_blob_sizes __lsm_ro_after_init = { static int __init landlock_init(void) { landlock_add_cred_hooks(); + landlock_add_ptrace_hooks(); pr_info("Up and running.\n"); return 0; }