sandlock-core: deny by file-handle identity at open to close hardlink/rename bypass

Signed-off-by: Cong Wang <cwang@multikernel.io>

Author: congwang-mk

crates/sandlock-core/src/policy_fn.rs

@@ -147,22 +147,22 @@ pub struct PolicyContext {
     ceiling: LivePolicy,
     restricted: HashSet<&'static str>,
     pid_overrides: Arc<RwLock<HashMap<u32, HashSet<IpAddr>>>>,
-    denied_paths: Arc<RwLock<HashSet<String>>>,
+    denied: Arc<crate::seccomp::state::DeniedSet>,
 }
 
 impl PolicyContext {
     pub(crate) fn new(
         live: Arc<RwLock<LivePolicy>>,
         ceiling: LivePolicy,
         pid_overrides: Arc<RwLock<HashMap<u32, HashSet<IpAddr>>>>,
-        denied_paths: Arc<RwLock<HashSet<String>>>,
+        denied: Arc<crate::seccomp::state::DeniedSet>,
     ) -> Self {
         Self {
             live,
             ceiling,
             restricted: HashSet::new(),
             pid_overrides,
-            denied_paths,
+            denied,
         }
     }
 
@@ -246,16 +246,16 @@ impl PolicyContext {
     // ---- Filesystem restriction ----
 
     /// Deny access to a path (and all children). Checked by the supervisor
-    /// on openat/stat/access syscalls. Takes effect immediately.
+    /// on openat/stat/access syscalls. Takes effect immediately. The file's
+    /// inode identity is captured too, so the deny survives hardlinks and
+    /// renames to a non-denied name.
     pub fn deny_path(&self, path: &str) {
-        let mut denied = self.denied_paths.write().unwrap();
-        denied.insert(path.to_string());
+        self.denied.deny(path);
     }
 
     /// Remove a previously denied path.
     pub fn allow_path(&self, path: &str) {
-        let mut denied = self.denied_paths.write().unwrap();
-        denied.remove(path);
+        self.denied.allow(path);
     }
 
     // ---- Internal ----
@@ -337,14 +337,14 @@ pub(crate) fn spawn_policy_fn(
     live: Arc<RwLock<LivePolicy>>,
     ceiling: LivePolicy,
     pid_overrides: Arc<RwLock<HashMap<u32, HashSet<IpAddr>>>>,
-    denied_paths: Arc<RwLock<HashSet<String>>>,
+    denied: Arc<crate::seccomp::state::DeniedSet>,
 ) -> tokio::sync::mpsc::UnboundedSender<PolicyEvent> {
     let (tx, mut rx) = tokio::sync::mpsc::unbounded_channel::<PolicyEvent>();
 
     std::thread::Builder::new()
         .name("sandlock-policy-fn".to_string())
         .spawn(move || {
-            let mut ctx = PolicyContext::new(live, ceiling, pid_overrides, denied_paths);
+            let mut ctx = PolicyContext::new(live, ceiling, pid_overrides, denied);
 
             while let Some(pe) = rx.blocking_recv() {
                 let verdict = callback(pe.event, &mut ctx);
@@ -389,8 +389,8 @@ mod tests {
         }));
         let ceiling = test_live();
         let pid_overrides = Arc::new(RwLock::new(HashMap::new()));
-        let denied_paths = Arc::new(RwLock::new(HashSet::new()));
-        let mut ctx = PolicyContext::new(live.clone(), ceiling, pid_overrides, denied_paths);
+        let denied = Arc::new(crate::seccomp::state::DeniedSet::default());
+        let mut ctx = PolicyContext::new(live.clone(), ceiling, pid_overrides, denied);
 
         let ip: IpAddr = "127.0.0.1".parse().unwrap();
         ctx.grant_network(&[ip]).unwrap();
@@ -406,8 +406,8 @@ mod tests {
         }));
         let ceiling = test_live();
         let pid_overrides = Arc::new(RwLock::new(HashMap::new()));
-        let denied_paths = Arc::new(RwLock::new(HashSet::new()));
-        let mut ctx = PolicyContext::new(live.clone(), ceiling, pid_overrides, denied_paths);
+        let denied = Arc::new(crate::seccomp::state::DeniedSet::default());
+        let mut ctx = PolicyContext::new(live.clone(), ceiling, pid_overrides, denied);
 
