Skip to content

Commit 01a9796

Browse files
kailun-qinkailun-qin
committed
Address review comments
* Use an object with rule-type keys instead of an array of rules with specific types to make configuration lighter. * Simplify the access rights consts as they are scoped and typed by the `LandlockFSAction`. * Update some field comments and add elaborations on the usage of `abi` etc. * Misc minor fixes. Signed-off-by: Kailun Qin <[email protected]>
1 parent 0257e77 commit 01a9796

File tree

2 files changed

+74
-75
lines changed

2 files changed

+74
-75
lines changed

‎config.md

Lines changed: 48 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -213,12 +213,22 @@ For Linux-based systems, the `process` object supports the following process-spe
213213
* **`selinuxLabel`** (string, OPTIONAL) specifies the SELinux label for the process.
214214
For more information about SELinux, see [SELinux documentation][selinux].
215215
* **`landlock`** (object, OPTIONAL) specifies the Landlock unprivileged access control settings for the container process.
216+
Note that `noNewPrivileges` must be set to true to use this feature.
216217
For more information about Landlock, see [Landlock documentation][landlock].
217218
`landlock` contains the following properties:
218219

219220
* **`ruleset`** (object, OPTIONAL) the `ruleset` field identifies a set of rules (i.e., actions on objects) that need to be handled (i.e., restricted).
220-
* **`rules`** (array of objects, OPTIONAL) the `rules` field specifies the security policies (i.e., actions allowed on objects) to be added to an existing ruleset
221+
The `ruleset` currently contains the following types:
222+
* **`handledAccessFS`** (array of strings, OPTIONAL) is an array of FS typed actions that are handled by a ruleset.
223+
If no rule explicitly allow them, they should then be forbidden.
224+
* **`rules`** (object, OPTIONAL) the `rules` field specifies the security policies (i.e., actions allowed on objects) to be added to an existing ruleset.
225+
The `rules` currently contains the following types:
226+
* **`pathBeneath`** (array of objects, OPTIONAL) is an array of the file-hierarchy typed rules.
227+
Entries in the array contain the following properties:
228+
* **`allowedAccess`** (array of strings, OPTIONAL) is an array of FS typed actions that are allowed by a rule.
229+
* **`paths`** (array of strings, OPTIONAL) is an array of files or parent directories of the file hierarchies to restrict.
221230
* **`abi`** (object, OPTIONAL) the `abi` field defines the specific Landlock ABI version.
231+
This should be used by the runtime to check if the kernel supports the specified sets of Landlock features and then enforce those following a best-effort security approach.
222232

