1 /* SPDX-License-Identifier: GPL-2.0 */ 2 /* 3 * Copyright © 2025 Microsoft Corporation 4 * Copyright © 2026 Cloudflare, Inc. 5 */ 6 7 #undef TRACE_SYSTEM 8 #define TRACE_SYSTEM landlock 9 10 #if !defined(_TRACE_LANDLOCK_H) || defined(TRACE_HEADER_MULTI_READ) 11 #define _TRACE_LANDLOCK_H 12 13 #include <linux/in.h> 14 #include <linux/in6.h> 15 #include <linux/landlock.h> 16 #include <linux/socket.h> 17 #include <linux/string.h> 18 #include <linux/string_helpers.h> 19 #include <linux/tracepoint.h> 20 #include <linux/trace_seq.h> 21 #include <net/af_unix.h> 22 23 enum landlock_request_type; 24 struct dentry; 25 struct landlock_blockers; 26 struct landlock_domain; 27 struct landlock_hierarchy; 28 struct landlock_rule; 29 struct landlock_ruleset; 30 struct path; 31 struct sock; 32 struct task_struct; 33 34 static_assert(sizeof(access_mask_t) <= sizeof(u64)); 35 36 TRACE_DEFINE_ENUM(LANDLOCK_REQUEST_FS_CHANGE_TOPOLOGY); 37 TRACE_DEFINE_ENUM(LANDLOCK_REQUEST_FS_ACCESS); 38 TRACE_DEFINE_ENUM(LANDLOCK_REQUEST_NET_ACCESS); 39 40 #ifdef CREATE_TRACE_POINTS 41 42 /* About 6 KiB, leaving about 2 KiB for sibling helpers and fixed fields. */ 43 #define TRACE_UNTRUSTED_STR_OUTPUT_SIZE \ 44 (TRACE_SEQ_BUFFER_SIZE - TRACE_SEQ_BUFFER_SIZE / 4) 45 46 /* 47 * A raw UTF-8 ellipsis (…) marks truncation and cannot collide with escaped 48 * input: ESCAPE_NAP renders every non-ASCII input byte in octal. 49 */ 50 #define TRACE_TRUNCATION_MARKER "\xe2\x80\xa6" 51 52 /* 53 * Escapes @len bytes of an untrusted string into the trace sequence @p so it 54 * cannot inject field separators or control characters into the ftrace text 55 * output, and can be unambiguously recovered. Called from the TP_printk() of 56 * the tracepoints that expose paths and process names. @len is passed by the 57 * caller (rather than derived with strlen()) so a name that is not 58 * NUL-terminated or carries embedded NUL bytes (an abstract socket name) is 59 * escaped in full instead of being truncated at the first NUL. 60 * 61 * Strings that exceed the output limit retain the largest complete escaped 62 * prefix followed by the truncation marker. 63 * 64 * Return: a pointer into @p's buffer, or NULL if @src is NULL or the fixed 65 * output reservation is unavailable. 66 */ 67 static inline const char * 68 __trace_print_untrusted_str(struct trace_seq *p, const char *src, size_t len) 69 { 70 const unsigned int escape_flags = ESCAPE_SPACE | ESCAPE_SPECIAL | 71 ESCAPE_NAP | ESCAPE_APPEND | 72 ESCAPE_OCTAL; 73 const size_t marker_len = sizeof(TRACE_TRUNCATION_MARKER) - 1; 74 size_t buf_size, prefix_len, prefix_size; 75 int escaped_size; 76 char *buf; 77 const char *ret; 78 79 buf_size = seq_buf_get_buf(&p->seq, &buf); 80 if (!src || buf_size < TRACE_UNTRUSTED_STR_OUTPUT_SIZE) 81 return NULL; 82 83 ret = trace_seq_buffer_ptr(p); 84 escaped_size = string_escape_mem(src, len, buf, 85 TRACE_UNTRUSTED_STR_OUTPUT_SIZE, 86 escape_flags, " ='\"\\"); 87 if (likely(escaped_size < TRACE_UNTRUSTED_STR_OUTPUT_SIZE)) { 88 seq_buf_commit(&p->seq, escaped_size); 89 trace_seq_putc(p, 0); 90 return ret; 91 } 92 93 prefix_len = 0; 94 prefix_size = 0; 95 while (prefix_len < len) { 96 const char *const src_char = src + prefix_len; 97 int char_size; 98 99 char_size = string_escape_mem(src_char, 1, NULL, 0, 100 escape_flags, " ='\"\\"); 101 if (char_size > TRACE_UNTRUSTED_STR_OUTPUT_SIZE - marker_len - 102 1 - prefix_size) 103 break; 104 prefix_size += char_size; 105 prefix_len++; 106 } 107 108 escaped_size = string_escape_mem(src, prefix_len, buf, prefix_size, 109 escape_flags, " ='\"\\"); 110 if (WARN_ON_ONCE(escaped_size != prefix_size)) 111 return NULL; 112 memcpy(buf + prefix_size, TRACE_TRUNCATION_MARKER, marker_len); 113 seq_buf_commit(&p->seq, prefix_size + marker_len); 114 trace_seq_putc(p, 0); 115 return ret; 116 } 117 118 /* 119 * Fills the dense per-domain-layer array layers (one access mask per layer, 120 * indexed by level - 1) from rule's sparse layer stack, keeping only the 121 * requested rights (access_request). Layers with no matching rule entry get 122 * a zero mask. Shared by the check_rule_inode and check_rule_net_port events. 