forked from opencontainers/runc
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
libcontainer: add support for Landlock
This patch introduces Landlock Linux Security Module (LSM) support in runc, which was landed in Linux kernel 5.13. This allows unprivileged processes to create safe security sandboxes that can securely restrict the ambient rights (e.g. global filesystem access) for themselves. runtime-spec: opencontainers/runtime-spec#1111 Fixes opencontainers#2859 Signed-off-by: Kailun Qin <[email protected]>
- Loading branch information
1 parent
654f331
commit f99455d
Showing
9 changed files
with
250 additions
and
3 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,31 @@ | ||
| package landlock | ||
|
|
||
| import ( | ||
| "fmt" | ||
|
|
||
| "github.com/opencontainers/runc/libcontainer/configs" | ||
| ) | ||
|
|
||
| var accessFSs = map[string]configs.AccessFS{ | ||
| "execute": configs.Execute, | ||
| "write_file": configs.WriteFile, | ||
| "read_file": configs.ReadFile, | ||
| "read_dir": configs.ReadDir, | ||
| "remove_dir": configs.RemoveDir, | ||
| "remove_file": configs.RemoveFile, | ||
| "make_char": configs.MakeChar, | ||
| "make_dir": configs.MakeDir, | ||
| "make_reg": configs.MakeReg, | ||
| "make_sock": configs.MakeSock, | ||
| "make_fifo": configs.MakeFifo, | ||
| "make_block": configs.MakeBlock, | ||
| "make_sym": configs.MakeSym, | ||
| } | ||
|
|
||
| // ConvertStringToAccessFS converts a string into a Landlock access right. | ||
| func ConvertStringToAccessFS(in string) (configs.AccessFS, error) { | ||
| if access, ok := accessFSs[in]; ok { | ||
| return access, nil | ||
| } | ||
| return 0, fmt.Errorf("string %s is not a valid access right for landlock", in) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,67 @@ | ||
| // +build linux | ||
|
|
||
| package landlock | ||
|
|
||
| import ( | ||
| "errors" | ||
| "fmt" | ||
|
|
||
| "github.com/landlock-lsm/go-landlock/landlock" | ||
|
|
||
| "github.com/opencontainers/runc/libcontainer/configs" | ||
| ) | ||
|
|
||
| // Initialize Landlock unprivileged access control for the container process | ||
| // based on the given settings. | ||
| // The specified `ruleset` identifies a set of rules (i.e., actions on objects) | ||
| // that need to be handled (i.e., restricted) by Landlock. And if no `rule` | ||
| // explicitly allow them, they should then be forbidden. | ||
| // The `disableBestEffort` input gives control over whether the best-effort | ||
| // security approach should be applied for Landlock access rights. | ||
| func InitLandlock(config *configs.Landlock) error { | ||
| if config == nil { | ||
| return errors.New("cannot initialize Landlock - nil config passed") | ||
| } | ||
|
|
||
| var llConfig landlock.Config | ||
|
|
||
| ruleset := getAccess(config.Ruleset.HandledAccessFS) | ||
| // Panic on error when constructing the Landlock configuration using invalid config values. | ||
| if config.DisableBestEffort { | ||
| llConfig = landlock.MustConfig(ruleset) | ||
| } else { | ||
| llConfig = landlock.MustConfig(ruleset).BestEffort() | ||
| } | ||
|
|
||
| if err := llConfig.RestrictPaths( | ||
| getPathAccesses(config.Rules)..., | ||
| ); err != nil { | ||
| return fmt.Errorf("Could not restrict paths: %v", err) | ||
| } | ||
|
|
||
| return nil | ||
| } | ||
|
|
||
| // Convert Libcontainer AccessFS to go-landlock AccessFSSet. | ||
| func getAccess(access configs.AccessFS) landlock.AccessFSSet { | ||
| return landlock.AccessFSSet(access) | ||
| } | ||
|
|
||
| // Convert Libcontainer RulePathBeneath to go-landlock PathOpt. | ||
| func getPathAccess(rule *configs.RulePathBeneath) landlock.PathOpt { | ||
| return landlock.PathAccess( | ||
| getAccess(rule.AllowedAccess), | ||
| rule.Paths...) | ||
| } | ||
|
|
||
| // Convert Libcontainer Rules to an array of go-landlock PathOpt. | ||
| func getPathAccesses(rules *configs.Rules) []landlock.PathOpt { | ||
| pathAccesses := []landlock.PathOpt{} | ||
|
|
||
| for _, rule := range rules.PathBeneath { | ||
| opt := getPathAccess(rule) | ||
| pathAccesses = append(pathAccesses, opt) | ||
| } | ||
|
|
||
| return pathAccesses | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| // +build !linux | ||
|
|
||
| package landlock | ||
|
|
||
| import ( | ||
| "errors" | ||
|
|
||
| "github.com/opencontainers/runc/libcontainer/configs" | ||
| ) | ||
|
|
||
| var ErrLandlockNotSupported = errors.New("land: config provided but Landlock not supported") | ||
|
|
||
| // InitLandlock does nothing because Landlock is not supported. | ||
| func InitSLandlock(config *configs.Landlock) error { | ||
| if config != nil { | ||
| return ErrLandlockNotSupported | ||
| } | ||
| return nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters