Skip to content

Commit 6730eb2

Browse files
kailun-qinZheaoli
kailun-qin
and
Zheaoli
committed
specs-go/config: add Landlock LSM support
Linux kernel 5.13 adds support for Landlock Linux Security Module (LSM). This allows unprivileged processes to create safe security sandboxes that can securely restrict the ambient rights (e.g. global filesystem access) for themselves. #1110 Co-authored-by: Zheao Li <me@manjusaka.me> Signed-off-by: Kailun Qin <kailun.qin@intel.com>
1 parent 68346ed commit 6730eb2

4 files changed

Lines changed: 318 additions & 2 deletions

File tree

‎config.md‎

Lines changed: 121 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -340,6 +340,52 @@ For Linux-based systems, the `process` object supports the following process-spe
340340

341341
* **`class`** (string, REQUIRED) specifies the I/O scheduling class. Possible values are `IOPRIO_CLASS_RT`, `IOPRIO_CLASS_BE`, and `IOPRIO_CLASS_IDLE`.
342342
* **`priority`** (int, REQUIRED) specifies the priority level within the class. The value should be an integer ranging from 0 (highest) to 7 (lowest).
343+
* **`landlock`** (object, OPTIONAL) specifies the Landlock unprivileged access control settings for the container process.
344+
Note that `noNewPrivileges` must be set to true to use this feature.
345+
For more information about Landlock, see [Landlock documentation][landlock].
346+
`landlock` contains the following properties:
347+
348+
* **`ruleset`** (object, OPTIONAL) the `ruleset` field identifies a set of rules (i.e., actions on objects) that need to be handled (i.e., restricted).
349+
The `ruleset` currently contains the following types:
350+
* **`handledAccessFS`** (array of strings, OPTIONAL) is an array of FS typed actions that are handled by a ruleset.
351+
If no rule explicitly allow them, they should then be forbidden.
352+
* **`handledAssessNetwork`** (array of strings, OPTIONAL) is an array of NETWORK typed actions that are handled by a ruleset. (The NETWORK typed actions are avaliable when the ABI version >= 4. the behavior of the NETWORK typed actions is not used when the ABI version is less than 4 will depend on the **`disableBestEffort`**)
353+
* **`rules`** (object, OPTIONAL) the `rules` field specifies the security policies (i.e., actions allowed on objects) to be added to an existing ruleset.
354+
The `rules` currently contains the following types:
355+
* **`pathBeneath`** (array of objects, OPTIONAL) is an array of the file-hierarchy typed rules.
356+
Entries in the array contain the following properties:
357+
* **`allowedAccess`** (array of strings, OPTIONAL) is an array of FS typed actions that are allowed by a rule. The actions are grouped by the ABI version in the following description:
358+
1. ABI version >= 1:
359+
1. exectute
360+
2. write_file
361+
3. read_file
362+
4. read_dir
363+
5. remove_dir
364+
6. remove_file
365+
7. make_char
366+
8. make_dir
367+
9. make_reg
368+
10. make_sock
369+
11. make_fifo
370+
12. make_block
371+
13. make_sym
372+
2. ABI version >= 2:
373+
1. refer
374+
3. ABI version >= 3:
375+
1. truncate
376+
* **`paths`** (array of strings, OPTIONAL) is an array of files or parent directories of the file hierarchies to restrict.
377+
* **`portBeneath`** (array of objects, OPTIONAL) is an array of the network-hierarchy typed rules.
378+
Entries in the array contain the following properties:
379+
* **`allowedAccess`** (array of strings, OPTIONAL) is an array of NETWORK typed actions that are allowed by a rule. The actions are grouped by the ABI version in the following description:
380+
1. ABI version >= 4:
381+
1. bind
382+
2. connect
383+
* **`ports`** (array of strings, OPTIONAL) is an array of network ports to restrict.
384+
* **`disableBestEffort`** (bool, OPTIONAL) the `disableBestEffort` field disables the best-effort security approach for Landlock access rights.
385+
This is for conditions when the Landlock access rights explicitly configured by the container are not supported or available in the running kernel.
386+
If the best-effort security approach is enabled (`false`), the runtime SHOULD enforce the strongest rules configured up to the current kernel support, and only be [logged as a warning](runtime.md#warnings) for those not supported.
387+
If disabled (`true`), the runtime MUST [generate an error](runtime.md#errors) if one or more rules specified by the container is not supported.
388+
Default is `false`, i.e., following a best-effort security approach.
343389

