1 /* SPDX-License-Identifier: GPL-2.0-only */
2 /*
3 * Landlock - Log helpers
4 *
5 * Copyright © 2023-2025 Microsoft Corporation
6 * Copyright © 2026 Cloudflare, Inc.
7 */
8
9 #ifndef _SECURITY_LANDLOCK_LOG_H
10 #define _SECURITY_LANDLOCK_LOG_H
11
12 #include <linux/lsm_audit.h>
13
14 #include "access.h"
15
16 struct landlock_cred_security;
17 struct landlock_hierarchy;
18 struct sockaddr;
19 struct task_struct;
20
21 enum landlock_request_type {
22 LANDLOCK_REQUEST_PTRACE = 1,
23 LANDLOCK_REQUEST_FS_CHANGE_TOPOLOGY,
24 LANDLOCK_REQUEST_FS_ACCESS,
25 LANDLOCK_REQUEST_NET_ACCESS,
26 LANDLOCK_REQUEST_SCOPE_ABSTRACT_UNIX_SOCKET,
27 LANDLOCK_REQUEST_SCOPE_SIGNAL,
28 };
29
30 struct landlock_blockers {
31 access_mask_t access;
32 enum landlock_request_type type;
33 };
34
35 #ifdef CONFIG_TRACEPOINTS
36
37 struct landlock_net_trace {
38 const struct sockaddr *address;
39 int addrlen;
40 u16 socket_family;
41 };
42
43 struct landlock_ptrace_trace {
44 u64 tracee_domain_id;
45 const struct task_struct *tracer;
46 };
47
48 struct landlock_signal_trace {
49 u64 target_domain_id;
50 int signal;
51 };
52
53 #endif /* CONFIG_TRACEPOINTS */
54
55 /*
56 * We should be careful to only use a variable of this type for
57 * landlock_log_denial(). This way, the compiler can remove it entirely if
58 * CONFIG_SECURITY_LANDLOCK_LOG is not set.
59 */
60 struct landlock_request {
61 /* Mandatory fields. */
62 enum landlock_request_type type;
63 struct common_audit_data audit;
64
65 /**
66 * layer_plus_one: First layer level that denies the request + 1. The
67 * extra one is useful to detect uninitialized field.
68 */
69 size_t layer_plus_one;
70
71 /* Required field for configurable access control. */
72 access_mask_t access;
73
74 /* Required fields for requests with layer masks. */
75 const struct layer_masks *layer_masks;
76
77 /* Required fields for requests with deny masks. */
78 const access_mask_t all_existing_optional_access;
79 deny_masks_t deny_masks;
80 optional_access_t quiet_optional_accesses;
81
82 #ifdef CONFIG_TRACEPOINTS
83 union {
84 /*
85 * Other-party domain ID for an abstract UNIX socket scope
86 * denial, or 0 if that party is unsandboxed. Store an ID, not
87 * a pointer: the other task can replace its credential and free
88 * the domain it referenced.
89 */
90 u64 other_domain_id;
91
92 /* Synchronous context for a network denial. */
93 const struct landlock_net_trace *trace_net;
94 /* Synchronous context for a ptrace denial. */
95 const struct landlock_ptrace_trace *trace_ptrace;
96 /* Synchronous context for a signal denial. */
97 const struct landlock_signal_trace *trace_signal;
98 };
99 #endif /* CONFIG_TRACEPOINTS */
100 };
101
102 #ifdef CONFIG_SECURITY_LANDLOCK_LOG
103
104 void landlock_log_free_domain(const struct landlock_hierarchy *const hierarchy);
105
106 void landlock_log_denial(const struct landlock_cred_security *const subject,
107 const struct landlock_request *const request);
108
109 #else /* CONFIG_SECURITY_LANDLOCK_LOG */
110
111 static inline void
landlock_log_free_domain(const struct landlock_hierarchy * const hierarchy)112 landlock_log_free_domain(const struct landlock_hierarchy *const hierarchy)
113 {
114 }
115
116 static inline void
landlock_log_denial(const struct landlock_cred_security * const subject,const struct landlock_request * const request)117 landlock_log_denial(const struct landlock_cred_security *const subject,
118 const struct landlock_request *const request)
119 {
120 }
121
122 #endif /* CONFIG_SECURITY_LANDLOCK_LOG */
123
124 #endif /* _SECURITY_LANDLOCK_LOG_H */
125