-
Notifications
You must be signed in to change notification settings - Fork 28
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Enabled by default on Linux. Managed by the class UhyveLandlockWrapper, Landlock is enforced after all paths that it requires to function are enumerated in UhyveVm::new, right before the kernel is loaded in UhyveVm::load_kernel. Some tests were modified accordingly, as UhyveVm objects can't be reused.
- Loading branch information
Showing
11 changed files
with
318 additions
and
80 deletions.
There are no files selected for viewing
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -311,6 +311,7 @@ fn run_uhyve() -> i32 { | |
| println!("{stats}"); | ||
| } | ||
| } | ||
|
|
||
| res.code | ||
| } | ||
|
|
||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,120 @@ | ||
| use std::{ffi::OsString, path::PathBuf, vec::Vec}; | ||
|
|
||
| use landlock::{ | ||
| Access, AccessFs, PathBeneath, PathFd, PathFdError, RestrictionStatus, Ruleset, RulesetAttr, | ||
| RulesetCreatedAttr, RulesetError, ABI, | ||
| }; | ||
| use thiserror::Error; | ||
|
|
||
| use crate::isolation::split_guest_and_host_path; | ||
|
|
||
| /// Contains types of errors that may occur during Landlock's initialization. | ||
| #[derive(Debug, Error)] | ||
| pub enum RestrictError { | ||
| #[error(transparent)] | ||
| Ruleset(#[from] RulesetError), | ||
| #[error(transparent)] | ||
| AddRule(#[from] PathFdError), | ||
| } | ||
|
|
||
| /// Interface for Landlock crate. | ||
| #[derive(Clone, Debug)] | ||
| pub struct UhyveLandlockWrapper { | ||
| rw_paths: Vec<String>, | ||
| ro_paths: Vec<String>, | ||
| } | ||
|
|
||
| impl UhyveLandlockWrapper { | ||
| pub fn new( | ||
| mappings: &[String], | ||
| uhyve_rw_paths: &mut Vec<String>, | ||
| uhyve_ro_paths: &[String], | ||
| ) -> UhyveLandlockWrapper { | ||
| #[cfg(not(target_os = "linux"))] | ||
| compile_error!("Landlock is only available on Linux."); | ||
|
|
||
| // TODO: Check whether host OS (Linux, of course) actually supports Landlock. | ||
| // TODO: Introduce parameter that lets the user manually disable Landlock. | ||
| // TODO: Reduce code repetition (wrt. `crate::isolation::filemap`). | ||
| // TODO: What to do with files that don't exist yet? | ||
| let mut rw_paths: Vec<String> = mappings | ||
| .iter() | ||
| .map(String::as_str) | ||
| .map(split_guest_and_host_path) | ||
| .map(Result::unwrap) | ||
| .map(|(guest_path, host_path)| (guest_path, host_path).1) | ||
| .map(Self::get_parent_directory) | ||
| .collect(); | ||
| rw_paths.append(uhyve_rw_paths); | ||
|
|
||
| UhyveLandlockWrapper { | ||
| rw_paths, | ||
| ro_paths: uhyve_ro_paths.to_vec(), | ||
| } | ||
| } | ||
|
|
||
| pub fn apply_landlock_restrictions(&self) { | ||
| { | ||
| let _status = match Self::enforce_landlock(self) { | ||
| Ok(status) => status, | ||
| Err(error) => panic!("Unable to initialize Landlock: {error:?}"), | ||
| }; | ||
| } | ||
| } | ||
|
|
||
| /// If the file does not exist, we add the parent directory instead. This might have practical | ||
| /// security implications, however, combined with the other security measures implemented into | ||
| /// Uhyve, this should be fine. | ||
| /// | ||
| /// TODO: Inform the user in the docs. | ||
| /// TODO: Make the amount of iterations configurable. | ||
| pub fn get_parent_directory(host_path: OsString) -> String { | ||
| let iterations = 2; | ||
| let mut host_pathbuf: PathBuf = host_path.into(); | ||
| for _i in 0..iterations { | ||
| if !host_pathbuf.exists() { | ||
| warn!("Mapped file {:#?} not found. Popping...", host_pathbuf); | ||
| host_pathbuf.pop(); | ||
| continue; | ||
| } | ||
| debug!("Adding {:#?} to Landlock", host_pathbuf); | ||
| return host_pathbuf.to_str().unwrap().to_owned(); | ||
| } | ||
| panic!( | ||
| "The mapped file's parent directory wasn't found within {} iteration(s).", | ||