344390
### <a name="configUser" />User
345391

@@ -385,6 +431,79 @@ _Note: symbolic name for uid and gid, such as uname and gname respectively, are
385431
"class": "IOPRIO_CLASS_IDLE",
386432
"priority": 4
387433
},
434+
"landlock": {
435+
"ruleset": {
436+
"handledAccessFS": [
437+
"execute",
438+
"write_file",
439+
"read_file",
440+
"read_dir",
441+
"remove_dir",
442+
"remove_file",
443+
"make_char",
444+
"make_dir",
445+
"make_reg",
446+
"make_sock",
447+
"make_fifo",
448+
"make_block",
449+
"make_sym",
450+
"refer",
451+
"truncate"
452+
],
453+
"handledAssessNetwork": [
454+
"bind",
455+
"connect"
456+
]
457+
},
458+
"rules": {
459+
"pathBeneath": [
460+
{
461+
"allowedAccess": [
462+
"execute",
463+
"read_file",
464+
"read_dir"
465+
],
466+
"paths": [
467+
"/usr",
468+
"/bin"
469+
]
470+
},
471+
{
472+
"allowedAccess": [
473+
"execute",
474+
"write_file",
475+
"read_file",
476+
"read_dir",
477+
"remove_dir",
478+
"remove_file",
479+
"make_char",
480+
"make_dir",
481+
"make_reg",
482+
"make_sock",
483+
"make_fifo",
484+
"make_block",
485+
"make_sym"
486+
],
487+
"paths": [
488+
"/tmp"
489+
]
490+
}
491+
],
492+
"portBeneath": [
493+
{
494+
"allowedAccess": [
495+
"bind",
496+
"connect"
497+
],
498+
"ports": [
499+
80,
500+
443
501+
]
502+
}
503+
]
504+
},
505+
"disableBestEffort": false
506+
},
388507
"noNewPrivileges": true,
389508
"capabilities": {
390509
"bounding": [
@@ -1135,7 +1254,8 @@ Here is a full example `config.json` for reference.
11351254

11361255
[apparmor]: https://wiki.ubuntu.com/AppArmor
11371256
[cgroup-v1-memory_2]: https://www.kernel.org/doc/Documentation/cgroup-v1/memory.txt
1138-
[selinux]:http://selinuxproject.org/page/Main_Page
1257+
[selinux]: http://selinuxproject.org/page/Main_Page
1258+
[landlock]: https://landlock.io
11391259
[no-new-privs]: https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt
11401260
[proc_2]: https://www.kernel.org/doc/Documentation/filesystems/proc.txt
11411261
[umask.2]: http://pubs.opengroup.org/onlinepubs/009695399/functions/umask.html

‎schema/config-schema.json‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -163,6 +163,20 @@
163163
}
164164
}
165165
},
166+
"landlock": {
167+
"type": "object",
168+
"properties": {
169+
"ruleset": {
170+
"$ref": "defs.json#/definitions/LandlockRuleset"
171+
},
172+
"rules": {
173+
"$ref": "defs.json#/definitions/LandlockRules"
174+
},
175+
"disableBestEffort": {
176+
"type": "boolean"
177+
}
178+
}
179+
},
166180
"noNewPrivileges": {
167181
"type": "boolean"
168182
},

