Skip to content

Commit 3b00e43

Browse files
kailun-qinkailun-qin
committed
specs-go/config: add Landlock LSM support
Linux kernel 5.13 adds support for Landlock Linux Security Module (LSM). This allows unprivileged processes to create safe security sandboxes that can securely restrict the ambient rights (e.g. global filesystem access) for themselves. #1110 Signed-off-by: Kailun Qin <kailun.qin@intel.com>
1 parent 86290f6 commit 3b00e43

4 files changed

Lines changed: 207 additions & 2 deletions

File tree

‎config.md‎

Lines changed: 78 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -216,7 +216,27 @@ For Linux-based systems, the `process` object supports the following process-spe
216216
This is a per-process setting, where as [`disableOOMKiller`](config-linux.md#memory) is scoped for a memory cgroup.
217217
For more information on how these two settings work together, see [the memory cgroup documentation section 10. OOM Contol][cgroup-v1-memory_2].
218218
* **`selinuxLabel`** (string, OPTIONAL) specifies the SELinux label for the process.
219-
For more information about SELinux, see [SELinux documentation][selinux].
219+
For more information about SELinux, see [SELinux documentation][selinux].
220+
* **`landlock`** (object, OPTIONAL) specifies the Landlock unprivileged access control settings for the container process.
221+
Note that `noNewPrivileges` must be set to true to use this feature.
222+
For more information about Landlock, see [Landlock documentation][landlock].
223+
`landlock` contains the following properties:
224+
225+
* **`ruleset`** (object, OPTIONAL) the `ruleset` field identifies a set of rules (i.e., actions on objects) that need to be handled (i.e., restricted).
226+
The `ruleset` currently contains the following types:
227+
* **`handledAccessFS`** (array of strings, OPTIONAL) is an array of FS typed actions that are handled by a ruleset.
228+
If no rule explicitly allow them, they should then be forbidden.
229+
* **`rules`** (object, OPTIONAL) the `rules` field specifies the security policies (i.e., actions allowed on objects) to be added to an existing ruleset.
230+
The `rules` currently contains the following types:
231+
* **`pathBeneath`** (array of objects, OPTIONAL) is an array of the file-hierarchy typed rules.
232+
Entries in the array contain the following properties:
233+
* **`allowedAccess`** (array of strings, OPTIONAL) is an array of FS typed actions that are allowed by a rule.
234+
* **`paths`** (array of strings, OPTIONAL) is an array of files or parent directories of the file hierarchies to restrict.
235+
* **`disableBestEffort`** (bool, OPTIONAL) the `disableBestEffort` field disables the best-effort security approach for Landlock access rights.
236+
This is for conditions when the Landlock access rights explicitly configured by the container are not supported or available in the running kernel.
237+
If the best-effort security approach is enabled (`false`), the runtime SHOULD enforce the strongest rules configured up to the current kernel support, and only be [logged as a warning](runtime.md#warnings) for those not supported.
238+
If disabled (`true`), the runtime MUST [generate an error](runtime.md#errors) if one or more rules specified by the container is not supported.
239+
Default is `false`, i.e., following a best-effort security approach.
220240

221241
### <a name="configUser" />User
222242

@@ -258,6 +278,61 @@ _Note: symbolic name for uid and gid, such as uname and gname respectively, are
258278
],
259279
"apparmorProfile": "acme_secure_profile",
260280
"selinuxLabel": "system_u:system_r:svirt_lxc_net_t:s0:c124,c675",
281+
"landlock": {
282+
"ruleset": {
283+
"handledAccessFS": [
284+
"execute",
285+
"write_file",
286+
"read_file",
287+
"read_dir",
288+
"remove_dir",
289+
"remove_file",
290+
"make_char",
291+
"make_dir",
292+
"make_reg",
293+
"make_sock",
294+
"make_fifo",
295+
"make_block",
296+
"make_sym"
297+
]
298+
},
299+
"rules": {
300+
"pathBeneath": [
301+
{
302+
"allowedAccess": [
303+
"execute",
304+
"read_file",
305+
"read_dir"
306+
],
307+
"paths": [
308+
"/usr",
309+
"/bin"
310+
]
311+
},
312+
{
313+
"allowedAccess": [
314+
"execute",
315+
"write_file",
316+
"read_file",
317+
"read_dir",
318+
"remove_dir",
319+
"remove_file",
320+
"make_char",
321+
"make_dir",
322+
"make_reg",
323+
"make_sock",
324+
"make_fifo",
325+
"make_block",
326+
"make_sym"
327+
],
328+
"paths": [
329+
"/tmp"
330+
]
331+
}
332+
]
333+
},
334+
"disableBestEffort": false
335+
},
261336
"noNewPrivileges": true,
262337
"capabilities": {
263338
"bounding": [
@@ -978,7 +1053,8 @@ Here is a full example `config.json` for reference.
9781053

