mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2026-09-18 22:59:29 +02:00
Mickaël Salaün
e761a88ced
Tracepoint emission requires the denial framework (layer identification, request validation) without depending on CONFIG_AUDIT. Separate the denial logging infrastructure from the audit-specific code by introducing a common log framework. Create CONFIG_SECURITY_LANDLOCK_LOG, enabled by default when CONFIG_AUDIT is set; a following commit extends it to CONFIG_TRACEPOINTS when the first tracepoint consumer is added. Move the common framework (the request types, the layer identification and request validation, and the landlock_log_denial() and landlock_log_free_domain() entry points) into log.c and log.h, and keep the audit-specific record formatting in audit.c. log.o is built for CONFIG_SECURITY_LANDLOCK_LOG and audit.o for CONFIG_AUDIT, so the common framework is available to a tracepoints-only build. The entry points dispatch to no-op static inline audit stubs without CONFIG_AUDIT, so the call sites stay unconditional. Rename the former landlock_log_drop_domain() to landlock_log_free_domain() to match the landlock_free_domain tracepoint added in a following commit. landlock_log_denial() counts denials even without audit, so its declaration and no-op stub are guarded by CONFIG_SECURITY_LANDLOCK_LOG, not CONFIG_AUDIT; a CONFIG_AUDIT guard would expose the stub and clash with log.c's definition in a tracepoints-only build. Widen the ID allocation (id.o and the landlock_init_id() / landlock_get_id_range() declarations) and the log-state representation (the domain_exec and log_subdomains_off credential fields, the landlock_hierarchy log fields, and the code that maintains them) from CONFIG_AUDIT to CONFIG_SECURITY_LANDLOCK_LOG, so each field and its writer share one guard and are available to tracing without audit support. Widen the denial-path state that feeds the per-denial logging decision the same way, so the "logged" verdict is computed identically whether or not CONFIG_AUDIT is set. Widening fown_layer is what keeps the file-owner-signal path valid without audit: otherwise hook_file_send_sigiotask() would leave layer_plus_one at zero, tripping the is_valid_request() canary and dropping the LANDLOCK_SCOPE_SIGNAL denial from tracing. The ruleset-level quiet_masks stays on no CONFIG guard: it is builder state validated and stored from user input, kept available so LANDLOCK_ADD_RULE_QUIET flags are accepted and ignored, not rejected, when CONFIG_SECURITY_LANDLOCK_LOG is disabled. Cc: Günther Noack <gnoack@google.com> Link: https://patch.msgid.link/20260811094338.288094-5-mic@digikod.net Signed-off-by: Mickaël Salaün <mic@digikod.net>
70 lines
1.7 KiB
C
70 lines
1.7 KiB
C
// SPDX-License-Identifier: GPL-2.0-only
|
|
/*
|
|
* Landlock - Credential hooks
|
|
*
|
|
* Copyright © 2017-2020 Mickaël Salaün <mic@digikod.net>
|
|
* Copyright © 2018-2020 ANSSI
|
|
* Copyright © 2024-2025 Microsoft Corporation
|
|
*/
|
|
|
|
#include <linux/binfmts.h>
|
|
#include <linux/cred.h>
|
|
#include <linux/lsm_hooks.h>
|
|
|
|
#include "common.h"
|
|
#include "cred.h"
|
|
#include "ruleset.h"
|
|
#include "setup.h"
|
|
|
|
static void hook_cred_transfer(struct cred *const new,
|
|
const struct cred *const old)
|
|
{
|
|
const struct landlock_cred_security *const old_llcred =
|
|
landlock_cred(old);
|
|
|
|
landlock_get_domain(old_llcred->domain);
|
|
*landlock_cred(new) = *old_llcred;
|
|
}
|
|
|
|
static int hook_cred_prepare(struct cred *const new,
|
|
const struct cred *const old, const gfp_t gfp)
|
|
{
|
|
hook_cred_transfer(new, old);
|
|
return 0;
|
|
}
|
|
|
|
static void hook_cred_free(struct cred *const cred)
|
|
{
|
|
struct landlock_domain *const dom = landlock_cred(cred)->domain;
|
|
|
|
if (dom)
|
|
landlock_put_domain_deferred(dom);
|
|
}
|
|
|
|
#ifdef CONFIG_SECURITY_LANDLOCK_LOG
|
|
|
|
static int hook_bprm_creds_for_exec(struct linux_binprm *const bprm)
|
|
{
|
|
/* Resets for each execution. */
|
|
landlock_cred(bprm->cred)->domain_exec = 0;
|
|
return 0;
|
|
}
|
|
|
|
#endif /* CONFIG_SECURITY_LANDLOCK_LOG */
|
|
|
|
static struct security_hook_list landlock_hooks[] __ro_after_init = {
|
|
LSM_HOOK_INIT(cred_prepare, hook_cred_prepare),
|
|
LSM_HOOK_INIT(cred_transfer, hook_cred_transfer),
|
|
LSM_HOOK_INIT(cred_free, hook_cred_free),
|
|
|
|
#ifdef CONFIG_SECURITY_LANDLOCK_LOG
|
|
LSM_HOOK_INIT(bprm_creds_for_exec, hook_bprm_creds_for_exec),
|
|
#endif /* CONFIG_SECURITY_LANDLOCK_LOG */
|
|
};
|
|
|
|
__init void landlock_add_cred_hooks(void)
|
|
{
|
|
security_add_hooks(landlock_hooks, ARRAY_SIZE(landlock_hooks),
|
|
&landlock_lsmid);
|
|
}
|