@@ -71,6 +71,14 @@ get_blocker(const enum landlock_request_type type,
if (WARN_ON_ONCE(access_bit >= ARRAY_SIZE(net_access_strings)))
return "unknown";
return net_access_strings[access_bit];
+
+ case LANDLOCK_REQUEST_SCOPE_ABSTRACT_UNIX_SOCKET:
+ WARN_ON_ONCE(access_bit != -1);
+ return "scope.abstract_unix_socket";
+
+ case LANDLOCK_REQUEST_SCOPE_SIGNAL:
+ WARN_ON_ONCE(access_bit != -1);
+ return "scope.signal";
}
WARN_ON_ONCE(1);
@@ -20,6 +20,8 @@ enum landlock_request_type {
LANDLOCK_REQUEST_FS_CHANGE_LAYOUT,
LANDLOCK_REQUEST_FS_ACCESS,
LANDLOCK_REQUEST_NET_ACCESS,
+ LANDLOCK_REQUEST_SCOPE_ABSTRACT_UNIX_SOCKET,
+ LANDLOCK_REQUEST_SCOPE_SIGNAL,
};
/*
@@ -1798,6 +1798,7 @@ static void hook_file_set_fowner(struct file *file)
const struct landlock_cred_security *new_subject;
struct landlock_cred_security *fown_subject;
struct landlock_ruleset *prev_dom;
+ size_t handle_layer;
/*
* Lock already held by __f_setown(), see commit 26f204380a3c ("fs: Fix
@@ -1807,15 +1808,17 @@ static void hook_file_set_fowner(struct file *file)
fown_subject = &landlock_file(file)->fown_subject;
prev_dom = fown_subject->domain;
- new_subject = landlock_get_applicable_subject(current_cred(),
- signal_scope, NULL);
+ new_subject = landlock_get_applicable_subject(
+ current_cred(), signal_scope, &handle_layer);
if (new_subject) {
landlock_get_ruleset(new_subject->domain);
*fown_subject = *new_subject;
+ landlock_file(file)->fown_layer = handle_layer;
} else {
static const struct landlock_cred_security empty = {};
*fown_subject = empty;
+ landlock_file(file)->fown_layer = 0;
}
/* Called in an RCU read-side critical section. */
@@ -9,6 +9,7 @@
#ifndef _SECURITY_LANDLOCK_FS_H
#define _SECURITY_LANDLOCK_FS_H
+#include <linux/build_bug.h>
#include <linux/fs.h>
#include <linux/init.h>
#include <linux/rcupdate.h>
@@ -61,6 +62,11 @@ struct landlock_file_security {
* _LANDLOCK_ACCESS_FS_OPTIONAL).
*/
deny_masks_t deny_masks;
+ /**
+ * @fown_layer: Layer level of @fown_subject->domain with
+ * LANDLOCK_SCOPE_SIGNAL.
+ */
+ u8 fown_layer;
#endif /* CONFIG_AUDIT */
/**
@@ -73,6 +79,14 @@ struct landlock_file_security {
struct landlock_cred_security fown_subject;
};
+#ifdef CONFIG_AUDIT
+
+/* Makes sure all layers can be identified. */
+static_assert((typeof_member(struct landlock_file_security, fown_layer))~0 >=
+ LANDLOCK_MAX_NUM_LAYERS);
+
+#endif /* CONFIG_AUDIT */
+
/**
* struct landlock_superblock_security - Superblock security blob
*
@@ -264,26 +264,41 @@ static int hook_unix_stream_connect(struct sock *const sock,
struct sock *const other,
struct sock *const newsk)
{
+ size_t handle_layer;
const struct landlock_cred_security *const subject =
landlock_get_applicable_subject(current_cred(), unix_scope,
- NULL);
+ &handle_layer);
/* Quick return for non-landlocked tasks. */
if (!subject)
return 0;
- if (is_abstract_socket(other) && sock_is_scoped(other, subject->domain))
- return -EPERM;
+ if (!is_abstract_socket(other))
+ return 0;
+
+ if (!sock_is_scoped(other, subject->domain))
+ return 0;
- return 0;
+ landlock_log_denial(subject, &(struct landlock_request) {
+ .type = LANDLOCK_REQUEST_SCOPE_ABSTRACT_UNIX_SOCKET,
+ .audit = {
+ .type = LSM_AUDIT_DATA_NET,
+ .u.net = &(struct lsm_network_audit) {
+ .sk = other,
+ },
+ },
+ .layer_plus_one = handle_layer + 1,
+ });
+ return -EPERM;
}
static int hook_unix_may_send(struct socket *const sock,
struct socket *const other)
{
+ size_t handle_layer;
const struct landlock_cred_security *const subject =
landlock_get_applicable_subject(current_cred(), unix_scope,
- NULL);
+ &handle_layer);
if (!subject)
return 0;
@@ -295,11 +310,23 @@ static int hook_unix_may_send(struct socket *const sock,
if (unix_peer(sock->sk) == other->sk)
return 0;