123 * 124 * rule->layers is sorted by ascending level, with levels in the domain's 125 * [1, num_layers] range (see landlock_merge_ruleset()), so every entry maps 126 * to a slot. A leftover entry would be a malformed rule; the zero-filled 127 * slots keep the output and the array bounds safe regardless. 128 */ 129 static inline void 130 __trace_landlock_fill_layers(access_mask_t *const layers, 131 const size_t num_layers, 132 const struct landlock_rule *const rule, 133 const access_mask_t access_request) 134 { 135 size_t i = 0; 136 137 for (size_t level = 1; level <= num_layers; level++) { 138 access_mask_t grants = 0; 139 140 if (i < rule->num_layers && level == rule->layers[i].level) { 141 grants = rule->layers[i].access & access_request; 142 i++; 143 } 144 layers[level - 1] = grants; 145 } 146 147 /* A leftover entry means an out-of-range or unsorted rule level. */ 148 WARN_ON_ONCE(i < rule->num_layers); 149 } 150 151 /* 152 * Renders the dense per-domain-layer access array as symbolic flag names for 153 * the grants field: layers wrapped in "{}", flags within a layer joined by 154 * "|", layers separated by ",", an empty layer rendered as nothing. 155 * Open-codes the flag walk because trace_print_flags_seq() NUL-terminates per 156 * call and so cannot be chained into a single field. The shared names table 157 * covers every access right, so masked bits are always named. Returns the 158 * trace_seq position like __print_flags(). 159 */ 160 static inline const char *__trace_landlock_print_layers( 161 struct trace_seq *p, const access_mask_t *const layers, 162 const size_t num_layers, const struct trace_print_flags *const names, 163 const size_t names_size) 164 { 165 const char *const ret = trace_seq_buffer_ptr(p); 166 167 trace_seq_putc(p, '{'); 168 for (size_t i = 0; i < num_layers; i++) { 169 access_mask_t mask = layers[i]; 170 bool first = true; 171 172 if (i) 173 trace_seq_putc(p, ','); 174 for (size_t j = 0; mask && j < names_size; j++) { 175 if ((mask & names[j].mask) != names[j].mask) 176 continue; 177 if (!first) 178 trace_seq_putc(p, '|'); 179 trace_seq_puts(p, names[j].name); 180 mask &= ~names[j].mask; 181 first = false; 182 } 183 } 184 trace_seq_putc(p, '}'); 185 trace_seq_putc(p, 0); 186 return ret; 187 } 188 189 #endif /* CREATE_TRACE_POINTS */ 190 191 /* clang-format off */ 192 193 /* Maps a shared _LANDLOCK_*_NAMES entry to a __print_flags() pair. */ 194 #define _LANDLOCK_NAME_ENTRY(mask, name) { mask, name } 195 196 #define _LANDLOCK_FS_BLOCKER_TYPE_NAMES \ 197 { LANDLOCK_REQUEST_FS_CHANGE_TOPOLOGY, "change_topology" } 198 199 /** 200 * DOC: Landlock trace events 201 * 202 * These guarantees and constraints hold for every Landlock tracepoint. 203 * A new tracepoint must uphold them, and an eBPF consumer can rely on 204 * them. 205 * 206 * Decision context 207 * ~~~~~~~~~~~~~~~~ 208 * 209 * A denial event identifies the domain whose policy denied the request, the 210 * Landlock operation and policy object that were checked, and the blocker or 211 * domain relationship responsible for the denial. When tracing starts with 212 * sandbox construction, ruleset and domain events provide the policy history 213 * needed to interpret these identifiers. The denying domain is the subject 214 * that enforced the policy, not necessarily current. Generic tracepoints can 215 * provide additional operational context. 