Add initial networking support #55
Conversation
l0kod
force-pushed
the
tcp
branch
2 times, most recently
from
eff6566 to
ca536b0
Compare
l0kod
force-pushed
the
tcp
branch
4 times, most recently
from
2469121 to
4ea35a2
Compare
l0kod
force-pushed
the
tcp
branch
2 times, most recently
from
9afb670 to
1bebfdd
Compare
|
I still need to address a few TODOs but the main changes should work fine. I'd like to leverage the type system for the port check (instead of the runtime check) but I'm still thinking about a proper API. |
I switched to |
Prepare crate for networking support, and run all tests against Linux 6.7.1 that supports Landlock ABI 4 Signed-off-by: Mickaël Salaün <mic@digikod.net>
Add the AccessNet::BindTcp and AccessNet::ConnectTcp rights. Add ruleset_created_handle_access_net test to check that handled and actual access rights are consistent according to the Landlock ABI. Rename the ruleset_created_handle_access_or test to ruleset_created_handle_access_fs. It should be noted that handle_access(AccessNet::from_all(ABI::V3)) returns an error because of the empty access bitflags. Signed-off-by: Mickaël Salaün <mic@digikod.net>
The NetPort type enables us to create network port rules leveraging Landlock ABI 4. Only 16-bit ports are allowed by the type system, which remove the need for overflow check and error. Add related tests, and handle E2BIG when the handled_access_net field is set and the running kernel does not support it. Signed-off-by: Mickaël Salaün <mic@digikod.net>
Bump to Landlock ABI v4.
Tested that this sandbox doesn't restrict TCP:
LL_FS_RO=/ LL_FS_RW=/ \
cargo run --example=sandboxer bash -i
Tested that this sandbox restrict bind and connect ports:
LL_FS_RO=/ LL_FS_RW=/ LL_TCP_BIND="2000" LL_TCP_CONNECT="3000:4000" \
cargo run --example=sandboxer bash -i
Test commands (with different ports):
socat tcp-listen:2000 stdio
date | socat stdio tcp-connect:127.1:2000
Signed-off-by: Mickaël Salaün <mic@digikod.net>
|
I'll release a new version of this crate tomorrow if no issue is reported. |
|
That was a long ride, but it's now published! 🥳 As you can see, this was due to some refactoring to generalize the internal library code for the new class of access rights and rule (network). This investment will greatly simplify the implementation of future changes. As described in the changelog, you'll need to update |
Linux 6.7 adds an initial Landlock network support with TCP bind and connect restrictions.