samples/landlock: Add sandboxer UDP access control

Add environment variables to control associated access rights:
- LL_UDP_BIND
- LL_UDP_CONNECT_SEND

Each one takes a list of ports separated by colons, like other list
options.

Signed-off-by: Matthieu Buffet <matthieu@buffet.re>
Link: https://patch.msgid.link/20260611162107.49278-6-matthieu@buffet.re
Signed-off-by: Mickaël Salaün <mic@digikod.net>

diff --git a/samples/landlock/sandboxer.c b/samples/landlock/sandboxer.c
index 66e56ae275c6b350cc0dedb4ef05aca5e1d4d8e3..f44db2857bbf2bf0127dbc24d29b9894fef40c43 100644 (file)
--- a/samples/landlock/sandboxer.c
+++ b/samples/landlock/sandboxer.c
@@ -62,6 +62,8 @@ static inline int landlock_restrict_self(const int ruleset_fd,
 #define ENV_TCP_CONNECT_NAME "LL_TCP_CONNECT"
 #define ENV_SCOPED_NAME "LL_SCOPED"
 #define ENV_FORCE_LOG_NAME "LL_FORCE_LOG"
+#define ENV_UDP_BIND_NAME "LL_UDP_BIND"
+#define ENV_UDP_CONNECT_SEND_NAME "LL_UDP_CONNECT_SEND"
 #define ENV_DELIMITER ":"
 
 static int str2num(const char *numstr, __u64 *num_dst)
@@ -301,7 +303,7 @@ out_unset:
 
 /* clang-format on */
 
-#define LANDLOCK_ABI_LAST 9
+#define LANDLOCK_ABI_LAST 10
 
 #define XSTR(s) #s
 #define STR(s) XSTR(s)
@@ -324,6 +326,11 @@ static const char help[] =
        "means an empty list):\n"
        "* " ENV_TCP_BIND_NAME ": ports allowed to bind (server)\n"
        "* " ENV_TCP_CONNECT_NAME ": ports allowed to connect (client)\n"
+       "* " ENV_UDP_BIND_NAME ": local UDP ports allowed to bind (server: "
+       "prepare to receive on port / client: set as source port)\n"
+       "* " ENV_UDP_CONNECT_SEND_NAME ": remote UDP ports allowed to connect "
+       "or send to (client: use as destination port / server: receive only from it)\n"
+       "(caution: sending requires being able to bind to a local source port)\n"
        "* " ENV_SCOPED_NAME ": actions denied on the outside of the landlock domain\n"
        "  - \"a\" to restrict opening abstract unix sockets\n"
        "  - \"s\" to restrict sending signals\n"
@@ -336,6 +343,7 @@ static const char help[] =
        ENV_FS_RW_NAME "=\"/dev/null:/dev/full:/dev/zero:/dev/pts:/tmp\" "
        ENV_TCP_BIND_NAME "=\"9418\" "
        ENV_TCP_CONNECT_NAME "=\"80:443\" "
+       ENV_UDP_CONNECT_SEND_NAME "=\"53\" "
        ENV_SCOPED_NAME "=\"a:s\" "
        "%1$s bash -i\n"
        "\n"
@@ -356,7 +364,9 @@ int main(const int argc, char *const argv[], char *const *const envp)
        struct landlock_ruleset_attr ruleset_attr = {
                .handled_access_fs = access_fs_rw,
                .handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP |
-                                     LANDLOCK_ACCESS_NET_CONNECT_TCP,
+                                     LANDLOCK_ACCESS_NET_CONNECT_TCP |
+                                     LANDLOCK_ACCESS_NET_BIND_UDP |
+                                     LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP,
                .scoped = LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET |
                          LANDLOCK_SCOPE_SIGNAL,
        };
@@ -444,6 +454,13 @@ int main(const int argc, char *const argv[], char *const *const envp)
                /* Removes LANDLOCK_ACCESS_FS_RESOLVE_UNIX for ABI < 9 */
                ruleset_attr.handled_access_fs &=
                        ~LANDLOCK_ACCESS_FS_RESOLVE_UNIX;
+               __attribute__((fallthrough));
+       case 9:
+               /* Removes UDP support for ABI < 10 */
+               ruleset_attr.handled_access_net &=
+                       ~(LANDLOCK_ACCESS_NET_BIND_UDP |
+                         LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP);
+
                /* Must be printed for any ABI < LANDLOCK_ABI_LAST. */
                fprintf(stderr,
                        "Hint: You should update the running kernel "
@@ -475,6 +492,18 @@ int main(const int argc, char *const argv[], char *const *const envp)
                ruleset_attr.handled_access_net &=
                        ~LANDLOCK_ACCESS_NET_CONNECT_TCP;
        }
+       /* Removes UDP bind access control if not supported by a user. */
+       env_port_name = getenv(ENV_UDP_BIND_NAME);
+       if (!env_port_name) {
+               ruleset_attr.handled_access_net &=
+                       ~LANDLOCK_ACCESS_NET_BIND_UDP;
+       }
+       /* Removes UDP connect/send access control if not supported by a user. */
+       env_port_name = getenv(ENV_UDP_CONNECT_SEND_NAME);
+       if (!env_port_name) {
+               ruleset_attr.handled_access_net &=
+                       ~LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP;
+       }
 
        if (check_ruleset_scope(ENV_SCOPED_NAME, &ruleset_attr))
                return 1;
@@ -519,6 +548,14 @@ int main(const int argc, char *const argv[], char *const *const envp)
                                 LANDLOCK_ACCESS_NET_CONNECT_TCP)) {
                goto err_close_ruleset;
        }
+       if (populate_ruleset_net(ENV_UDP_BIND_NAME, ruleset_fd,
+                                LANDLOCK_ACCESS_NET_BIND_UDP)) {
+               goto err_close_ruleset;
+       }
+       if (populate_ruleset_net(ENV_UDP_CONNECT_SEND_NAME, ruleset_fd,
+                                LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP)) {
+               goto err_close_ruleset;
+       }
 
        if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
                perror("Failed to restrict privileges");