216 * 217 * Lifecycle consistency 218 * ~~~~~~~~~~~~~~~~~~~~~~ 219 * 220 * Lifecycle emission is balanced: a creation event always has a matching 221 * deallocation event and vice versa. A consumer that observes an object's 222 * complete lifetime can model it from this pair; one that attaches late or 223 * loses exported records must reconcile incomplete state. A creation event 224 * fires while the object is still private to the calling thread 225 * (landlock_create_ruleset fires before the ruleset's file descriptor is 226 * installed, so it cannot race a concurrent :manpage:`close(2)`); if fd 227 * installation later fails and the ruleset is freed, free_ruleset still 228 * fires, keeping the pair balanced. The domain pair (create_domain and 229 * free_domain) is balanced the same way: create_domain fires when the 230 * domain is created (under the ruleset lock, before thread-sync), and 231 * free_domain fires when it is freed. A rare thread-sync failure aborts 232 * the just-created domain, which then emits both events (its creation, then 233 * an immediate free). Denial events fire only for denials that actually 234 * happen. 235 * 236 * Pointer access 237 * ~~~~~~~~~~~~~~ 238 * 239 * All pointer arguments in TP_PROTO are guaranteed non-NULL by the 240 * caller, but pointers reached through them may still be NULL (e.g., 241 * hierarchy->parent at a root domain) and must be checked. eBPF programs 242 * read these pointers via BTF for richer introspection than the 243 * TP_STRUCT__entry fields, which serve TP_printk display only. 244 * 245 * Mutable object pointers are passed while the caller holds the object's 246 * lock, so TP_fast_assign and a BTF reader see the exact object the event 247 * reports, a snapshot no concurrent writer can change: add_rule holds the 248 * modified ruleset's lock, and create_domain holds the ruleset lock across 249 * the emission (before the thread-sync wait) so the inspected ruleset is 250 * the one merged into the domain. Objects immutable at the emission site 251 * (a domain after creation, a hierarchy at its last reference) need no 252 * lock. A few values that no held lock protects are a best-effort 253 * lockless snapshot instead: a task's comm, and the deny_access_net struct 254 * sock (whose network hook holds no socket lock), matching how the sched 255 * and signal trace events sample comm. 256 * 257 * Field encoding 258 * ~~~~~~~~~~~~~~ 259 * 260 * Fields that mirror the Landlock UAPI preserve their widths and endianness 261 * (e.g. network ports are u64 in host endianness, like 262 * landlock_net_port_attr.port). Per-event details, such as where a value 263 * is byte-swapped, live in the field's own kdoc. 264 * 265 * Rule-check fields 266 * ~~~~~~~~~~~~~~~~~ 267 * 268 * The check_rule events fire during an access check, once per matching 269 * rule, before the final allow-or-deny verdict. They share domain (the 270 * enforcing domain being evaluated), access_request (the access mask being 271 * checked), and rule (the matching rule, with per-layer access masks). 272 * 273 * Denial fields 274 * ~~~~~~~~~~~~~ 275 * 276 * Every denial event shares three fields. domain is the ID of the 277 * innermost domain that blocked the access. same_exec tells whether the 278 * current task is the same executable that entered that domain. logged is 279 * the domain's audit-logging decision for this denial (its log_status is 280 * enabled and the per-execution flag selected by same_exec is set); a 281 * stateless ftrace filter can select the denials the domain submits to 282 * audit with logged==1, without reconstructing it from the per-execution 283 * log flags. Denial events order their fields as domain, same_exec, 284 * logged, then blockers (deny_access events only), then the type-specific 285 * object fields, then any variable-length field. 286 * 287 * Relational referents 288 * ~~~~~~~~~~~~~~~~~~~~~ 289 * 290 * A scope or ptrace verdict compares two domains, so the other party's 291 * domain is part of the decision context. It is exposed as a scalar 292 * domain ID (0 when that party is unsandboxed): target_domain (signal), 293 * peer_domain (abstract unix socket), tracee_domain (ptrace). With both 294 * IDs in the stream, a consumer that tracked domain creation can relate 295 * the two parties without kernel-internal state. The ID is a scalar 296 * snapshot, not a live domain pointer that could dangle: an optional 297 * relational referent is a scalar (0 sentinel), not a nullable pointer. 