From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=185.125.25.9 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794342653; b=3lAgrJn0p9xhD6TE5aKlAHyAYo9nqb1v7ahHJ1/MGuYVXxNIATt/mFrTdjLeFzMf1RB0 bmcrGO5qWkgLXEt8/h+PFfQ53Q388Pa+XqS+ACogWFf/LIT2bFvnIJBJ5pJMtxJgS1pM+ FXs39SBFUbQXuxpbcpLZAl/DzPrXoSQRfBz7JcrQGwfCbyFP7aITZVARCdgYyXlhIzZzF WlIqvb4my748F8FFU3iOtASkoPQEeI86LkNzicbF1kch6b4O07us/qZyZ9u+1q14IEGpI WjrABtahbF2ccrGMzSd7taNSlzVf+p1fXHrlLVXJQDQ/DafkOZHwN36ckyFGEfbJD9Q== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794342653; h=DMARC-Filter:Received:DKIM-Signature:Received:From:To:Cc:Subject: Date:Message-ID:In-Reply-To:References:MIME-Version:Content-Type: Content-Transfer-Encoding:X-Infomaniak-Routing; bh=SLTuo8Bf8VesaAkT6DczV4E9wggKp8EAHDqnPASoGtA=; b=axD2bl/qz6b/160GJk6XUwuptA57sbYkA0rO1EiA5OHiwWv2U8vAYy5LIlFUCrnt07WC E1/jMRDAjf2RCtkQfgzUFOn6WQ/Wjup1Em72nxlThSjnqNw+wT/Yikm3bcSluHA5iqhrt qaOc1/eOEnBItmBHdXWLSisjNZ0LI2oP7PT+/pDZuuJDy4DIc4QXn4PmieyXucB5N4hID Q+lXI6079lYK7Zh6dUMWx+UEFrYXrdVVtwsJpz1UQyDNdtCJbbpBHlKzKlOCaKn7WDP8R BBhVwJtuVNlu5QHWBKAq+egfcWByAmZTdmE86ZtVSj3V0Iy5ZlAADp8b72sbuCrZgwQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none header.from=digikod.net; spf=pass smtp.mailfrom=digikod.net; dkim=pass header.d=digikod.net header.i=@digikod.net header.a=rsa-sha256 header.s=20191114 header.b=smJhIW3Z; arc=none smtp.remote-ip=185.125.25.9 Received: from smtp-1909.mail.infomaniak.ch (smtp-1909.mail.infomaniak.ch [185.125.25.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 01B5B606A33E for ; Tue, 10 Nov 2026 20:30:51 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 01B5B606A33E Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=digikod.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=digikod.net Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=digikod.net header.i=@digikod.net header.a=rsa-sha256 header.s=20191114 header.b=smJhIW3Z Received: from smtp-3-0001.mail.infomaniak.ch (smtp-3-0001.mail.infomaniak.ch [10.4.36.108]) by smtp-4-3000.mail.infomaniak.ch (Postfix) with ESMTPS id 4jPJFQ34JbzGWD; Tue, 10 Nov 2026 21:30:50 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=digikod.net; s=20191114; t=1794342650; bh=SLTuo8Bf8VesaAkT6DczV4E9wggKp8EAHDqnPASoGtA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=smJhIW3ZiKdcSt4kr0Z4Nr3AHa2wf7l+F+SUlwNRZg1toAtSo1Zw35GwKCmVWnDC4 bmBKoGh55a0w4d/GAgxCJ0vlek9GdMfSQiKwjbWbDJSEQlo7ViX/1yV0iqm2Y17J8E pQNvy4Xb/7ts4BXdHXMt+73mNuAQPA9Ukel1kJLA= Received: from unknown by smtp-3-0001.mail.infomaniak.ch (Postfix) with ESMTPA id 4jPJFN6pDRzxBr; Tue, 10 Nov 2026 21:30:48 +0100 (CET) From: =?UTF-8?q?Micka=C3=ABl=20Sala=C3=BCn?= To: Casey Schaufler , Georgia Garcia , =?UTF-8?q?G=C3=BCnther=20Noack?= , James Morris , John Johansen , =?UTF-8?q?Ondrej=20Mosn=C3=A1=C4=8Dek?= , Paul Moore , Serge Hallyn , Stephen Smalley Cc: =?UTF-8?q?Micka=C3=ABl=20Sala=C3=BCn?= , Christian Brauner , KP Singh , Matt Bobrowski , apparmor@lists.ubuntu.com, bpf@vger.kernel.org, kernel-team@cloudflare.com, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Subject: [PATCH 2/6] landlock: Restrict capabilities guarding other LSMs' policies Date: Tue, 10 Nov 2026 21:30:36 +0100 Message-ID: <20261110203042.2410140-3-mic@digikod.net> In-Reply-To: <20261110203042.2410140-1-mic@digikod.net> References: <20261110203042.2410140-1-mic@digikod.net> X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Infomaniak-Routing: alpha A process in a domain that denies CAP_MAC_ADMIN or CAP_MAC_OVERRIDE could still use them for AppArmor, Smack or SELinux policy, and CAP_SYS_PTRACE for Smack's ptrace rule, because these LSMs check them with cap_capable() instead of capable(). Implement the capable_lsm hook with the same check as the capable hook, so that such capability uses are restricted like any other. The following commits switch these LSMs to security_capable_lsm(). Cc: Christian Brauner Cc: Günther Noack Cc: Paul Moore Cc: Serge Hallyn Fixes: 97c8386f1d74 ("landlock: Enforce capability restrictions") Signed-off-by: Mickaël Salaün --- security/landlock/cap.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/security/landlock/cap.c b/security/landlock/cap.c index c9a900888f3b..162edf689f29 100644 --- a/security/landlock/cap.c +++ b/security/landlock/cap.c @@ -91,6 +91,28 @@ static int hook_capable(const struct cred *cred, struct user_namespace *ns, return check_cap(cred, cap, opts); } +/** + * hook_capable_lsm - Deny capabilities guarding another LSM's policy + * + * @cred: Credentials being checked. + * @ns: Target user namespace (intentionally ignored, see hook_capable()). + * @cap: Capability number (CAP_*). + * @opts: Capability check options, see check_cap(). + * @lsm_id: LSM_ID_* of the LSM whose policy @cap guards (unused: Landlock does + * not call security_capable_lsm()). + * + * Other LSMs check the capabilities that guard their own policy (e.g. + * CAP_MAC_ADMIN) with security_capable_lsm() instead of capable(). Restrict + * them like any other capability use. + * + * Return: 0 if allowed, -EPERM if capability use is denied. + */ +static int hook_capable_lsm(const struct cred *cred, struct user_namespace *ns, + int cap, unsigned int opts, u64 lsm_id) +{ + return check_cap(cred, cap, opts); +} + /** * hook_capset - Restrict inheritable capability changes * @@ -163,6 +185,7 @@ static int hook_vm_enough_memory(struct mm_struct *mm, long pages) static struct security_hook_list landlock_hooks[] __ro_after_init = { LSM_HOOK_INIT(capable, hook_capable), + LSM_HOOK_INIT(capable_lsm, hook_capable_lsm), LSM_HOOK_INIT(capset, hook_capset), LSM_HOOK_INIT(mmap_addr, hook_mmap_addr), LSM_HOOK_INIT(vm_enough_memory, hook_vm_enough_memory), -- 2.56.0