Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #73660 > unrolled thread

Bug#999551: Support Landlock by default in Debian kernels

Back to article view | Back to linux.debian.kernel

Contents

  Bug#999551: Support Landlock by default in Debian kernels Mickaël Salaün <mic@digikod.net> - 2021-11-12 12:40 +0100
    Bug#999551: Support Landlock by default in Debian kernels Yves-Alexis Perez <corsac@debian.org> - 2021-11-12 13:40 +0100
      Bug#999551: Support Landlock by default in Debian kernels Mickaël Salaün <mic@digikod.net> - 2021-11-12 15:00 +0100
    Processed: Re: Bug#999551: Support Landlock by default in Debian  kernels "Debian Bug Tracking System" <owner@bugs.debian.org> - 2021-11-12 14:00 +0100
    Bug#999551: Support Landlock by default in Debian kernels Bastian Blank <waldi@debian.org> - 2021-11-12 14:00 +0100
      Bug#999551: Support Landlock by default in Debian kernels Mickaël Salaün <mic@digikod.net> - 2021-11-12 14:50 +0100
    Bug#999551: Support Landlock by default in Debian kernels Brad Tilley <brad@vt.edu> - 2022-03-30 13:50 +0200
    Bug#999551: marked as done (Support Landlock by default in Debian  kernels) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2022-08-02 20:10 +0200
    Bug#999551: marked as done (Support Landlock by default in Debian  kernels) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2022-08-11 08:10 +0200

#73660 — Bug#999551: Support Landlock by default in Debian kernels

[Multipart message — attachments visible in raw view] — view raw

Package: src:linux
Version: 5.14.16-1
Severity: normal
Tags: patch
X-Debbugs-Cc: landlock@lists.linux.dev

Hi,

The Landlock security feature is built in Debian kernel since
5.13.12-1~exp1 which is great!  However, it is not enough to enable the
CONFIG_SECURITY_LANDLOCK option as described in the related help.  The
CONFIG_LSM option needs to be prepended by "landlock," to make Landlock
system calls available without modifying the kernel boot arguments.

Could you please apply the attached patch to make this feature more
broadly available?

This can be validated with the tests provided by the kernel sources:

fakeroot make -C tools/testing/selftests TARGETS=landlock gen_tar
tar -xf
tools/testing/selftests/kselftest_install/kselftest-packages/kselftest.tar.gz
# as root:
./run_kselftest.sh

If Yama is enabled, half of the ptrace tests may failed, which is OK.

Regards,
 Mickaël

[toc] | [next] | [standalone]

#73662

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Hey Mickaël, kernel team,

On Fri, 2021-11-12 at 12:23 +0100, Mickaël Salaün wrote:
> -
> CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,apparmor,selinux,smack
> ,to
> moyo"
> +CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,integrity,apparmor,sel
> in
> ux,smack,tomoyo"
>   
At first sight the change looks reasonable, but just to check: right now there
is there is no userland stuff using Landlock LSM packaged in Debian? So
nothing is currently broken by not having the above, it's just more practical
when testing or using the feature?

(not saying we shouldn't enable it, it's just so we know what exactly we gain
or not).

Regards,
- -- 
Yves-Alexis
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEE8vi34Qgfo83x35gF3rYcyPpXRFsFAmGOX14ACgkQ3rYcyPpX
RFuWRQf7B96Z1IoKkm7qbHswja4TmPuM2cJcBzXJLX0t591MO2D/GdAS08w+/kTL
ALUJSXKiDvcC9AmzKD4tFszs13NJwSXlhUB4sflqLk2TBltDEhSdlVSwAw2UGHxx
/NJRqH7nMWvMeghO/SLkaoXDEOAIQUR75cyQs1/oQIcfmYx+A68cr0DarEJKWUM8
SrLWTvY90IKKyBwKEY3hT/qFtb+YhPRp76tykT0J25b55EmkPO/f3p5vz+uUBG+N
WaKS+KKI1D4XubcmOOfa09XMh1OnZ1u3Jd6WZopcB7G2I18j/ejDXiz1pPDC7BrF
7nh/V2L7YRv0r4ppP5QwglLgRF5SOQ==
=xSao
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#73666

On 12/11/2021 13:34, Yves-Alexis Perez wrote:
> Hey Mickaël, kernel team,
> 
> On Fri, 2021-11-12 at 12:23 +0100, Mickaël Salaün wrote:
>> -
>> CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,apparmor,selinux,smack
>> ,to
>> moyo"
>> +CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,integrity,apparmor,sel
>> in
>> ux,smack,tomoyo"
> 
> At first sight the change looks reasonable, but just to check: right now there
> is there is no userland stuff using Landlock LSM packaged in Debian? So
> nothing is currently broken by not having the above, it's just more practical
> when testing or using the feature?
> 
> (not saying we shouldn't enable it, it's just so we know what exactly we gain
> or not).

