diff options
| -rw-r--r-- | Makefile | 12 | ||||
| -rw-r--r-- | main.c | 22 | ||||
| -rw-r--r-- | vll_sandbox.c | 118 | ||||
| -rw-r--r-- | vll_sandbox.h | 64 |
4 files changed, 213 insertions, 3 deletions
@@ -29,15 +29,19 @@ # OpenBSD CHROOT=/var/www WWW_USER=www +CFLAGS_CONFIG= +OBJS_CONFIG= # Linux #CHROOT= #WWW_USER=www-data +#CFLAGS_CONFIG=-D__Linux__ +#OBJS_CONFIG=vll_sandbox.o CC=cc CFLAGS_DEPS != pkg-config --cflags kcgi kcgi-html LDFLAGS_DEPS != pkg-config --libs kcgi kcgi-html -CFLAGS=-DLOG_INFO -D_POSIX_C_SOURCE=200809L -std=c89 $(CFLAGS_DEPS) +CFLAGS=-DLOG_INFO -D_POSIX_C_SOURCE=200809L -std=c89 $(CFLAGS_DEPS) $(CFLAGS_CONFIG) LDFLAGS=-static $(LDFLAGS_DEPS) .if make(debug) || make(test) @@ -47,6 +51,8 @@ CFLAGS+=-O0 -g -W -Wall -Wextra -DTEMPLATE_DIR='"template"' CFLAGS+=-O2 .endif +OBJS=$(OBJS_CONFIG) str.o config.o mime.o url.o template.o file.o http.o delete.o upload.o download.o create.o browse.o + debug: main all: main @@ -54,10 +60,10 @@ all: main .c.o: $(CC) -o $@ -c $< $(CFLAGS) -main: str.o config.o mime.o url.o template.o file.o http.o delete.o upload.o download.o create.o browse.o main.o +main: $(OBJS) main.o $(CC) -o $@ $> $(LDFLAGS) -test: str.o config.o mime.o url.o template.o file.o http.o delete.o upload.o download.o create.o browse.o test.o +test: $(OBJS) test.o $(CC) -o $@ $> $(LDFLAGS) env: env.o @@ -41,6 +41,9 @@ #include "download.h" #include "http.h" #include "upload.h" +#ifdef __Linux__ +#include "vll_sandbox.h" +#endif /* __Linux__ */ enum page { PAGE_BROWSE, @@ -63,6 +66,9 @@ int main(void) { char *data_dir; +#ifdef __Linux__ + int vll_ruleset_id; +#endif /* __Linux__ */ enum kcgi_err parse_err; struct kreq r; @@ -97,6 +103,22 @@ main(void) goto end; } #endif /* __OpenBSD__ */ +#ifdef __Linux__ + vll_ruleset_id = vll_create_ruleset(); + if (vll_ruleset_id < 0) { + http_exit(&r, KHTTP_500, "vll_ruleset_id failed"); + goto end; + } + if (-1 == vll_add_rule(vll_ruleset_id, data_dir, VLL_READ | VLL_WRITE) + || -1 == vll_add_rule(vll_ruleset_id, TEMPLATE_DIR, VLL_READ)) { + http_exit(&r, KHTTP_500, "vll_add_rule failed"); + goto end; + } + if (-1 == vll_restrict_self(vll_ruleset_id)) { + http_exit(&r, KHTTP_500, "vrr_restrict_self failed"); + goto end; + } +#endif /* __Linux__ */ /* * Make sure basic request parameters are as expected : GET or POST, diff --git a/vll_sandbox.c b/vll_sandbox.c new file mode 100644 index 0000000..50d1dcc --- /dev/null +++ b/vll_sandbox.c @@ -0,0 +1,118 @@ +/* + * Copyright 2026, Vincent Douillet <vincent@vdouillet.fr> + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * 1. Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * + * 3. Neither the name of the copyright holder nor the names of its contributors + * may be used to endorse or promote products derived from this software without + * specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" + * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +#include <linux/landlock.h> +#include <sys/prctl.h> +#include <sys/syscall.h> + +#include <fcntl.h> +#include <stddef.h> + +#include "vll_sandbox.h" + +/* + * TODO add missing accesses to deny them by default. + * Also move inside vll_create_ruleset + */ +static struct landlock_ruleset_attr