‎schema/defs.json‎

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,11 @@
4646
"minimum": 0,
4747
"maximum": 100
4848
},
49+
"port": {
50+
"type": "integer",
51+
"minimum": 0,
52+
"maximum": 65535
53+
},
4954
"mapStringString": {
5055
"type": "object",
5156
"patternProperties": {
@@ -75,6 +80,12 @@
7580
"type": "string"
7681
}
7782
},
83+
"ArrayOfPorts":{
84+
"type": "array",
85+
"items": {
86+
"$ref": "#/definitions/port"
87+
}
88+
},
7889
"FilePath": {
7990
"type": "string"
8091
},
@@ -165,6 +176,98 @@
165176
},
166177
"annotations": {
167178
"$ref": "#/definitions/mapStringString"
179+
},
180+
"LandlockFSAction": {
181+
"type": "string",
182+
"enum": [
183+
"execute",
184+
"write_file",
185+
"read_file",
186+
"read_dir",
187+
"remove_dir",
188+
"remove_file",
189+
"make_char",
190+
"make_dir",
191+
"make_reg",
192+
"make_sock",
193+
"make_fifo",
194+
"make_block",
195+
"make_sym",
196+
"refer",
197+
"truncate"
198+
]
199+
},
200+
"LandlockNetworkAction": {
201+
"type": "string",
202+
"enum": [
203+
"bind",
204+
"connect"
205+
]
206+
},
207+
"ArrayOfLandlockFSActions": {
208+
"type": "array",
209+
"items": {
210+
"$ref": "#/definitions/LandlockFSAction"
211+
}
212+
},
213+
"ArrayOfLandlockNetworkActions": {
214+
"type": "array",
215+
"items": {
216+
"$ref": "#/definitions/LandlockNetworkAction"
217+
}
218+
},
219+
"LandlockRuleset": {
220+
"type": "object",
221+
"properties": {
222+
"handledAccessFS": {
223+
"$ref": "#/definitions/ArrayOfLandlockFSActions"
224+
},
225+
"handledAssessNetwork": {
226+
"$ref": "#/definitions/ArrayOfLandlockNetworkActions"
227+
}
228+
}
229+
},
230+
"LandlockRulePathBeneath": {
231+
"type": "object",
232+
"properties": {
233+
"allowedAccess": {
234+
"$ref": "#/definitions/ArrayOfLandlockFSActions"
235+
},
236+
"paths": {
237+
"$ref": "#/definitions/ArrayOfStrings"
238+
}
239+
}
240+
},
241+
"LandlockRulePortBeneath": {
242+
"type": "object",
243+
"properties": {
244+
"allowedAccess": {
245+
"$ref": "#/definitions/ArrayOfLandlockNetworkActions"
246+
},
247+
"paths": {
248+
"$ref": "#/definitions/ArrayOfPorts"
249+
}
250+
}
251+
},
252+
"ArrayOfLandlockRulePathBeneaths": {
253+
"type": "array",
254+
"items": {
255+
"$ref": "#/definitions/LandlockRulePathBeneath"
256+
}
257+
},
258+
"ArrayOfLandlockRulePortBeneaths": {
259+
"type": "array",
260+
"items": {
261+
"$ref": "#/definitions/LandlockRulePortBeneath"
262+
}
263+
},
264+
"LandlockRules": {
265+
"type": "object",
266+
"properties": {
267+
"pathBeneath": {
268+
"$ref": "#/definitions/ArrayOfLandlockRulePathBeneaths"
269+
}
270+
}
168271
}
169272
}
170273
}

