File access for libraries

[jabedude]

It's a common pattern for sandboxed programs to declare their need to map in executable code by library path. It'd be useful to have support for this in landlock ala LANDLOCK_ACCESS_FS_MAP_EXECUTABLE. I don't believe any existing file access rights apply to shared library usage

[l0kod]

This new access right would make sense. It would require to implement the security_mmap_file() and security_file_mprotect() LSM hooks. See related work: #37

Would you like to give it a try?

[jabedude]

Yes please

[gnoack]

Sounds like a good idea to restrict library loading from surprising locations! You can likely make the decision at the time of opening the file and remember whether mmap-with-executable-bit should be permitted for these, in the struct file. There is prior art for that in the open hook, for the ~TRUNCATE and ~IOCTL_DEV rights. (This is just my initial impression of how this would work though. :) If there are good reasons to do it differently, please do.)

[jabedude]

I have a patch ready/tested, I'll send it to the mailing list late this week/early next week