         // Try to grant an IP not in ceiling — should be silently ignored
         let foreign: IpAddr = "8.8.8.8".parse().unwrap();
@@ -420,8 +420,8 @@ mod tests {
         let live = Arc::new(RwLock::new(test_live()));
         let ceiling = test_live();
         let pid_overrides = Arc::new(RwLock::new(HashMap::new()));
-        let denied_paths = Arc::new(RwLock::new(HashSet::new()));
-        let mut ctx = PolicyContext::new(live, ceiling, pid_overrides, denied_paths);
+        let denied = Arc::new(crate::seccomp::state::DeniedSet::default());
+        let mut ctx = PolicyContext::new(live, ceiling, pid_overrides, denied);
 
         ctx.restrict_network(&[]);
         let ip: IpAddr = "127.0.0.1".parse().unwrap();
@@ -433,8 +433,8 @@ mod tests {
         let live = Arc::new(RwLock::new(test_live()));
         let ceiling = test_live();
         let pid_overrides = Arc::new(RwLock::new(HashMap::new()));
-        let denied_paths = Arc::new(RwLock::new(HashSet::new()));
-        let mut ctx = PolicyContext::new(live.clone(), ceiling, pid_overrides, denied_paths);
+        let denied = Arc::new(crate::seccomp::state::DeniedSet::default());
+        let mut ctx = PolicyContext::new(live.clone(), ceiling, pid_overrides, denied);
 
         ctx.restrict_max_memory(256 * 1024 * 1024);
         assert_eq!(live.read().unwrap().max_memory_bytes, 256 * 1024 * 1024);
@@ -445,8 +445,8 @@ mod tests {
         let live = Arc::new(RwLock::new(test_live()));
         let ceiling = test_live();
         let pid_overrides = Arc::new(RwLock::new(HashMap::new()));
-        let denied_paths = Arc::new(RwLock::new(HashSet::new()));
-        let ctx = PolicyContext::new(live, ceiling, pid_overrides.clone(), denied_paths);
+        let denied = Arc::new(crate::seccomp::state::DeniedSet::default());
+        let ctx = PolicyContext::new(live, ceiling, pid_overrides.clone(), denied);
 
         let localhost: IpAddr = "127.0.0.1".parse().unwrap();
         ctx.restrict_pid_network(1234, &[localhost]);
@@ -462,8 +462,8 @@ mod tests {
         let live = Arc::new(RwLock::new(test_live()));
         let ceiling = test_live();
         let pid_overrides = Arc::new(RwLock::new(HashMap::new()));
-        let denied_paths = Arc::new(RwLock::new(HashSet::new()));
-        let ctx = PolicyContext::new(live, ceiling, pid_overrides.clone(), denied_paths);
+        let denied = Arc::new(crate::seccomp::state::DeniedSet::default());
+        let ctx = PolicyContext::new(live, ceiling, pid_overrides.clone(), denied);
 
         let localhost: IpAddr = "127.0.0.1".parse().unwrap();
         ctx.restrict_pid_network(1234, &[localhost]);

crates/sandlock-core/src/sandbox.rs

@@ -1659,10 +1659,10 @@ impl Sandbox {
 
             let mut policy_fn_state = PolicyFnState::new();
 
-            if let Ok(mut denied) = policy_fn_state.denied_paths.write() {
-                for path in &self.fs_denied {
-                    denied.insert(path.to_string_lossy().into_owned());
-                }
+            for path in &self.fs_denied {
+                // Captures the path prefix and the file's inode identity, so
+                // the deny survives hardlinks/renames to a non-denied name.
+                policy_fn_state.denied.deny(&path.to_string_lossy());
             }
 
             if let Some(ref callback) = self.policy_fn {
@@ -1687,11 +1687,11 @@ impl Sandbox {
                 };
                 let ceiling = live.clone();
                 let live = std::sync::Arc::new(std::sync::RwLock::new(live));
-                let denied_paths = policy_fn_state.denied_paths.clone();
+                let denied = policy_fn_state.denied.clone();
                 let pid_overrides = net_state.pid_ip_overrides.clone();
                 policy_fn_state.live_policy = Some(live.clone());
                 let tx = crate::policy_fn::spawn_policy_fn(
-                    callback.clone(), live, ceiling, pid_overrides, denied_paths,
+                    callback.clone(), live, ceiling, pid_overrides, denied,
                 );
                 policy_fn_state.event_tx = Some(tx);
             }