‎specs-go/config.go‎

Lines changed: 80 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,86 @@ type Process struct {
9494
SelinuxLabel string `json:"selinuxLabel,omitempty" platform:"linux"`
9595
// IOPriority contains the I/O priority settings for the cgroup.
9696
IOPriority *LinuxIOPriority `json:"ioPriority,omitempty" platform:"linux"`
97-
}
97+
// Landlock specifies the Landlock unprivileged access control settings for the container process.
98+
// `noNewPrivileges` must be enabled to use Landlock.
99+
Landlock *Landlock `json:"landlock,omitempty" platform:"linux"`
100+
}
101+
102+
// Landlock specifies the Landlock unprivileged access control settings for the container process.
103+
type Landlock struct {
104+
// Ruleset identifies a set of rules (i.e., actions on objects) that need to be handled.
105+
Ruleset *LandlockRuleset `json:"ruleset,omitempty" platform:"linux"`
106+
// Rules are the security policies (i.e., actions allowed on objects) to be added to an existing ruleset.
107+
Rules *LandlockRules `json:"rules,omitempty" platform:"linux"`
108+
// DisableBestEffort disables the best-effort security approach for Landlock access rights.
109+
// This is for conditions when the Landlock access rights explicitly configured by the container are not
110+
// supported or available in the running kernel.
111+
// Default is false, i.e., following a best-effort security approach.
112+
DisableBestEffort bool `json:"disableBestEffort,omitempty" platform:"linux"`
113+
}
114+
115+
// LandlockRuleset identifies a set of rules (i.e., actions on objects) that need to be handled.
116+
type LandlockRuleset struct {
117+
// HandledAccessFS is a list of actions that is handled by this ruleset and should then be
118+
// forbidden if no rule explicitly allow them.
119+
HandledAccessFS []LandlockFSAction `json:"handledAccessFS,omitempty" platform:"linux"`
120+
// HandledAccessNetwork is a list of actions that is handled by this ruleset and should then be
121+
// forbidden if no rule explicitly allow them.
122+
HandledAccessNetwork []LandlockNetworkAction `json:"handledAccessNetwork,omitempty" platform:"linux"`
123+
}
124+
125+
// LandlockRules represents the security policies (i.e., actions allowed on objects).
126+
type LandlockRules struct {
127+
// PathBeneath specifies the file-hierarchy typed rules.
128+
PathBeneath []LandlockRulePathBeneath `json:"pathBeneath,omitempty" platform:"linux"`
129+
// PortBeneath specifies the network-socket typed rules.
130+
PortBeneath []LandlockRulePortBeneath `json:"portBeneath,omitempty" platform:"linux"`
131+
}
132+
133+
// LandlockRulePathBeneath defines the file-hierarchy typed rule that grants the access rights specified by
134+
// `AllowedAccess` to the file hierarchies under the given `Paths`.
135+
type LandlockRulePathBeneath struct {
136+
// AllowedAccess contains a list of allowed filesystem actions for the file hierarchies.
137+
AllowedAccess []LandlockFSAction `json:"allowedAccess,omitempty" platform:"linux"`
138+
// Paths are the files or parent directories of the file hierarchies to restrict.
139+
Paths []string `json:"paths,omitempty" platform:"linux"`
140+
}
141+
142+
type LandlockRulePortBeneath struct {
143+
// AllowedAccess contains a list of allowed network actions for the network sockets.
144+
AllowedAccess []LandlockNetworkAction `json:"allowedAccess,omitempty" platform:"linux"`
145+
// Ports are the network ports to restrict.
146+
Ports []string `json:"ports,omitempty" platform:"linux"`
147+
}
148+
149+
// LandlockFSAction used to specify the FS actions that are handled by a ruleset or allowed by a rule.
150+
type LandlockFSAction string
151+
152+
// Define actions on files and directories that Landlock can restrict a sandboxed process to.
153+
const (
154+
LLFSActExecute LandlockFSAction = "execute"
155+
LLFSActWriteFile LandlockFSAction = "write_file"
156+
LLFSActReadFile LandlockFSAction = "read_file"
157+
LLFSActReadDir LandlockFSAction = "read_dir"
158+
LLFSActRemoveDir LandlockFSAction = "remove_dir"
159+
LLFSActRemoveFile LandlockFSAction = "remove_file"
160+
LLFSActMakeChar LandlockFSAction = "make_char"
161+
LLFSActMakeDir LandlockFSAction = "make_dir"
162+
LLFSActMakeReg LandlockFSAction = "make_reg"
163+
LLFSActMakeSock LandlockFSAction = "make_sock"
164+
LLFSActMakeFifo LandlockFSAction = "make_fifo"
165+
LLFSActMakeBlock LandlockFSAction = "make_block"
166+
LLFSActMakeSym LandlockFSAction = "make_sym"
167+
LLFSActRefer LandlockFSAction = "refer"
168+
LLFSActTruncate LandlockFSAction = "truncate"
169+
)
170+
171+
type LandlockNetworkAction string
172+
173+
const (
174+
LLNetworkActConnect LandlockNetworkAction = "connect"
175+
LLNetworkActBind LandlockNetworkAction = "bind"
176+
)
98177

99178
// LinuxCapabilities specifies the list of allowed capabilities that are kept for a process.
100179
// http://man7.org/linux/man-pages/man7/capabilities.7.html

0 commit comments

Comments
 (0)