298 * Nonzero IDs are unique within one boot. For ptrace, same_exec instead 299 * describes the tracer, even for 300 * PTRACE_TRACEME, and may differ from the current task. 301 * 302 * Blocker fields 303 * ~~~~~~~~~~~~~~ 304 * 305 * The filesystem and network blocker arguments identify the request type 306 * and carry its final missing access subset when applicable. The type 307 * determines how to interpret the access value. 308 */ 309 310 /* 311 * Prints a per-layer access mask array (the dynamic array @array) as symbolic 312 * flag names using the shared @flag_names list (a _LANDLOCK_*_NAMES macro). 313 * Stays outside CREATE_TRACE_POINTS: TP_printk is expanded in the print-output 314 * pass where that macro is undefined. 315 */ 316 #define __print_landlock_layers(array, flag_names...) \ 317 ({ \ 318 static const struct trace_print_flags __layer_names[] = { \ 319 flag_names \ 320 }; \ 321 __trace_landlock_print_layers( \ 322 p, __get_dynamic_array(array), \ 323 __get_dynamic_array_len(array) / \ 324 sizeof(access_mask_t), \ 325 __layer_names, ARRAY_SIZE(__layer_names)); \ 326 }) 327 328 /** 329 * landlock_create_ruleset - New ruleset created 330 * 331 * @ruleset: Newly created ruleset (never NULL); not yet shared via an fd, 332 * so no lock is needed. 333 * 334 * Emitted by sys_landlock_create_ruleset() while the new ruleset is still 335 * private to the calling thread, before its file descriptor is installed, 336 * so it cannot race a concurrent :manpage:`close(2)`. Balanced by a 337 * matching landlock_free_ruleset event. 338 */ 339 TRACE_EVENT(landlock_create_ruleset, 340 341 TP_PROTO(const struct landlock_ruleset *ruleset), 342 343 TP_ARGS(ruleset), 344 345 TP_STRUCT__entry( 346 __field( u64, ruleset_id ) 347 __field( u64, ruleset_version ) 348 __field( access_mask_t, handled_fs ) 349 __field( access_mask_t, handled_net ) 350 __field( access_mask_t, scoped ) 351 ), 352 353 TP_fast_assign( 354 __entry->ruleset_id = ruleset->id; 355 __entry->ruleset_version = ruleset->version; 356 __entry->handled_fs = ruleset->handled_masks.fs; 357 __entry->handled_net = ruleset->handled_masks.net; 358 __entry->scoped = ruleset->handled_masks.scope; 359 ), 360 361 TP_printk("ruleset=%llx.%llu handled_fs=%s handled_net=%s scoped=%s", 362 __entry->ruleset_id, __entry->ruleset_version, 363 __print_flags(__entry->handled_fs, "|", _LANDLOCK_ACCESS_FS_NAMES), 364 __print_flags(__entry->handled_net, "|", _LANDLOCK_ACCESS_NET_NAMES), 365 __print_flags(__entry->scoped, "|", _LANDLOCK_SCOPE_NAMES)) 366 ); 367 368 /** 369 * landlock_free_ruleset - Ruleset freed 370 * 371 * @ruleset: Ruleset being freed (never NULL); at its last reference, so no 372 * lock is needed. 373 * 374 * Emitted when a ruleset's last reference is dropped (typically when 375 * the creating process closes the ruleset file descriptor). Fires even 376 * when file-descriptor installation failed after creation, keeping the 377 * create/free pair balanced. 378 */ 379 TRACE_EVENT(landlock_free_ruleset, 380 381 TP_PROTO(const struct landlock_ruleset *ruleset), 382 383 TP_ARGS(ruleset), 384 385 TP_STRUCT__entry( 386 __field( u64, ruleset_id ) 387 __field( u64, ruleset_version ) 388 ), 389 390 TP_fast_assign( 391 __entry->ruleset_id = ruleset->id; 392 __entry->ruleset_version = ruleset->version; 393 ), 394 395 TP_printk("ruleset=%llx.%llu", 396 __entry->ruleset_id, __entry->ruleset_version) 397 ); 398 399 /** 400 * landlock_add_rule_path_beneath - Path-beneath rule added to a ruleset 401 * 402 * @ruleset: Source ruleset (never NULL). 403 * @flags: Complete validated landlock_add_rule_flags value supplied by this 404 * successful call, not the rule's accumulated quiet state. 405 * @access_rights: Canonical per-call access mask passed to 406 * landlock_insert_rule() after normalization, not the raw 407 * sys_landlock_add_rule() argument or accumulated rule. 408 * @path: Filesystem path for the rule (never NULL). 