223233
### <a name="configUser" />User
224234

@@ -262,61 +272,57 @@ _Note: symbolic name for uid and gid, such as uname and gname respectively, are
262272
"selinuxLabel": "system_u:system_r:svirt_lxc_net_t:s0:c124,c675",
263273
"landlock": {
264274
"ruleset": {
265-
"handledAcessFS": [
266-
"LANDLOCK_ACCESS_FS_EXECUTE",
267-
"LANDLOCK_ACCESS_FS_WRITE_FILE",
268-
"LANDLOCK_ACCESS_FS_READ_FILE",
269-
"LANDLOCK_ACCESS_FS_READ_DIR",
270-
"LANDLOCK_ACCESS_FS_REMOVE_DIR",
271-
"LANDLOCK_ACCESS_FS_REMOVE_FILE",
272-
"LANDLOCK_ACCESS_FS_MAKE_CHAR",
273-
"LANDLOCK_ACCESS_FS_MAKE_DIR",
274-
"LANDLOCK_ACCESS_FS_MAKE_REG",
275-
"LANDLOCK_ACCESS_FS_MAKE_SOCK",
276-
"LANDLOCK_ACCESS_FS_MAKE_FIFO",
277-
"LANDLOCK_ACCESS_FS_MAKE_BLOCK",
278-
"LANDLOCK_ACCESS_FS_MAKE_SYM"
275+
"handledAccessFS": [
276+
"execute",
277+
"write_file",
278+
"read_file",
279+
"read_dir",
280+
"remove_dir",
281+
"remove_file",
282+
"make_char",
283+
"make_dir",
284+
"make_reg",
285+
"make_sock",
286+
"make_fifo",
287+
"make_block",
288+
"make_sym"
279289
]
280290
},
281-
"rules": [
282-
{
283-
"type": "path_beneath",
284-
"restrictPaths": {
291+
"rules": {
292+
"pathBeneath": [
293+
{
285294
"allowedAccess": [
286-
"LANDLOCK_ACCESS_FS_EXECUTE",
287-
"LANDLOCK_ACCESS_FS_READ_FILE",
288-
"LANDLOCK_ACCESS_FS_READ_DIR"
295+
"execute",
296+
"read_file",
297+
"read_dir"
289298
],
290299
"paths": [
291300
"/usr",
292301
"/bin"
293302
]
294-
}
295-
},
296-
{
297-
"type": "path_beneath",
298-
"restrictPaths": {
303+
},
304+
{
299305
"allowedAccess": [
300-
"LANDLOCK_ACCESS_FS_EXECUTE",
301-
"LANDLOCK_ACCESS_FS_WRITE_FILE",
302-
"LANDLOCK_ACCESS_FS_READ_FILE",
303-
"LANDLOCK_ACCESS_FS_READ_DIR",
304-
"LANDLOCK_ACCESS_FS_REMOVE_DIR",
305-
"LANDLOCK_ACCESS_FS_REMOVE_FILE",
306-
"LANDLOCK_ACCESS_FS_MAKE_CHAR",
307-
"LANDLOCK_ACCESS_FS_MAKE_DIR",
308-
"LANDLOCK_ACCESS_FS_MAKE_REG",
309-
"LANDLOCK_ACCESS_FS_MAKE_SOCK",
310-
"LANDLOCK_ACCESS_FS_MAKE_FIFO",
311-
"LANDLOCK_ACCESS_FS_MAKE_BLOCK",
312-
"LANDLOCK_ACCESS_FS_MAKE_SYM"
306+
"execute",
307+
"write_file",
308+
"read_file",
309+
"read_dir",
310+
"remove_dir",
311+
"remove_file",
312+
"make_char",
313+
"make_dir",
314+
"make_reg",
315+
"make_sock",
316+
"make_fifo",
317+
"make_block",
318+
"make_sym"
313319
],
314320
"paths": [
315321
"/tmp"
316322
]
317323
}
318-
},
319-
],
324+
]
325+
},
320326
"abi": "v1"
321327
},
322328
"noNewPrivileges": true,

‎specs-go/config.go

Lines changed: 26 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -59,37 +59,38 @@ type Process struct {
5959
// SelinuxLabel specifies the selinux context that the container process is run as.
6060
SelinuxLabel string `json:"selinuxLabel,omitempty" platform:"linux"`
6161
// Landlock specifies the Landlock unprivileged access control settings for the container process.
62-
Landlock Landlock `json:"landlock,omitempty" platform:"linux"`
62+
// `noNewPrivileges` must be enabled to use Landlock.
63+
Landlock *Landlock `json:"landlock,omitempty" platform:"linux"`
6364
}
6465

6566
// Landlock specifies the Landlock unprivileged access control settings for the container process.
6667
type Landlock struct {
6768
// Ruleset identifies a set of rules (i.e., actions on objects) that need to be handled.
68-
Ruleset LandlockRuleset `json:"ruleset,omitempty" platform:"linux"`
69+
Ruleset *LandlockRuleset `json:"ruleset,omitempty" platform:"linux"`
6970
// Rules are the security policies (i.e., actions allowed on objects) to be added to an existing ruleset.
70-
Rules []LandlockRule `json:"rules,omitempty" platform:"linux"`
71+
Rules *LandlockRules `json:"rules,omitempty" platform:"linux"`
7172
// ABI is the specific Landlock ABI version.
73+
// This should be used by the runtime to check if the kernel supports the specified sets of Landlock
74+
// features and then enforce those following a best-effort security approach.
7275
ABI LandlockABIVersion `json:"abi,omitempty" platform:"linux"`
7376
}
7477

7578
// LandlockRuleset identifies a set of rules (i.e., actions on objects) that need to be handled.
7679
type LandlockRuleset struct {
7780
// HandledAccessFS is a list of actions that is handled by this ruleset and should then be
7881
// forbidden if no rule explicitly allow them.
79-
HandledAccessFS []LandlockFSAction `json:"handledAcessFS,omitempty" platform:"linux"`
82+
HandledAccessFS []LandlockFSAction `json:"handledAccessFS,omitempty" platform:"linux"`
8083
}
8184