ruleset_attr = { + .handled_access_fs = + LANDLOCK_ACCESS_FS_WRITE_FILE | + LANDLOCK_ACCESS_FS_READ_FILE | + LANDLOCK_ACCESS_FS_READ_DIR | + LANDLOCK_ACCESS_FS_REMOVE_DIR | + LANDLOCK_ACCESS_FS_REMOVE_FILE | + LANDLOCK_ACCESS_FS_MAKE_DIR | + LANDLOCK_ACCESS_FS_MAKE_REG, +}; + +int +vll_create_ruleset() +{ + int abi; + + abi = syscall(SYS_landlock_create_ruleset, NULL, 0, + LANDLOCK_CREATE_RULESET_VERSION); + if (abi < 0) + return -1; + + return syscall(SYS_landlock_create_ruleset, &ruleset_attr, + sizeof(ruleset_attr), 0); +} + +int +vll_add_rule(int ruleset_fd, const char *path, const char perm) +{ + int err; + struct landlock_path_beneath_attr path_beneath; + + path_beneath.allowed_access = 0; + if (perm & VLL_READ) + path_beneath.allowed_access |= LANDLOCK_ACCESS_FS_READ_FILE | + LANDLOCK_ACCESS_FS_READ_DIR; + if (perm & VLL_WRITE) + path_beneath.allowed_access |= LANDLOCK_ACCESS_FS_WRITE_FILE | + LANDLOCK_ACCESS_FS_REMOVE_DIR | LANDLOCK_ACCESS_FS_REMOVE_FILE | + LANDLOCK_ACCESS_FS_MAKE_DIR | LANDLOCK_ACCESS_FS_MAKE_REG; + + if (!path_beneath.allowed_access) + return -1; + + path_beneath.parent_fd = open(path, O_CLOEXEC); + if (path_beneath.parent_fd < 0) + return -1; + + err = syscall(SYS_landlock_add_rule, ruleset_fd, + LANDLOCK_RULE_PATH_BENEATH, &path_beneath, 0); + close(path_beneath.parent_fd); + if (err) + return -1; + + return 0; +} + +int +vll_restrict_self(int ruleset_fd) +{ + int ret; + + ret = 0; + if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { + ret = -1; + goto end; + } + if (syscall(SYS_landlock_restrict_self, ruleset_fd, 0)) { + ret = -1; + goto end; + } + + end: + close(ruleset_fd); + return ret; +} diff --git a/vll_sandbox.h b/vll_sandbox.h new file mode 100644 index 0000000..739cd7c --- /dev/null +++ b/vll_sandbox.h @@ -0,0 +1,64 @@ +/* + * Copyright 2026, Vincent Douillet <vincent@vdouillet.fr> + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * 1. Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * + * 3. Neither the name of the copyright holder nor the names of its contributors + * may be used to endorse or promote products derived from this software without + * specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" + * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +#ifndef VLL_SANDBOX_H +#define VLL_SANDBOX_H + +#define VLL_READ (0x1 << 2) +#define VLL_WRITE (0x1 << 1) + +/* + * Initialize a new landlock rule set, and returns its ID upon success. + * Returns -1 upon error. + */ +int +vll_create_ruleset(); + +/* + * Add a rule to a previously initialized rule set. + * First parameter is the ID of the rule set. + * Second parameter is a file or directory path. + * Third parameter are the desired permission, currently VLL_READ and VLL_WRITE + * constants are supported. They can be combined with a bitwise OR. + * Returns 0 upon success or -1 upon error. + */ +int +vll_add_rule(int, const char *, const char); + +/* + * Applies a rule set. After calling this, whether it returns as success or + * error, the rule set is destroyed and should not be used anymore. + * First parameter is the rule set ID to apply + * Returns 0 upon success or -1 upon error. + */ +int +vll_restrict_self(int); + +#endif |