409 * @pathname: Resolved absolute path string (never NULL; error placeholder 410 * on resolution failure). 411 * 412 * Emitted by sys_landlock_add_rule() under the modified ruleset's lock, so 413 * the reported ruleset is a stable snapshot that no concurrent writer can 414 * change. 415 */ 416 TRACE_EVENT(landlock_add_rule_path_beneath, 417 418 TP_PROTO(const struct landlock_ruleset *ruleset, u32 flags, 419 u64 access_rights, const struct path *path, 420 const char *pathname), 421 422 TP_ARGS(ruleset, flags, access_rights, path, pathname), 423 424 TP_STRUCT__entry( 425 __field( u64, ruleset_id ) 426 __field( u64, ruleset_version ) 427 __field( access_mask_t, access_rights ) 428 __field( dev_t, dev ) 429 __field( ino_t, ino ) 430 __string( pathname, pathname ) 431 ), 432 433 TP_fast_assign( 434 lockdep_assert_held(&ruleset->lock); 435 __entry->ruleset_id = ruleset->id; 436 __entry->ruleset_version = ruleset->version; 437 __entry->access_rights = access_rights; 438 __entry->dev = path->dentry->d_sb->s_dev; 439 /* 440 * The inode number may not be the user-visible one, 441 * but it will be the same used by audit. 442 */ 443 __entry->ino = d_backing_inode(path->dentry)->i_ino; 444 __assign_str(pathname); 445 ), 446 447 TP_printk("ruleset=%llx.%llu access_rights=%s dev=%u:%u ino=%lu path=%s", 448 __entry->ruleset_id, __entry->ruleset_version, 449 __print_flags(__entry->access_rights, "|", _LANDLOCK_ACCESS_FS_NAMES), 450 MAJOR(__entry->dev), MINOR(__entry->dev), __entry->ino, 451 __trace_print_untrusted_str(p, __get_str(pathname), 452 __get_dynamic_array_len(pathname) - 1)) 453 ); 454 455 /** 456 * landlock_add_rule_net_port - Network-port rule added to a ruleset 457 * 458 * @ruleset: Source ruleset (never NULL). 459 * @flags: Complete validated landlock_add_rule_flags value supplied by this 460 * successful call, not the rule's accumulated quiet state. 461 * @access_rights: Canonical per-call access mask passed to 462 * landlock_insert_rule() after normalization, not the raw 463 * sys_landlock_add_rule() argument or accumulated rule. 464 * @port: Network port in host endianness, forwarded directly from 465 * &landlock_net_port_attr.port. 466 * 467 * Emitted by sys_landlock_add_rule() under the modified ruleset's lock, so 468 * the reported ruleset is a stable snapshot that no concurrent writer can 469 * change. 470 */ 471 TRACE_EVENT(landlock_add_rule_net_port, 472 473 TP_PROTO(const struct landlock_ruleset *ruleset, u32 flags, 474 u64 access_rights, u64 port), 475 476 TP_ARGS(ruleset, flags, access_rights, port), 477 478 TP_STRUCT__entry( 479 __field( u64, ruleset_id ) 480 __field( u64, ruleset_version ) 481 __field( access_mask_t, access_rights ) 482 __field( u64, port ) 483 ), 484 485 TP_fast_assign( 486 lockdep_assert_held(&ruleset->lock); 487 __entry->ruleset_id = ruleset->id; 488 __entry->ruleset_version = ruleset->version; 489 __entry->access_rights = access_rights; 490 __entry->port = port; 491 ), 492 493 TP_printk("ruleset=%llx.%llu access_rights=%s port=%llu", 494 __entry->ruleset_id, __entry->ruleset_version, 495 __print_flags(__entry->access_rights, "|", _LANDLOCK_ACCESS_NET_NAMES), 496 __entry->port) 497 ); 498 499 /** 500 * landlock_create_domain - New domain created 501 * 502 * @domain: Newly created domain (never NULL, immutable after creation). 503 * @domain->hierarchy->id is its unique ID, shared with the 504 * landlock_enforce_domain and landlock_free_domain events; 505 * @domain->hierarchy->details holds the requesting process. 506 * @ruleset: Source ruleset frozen into the domain (never NULL). The 507 * ruleset lock is held across the emission, so a BPF program 508 * reading it via BTF sees the exact merged ruleset; 509 * @ruleset->id / @ruleset->version identify it. 510 * 511 * Emitted by sys_landlock_restrict_self() once, in the requesting 512 * thread's context, right after the merge and before thread-sync. The 513 * flags-only path (ruleset_fd == -1) creates no domain and does not 514 * emit this event. Paired with the per-thread landlock_enforce_domain 515 * (join on @domain->hierarchy->id) and balanced by a matching 516 * landlock_free_domain event. 