Applications using Landlock should not break if the feature is not
supported by the running kernel (best-effort security). Whether some
Debian packaged applications are using Landlock or not doesn't seem
important since users can download and run their own applications, right?

[toc] | [prev] | [next] | [standalone]

#73663 — Processed: Re: Bug#999551: Support Landlock by default in Debian kernels

Processing control commands:

> tag -1 wontfix
Bug #999551 [src:linux] Support Landlock by default in Debian kernels
Added tag(s) wontfix.

-- 
999551: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=999551
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

[toc] | [prev] | [next] | [standalone]

#73664

Control: tag -1 wontfix

On Fri, Nov 12, 2021 at 12:23:13PM +0100, Mickaël Salaün wrote:
> The Landlock security feature is built in Debian kernel since
> 5.13.12-1~exp1 which is great!  However, it is not enough to enable the
> CONFIG_SECURITY_LANDLOCK option as described in the related help.  The
> CONFIG_LSM option needs to be prepended by "landlock," to make Landlock
> system calls available without modifying the kernel boot arguments.

It was left out of this list by team decision, as is e.g. bpf.  So not
right now.

Bastian

-- 
Military secrets are the most fleeting of all.
		-- Spock, "The Enterprise Incident", stardate 5027.4

[toc] | [prev] | [next] | [standalone]

#73665

On 12/11/2021 13:45, Bastian Blank wrote:
> Control: tag -1 wontfix
> 
> On Fri, Nov 12, 2021 at 12:23:13PM +0100, Mickaël Salaün wrote:
>> The Landlock security feature is built in Debian kernel since
>> 5.13.12-1~exp1 which is great!  However, it is not enough to enable the
>> CONFIG_SECURITY_LANDLOCK option as described in the related help.  The
>> CONFIG_LSM option needs to be prepended by "landlock," to make Landlock
>> system calls available without modifying the kernel boot arguments.
> 
> It was left out of this list by team decision, as is e.g. bpf.  So not
> right now.

Could we know the reason? FYI, Landlock is enabled by default at least
in Arch and Fedora (and then Gentoo according to selected configuration).

BPF-LSM is very specific and would require privileged services to manage
it. However, Landlock brings new security features (like seccomp) and
would then benefit potentially all Debian applications. It is designed
from the beginning to be safely usable by all users, including
unprivileged ones.

[toc] | [prev] | [next] | [standalone]

#74926

[Multipart message — attachments visible in raw view] — view raw

I support enabling this in default Debian kernels. It would allow
application developers to use landlock sandboxing while developing
programs. By not enabling it, developers have to build custom kernels and
ask that their customers do this as well to run landlock protected
programs.

It should not cause any negative impact and will only potentially improve
the security of applications in Debian.

Thanks,

Brad
Virginia Tech

[toc] | [prev] | [next] | [standalone]

#76047 — Bug#999551: marked as done (Support Landlock by default in Debian kernels)

[Multipart message — attachments visible in raw view] — view raw

Your message dated Tue, 02 Aug 2022 18:00:11 +0000
with message-id <E1oIwBf-00BuAa-Ds@fasolo.debian.org>
and subject line Bug#999551: fixed in linux 5.19-1~exp1
has caused the Debian Bug report #999551,
regarding Support Landlock by default in Debian kernels
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
999551: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=999551
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

[toc] | [prev] | [next] | [standalone]

#76092 — Bug#999551: marked as done (Support Landlock by default in Debian kernels)

[Multipart message — attachments visible in raw view] — view raw

Your message dated Thu, 11 Aug 2022 06:00:10 +0000
with message-id <E1oM1Eo-004xKE-NB@fasolo.debian.org>
and subject line Bug#999551: fixed in linux 5.18.16-1
has caused the Debian Bug report #999551,
regarding Support Landlock by default in Debian kernels
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
999551: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=999551
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.kernel

csiph-web