82-
// LandlockRule represents the security policies (i.e., actions allowed on objects) .
83-
type LandlockRule struct {
84-
// Type is the Landlock rule type pointing to the rules to be added to an existing ruleset.
85-
Type LandlockRuleType `json:"type,omitempty" platform:"linux"`
86-
// RestrictPaths defines the file-hierarchy typed rule.
87-
RestrictPaths LandlockRestrictPaths `json:"restrictPaths,omitempty" platform:"linux"`
85+
// LandlockRules represents the security policies (i.e., actions allowed on objects).
86+
type LandlockRules struct {
87+
// PathBeneath specifies the file-hierarchy typed rules.
88+
PathBeneath []LandlockRulePathBeneath `json:"pathBeneath,omitempty" platform:"linux"`
8889
}
8990

90-
// LandlockRestrictPaths defines the file-hierarchy typed rule that grants the access rights specified by
91+
// LandlockRulePathBeneath defines the file-hierarchy typed rule that grants the access rights specified by
9192
// `AllowedAccess` to the file hierarchies under the given `Paths`.
92-
type LandlockRestrictPaths struct {
93+
type LandlockRulePathBeneath struct {
9394
// AllowedAccess contains a list of allowed filesystem actions for the file hierarchies.
9495
AllowedAccess []LandlockFSAction `json:"allowedAccess,omitempty" platform:"linux"`
9596
// Paths are the files or parent directories of the file hierarchies to restrict.
@@ -104,32 +105,24 @@ const (
104105
V1 LandlockABIVersion = "v1"
105106
)
106107

107-
// LandlockRuleType taken upon adding a new Landlock rule to a ruleset.
108-
type LandlockRuleType string
109-
110-
// Define types for Landlock rules. There is currently only one Landlock rule type.
111-
const (
112-
PathBeneath LandlockRuleType = "path_beneath"
113-
)
114-
115108
// LandlockFSAction used to specify the FS actions that are handled by a ruleset or allowed by a rule.
116109
type LandlockFSAction string
117110

118111
// Define actions on files and directories that Landlock can restrict a sandboxed process to.
119112
const (
120-
FSActExecute LandlockFSAction = "LANDLOCK_ACCESS_FS_EXECUTE"
121-
FSActWriteFile LandlockFSAction = "LANDLOCK_ACCESS_FS_WRITE_FILE"
122-
FSActReadFile LandlockFSAction = "LANDLOCK_ACCESS_FS_READ_FILE"
123-
FSActReadDir LandlockFSAction = "LANDLOCK_ACCESS_FS_READ_DIR"
124-
FSActRemoveDir LandlockFSAction = "LANDLOCK_ACCESS_FS_REMOVE_DIR"
125-
FSActRemoveFile LandlockFSAction = "LANDLOCK_ACCESS_FS_REMOVE_FILE"
126-
FSActMakeChar LandlockFSAction = "LANDLOCK_ACCESS_FS_MAKE_CHAR"
127-
FSActMakeDir LandlockFSAction = "LANDLOCK_ACCESS_FS_MAKE_DIR"
128-
FSActMakeReg LandlockFSAction = "LANDLOCK_ACCESS_FS_MAKE_REG"
129-
FSActMakeSock LandlockFSAction = "LANDLOCK_ACCESS_FS_MAKE_SOCK"
130-
FSActMakeFifo LandlockFSAction = "LANDLOCK_ACCESS_FS_MAKE_FIFO"
131-
FSActMakeBlock LandlockFSAction = "LANDLOCK_ACCESS_FS_MAKE_BLOCK"
132-
FSActMakeSym LandlockFSAction = "LANDLOCK_ACCESS_FS_MAKE_SYM"
113+
FSActExecute LandlockFSAction = "execute"
114+
FSActWriteFile LandlockFSAction = "write_file"
115+
FSActReadFile LandlockFSAction = "read_file"
116+
FSActReadDir LandlockFSAction = "read_dir"
117+
FSActRemoveDir LandlockFSAction = "remove_dir"
118+
FSActRemoveFile LandlockFSAction = "remove_file"
119+
FSActMakeChar LandlockFSAction = "make_char"
120+
FSActMakeDir LandlockFSAction = "make_dir"
121+
FSActMakeReg LandlockFSAction = "make_reg"
122+
FSActMakeSock LandlockFSAction = "make_sock"
123+
FSActMakeFifo LandlockFSAction = "make_fifo"
124+
FSActMakeBlock LandlockFSAction = "make_block"
125+
FSActMakeSym LandlockFSAction = "make_sym"
133126
)
134127

135128
// LinuxCapabilities specifies the list of allowed capabilities that are kept for a process.

0 commit comments

Comments
 (0)