9791054
[apparmor]: https://wiki.ubuntu.com/AppArmor
9801055
[cgroup-v1-memory_2]: https://www.kernel.org/doc/Documentation/cgroup-v1/memory.txt
981-
[selinux]:http://selinuxproject.org/page/Main_Page
1056+
[selinux]: http://selinuxproject.org/page/Main_Page
1057+
[landlock]: https://landlock.io
9821058
[no-new-privs]: https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt
9831059
[proc_2]: https://www.kernel.org/doc/Documentation/filesystems/proc.txt
9841060
[umask.2]: http://pubs.opengroup.org/onlinepubs/009695399/functions/umask.html

‎schema/config-schema.json‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -144,6 +144,20 @@
144144
"selinuxLabel": {
145145
"type": "string"
146146
},
147+
"landlock": {
148+
"type": "object",
149+
"properties": {
150+
"ruleset": {
151+
"$ref": "defs.json#/definitions/LandlockRuleset"
152+
},
153+
"rules": {
154+
"$ref": "defs.json#/definitions/LandlockRules"
155+
},
156+
"disableBestEffort": {
157+
"type": "boolean"
158+
}
159+
}
160+
},
147161
"noNewPrivileges": {
148162
"type": "boolean"
149163
},

‎schema/defs.json‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -165,6 +165,63 @@
165165
},
166166
"annotations": {
167167
"$ref": "#/definitions/mapStringString"
168+
},
169+
"LandlockFSAction": {
170+
"type": "string",
171+
"enum": [
172+
"execute",
173+
"write_file",
174+
"read_file",
175+
"read_dir",
176+
"remove_dir",
177+
"remove_file",
178+
"make_char",
179+
"make_dir",
180+
"make_reg",
181+
"make_sock",
182+
"make_fifo",
183+
"make_block",
184+
"make_sym"
185+
]
186+
},
187+
"ArrayOfLandlockFSActions": {
188+
"type": "array",
189+
"items": {
190+
"$ref": "#/definitions/LandlockFSAction"
191+
}
192+
},
193+
"LandlockRuleset": {
194+
"type": "object",
195+
"properties": {
196+
"handledAccessFS": {
197+
"$ref": "#/definitions/ArrayOfLandlockFSActions"
198+
}
199+
}
200+
},
201+
"LandlockRulePathBeneath": {
202+
"type": "object",
203+
"properties": {
204+
"allowedAccess": {
205+
"$ref": "#/definitions/ArrayOfLandlockFSActions"
206+
},
207+
"paths": {
208+
"$ref": "#/definitions/ArrayOfStrings"
209+
}
210+
}
211+
},
212+
"ArrayOfLandlockRulePathBeneaths": {
213+
"type": "array",
214+
"items": {
215+
"$ref": "#/definitions/LandlockRulePathBeneath"
216+
}
217+
},
218+
"LandlockRules": {
219+
"type": "object",
220+
"properties": {
221+
"pathBeneath": {
222+
"$ref": "#/definitions/ArrayOfLandlockRulePathBeneaths"
223+
}
224+
}
168225
}
169226
}
170227
}