517 */ 518 TRACE_EVENT(landlock_create_domain, 519 520 TP_PROTO(const struct landlock_domain *domain, 521 const struct landlock_ruleset *ruleset), 522 523 TP_ARGS(domain, ruleset), 524 525 TP_STRUCT__entry( 526 __field( u64, domain_id ) 527 __field( u64, parent_id ) 528 __field( u64, ruleset_id ) 529 __field( u64, ruleset_version ) 530 ), 531 532 TP_fast_assign( 533 lockdep_assert_held(&ruleset->lock); 534 __entry->domain_id = domain->hierarchy->id; 535 __entry->parent_id = domain->hierarchy->parent ? 536 domain->hierarchy->parent->id : 0; 537 __entry->ruleset_id = ruleset->id; 538 __entry->ruleset_version = ruleset->version; 539 ), 540 541 TP_printk("domain=%llx parent=%llx ruleset=%llx.%llu", 542 __entry->domain_id, __entry->parent_id, 543 __entry->ruleset_id, __entry->ruleset_version) 544 ); 545 546 /** 547 * landlock_enforce_domain - Domain enforced on a thread 548 * 549 * @domain: Domain now enforced on the current thread (never NULL, 550 * immutable; read locklessly). Correlate to 551 * landlock_create_domain via @domain->hierarchy->id for the 552 * source ruleset and requesting thread, or read 553 * @domain->hierarchy->details for the requesting process. 554 * @complete: Set on the single event that concludes the operation, after 555 * all its other enforcements; filter on it for one event per 556 * operation. 557 * @process_wide: The enforcement covers every eligible (non-exiting) 558 * thread of the process: set when the caller used 559 * %LANDLOCK_RESTRICT_SELF_TSYNC or the process is 560 * single-threaded. A lone thread whose group still 561 * holds a zombie leader is not counted single-threaded, 562 * so process_wide == 0 never proves the opposite. 563 * @no_new_privs: The enforcing thread's no_new_privs state at 564 * enforcement time: 1 if set (by a prior 565 * :manpage:`prctl(2)` %PR_SET_NO_NEW_PRIVS or by 566 * %LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS), 0 if the domain 567 * was enforced with %CAP_SYS_ADMIN instead. 568 * 569 * Emitted for each thread sys_landlock_restrict_self() enforces the 570 * domain on, in that thread's own context, right after its 571 * commit_creds(), so it fires only once the thread is irreversibly 572 * enforcing the domain (aborted operations emit none). Not 573 * balanced; every enforcement falls between the domain's 574 * landlock_create_domain and landlock_free_domain events. 575 * 576 * @complete == 1 && @process_wide == 1 means the whole process is 577 * sandboxed by @domain, durably (Landlock domains are monotonic and 578 * inherited on :manpage:`clone(2)`). 579 */ 580 TRACE_EVENT(landlock_enforce_domain, 581 582 TP_PROTO(const struct landlock_domain *domain, bool complete, 583 bool process_wide, bool no_new_privs), 584 585 TP_ARGS(domain, complete, process_wide, no_new_privs), 586 587 TP_STRUCT__entry( 588 __field( u64, domain_id ) 589 __field( bool, complete ) 590 __field( bool, process_wide ) 591 __field( bool, no_new_privs ) 592 ), 593 594 TP_fast_assign( 595 __entry->domain_id = domain->hierarchy->id; 596 __entry->complete = complete; 597 __entry->process_wide = process_wide; 598 __entry->no_new_privs = no_new_privs; 599 ), 600 601 TP_printk("domain=%llx complete=%d process_wide=%d no_new_privs=%d", 602 __entry->domain_id, __entry->complete, __entry->process_wide, 603 __entry->no_new_privs) 604 ); 605 606 /** 607 * landlock_free_domain - Domain freed 608 * 609 * @hierarchy: Hierarchy node being freed (never NULL). 610 * 611 * Emitted when the hierarchy node's last reference is dropped: its 612 * refcount reaches zero after all child domains have released their 613 * parent reference. A committed domain is 614 * freed from a kworker via landlock_put_domain_deferred() (the credential 615 * free path runs in RCU context, where sleeping is forbidden), so the 616 * current task is not the sandboxed task that triggered the free. Balanced 617 * by a matching landlock_create_domain event. 