Hello!
This patch set makes it possible to restrict MPTCP bind(2) and
connect(2) operations by port, adding the access rights
LANDLOCK_ACCESS_NET_BIND_MPTCP and LANDLOCK_ACCESS_NET_CONNECT_MPTCP.
Motivation
==========
With MPTCP operations being unrestrictable, some aspects of Landlock's
existing TCP restrictions were not useful. Notably, bind(2) and
listen(2) on MPTCP sockets was possible, sidestepping a bind(2)
restriction that might exist for plain TCP sockets. This patch set
fixes that gap by restricting bind(2) and connect(2) operations in the
same way as for TCP.
As listening on MPTCP sockets is backwards compatible with plain TCP,
it has gained more support and has become the default in common
networking libraries such as Go's net.Listen() function since Go 1.24
[1].
Historical background
=====================
In the initial implementation, Landlock's TCP bind(2) and connect(2)
access rights worked on IP stream ports independent of their protocol
as specified in socket(2). This was corrected in Landlock erratum 1
in commit 854277e2cc8c ("landlock: Fix non-TCP sockets restriction")
[2] [3], but also meant that MPTCP sockets were now not restrictable with
Landlock any more, even though MPTCP operates on the same TCP ports as
plain TCP.
That MPTCP should often be treated the same as plain TCP was also
pointed out in [4] and [5].
Implementation notes
====================
* The tests are an extension of the existing exhaustive TCP/UDP
selftest coverage.
* MPTCP subflows are separate connections with their own port numbers.
As it is the Linux kernel which negotiates these ports with the
remote system, the ports used in subflows are not subject to this
Landlock restriction.
* MPTCP Fast Open is treated the same as for TCP.
Apart from these, MPTCP support is a relatively straightforward
implementation, mirroring the TCP logic in most places.
Alternatives considered
=======================
Making MPTCP sockets subject to "plain TCP" Landlock access rights is
technically feasible, but would undo erratum 1 [3], which could be
confusing to users and might introduce potential incompatibilities
with existing programs.
Open questions
==============
I am on the edge about the helper functions that I added to the
selftests; maybe would be better to flatten these decisions out into
the fixture data for improved clarity and to not run the risk of
reimplementing the same code that we want to test.
Let me know what you think!
–Günther
[1] https://go.dev/doc/go1.24#netpkgnet
[2] commit 854277e2cc8c ("landlock: Fix non-TCP sockets restriction")
https://lore.kernel.org/r/20250205093651.1424339-2-ivanov.mikhail1@huawei-partners.com
[3] Landlock erratum 1, security/landlock/errata/abi-4.h
[4] https://lore.kernel.org/all/49bc2227-d8e1-4233-8bc4-4c2f0a191b7c@kernel.org/
[5] https://lore.kernel.org/all/1d1d58b3-2516-4fc8-9f9a-b10604bbe05b@kernel.org/
Günther Noack (6):
samples/landlock: Implement best-effort fallback for network rules.
selftests/landlock: Generalize net test helpers for multiple socket
types
landlock: Add MPTCP bind and connect access rights
selftests/landlock: Add MPTCP network access tests
samples/landlock: Support MPTCP access rights
landlock: Document MPTCP access rights
Documentation/userspace-api/landlock.rst | 27 +-
include/linux/landlock.h | 5 +-
include/uapi/linux/landlock.h | 24 ++
samples/landlock/sandboxer.c | 72 +++-
security/landlock/limits.h | 2 +-
security/landlock/net.c | 68 ++--
security/landlock/syscalls.c | 2 +-
tools/testing/selftests/landlock/base_test.c | 2 +-
tools/testing/selftests/landlock/net_test.c | 341 ++++++++++++++-----
9 files changed, 425 insertions(+), 118 deletions(-)
--
2.55.0