Skip to content

Commit c56f649

Browse files
l0kodl0kod
committed
landlock: Log mount-related denials
Add audit support for sb_mount, move_mount, sb_umount, sb_remount, and sb_pivot_root hooks. The new related blocker is "fs.change_topology". Audit event sample: type=LANDLOCK_DENY msg=audit(1729738800.349:44): domain=195ba459b blockers=fs.change_topology name="/" dev="tmpfs" ino=1 Remove landlock_get_applicable_domain() and get_current_fs_domain() which are now fully replaced with landlock_get_applicable_subject(). Cc: Günther Noack <gnoack@google.com> Link: https://lore.kernel.org/r/20250320190717.2287696-12-mic@digikod.net Signed-off-by: Mickaël Salaün <mic@digikod.net>
1 parent 1d63698 commit c56f649

4 files changed

Lines changed: 74 additions & 41 deletions

File tree

‎security/landlock/audit.c‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,9 @@ static const char *get_blocker(const enum landlock_request_type type)
2121
switch (type) {
2222
case LANDLOCK_REQUEST_PTRACE:
2323
return "ptrace";
24+
25+
case LANDLOCK_REQUEST_FS_CHANGE_TOPOLOGY:
26+
return "fs.change_topology";
2427
}
2528

2629
WARN_ON_ONCE(1);

‎security/landlock/audit.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515

1616
enum landlock_request_type {
1717
LANDLOCK_REQUEST_PTRACE = 1,
18+
LANDLOCK_REQUEST_FS_CHANGE_TOPOLOGY,
1819
};
1920

2021
/*

‎security/landlock/fs.c‎

Lines changed: 70 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323
#include <linux/kernel.h>
2424
#include <linux/limits.h>
2525
#include <linux/list.h>
26+
#include <linux/lsm_audit.h>
2627
#include <linux/lsm_hooks.h>
2728
#include <linux/mount.h>
2829
#include <linux/namei.h>
@@ -39,6 +40,7 @@
3940
#include <uapi/linux/landlock.h>
4041

4142
#include "access.h"
43+
#include "audit.h"
4244
#include "common.h"
4345
#include "cred.h"
4446
#include "fs.h"
@@ -395,12 +397,6 @@ static const struct access_masks any_fs = {
395397
.fs = ~0,
396398
};
397399

398-
static const struct landlock_ruleset *get_current_fs_domain(void)
399-
{
400-
return landlock_get_applicable_domain(landlock_get_current_domain(),
401-
any_fs);
402-
}
403-
404400
/*
405401
* Check that a destination file hierarchy has more restrictions than a source
406402
* file hierarchy. This is only used for link and rename actions.
@@ -1335,6 +1331,34 @@ static void hook_sb_delete(struct super_block *const sb)
13351331
!atomic_long_read(&landlock_superblock(sb)->inode_refs));
13361332
}
13371333

1334+
static void
1335+
log_fs_change_topology_path(const struct landlock_cred_security *const subject,
1336+
size_t handle_layer, const struct path *const path)
1337+
{
1338+
landlock_log_denial(subject, &(struct landlock_request) {
1339+
.type = LANDLOCK_REQUEST_FS_CHANGE_TOPOLOGY,
1340+
.audit = {
1341+
.type = LSM_AUDIT_DATA_PATH,
1342+
.u.path = *path,
1343+
},
1344+
.layer_plus_one = handle_layer + 1,
1345+
});
1346+
}
1347+
1348+
static void log_fs_change_topology_dentry(
1349+
const struct landlock_cred_security *const subject, size_t handle_layer,
1350+
struct dentry *const dentry)
1351+
{
1352+
landlock_log_denial(subject, &(struct landlock_request) {
1353+
.type = LANDLOCK_REQUEST_FS_CHANGE_TOPOLOGY,
1354+
.audit = {
1355+
.type = LSM_AUDIT_DATA_DENTRY,
1356+
.u.dentry = dentry,
1357+
},
1358+
.layer_plus_one = handle_layer + 1,
1359+
});
1360+
}
1361+
13381362
/*
13391363
* Because a Landlock security policy is defined according to the filesystem
13401364
* topology (i.e. the mount namespace), changing it may grant access to files
@@ -1357,16 +1381,30 @@ static int hook_sb_mount(const char *const dev_name,
13571381
const struct path *const path, const char *const type,
13581382
const unsigned long flags, void *const data)
13591383
{
1360-
if (!get_current_fs_domain())
1384+
size_t handle_layer;
1385+
const struct landlock_cred_security *const subject =
1386+
landlock_get_applicable_subject(current_cred(), any_fs,
1387+
&handle_layer);
1388+
1389+
if (!subject)
13611390
return 0;
1391+
1392+
log_fs_change_topology_path(subject, handle_layer, path);
13621393
return -EPERM;
13631394
}
13641395