- if (is_abstract_socket(other->sk) &&
- sock_is_scoped(other->sk, subject->domain))
- return -EPERM;
+ if (!is_abstract_socket(other->sk))
+ return 0;
+
+ if (!sock_is_scoped(other->sk, subject->domain))
+ return 0;
- return 0;
+ landlock_log_denial(subject, &(struct landlock_request) {
+ .type = LANDLOCK_REQUEST_SCOPE_ABSTRACT_UNIX_SOCKET,
+ .audit = {
+ .type = LSM_AUDIT_DATA_NET,
+ .u.net = &(struct lsm_network_audit) {
+ .sk = other->sk,
+ },
+ },
+ .layer_plus_one = handle_layer + 1,
+ });
+ return -EPERM;
}
static const struct access_masks signal_scope = {
@@ -311,13 +338,15 @@ static int hook_task_kill(struct task_struct *const p,
const struct cred *cred)
{
bool is_scoped;
+ size_t handle_layer;
const struct landlock_cred_security *subject;
if (!cred)
/* Not dealing with USB IO. */
cred = current_cred();
- subject = landlock_get_applicable_subject(cred, signal_scope, NULL);
+ subject = landlock_get_applicable_subject(cred, signal_scope,
+ &handle_layer);
/* Quick return for non-landlocked tasks. */
if (!subject)
@@ -329,10 +358,19 @@ static int hook_task_kill(struct task_struct *const p,
landlock_get_task_domain(p),
signal_scope.scope);
}
- if (is_scoped)
- return -EPERM;
- return 0;
+ if (!is_scoped)
+ return 0;
+
+ landlock_log_denial(subject, &(struct landlock_request) {
+ .type = LANDLOCK_REQUEST_SCOPE_SIGNAL,
+ .audit = {
+ .type = LSM_AUDIT_DATA_TASK,
+ .u.tsk = p,
+ },
+ .layer_plus_one = handle_layer + 1,
+ });
+ return -EPERM;
}
static int hook_file_send_sigiotask(struct task_struct *tsk,
@@ -361,10 +399,19 @@ static int hook_file_send_sigiotask(struct task_struct *tsk,
landlock_get_task_domain(tsk),
signal_scope.scope);
}
- if (is_scoped)
- return -EPERM;
- return 0;
+ if (!is_scoped)
+ return 0;
+
+ landlock_log_denial(subject, &(struct landlock_request) {
+ .type = LANDLOCK_REQUEST_SCOPE_SIGNAL,
+ .audit = {
+ .type = LSM_AUDIT_DATA_TASK,
+ .u.tsk = tsk,
+ },
+ .layer_plus_one = landlock_file(fown->file)->fown_layer + 1,
+ });
+ return -EPERM;
}
static struct security_hook_list landlock_hooks[] __ro_after_init = {
Add audit support for unix_stream_connect, unix_may_send, task_kill, and file_send_sigiotask hooks. The related blockers are: - scope.abstract_unix_socket - scope.signal Audit event sample for abstract unix socket: type=LANDLOCK_DENY msg=audit(1729738800.268:30): domain=195ba459b blockers=scope.abstract_unix_socket path=00666F6F Audit event sample for signal: type=LANDLOCK_DENY msg=audit(1729738800.291:31): domain=195ba459b blockers=scope.signal opid=1 ocomm="systemd" Refactor and simplify error handling in LSM hooks. Extend struct landlock_file_security with fown_layer and use it to log the blocking domain. The struct aligned size is still 16 bytes. Cc: Günther Noack <gnoack@google.com> Cc: Tahera Fahimi <fahimitahera@gmail.com> Signed-off-by: Mickaël Salaün <mic@digikod.net> Link: https://lore.kernel.org/r/20250308184422.2159360-16-mic@digikod.net --- Changes since v5: - Move request declarations in the landlock_log_denial() calls to not impact allowed requests with audit, and return as soon as possible when access is allowed. - Store a fown_layer per file and use it to log the blocking domain. - Refactor and simplify error handling in LSM hooks. Changes since v4: - Rebase on top of the landlock_log_denial() and subject type changes. Changes since v3: - Cosmetic change to the "scope.*" blocker names. - Extend commit message. Changes since v1: - New patch. --- security/landlock/audit.c | 8 ++++ security/landlock/audit.h | 2 + security/landlock/fs.c | 7 +++- security/landlock/fs.h | 14 +++++++ security/landlock/task.c | 79 +++++++++++++++++++++++++++++++-------- 5 files changed, 92 insertions(+), 18 deletions(-)