From nobody Tue Nov 26 04:48:23 2024 Received: from smtp-42af.mail.infomaniak.ch (smtp-42af.mail.infomaniak.ch [84.16.66.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4A0E51AD5DE for ; Tue, 22 Oct 2024 16:10:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=84.16.66.175 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729613432; cv=none; b=uWT3dAXTN+a12FNVq0aSmdMOxF7QHuL5IDGbUvhJVjqCB2PnDIUZrsIDpXSKYIU4mosIJoJ21ixn8m++IasRcrQ4B9+GE4GZAQcr9KVcMotgjYpOTOH9ZH9bxCP0n52pIdUHt3j2JD2+/6ymqCQSw1Lkc+XiArVjlvAVqlLkA/U= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729613432; c=relaxed/simple; bh=4GeYmW8FVXAUclTZ3wGNsCun2WpzvRZ0cA3FW8mmcv0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=hh3ppMlv1Dlg8VfOIGh8/NNQ/aR0+OQV+QWq5dtGF7gh/5foI2gmge9FteZVZ3i+k2h5uIu8rZzmjN8X6pjfeOx+RwOJLqP1RxhXk/5R67/C83Hr9BqByfOJ2jeJgHs/vpuZ8MBXtCSkwwVd0cIIRXazfK1AmPVKk9BPv5uTFlM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=digikod.net; spf=pass smtp.mailfrom=digikod.net; dkim=pass (1024-bit key) header.d=digikod.net header.i=@digikod.net header.b=hqg/nHDt; arc=none smtp.client-ip=84.16.66.175 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=digikod.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=digikod.net Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=digikod.net header.i=@digikod.net header.b="hqg/nHDt" Received: from smtp-4-0000.mail.infomaniak.ch (unknown [IPv6:2001:1600:7:10:40ca:feff:fe05:0]) by smtp-4-3000.mail.infomaniak.ch (Postfix) with ESMTPS id 4XXxwg1mywz183d; Tue, 22 Oct 2024 18:10:27 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=digikod.net; s=20191114; t=1729613427; bh=6kguhd2Vr+s/85Nr2Op6lj+yU1Ns4KOpTtVIwEiojB0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hqg/nHDtE3nSVjsQExu2OEaru4HgWI7eE5n/kPq9/gNUbIDkSz1H2vMDRy5HhGAwr giUL3xeELgunfjKJCySCZx3vR/OPYoCLONd8OBrj0qYX4kIZT4er5d7NAj0DGNWODt W2WVvHjB934JPNV6LkaDyjyghIX1XaYudUeZfuAg= Received: from unknown by smtp-4-0000.mail.infomaniak.ch (Postfix) with ESMTPA id 4XXxwf3DYyzwwl; Tue, 22 Oct 2024 18:10:26 +0200 (CEST) From: =?UTF-8?q?Micka=C3=ABl=20Sala=C3=BCn?= To: Eric Paris , Paul Moore , =?UTF-8?q?G=C3=BCnther=20Noack?= , "Serge E . Hallyn" Cc: =?UTF-8?q?Micka=C3=ABl=20Sala=C3=BCn?= , Ben Scarlato , Casey Schaufler , Charles Zaffery , James Morris , Jann Horn , Jeff Xu , Jorge Lucangeli Obes , Kees Cook , Konstantin Meskhidze , Matt Bobrowski , Mikhail Ivanov , Praveen K Paladugu , Robert Salvet , Shervin Oloumi , Song Liu , Tahera Fahimi , audit@vger.kernel.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org Subject: [RFC PATCH v2 06/14] landlock: Move domain hierarchy management Date: Tue, 22 Oct 2024 18:10:01 +0200 Message-ID: <20241022161009.982584-7-mic@digikod.net> In-Reply-To: <20241022161009.982584-1-mic@digikod.net> References: <20241022161009.982584-1-mic@digikod.net> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Infomaniak-Routing: alpha Create a new domain.h file containing the struct landlock_hierarchy definition and helpers. This type will grow with audit support. This also prepares for a new domain type. Cc: G=C3=BCnther Noack Signed-off-by: Micka=C3=ABl Sala=C3=BCn Link: https://lore.kernel.org/r/20241022161009.982584-7-mic@digikod.net --- Changes since v1: * New patch. --- security/landlock/domain.h | 48 +++++++++++++++++++++++++++++++++++++ security/landlock/ruleset.c | 21 +++------------- security/landlock/ruleset.h | 17 +------------ security/landlock/task.c | 1 + 4 files changed, 53 insertions(+), 34 deletions(-) create mode 100644 security/landlock/domain.h diff --git a/security/landlock/domain.h b/security/landlock/domain.h new file mode 100644 index 000000000000..015d61fd81ec --- /dev/null +++ b/security/landlock/domain.h @@ -0,0 +1,48 