crates/sandlock-core/src/seccomp/notif.rs

@@ -370,6 +370,16 @@ fn is_denied_with_symlink_resolve(
         if policy_fn_state.is_path_denied(&real.to_string_lossy()) {
             return true;
         }
+        // Identity check: catches a denied file reached via a hardlink or a
+        // pre-existing alias, where the resolved path itself is not denied
+        // but the file identity is. Best-effort here (path-based precheck);
+        // the race-free authority is the fd identity check in the on-behalf
+        // open.
+        if let Some(id) = super::state::file_id_of_path(&real.to_string_lossy()) {
+            if policy_fn_state.is_id_denied(&id) {
+                return true;
+            }
+        }
     }
     false
 }
@@ -437,6 +447,7 @@ fn realpath_of_fd(fd: RawFd) -> Option<std::path::PathBuf> {
     std::fs::read_link(format!("/proc/self/fd/{}", fd)).ok()
 }
 
+
 fn path_under_any(path: &std::path::Path, list: &[std::path::PathBuf]) -> bool {
     list.iter().any(|p| path.starts_with(p))
 }
@@ -551,6 +562,15 @@ fn reopen_existing_on_behalf(
     if let Some(errno) = deny_open_verdict(&realpath, flags, policy, pfs) {
         return NotifAction::Errno(errno);
     }
+    // Identity check on the pinned file: a denied file reached via a hardlink,
+    // a rename to a non-denied name, or a pre-existing alias has a realpath
+    // that is not denied, but its handle identity is. Race-free — this is the
+    // exact file the child will receive.
+    if let Some(id) = super::state::file_id_of_fd(probe.as_raw_fd()) {
+        if pfs.is_id_denied(&id) {
+            return NotifAction::Errno(libc::EACCES);
+        }
+    }
     // Resolution-only flags are stripped from the reopen.
     let reopen_flags =
         flags as i32 & !(libc::O_CREAT | libc::O_EXCL | libc::O_PATH | libc::O_NOFOLLOW);