618 */ 619 TRACE_EVENT(landlock_free_domain, 620 621 TP_PROTO(const struct landlock_hierarchy *hierarchy), 622 623 TP_ARGS(hierarchy), 624 625 TP_STRUCT__entry( 626 __field( u64, domain_id ) 627 __field( u64, denials ) 628 ), 629 630 TP_fast_assign( 631 __entry->domain_id = hierarchy->id; 632 __entry->denials = atomic64_read(&hierarchy->num_denials); 633 ), 634 635 TP_printk("domain=%llx denials=%llu", 636 __entry->domain_id, __entry->denials) 637 ); 638 639 /** 640 * landlock_check_rule_inode - Inode rule evaluated during access check 641 * 642 * @domain: Enforcing domain (never NULL). 643 * @rule: Matching rule with per-layer access masks (never NULL). 644 * @access_request: Access mask evaluated against the rule (the domain's 645 * handled mask during rename/link double-checks). 646 * @dentry: Filesystem dentry being checked (never NULL). 647 * 648 * Emitted for each rule that matches during a filesystem access check. 649 * The grants array shows the requested rights the rule grants at each 650 * domain layer. See Documentation/trace/events-landlock.rst for how to 651 * interpret it. 652 */ 653 TRACE_EVENT(landlock_check_rule_inode, 654 655 TP_PROTO(const struct landlock_domain *domain, 656 const struct landlock_rule *rule, 657 u64 access_request, const struct dentry *dentry), 658 659 TP_ARGS(domain, rule, access_request, dentry), 660 661 TP_STRUCT__entry( 662 __field( u64, domain_id ) 663 __field( access_mask_t, access_request ) 664 __field( dev_t, dev ) 665 __field( ino_t, ino ) 666 __dynamic_array(access_mask_t, grants, 667 domain->num_layers) 668 ), 669 670 TP_fast_assign( 671 __entry->domain_id = domain->hierarchy->id; 672 __entry->access_request = access_request; 673 __entry->dev = dentry->d_sb->s_dev; 674 __entry->ino = d_backing_inode(dentry)->i_ino; 675 676 __trace_landlock_fill_layers(__get_dynamic_array(grants), 677 __get_dynamic_array_len(grants) / 678 sizeof(access_mask_t), 679 rule, 680 (access_mask_t)access_request); 681 ), 682 683 TP_printk("domain=%llx access_request=%s dev=%u:%u ino=%lu grants=%s", 684 __entry->domain_id, 685 __print_flags(__entry->access_request, "|", _LANDLOCK_ACCESS_FS_NAMES), 686 MAJOR(__entry->dev), MINOR(__entry->dev), __entry->ino, 687 __print_landlock_layers(grants, _LANDLOCK_ACCESS_FS_NAMES)) 688 ); 689 690 /** 691 * landlock_check_rule_net_port - Network port rule evaluated 692 * 693 * @domain: Enforcing domain (never NULL). 694 * @rule: Matching rule with per-layer access masks (never NULL). 695 * @access_request: Access mask being requested. 696 * @port: Network port being checked (host endianness). 697 * 698 * Emitted for each rule that matches during a network access check. The 699 * grants array shows the requested rights the rule grants at each domain 700 * layer. See Documentation/trace/events-landlock.rst for how to 701 * interpret it. 702 */ 703 TRACE_EVENT(landlock_check_rule_net_port, 704 705 TP_PROTO(const struct landlock_domain *domain, 706 const struct landlock_rule *rule, 707 u64 access_request, u64 port), 708 709 TP_ARGS(domain, rule, access_request, port), 710 711 TP_STRUCT__entry( 712 __field( u64, domain_id ) 713 __field( access_mask_t, access_request ) 714 __field( u64, port ) 715 __dynamic_array(access_mask_t, grants, 716 domain->num_layers) 717 ), 718 719 TP_fast_assign( 720 __entry->domain_id = domain->hierarchy->id; 721 __entry->access_request = access_request; 722 __entry->port = port; 723 724 __trace_landlock_fill_layers(__get_dynamic_array(grants), 725 __get_dynamic_array_len(grants) / 726 sizeof(access_mask_t), 727 rule, 728 (access_mask_t)access_request); 729 ), 730 731 TP_printk("domain=%llx access_request=%s port=%llu grants=%s", 732 __entry->domain_id, 733 __print_flags(__entry->access_request, "|", _LANDLOCK_ACCESS_NET_NAMES), 734 __entry->port, 735 __print_landlock_layers(grants, _LANDLOCK_ACCESS_NET_NAMES)) 736 ); 737 738 /** 739 * landlock_deny_access_fs - Filesystem access denied 740 * 741 * @hierarchy: Denying domain's hierarchy node (never NULL); its id is the 742 * domain field. 