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +/* + * Landlock LSM - Domain management + * + * Copyright =C2=A9 2016-2020 Micka=C3=ABl Sala=C3=BCn + * Copyright =C2=A9 2018-2020 ANSSI + */ + +#ifndef _SECURITY_LANDLOCK_DOMAIN_H +#define _SECURITY_LANDLOCK_DOMAIN_H + +#include +#include + +/** + * struct landlock_hierarchy - Node in a domain hierarchy + */ +struct landlock_hierarchy { + /** + * @parent: Pointer to the parent node, or NULL if it is a root + * Landlock domain. + */ + struct landlock_hierarchy *parent; + /** + * @usage: Number of potential children domains plus their parent + * domain. + */ + refcount_t usage; +}; + +static inline void +landlock_get_hierarchy(struct landlock_hierarchy *const hierarchy) +{ + if (hierarchy) + refcount_inc(&hierarchy->usage); +} + +static inline void landlock_put_hierarchy(struct landlock_hierarchy *hiera= rchy) +{ + while (hierarchy && refcount_dec_and_test(&hierarchy->usage)) { + const struct landlock_hierarchy *const freeme =3D hierarchy; + + hierarchy =3D hierarchy->parent; + kfree(freeme); + } +} + +#endif /* _SECURITY_LANDLOCK_DOMAIN_H */ diff --git a/security/landlock/ruleset.c b/security/landlock/ruleset.c index a93bdbf52fff..57cb7dcd6333 100644 --- a/security/landlock/ruleset.c +++ b/security/landlock/ruleset.c @@ -20,6 +20,7 @@ #include #include =20 +#include "domain.h" #include "limits.h" #include "object.h" #include "ruleset.h" @@ -304,22 +305,6 @@ int landlock_insert_rule(struct landlock_ruleset *cons= t ruleset, return insert_rule(ruleset, id, &layers, ARRAY_SIZE(layers)); } =20 -static void get_hierarchy(struct landlock_hierarchy *const hierarchy) -{ - if (hierarchy) - refcount_inc(&hierarchy->usage); -} - -static void put_hierarchy(struct landlock_hierarchy *hierarchy) -{ - while (hierarchy && refcount_dec_and_test(&hierarchy->usage)) { - const struct landlock_hierarchy *const freeme =3D hierarchy; - - hierarchy =3D hierarchy->parent; - kfree(freeme); - } -} - static int merge_tree(struct landlock_ruleset *const dst, struct landlock_ruleset *const src, const enum landlock_key_type key_type) @@ -473,7 +458,7 @@ static int inherit_ruleset(struct landlock_ruleset *con= st parent, err =3D -EINVAL; goto out_unlock; } - get_hierarchy(parent->hierarchy); + landlock_get_hierarchy(parent->hierarchy); child->hierarchy->parent =3D parent->hierarchy; =20 out_unlock: @@ -497,7 +482,7 @@ static void free_ruleset(struct landlock_ruleset *const= ruleset) free_rule(freeme, LANDLOCK_KEY_NET_PORT); #endif /* IS_ENABLED(CONFIG_INET) */ =20 - put_hierarchy(ruleset->hierarchy); + landlock_put_hierarchy(ruleset->hierarchy); kfree(ruleset); } =20 diff --git a/security/landlock/ruleset.h b/security/landlock/ruleset.h index 7921bbe01344..d0a60a5f7cd9 100644 --- a/security/landlock/ruleset.h +++ b/security/landlock/ruleset.h @@ -18,6 +18,7 @@ #include =20 #include "access.h" +#include "domain.h" #include "limits.h" #include "object.h" =20 @@ -119,22 +120,6 @@ struct landlock_rule { struct landlock_layer layers[] __counted_by(num_layers); }; =20 -/** - * struct landlock_hierarchy - Node in a ruleset hierarchy - */ -struct landlock_hierarchy { - /** - * @parent: Pointer to the parent node, or NULL if it is a root - * Landlock domain. - */ - struct landlock_hierarchy *parent; - /** - * @usage: Number of potential children domains plus their parent - * domain. - */ - refcount_t usage; -}; - /** * struct landlock_ruleset - Landlock ruleset * diff --git a/security/landlock/task.c b/security/landlock/task.c index e7f45af87ff5..23b56b3772c6 100644 --- a/security/landlock/task.c +++ b/security/landlock/task.c @@ -18,6 +18,7 @@ =20 #include "common.h" #include "cred.h" +#include "domain.h" #include "fs.h" #include "ruleset.h" #include "setup.h" --=20 2.47.0