| iterations | ||
| ); | ||
| } | ||
|
|
||
| /// Initializes Landlock by providing R/W-access to user-defined and | ||
| /// Uhyve-defined paths. | ||
| pub fn enforce_landlock(&self) -> Result<RestrictionStatus, RestrictError> { | ||
| // This should be incremented regularly. | ||
| let abi = ABI::V5; | ||
| // Used for explicitly whitelisted files (read & write). | ||
| let access_all: landlock::BitFlags<AccessFs, u64> = AccessFs::from_all(abi); | ||
| // Used for the kernel itself, as well as "system directories" that we only read from. | ||
| let access_read: landlock::BitFlags<AccessFs, u64> = AccessFs::from_read(abi); | ||
|
|
||
| Ok(Ruleset::default() | ||
| .handle_access(access_all)? | ||
| .create()? | ||
| .add_rules( | ||
| self.rw_paths | ||
| .as_slice() | ||
| .iter() | ||
| .map::<Result<_, RestrictError>, _>(|p| { | ||
| Ok(PathBeneath::new(PathFd::new(p)?, access_all)) | ||
| }), | ||
| )? | ||
| .add_rules( | ||
| self.ro_paths | ||
| .as_slice() | ||
| .iter() | ||
| .map::<Result<_, RestrictError>, _>(|p| { | ||
| Ok(PathBeneath::new(PathFd::new(p)?, access_read)) | ||
| }), | ||
| )? | ||
| .restrict_self()?) | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,2 +1,71 @@ | ||
| pub mod filemap; | ||
| #[cfg(target_os = "linux")] | ||
| pub mod landlock; | ||
| pub mod tempdir; | ||
|
|
||
| use std::{ffi::OsString, fs::canonicalize, io::ErrorKind, path::absolute}; | ||
|
|
||
| use clean_path::clean; | ||
|
|
||
| /// Separates a string of the format "./host_dir/host_path.txt:guest_path.txt" | ||
| /// into a guest_path (String) and host_path (OsString) respectively. | ||
| /// | ||
| /// * `mapping` - A mapping of the format `./host_path.txt:guest.txt`. | ||
| fn split_guest_and_host_path(mapping: &str) -> Result<(String, OsString), ErrorKind> { | ||
| let mut mappingiter: std::str::Split<'_, &str> = mapping.split(":"); | ||
| let host_str = mappingiter.next().ok_or(ErrorKind::InvalidInput)?; | ||
| let guest_str = mappingiter.next().ok_or(ErrorKind::InvalidInput)?; | ||
|
|
||
| // TODO: Replace clean-path in favor of Path::normalize_lexically, which has not | ||
| // been implemented yet. See: https://github.com/rust-lang/libs-team/issues/396 | ||
| let host_path = canonicalize(host_str) | ||
| .map_or_else(|_| clean(absolute(host_str).unwrap()), clean) | ||
| .into(); | ||
| let guest_path: String = clean(guest_str).display().to_string(); | ||
|
|
||
| Ok((guest_path, host_path)) | ||
| } | ||
|
|
||
| #[test] | ||
| fn test_split_guest_and_host_path() { | ||
| use std::path::PathBuf; | ||
|
|
||
| let host_guest_strings = [ | ||
| "./host_string.txt:guest_string.txt", | ||
| "/home/user/host_string.txt:guest_string.md.txt", | ||
| "host_string.txt:this_does_exist.txt:should_not_exist.txt", | ||
| "host_string.txt:test/..//guest_string.txt", | ||
| ]; | ||
|
|
||
| // We will use `host_string.txt` for all tests checking canonicalization. | ||
| let mut fixture_path = PathBuf::from(env!("CARGO_MANIFEST_DIR")); | ||
| fixture_path.push("host_string.txt"); | ||
|
|
||
| // Mind the inverted order. | ||
| let results = [ | ||
| ( | ||
| String::from("guest_string.txt"), | ||
| fixture_path.clone().into(), | ||
| ), | ||
| ( | ||
| String::from("guest_string.md.txt"), | ||
| OsString::from("/home/user/host_string.txt"), | ||
| ), | ||
| ( | ||
| String::from("this_does_exist.txt"), | ||
| fixture_path.clone().into(), | ||
| ), | ||
| (String::from("guest_string.txt"), fixture_path.into()), | ||
| ]; | ||
|
|
||
| for (i, host_and_guest_string) in host_guest_strings | ||
| .into_iter() | ||
| .map(split_guest_and_host_path) | ||
| .enumerate() | ||
| { | ||
| assert_eq!( | ||
| host_and_guest_string.expect("Result is an error!"), | ||
| results[i] | ||
| ); | ||
| } | ||
| } |
Oops, something went wrong.