@@ -21,6 +21,9 @@ static const char *get_blocker(const enum landlock_request_type type)
switch (type) {
case LANDLOCK_REQUEST_PTRACE:
return "ptrace";
+
+ case LANDLOCK_REQUEST_FS_CHANGE_LAYOUT:
+ return "fs_change_layout";
}
WARN_ON_ONCE(1);
@@ -15,6 +15,7 @@
enum landlock_request_type {
LANDLOCK_REQUEST_PTRACE = 1,
+ LANDLOCK_REQUEST_FS_CHANGE_LAYOUT,
};
/*
@@ -23,6 +23,7 @@
#include <linux/kernel.h>
#include <linux/limits.h>
#include <linux/list.h>
+#include <linux/lsm_audit.h>
#include <linux/lsm_hooks.h>
#include <linux/mount.h>
#include <linux/namei.h>
@@ -37,6 +38,7 @@
#include <uapi/linux/landlock.h>
#include "access.h"
+#include "audit.h"
#include "common.h"
#include "cred.h"
#include "fs.h"
@@ -1308,6 +1310,38 @@ static void hook_sb_delete(struct super_block *const sb)
!atomic_long_read(&landlock_superblock(sb)->inode_refs));
}
+static void
+log_fs_change_layout_path(const struct landlock_ruleset *const domain,
+ const struct path *const path)
+{
+ const struct landlock_request request = {
+ .type = LANDLOCK_REQUEST_FS_CHANGE_LAYOUT,
+ .audit = {
+ .type = LSM_AUDIT_DATA_PATH,
+ .u.path = *path,
+ },
+ .layer_plus_one = landlock_match_layer_level(domain, any_fs) + 1,
+ };
+
+ landlock_log_denial(domain, &request);
+}
+
+static void
+log_fs_change_layout_dentry(const struct landlock_ruleset *const domain,
+ struct dentry *const dentry)
+{
+ const struct landlock_request request = {
+ .type = LANDLOCK_REQUEST_FS_CHANGE_LAYOUT,
+ .audit = {
+ .type = LSM_AUDIT_DATA_DENTRY,
+ .u.dentry = dentry,
+ },
+ .layer_plus_one = landlock_match_layer_level(domain, any_fs) + 1,
+ };
+
+ landlock_log_denial(domain, &request);
+}
+
/*
* Because a Landlock security policy is defined according to the filesystem
* topology (i.e. the mount namespace), changing it may grant access to files
@@ -1330,16 +1364,24 @@ static int hook_sb_mount(const char *const dev_name,
const struct path *const path, const char *const type,
const unsigned long flags, void *const data)
{
- if (!get_current_fs_domain())
+ const struct landlock_ruleset *const dom = get_current_fs_domain();
+
+ if (!dom)
return 0;
+
+ log_fs_change_layout_path(dom, path);
return -EPERM;
}
static int hook_move_mount(const struct path *const from_path,
const struct path *const to_path)
{
- if (!get_current_fs_domain())
+ const struct landlock_ruleset *const dom = get_current_fs_domain();
+
+ if (!dom)
return 0;
+
+ log_fs_change_layout_path(dom, to_path);
return -EPERM;
}
@@ -1349,15 +1391,23 @@ static int hook_move_mount(const struct path *const from_path,
*/
static int hook_sb_umount(struct vfsmount *const mnt, const int flags)
{
- if (!get_current_fs_domain())
+ const struct landlock_ruleset *const dom = get_current_fs_domain();
+
+ if (!dom)
return 0;
+
+ log_fs_change_layout_dentry(dom, mnt->mnt_root);
return -EPERM;
}
static int hook_sb_remount(struct super_block *const sb, void *const mnt_opts)
{
- if (!get_current_fs_domain())
+ const struct landlock_ruleset *const dom = get_current_fs_domain();
+
+ if (!dom)
return 0;
+
+ log_fs_change_layout_dentry(dom, sb->s_root);
return -EPERM;
}
@@ -1372,8 +1422,12 @@ static int hook_sb_remount(struct super_block *const sb, void *const mnt_opts)
static int hook_sb_pivotroot(const struct path *const old_path,
const struct path *const new_path)
{
- if (!get_current_fs_domain())
+ const struct landlock_ruleset *const dom = get_current_fs_domain();
+
+ if (!dom)
return 0;
+
+ log_fs_change_layout_path(dom, new_path);
return -EPERM;
}
@@ -278,6 +278,37 @@ landlock_match_ruleset(const struct landlock_ruleset *const ruleset,
return NULL;
}
+/**
+ * landlock_match_layer_level - Return the layer level restricting @masks
+ *
+ * @ruleset: Landlock ruleset (used as a domain)
+ * @masks: access masks
+ *
+ * Returns: the number of the layer restricting/handling any right of @access,
+ * or return 0 (i.e. first layer) otherwise.
+ */
+static inline size_t
+landlock_match_layer_level(const struct landlock_ruleset *const ruleset,
+ const struct access_masks masks)
+{
+ const union access_masks_all masks_all = {
+ .masks = masks,
+ };
+ size_t layer_level;
+
+ for (layer_level = ruleset->num_layers; layer_level >= 0;
+ layer_level--) {
+ union access_masks_all layer = {
+ .masks = ruleset->access_masks[layer_level],
+ };
+
+ if (masks_all.all & layer.all)
+ return layer_level;
+ }
+
+ return 0;
+}
+
static inline void
landlock_add_fs_access_mask(struct landlock_ruleset *const ruleset,
const access_mask_t fs_access_mask,
Add audit support for sb_mount, move_mount, sb_umount, sb_remount, and sb_pivot_root hooks. Add and use a new landlock_match_layer_level() helper. Audit record sample: DENY: blockers=fs_change_layout name="/" dev="tmpfs" ino=1 SYSCALL: arch=c000003e syscall=166 success=no exit=-1 ... Cc: Günther Noack <gnoack@google.com> Signed-off-by: Mickaël Salaün <mic@digikod.net> Link: https://lore.kernel.org/r/20241022161009.982584-10-mic@digikod.net --- Changes since v2: * Log the domain that denied the action because not all layers block FS layout changes. Changes since v1: * Rebased on the TCP patch series. * Don't log missing permissions, only domain layer, and then remove the permission word (suggested by Günther) --- security/landlock/audit.c | 3 ++ security/landlock/audit.h | 1 + security/landlock/fs.c | 64 ++++++++++++++++++++++++++++++++++--- security/landlock/ruleset.h | 31 ++++++++++++++++++ 4 files changed, 94 insertions(+), 5 deletions(-)