Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

landlock: fix struct initialization #6200

Merged
merged 1 commit into from
Feb 8, 2024

Conversation

kmk3
Copy link
Collaborator

@kmk3 kmk3 commented Feb 7, 2024

Recently (as of Landlock ABI 4), the handled_access_net field was
added to the landlock_ruleset_attr struct in the Linux kernel (in
linux/landlock.h). In src/firejail/landlock.c, that field is not being
set in the struct (as we currently do not use it) before passing it to
the landlock_create_full_ruleset syscall, so it is likely to contain
random garbage when used, resulting in the syscall returning EINVAL:

$ firejail --debug --profile=/etc/firejail/landlock-common.inc \
  --landlock.enforce true
[...]
ll_is_supported: Detected Landlock ABI version 4
ll_restrict: Starting Landlock restrict
ll_create_full_ruleset: Creating Landlock ruleset (abi=4 fs=1fff)
Error: ll_create_full_ruleset: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
ll_read: Adding Landlock rule (abi=4 fs=c) for /
Error: ll_read: failed to add Landlock rule (abi=4 fs=c) for /: Bad file descriptor
[...]
Not enforcing Landlock

So ensure that all structs in src/firejail/landlock.c are initialized to
0 before using them.

Note: Arch has recently (2024-01-31) updated the linux-api-headers
package from version 6.4-1 to 6.7-1[1]. The former version is not affected
(as it does not contain the extra struct field in linux/landlock.h),
while the latter is.

Fixes #6195.

Relates to #6078.

[1] https://gitlab.archlinux.org/archlinux/packaging/packages/linux-api-headers/-/commit/b4223b0c2bfba54c26acc4dc289415b81b15989f

Reported-by: @curiosityseeker

Recently (as of Landlock ABI 4), the `handled_access_net` field was
added to the `landlock_ruleset_attr` struct in the Linux kernel (in
linux/landlock.h).  In src/firejail/landlock.c, that field is not being
set in the struct (as we currently do not use it) before passing it to
the `landlock_create_full_ruleset` syscall, so it is likely to contain
random garbage when used, resulting in the syscall returning EINVAL:

    $ firejail --debug --profile=/etc/firejail/landlock-common.inc \
      --landlock.enforce true
    [...]
    ll_is_supported: Detected Landlock ABI version 4
    ll_restrict: Starting Landlock restrict
    ll_create_full_ruleset: Creating Landlock ruleset (abi=4 fs=1fff)
    Error: ll_create_full_ruleset: failed to create Landlock ruleset (abi=4 fs=1fff): Invalid argument
    ll_read: Adding Landlock rule (abi=4 fs=c) for /
    Error: ll_read: failed to add Landlock rule (abi=4 fs=c) for /: Bad file descriptor
    [...]
    Not enforcing Landlock

So ensure that all structs in src/firejail/landlock.c are initialized to
0 before using them.

Note: Arch has recently (2024-01-31) updated the linux-api-headers
package from version 6.4-1 to 6.7-1[1].  The former version is not affected
(as it does not contain the extra struct field in linux/landlock.h),
while the latter is.

Fixes netblue30#6195.

Relates to netblue30#6078.

[1] https://gitlab.archlinux.org/archlinux/packaging/packages/linux-api-headers/-/commit/b4223b0c2bfba54c26acc4dc289415b81b15989f

Reported-by: @curiosityseeker
@kmk3 kmk3 requested a review from glitsj16 February 7, 2024 15:21
@kmk3 kmk3 added this to In progress in Release 0.9.74 via automation Feb 7, 2024
Copy link
Collaborator

@glitsj16 glitsj16 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice one, thank you!

@kmk3 kmk3 merged commit 5f33d8e into netblue30:master Feb 8, 2024
13 checks passed
@kmk3 kmk3 deleted the landlock-fix-struct-init branch February 8, 2024 06:14
kmk3 added a commit that referenced this pull request Feb 8, 2024
@kmk3 kmk3 moved this from In progress to Done (on RELNOTES) in Release 0.9.74 Feb 8, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Release 0.9.74
  
Done (on RELNOTES)
Development

Successfully merging this pull request may close these issues.

Landlock: "Invalid argument" error when creating the ruleset
2 participants