[PATCH v2 0/6] landlock: Add scoped access bit for SysV message queues

[Justin Suess]

This series extends Landlock with a new scoped access right,
LANDLOCK_SCOPE_SYSV_MSG_QUEUE, allowing a sandboxed process to be
restricted from interacting with SysV message queues created outside
of its Landlock domain (or a nested domain).

While use of SysV message queues is less common than other IPC types,
they are commonly used in older applications which may be vulnerable
to exploitation, so they are a meaningful attack surface to restrict.

Background
==========
SysV message queues have no FD or process-local handle.  A msqid is
valid IPC-namespace-wide and can be obtained without calling
msgget(), so simply hooking msgget() is insufficient.  Domain
provenance has to be tracked on the queue itself and checked on
every operation against it.

Approach
========
A new credential blob is attached to each kern_ipc_perm at creation
time, recording the creating task's Landlock domain and a @kind
tag identifying the IPC object type.  The @kind tag is required
because the LSM core allocates an IPC blob for every kern_ipc_perm
regardless of kind, and the generic ipc_permission hook fires for
semaphores and shared memory as well as message queues.

The enum also leaves room to extend scoping to sem/shm later
without changing the blob layout.

Enforcement is done from security_ipc_permission(), which is the
single choke point for msgget() on an existing queue, msgsnd(),
msgrcv(), and the msgctl() variants that go through ipcperms()
(IPC_STAT, MSG_STAT, MSG_STAT_ANY).  msgctl_down() (IPC_RMID and
IPC_SET) bypasses ipcperms(), so the per-call msg_queue_msgctl
hook is kept for those cases.  msg_queue_msgctl also covers the
IPC_INFO / MSG_INFO case where no specific queue exists.

Quirks
======
- Denials surface as -EACCES rather than -EPERM because the generic
  ipcperms() path maps every LSM denial to -EACCES before returning
  to userspace.  This is documented and the selftests check for
  -EACCES accordingly.
- Because there is no persistent handle, a msqid already obtained
  by a process before it enforces this scope can become unusable
  once the restriction is in place; this is intentional and
  documented.

Patch layout
============
  1. Add the kern_ipc_perm credential blob and @kind enum.
  2. Implement LANDLOCK_SCOPE_SYSV_MSG_QUEUE, the ipc_permission
     hook, and msg_queue_msgctl coverage for IPC_RMID/IPC_SET and
     IPC_INFO/MSG_INFO.
  3. Bump the Landlock ABI.
  4. Selftests covering msgget plus a separate fixture for msgsnd,
     msgrcv, and msgctl using a pre-created msqid.
  5. sandboxer sample support for the new scope.
  6. Documentation updates covering the new scope, the -EACCES
     return code, and the implications of non-persistent handles.

Test coverage
=============
Selftests exercise denial and allow paths for msgget, msgsnd,
msgrcv, and msgctl(IPC_STAT) across domain boundaries, including
nested-domain inheritance.  All existing and added tests are
passing.

Changes since v1
================
- Rebased on mic/next.
- Fixed the kernel-doc Return descriptions of hook_ipc_permission()
  and hook_msg_queue_msgctl().
- Renamed the internal audit request type to
  LANDLOCK_REQUEST_SCOPE_SYSV_MSG_QUEUE for consistency with the
  UAPI macro and the "scope.sysv_msg_queue" audit blocker string.
- Integrated the new scope with the sandboxer's quiet access
  support added in ABI 10 (new "sysv_msg_queue" LL_QUIET_ACCESS
  token).
- Selftests: track the created msqid in the fixture and remove it in
  FIXTURE_TEARDOWN_PARENT() so queues are reclaimed even when a failed
  assertion aborts a test (and never subject to the scoping under
  test); use IPC_PRIVATE where the key is not needed.
- Added CONFIG_SYSVIPC=y to the selftest config fragment.
- Fixed the patch 6 subject typo (LANDLOCK_SCOPE_SYSV_MESSAGE_QUEUE)
  and replaced an incorrect ipcperms(3) manpage reference with the
  kernel helper ipcperms().
- Reworded the LANDLOCK_SCOPE_SYSV_MSG_QUEUE UAPI comment and the
  in-code comment explaining the -EACCES mapping.

v1: https://lore.kernel.org/all/20260521160640.1716746-1-utilityemal77@xxxxxxxxx/

Kind Regards,
Justin Suess

Justin Suess (6):
  landlock: Add kern_ipc_perm credential blob structs
  landlock: Add LANDLOCK_SCOPE_SYSV_MSG_QUEUE
  landlock: Bump ABI for LANDLOCK_SCOPE_SYSV_MSG_QUEUE
  selftests/landlock: Test LANDLOCK_SCOPE_SYSV_MSG_QUEUE
  samples/landlock: Support LANDLOCK_SCOPE_SYSV_MSG_QUEUE in sandboxer
  landlock: Document LANDLOCK_SCOPE_SYSV_MSG_QUEUE

 Documentation/admin-guide/LSM/landlock.rst    |   1 +
 Documentation/userspace-api/landlock.rst      |  30 +-
 include/uapi/linux/landlock.h                 |   4 +
 samples/landlock/sandboxer.c                  |  24 +-
 security/landlock/audit.c                     |   4 +
 security/landlock/audit.h                     |   1 +
 security/landlock/limits.h                    |   2 +-
 security/landlock/setup.c                     |   1 +
 security/landlock/syscalls.c                  |   2 +-
 security/landlock/task.c                      | 137 +++++++++
 security/landlock/task.h                      |  50 ++++
 tools/testing/selftests/landlock/base_test.c  |   2 +-
 tools/testing/selftests/landlock/config       |   1 +
 .../landlock/scoped_sysv_msg_queue_test.c     | 265 ++++++++++++++++++
 .../testing/selftests/landlock/scoped_test.c  |   2 +-
 15 files changed, 517 insertions(+), 9 deletions(-)
 create mode 100644 tools/testing/selftests/landlock/scoped_sysv_msg_queue_test.c


base-commit: 28ca6f6f271d47253c240e64cc88a72c89456d74
-- 
2.54.0