Repository navigation
Landlock pr1 api v1.1 - #16375
Landlock pr1 api v1.1#16375regit wants to merge 5 commits into
Conversation
The landlock read and write path helpers were static and only usable from the sandboxing function itself. Rename them to the SC prefixed public API and declare them in the header so that other parts of the engine, and later plugins and output modules, can declare the paths they need before the sandbox is enforced. The ruleset is passed as an opaque void pointer to avoid exposing the landlock internal structure to callers, and the helpers are no-op when landlock is not available so they can be called unconditionally. Ticket: 8606
Landlock gained network access control in ABI version 4 (Linux 6.7), allowing to restrict TCP bind and connect to a set of ports. Handle the network access rights in the ruleset and add two helpers, SCLandlockGrantNetBindTCP() and SCLandlockGrantNetConnectTCP(), so that the components needing to bind or connect a socket can declare the port they use before the sandbox is enforced. The ABI check is turned into a switch as the number of features depending on the kernel version is growing: the network access rights are removed from the ruleset when running on a kernel with an ABI lower than 4. Ticket: 8606
Recent kernels added filesystem access rights that were not handled by the ruleset: LANDLOCK_ACCESS_FS_TRUNCATE (ABI 3), IOCTL_DEV (ABI 5) and RESOLVE_UNIX (ABI 9). As they are not part of the handled access, they were simply allowed, weakening the sandbox. Add them to the write access set and extend the ABI switch to remove the ones that are not known by the running kernel. Asking for an access right the kernel does not know makes the ruleset creation fail, so a missing case here would disable the sandbox instead of loosening it. Ticket: 8606
As the plugin may not implement correctly landlock, user has a way to override the configuration. Ticket: 8606
struct landlock_ruleset_attr gained the scoped field in Linux 6.12 (Landlock ABI 6) and handled_access_net in Linux 6.7 (ABI 4). Missing constants can be defined by hand, a struct member cannot, so both need their own configure check and the code using them has to be guarded. Ticket: 8606
suricata-review-bot
left a comment
suricata-review-bot
left a comment
There was a problem hiding this comment.
AI-generated review.
Verdict: changes requested
3 findings posted as inline comments:
- High —
src/util-landlock.c:102-104— The fallback value forLANDLOCK_ACCESS_FS_RESOLVE_UNIXis(1ULL << 18), but the kernel UAPI defines it as(1ULL << 16). - High —
src/util-landlock.c:120-121— TRUNCATE, IOCTL_DEV and RESOLVE_UNIX are now handled, but_LANDLOCK_SURI_ACCESS_FS_WRITEand the data-dir rule never grant them, so they… - Medium —
src/util-landlock.c:152-154— On ABI ≥ 4 kernels (Linux 6.7+), handling network rights denies every TCP connect and bind after sandboxing, and no component grants any…
Automated at commit 0dc246a9e596 using Claude Code with claude-opus-5-5/xhigh. Run: a442ee84465240d8.
| #ifndef LANDLOCK_ACCESS_FS_RESOLVE_UNIX | ||
| #define LANDLOCK_ACCESS_FS_RESOLVE_UNIX (1ULL << 18) | ||
| #endif |
There was a problem hiding this comment.
High — The fallback value for LANDLOCK_ACCESS_FS_RESOLVE_UNIX is (1ULL << 18), but the kernel UAPI defines it as (1ULL << 16). Consider a build against headers older than Landlock ABI 9 that runs on an ABI ≥ 9 kernel. Bit 18 stays in handled_access_fs, so landlock_create_ruleset() fails with EINVAL and Suricata runs with no sandbox. The same setup is sandboxed today. Use (1ULL << 16).
| LANDLOCK_ACCESS_FS_REFER | LANDLOCK_ACCESS_FS_TRUNCATE | \ | ||
| LANDLOCK_ACCESS_FS_IOCTL_DEV | LANDLOCK_ACCESS_FS_RESOLVE_UNIX) |
There was a problem hiding this comment.
High — TRUNCATE, IOCTL_DEV and RESOLVE_UNIX are now handled, but _LANDLOCK_SURI_ACCESS_FS_WRITE and the data-dir rule never grant them, so they are denied everywhere. On Linux ≥ 6.2, DatasetsSave() calls fopen(set->save, "w") on the existing state file. That open fails with EACCES, so dataset state is silently lost at shutdown. On ABI ≥ 9, EVE unix-socket and Redis unix reconnects are denied. Grant TRUNCATE and RESOLVE_UNIX where needed, as Redmine #8606 asks, or hold off handling these rights.
| #ifdef HAVE_LANDLOCK_RULESET_ATTR_HANDLED_ACCESS_NET | ||
| ruleset->attr.handled_access_net = _LANDLOCK_ACCESS_NET; | ||
| #endif |
There was a problem hiding this comment.
Medium — On ABI ≥ 4 kernels (Linux 6.7+), handling network rights denies every TCP connect and bind after sandboxing, and no component grants any port. Redis output reconnects fail after a Redis restart. In unix-socket runmode, outputs are opened after sandboxing, so a TCP Redis output never connects. The only workaround is the new security.landlock.network.{connect,bind}.tcp keys, which landlock.rst and suricata.yaml.in do not document. Grant the configured output ports or defer network handling, and document the keys.
victorjulien
left a comment
victorjulien
left a comment
There was a problem hiding this comment.
CI failures + the AI review needs a look.
3 participants
First part of #16005 introducing support for new Landlock features.
Contribution style:
https://docs.suricata.io/en/latest/devguide/contributing/contribution-process.html
Our Contribution agreements:
https://suricata.io/about/contribution-agreement/ (note: this is only required once)
Changes (if applicable):
(including schema descriptions)
https://redmine.openinfosecfoundation.org/projects/suricata/issues
Link to ticket: https://redmine.openinfosecfoundation.org/issues/8606
Describe changes: