security: Add landlock file restriction

[nbouchinet-anssi]

This patch adds a minimalist Landlock support to PAM which restricts the
SUID unix_chkpwd binary to a strict readonly access to /etc/shadow. The
goal here is to provide security in depth limiting access to the few
resources this program needs limiting uncontrolled privileged access to
the system.

The patch should evolve to support finer restrictions on other PAM
modules/binaries.

[ldv-alt]

This binary uses getspnam_r interface to obtain the shadow entry, this doesn't necessarily imply access to /etc/shadow.
Would it be possible to enforce a read-only access to the whole filesystem?

[ldv-alt]

By the way, your patch results to a code that doesn't even compile, this is not a good sign at all.

[l0kod]

I guess it misses a check for the header files (e.g. Suricata).

[nbouchinet-anssi]

By the way, your patch results to a code that doesn't even compile, this is not a good sign at all.

Hi, Thanks for the reply, sorry I indeed missed to add checks for the header files

[t8m]

Hi, Thanks for the reply, sorry I indeed missed to add checks for the header files

It should be also optional as presence of the headers should not automatically mean that the support should be compiled in.

[l0kod]

It should be also optional as presence of the headers should not automatically mean that the support should be compiled in.

I'd suggest to enable sandboxing whenever possible to protect users. This could be an enabled-by-default configuration though, but I'm not sure this complexity is worth it because Landlock support must not break anything anyway.

[nbouchinet-anssi]

This binary uses getspnam_r interface to obtain the shadow entry, this doesn't necessarily imply access to /etc/shadow. Would it be possible to enforce a read-only access to the whole filesystem?

Sorry I didn't saw this interface before the PR, I'll read more about getspnam_r to see if a more fine tuned ruleset is feasible as it will be more restrictive than a read-only access to the whole filesystem.

[nbouchinet-anssi]

Hi, I will not be available for the next 3 weeks.

[nbouchinet-anssi]

Hi, sorry it took far more than 3 weeks for me to reply.

I've change the Landlock rule to enforce a read-only access to the whole filesystem as suggested by @ldv-alt .

The _pam_landlock_restrict_to_file_read() function has thus been removed and could be sent in a later patch permitting a more fine grained Landlock configuration, unused macros has also been removed.

[l0kod]

Looks good to me but I didn't test it.