13651396
static int hook_move_mount(const struct path *const from_path,
13661397
const struct path *const to_path)
13671398
{
1368-
if (!get_current_fs_domain())
1399+
size_t handle_layer;
1400+
const struct landlock_cred_security *const subject =
1401+
landlock_get_applicable_subject(current_cred(), any_fs,
1402+
&handle_layer);
1403+
1404+
if (!subject)
13691405
return 0;
1406+
1407+
log_fs_change_topology_path(subject, handle_layer, to_path);
13701408
return -EPERM;
13711409
}
13721410

@@ -1376,15 +1414,29 @@ static int hook_move_mount(const struct path *const from_path,
13761414
*/
13771415
static int hook_sb_umount(struct vfsmount *const mnt, const int flags)
13781416
{
1379-
if (!get_current_fs_domain())
1417+
size_t handle_layer;
1418+
const struct landlock_cred_security *const subject =
1419+
landlock_get_applicable_subject(current_cred(), any_fs,
1420+
&handle_layer);
1421+
1422+
if (!subject)
13801423
return 0;
1424+
1425+
log_fs_change_topology_dentry(subject, handle_layer, mnt->mnt_root);
13811426
return -EPERM;
13821427
}
13831428

13841429
static int hook_sb_remount(struct super_block *const sb, void *const mnt_opts)
13851430
{
1386-
if (!get_current_fs_domain())
1431+
size_t handle_layer;
1432+
const struct landlock_cred_security *const subject =
1433+
landlock_get_applicable_subject(current_cred(), any_fs,
1434+
&handle_layer);
1435+
1436+
if (!subject)
13871437
return 0;
1438+
1439+
log_fs_change_topology_dentry(subject, handle_layer, sb->s_root);
13881440
return -EPERM;
13891441
}
13901442

@@ -1399,8 +1451,15 @@ static int hook_sb_remount(struct super_block *const sb, void *const mnt_opts)
13991451
static int hook_sb_pivotroot(const struct path *const old_path,
14001452
const struct path *const new_path)
14011453
{
1402-
if (!get_current_fs_domain())
1454+
size_t handle_layer;
1455+
const struct landlock_cred_security *const subject =
1456+
landlock_get_applicable_subject(current_cred(), any_fs,
1457+
&handle_layer);
1458+
1459+
if (!subject)
14031460
return 0;
1461+
1462+
log_fs_change_topology_path(subject, handle_layer, new_path);
14041463
return -EPERM;
14051464
}
14061465

‎security/landlock/ruleset.h‎

Lines changed: 0 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -243,36 +243,6 @@ landlock_union_access_masks(const struct landlock_ruleset *const domain)
243243
return matches.masks;
244244
}
245245

246-
/**
247-
* landlock_get_applicable_domain - Return @domain if it applies to (handles)
248-
* at least one of the access rights specified
249-
* in @masks
250-
*
251-
* @domain: Landlock ruleset (used as a domain)
252-
* @masks: access masks
253-
*
254-
* Returns: @domain if any access rights specified in @masks is handled, or
255-
* NULL otherwise.
256-
*/
257-
static inline const struct landlock_ruleset *
258-
landlock_get_applicable_domain(const struct landlock_ruleset *const domain,
259-
const struct access_masks masks)
260-
{
261-
const union access_masks_all masks_all = {
262-
.masks = masks,
263-
};
264-
union access_masks_all merge = {};
265-
266-
if (!domain)
267-
return NULL;
268-
269-
merge.masks = landlock_union_access_masks(domain);
270-
if (merge.all & masks_all.all)
271-
return domain;
272-
273-
return NULL;
274-
}
275-
276246
static inline void
277247
landlock_add_fs_access_mask(struct landlock_ruleset *const ruleset,
278248
const access_mask_t fs_access_mask,

0 commit comments

Comments
 (0)