crates/sandlock-core/src/seccomp/state.rs

@@ -401,6 +401,115 @@ impl TimeRandomState {
     }
 }
 
+// ============================================================
+// DeniedSet — denied paths plus captured file identities
+// ============================================================
+
+/// The filesystem deny set: path prefixes plus the file-handle identities
+/// captured when each path was denied.
+///
+/// The path set is the primary, race-free boundary enforced at `open`. The
+/// identity set makes the deny robust against namespace games (hardlinks,
+/// renames, and pre-existing aliases): a [`FileId`] is the kernel file handle,
+/// which encodes the inode and a generation number, so it travels with the
+/// file's identity rather than the name used to reach it and is immune to
+/// inode reuse. An open is denied if the opened file's identity matches, no
+/// matter which path led to it. With `AT_HANDLE_FID` the kernel encodes an
+/// identity FID for essentially every filesystem (generic inode FID where
+/// NFS-export ops are absent); the rare path that still fails captures no
+/// identity and relies on the always-on path prefix.
+#[derive(Default)]
+pub struct DeniedSet {
+    paths: std::sync::RwLock<HashSet<String>>,
+    ids: std::sync::RwLock<HashSet<FileId>>,
+}
+
+/// A file's stable identity: its kernel file handle, keyed by the superblock
+/// device so identical handles from different filesystems cannot collide.
+#[derive(Clone, PartialEq, Eq, Hash)]
+pub(crate) struct FileId {
+    dev: u64,
+    handle_type: i32,
+    handle: Vec<u8>,
+}
+
+/// Identity of a path, following symlinks (the open will resolve to the same
+/// target). `None` if it cannot be resolved or no handle can be encoded. The
+/// `(handle_type, handle)` FID comes from [`crate::sys::fs::file_handle`]; it is
+/// keyed by the superblock `dev` so handles from different filesystems cannot
+/// collide.
+pub(crate) fn file_id_of_path(path: &str) -> Option<FileId> {
+    use std::os::unix::fs::MetadataExt;
+    let dev = std::fs::metadata(path).ok()?.dev();
+    let c = std::ffi::CString::new(path).ok()?;
+    let (handle_type, handle) =
+        crate::sys::fs::file_handle(libc::AT_FDCWD, &c, libc::AT_SYMLINK_FOLLOW)?;
+    Some(FileId { dev, handle_type, handle })
+}
+
+/// Identity of an open fd.
+pub(crate) fn file_id_of_fd(fd: std::os::unix::io::RawFd) -> Option<FileId> {
+    let mut st: libc::stat = unsafe { std::mem::zeroed() };
+    if unsafe { libc::fstat(fd, &mut st) } != 0 {
+        return None;
+    }
+    let empty = std::ffi::CString::new("").ok()?;
+    let (handle_type, handle) = crate::sys::fs::file_handle(fd, &empty, libc::AT_EMPTY_PATH)?;
+    Some(FileId { dev: st.st_dev as u64, handle_type, handle })
+}
+
+impl DeniedSet {
+    /// Deny `path` (and its subtree, by prefix). Also captures the file's
+    /// handle identity if it exists now, so the deny still applies after the
+    /// file is hardlinked or renamed to a non-denied name.
+    pub fn deny(&self, path: &str) {
+        if let Ok(mut p) = self.paths.write() {
+            p.insert(path.to_string());
+        }
+        if let Some(id) = file_id_of_path(path) {
+            if let Ok(mut i) = self.ids.write() {
+                i.insert(id);
+            }
+        }
+    }
+
+    /// Stop denying `path`, dropping its captured identity too (best-effort:
+    /// only if the path still resolves). A leftover identity would only ever
+    /// over-deny, which is fail-safe.
+    pub fn allow(&self, path: &str) {
+        if let Ok(mut p) = self.paths.write() {
+            p.remove(path);
+        }
+        if let Some(id) = file_id_of_path(path) {
+            if let Ok(mut i) = self.ids.write() {
+                i.remove(&id);
+            }
+        }
+    }
+
+    /// True if `path` is at or beneath a denied path (lexical prefix).
+    pub fn is_path_denied(&self, path: &str) -> bool {
+        self.paths.read().map_or(false, |denied| {
+            let path = std::path::Path::new(path);
+            denied
+                .iter()
+                .any(|d| path.starts_with(std::path::Path::new(d)))
+        })
+    }
+
+    /// True if `id` is a denied file identity (catches hardlinks, renames, and
+    /// pre-existing aliases regardless of the path used).
+    pub(crate) fn is_id_denied(&self, id: &FileId) -> bool {
+        self.ids.read().map_or(false, |s| s.contains(id))
+    }
+
+    /// Whether any deny rule is in effect.
+    pub fn is_empty(&self) -> bool {
+        self.paths.read().map_or(true, |p| p.is_empty())
+            && self.ids.read().map_or(true, |i| i.is_empty())
+    }
+}
+
 // ============================================================
 // PolicyFnState — dynamic policy callback state
 // ============================================================
@@ -411,37 +520,34 @@ pub struct PolicyFnState {
     pub event_tx: Option<tokio::sync::mpsc::UnboundedSender<crate::policy_fn::PolicyEvent>>,
     /// Shared live policy for dynamic updates (None if no policy_fn).
     pub live_policy: Option<std::sync::Arc<std::sync::RwLock<crate::policy_fn::LivePolicy>>>,
-    /// Dynamically denied paths from policy_fn.
-    pub denied_paths: std::sync::Arc<std::sync::RwLock<HashSet<String>>>,
+    /// Dynamically denied paths and inode identities from policy_fn / fs_deny.
+    pub denied: std::sync::Arc<DeniedSet>,
 }
 
 impl PolicyFnState {
     pub fn new() -> Self {
         Self {
             event_tx: None,
             live_policy: None,
-            denied_paths: std::sync::Arc::new(std::sync::RwLock::new(HashSet::new())),
+            denied: std::sync::Arc::new(DeniedSet::default()),
         }
     }
 
-    /// Check if a path is dynamically denied.
+    /// Check if a path is at or beneath a denied path.
     pub fn is_path_denied(&self, path: &str) -> bool {
-        if let Ok(denied) = self.denied_paths.read() {
-            let path = std::path::Path::new(path);
-            denied.iter().any(|d| path.starts_with(std::path::Path::new(d)))
-        } else {
-            false
-        }
+        self.denied.is_path_denied(path)
+    }
+
+    /// Check if an opened file's handle identity is denied.
+    pub(crate) fn is_id_denied(&self, id: &FileId) -> bool {
+        self.denied.is_id_denied(id)
     }
 
     /// Whether any deny rule is currently in effect. Cheap gate for the
     /// race-free on-behalf open path: with no denies there is no carve-out
     /// to protect and opens are left to the kernel and Landlock.
     pub fn has_denied_paths(&self) -> bool {
-        self.denied_paths
-            .read()
-            .map(|d| !d.is_empty())
-            .unwrap_or(false)
+        !self.denied.is_empty()
     }
 }