‎specs-go/config.go‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,8 +62,66 @@ type Process struct {
6262
OOMScoreAdj *int `json:"oomScoreAdj,omitempty" platform:"linux"`
6363
// SelinuxLabel specifies the selinux context that the container process is run as.
6464
SelinuxLabel string `json:"selinuxLabel,omitempty" platform:"linux"`
65+
// Landlock specifies the Landlock unprivileged access control settings for the container process.
66+
// `noNewPrivileges` must be enabled to use Landlock.
67+
Landlock *Landlock `json:"landlock,omitempty" platform:"linux"`
6568
}
6669

70+
// Landlock specifies the Landlock unprivileged access control settings for the container process.
71+
type Landlock struct {
72+
// Ruleset identifies a set of rules (i.e., actions on objects) that need to be handled.
73+
Ruleset *LandlockRuleset `json:"ruleset,omitempty" platform:"linux"`
74+
// Rules are the security policies (i.e., actions allowed on objects) to be added to an existing ruleset.
75+
Rules *LandlockRules `json:"rules,omitempty" platform:"linux"`
76+
// DisableBestEffort disables the best-effort security approach for Landlock access rights.
77+
// This is for conditions when the Landlock access rights explicitly configured by the container are not
78+
// supported or available in the running kernel.
79+
// Default is false, i.e., following a best-effort security approach.
80+
DisableBestEffort bool `json:"disableBestEffort,omitempty" platform:"linux"`
81+
}
82+
83+
// LandlockRuleset identifies a set of rules (i.e., actions on objects) that need to be handled.
84+
type LandlockRuleset struct {
85+
// HandledAccessFS is a list of actions that is handled by this ruleset and should then be
86+
// forbidden if no rule explicitly allow them.
87+
HandledAccessFS []LandlockFSAction `json:"handledAccessFS,omitempty" platform:"linux"`
88+
}
89+
90+
// LandlockRules represents the security policies (i.e., actions allowed on objects).
91+
type LandlockRules struct {
92+
// PathBeneath specifies the file-hierarchy typed rules.
93+
PathBeneath []LandlockRulePathBeneath `json:"pathBeneath,omitempty" platform:"linux"`
94+
}
95+
96+
// LandlockRulePathBeneath defines the file-hierarchy typed rule that grants the access rights specified by
97+
// `AllowedAccess` to the file hierarchies under the given `Paths`.
98+
type LandlockRulePathBeneath struct {
99+
// AllowedAccess contains a list of allowed filesystem actions for the file hierarchies.
100+
AllowedAccess []LandlockFSAction `json:"allowedAccess,omitempty" platform:"linux"`
101+
// Paths are the files or parent directories of the file hierarchies to restrict.
102+
Paths []string `json:"paths,omitempty" platform:"linux"`
103+
}
104+
105+
// LandlockFSAction used to specify the FS actions that are handled by a ruleset or allowed by a rule.
106+
type LandlockFSAction string
107+
108+
// Define actions on files and directories that Landlock can restrict a sandboxed process to.
109+
const (
110+
LLFSActExecute LandlockFSAction = "execute"
111+
LLFSActWriteFile LandlockFSAction = "write_file"
112+
LLFSActReadFile LandlockFSAction = "read_file"
113+
LLFSActReadDir LandlockFSAction = "read_dir"
114+
LLFSActRemoveDir LandlockFSAction = "remove_dir"
115+
LLFSActRemoveFile LandlockFSAction = "remove_file"
116+
LLFSActMakeChar LandlockFSAction = "make_char"
117+
LLFSActMakeDir LandlockFSAction = "make_dir"
118+
LLFSActMakeReg LandlockFSAction = "make_reg"
119+
LLFSActMakeSock LandlockFSAction = "make_sock"
120+
LLFSActMakeFifo LandlockFSAction = "make_fifo"
121+
LLFSActMakeBlock LandlockFSAction = "make_block"
122+
LLFSActMakeSym LandlockFSAction = "make_sym"
123+
)
124+
67125
// LinuxCapabilities specifies the list of allowed capabilities that are kept for a process.
68126
// http://man7.org/linux/man-pages/man7/capabilities.7.html
69127
type LinuxCapabilities struct {

0 commit comments

Comments
 (0)