743 * @same_exec: Whether the current task entered the denying domain itself. 744 * @logged: The domain's audit-logging decision for this denial. 745 * @blockers: Request type and final missing access subset (never NULL). 746 * @path: Filesystem path that was denied (never NULL). 747 * @pathname: Resolved path string (never NULL; an error placeholder on 748 * resolution failure). 749 * 750 * Emitted when a Landlock domain denies a filesystem access. 751 */ 752 TRACE_EVENT(landlock_deny_access_fs, 753 754 TP_PROTO(const struct landlock_hierarchy *hierarchy, bool same_exec, 755 bool logged, const struct landlock_blockers *blockers, 756 const struct path *path, const char *pathname), 757 758 TP_ARGS(hierarchy, same_exec, logged, blockers, path, pathname), 759 760 TP_STRUCT__entry( 761 __field( u64, domain_id ) 762 __field( bool, same_exec ) 763 __field( bool, logged ) 764 __field( enum landlock_request_type, blockers_type ) 765 __field( access_mask_t, blockers_access ) 766 __field( dev_t, dev ) 767 __field( ino_t, ino ) 768 __string( pathname, pathname ) 769 ), 770 771 TP_fast_assign( 772 const struct inode *inode = d_backing_inode(path->dentry); 773 774 __entry->domain_id = hierarchy->id; 775 __entry->same_exec = same_exec; 776 __entry->logged = logged; 777 __entry->blockers_type = blockers->type; 778 __entry->blockers_access = blockers->access; 779 __entry->dev = path->dentry->d_sb->s_dev; 780 /* 781 * A negative dentry has no backing inode, so mirror the 782 * guard in dump_common_audit_data() and report inode 0. 783 */ 784 __entry->ino = inode ? inode->i_ino : 0; 785 __assign_str(pathname); 786 ), 787 788 TP_printk("domain=%llx same_exec=%d logged=%d blockers=%s dev=%u:%u ino=%lu path=%s", 789 __entry->domain_id, __entry->same_exec, __entry->logged, 790 __entry->blockers_type == LANDLOCK_REQUEST_FS_ACCESS ? 791 __print_flags(__entry->blockers_access, "|", _LANDLOCK_ACCESS_FS_NAMES) : 792 __print_symbolic(__entry->blockers_type, 793 _LANDLOCK_FS_BLOCKER_TYPE_NAMES), 794 MAJOR(__entry->dev), MINOR(__entry->dev), __entry->ino, 795 __trace_print_untrusted_str(p, __get_str(pathname), 796 __get_dynamic_array_len(pathname) - 1)) 797 ); 798 799 static_assert(offsetof(struct sockaddr_in, sin_port) == 800 offsetof(struct sockaddr_in6, sin6_port)); 801 static_assert(sizeof_field(struct sockaddr_in, sin_port) == 802 sizeof_field(struct sockaddr_in6, sin6_port)); 803 804 /** 805 * landlock_deny_access_net - Network access denied 806 * 807 * @hierarchy: Denying domain's hierarchy node (never NULL); its id is the 808 * domain field. 809 * @same_exec: Whether the current task entered the denying domain itself. 810 * @logged: The domain's audit-logging decision for this denial. 811 * @blockers: Request type and final missing access subset (never NULL). 812 * @sk: Socket object (never NULL), read without a socket lock, so its fields 813 * are a best-effort snapshot. 814 * @socket_family: Socket-family snapshot used by the verdict. 815 * @address: Authoritative address checked by the verdict (never NULL). 816 * The producer copies @addrlen bytes from the checked address and 817 * zeroes the remaining storage before emission. The 818 * &sockaddr_in.sin_port or &sockaddr_in6.sin6_port member, when 819 * present, remains in network endianness. 820 * @addrlen: Validated signed length of @address. 821 * 822 * Emitted when a Landlock domain denies a network operation. The blocker 823 * identifies whether the address is a bind or connect/send policy object. 824 * The flattened port field is converted from the checked address to host 825 * endianness, or is -1 when no port was checked. Zero is a valid checked 826 * port. 827 */ 828 TRACE_EVENT(landlock_deny_access_net, 829 830 TP_PROTO(const struct landlock_hierarchy *hierarchy, bool same_exec, 831 bool logged, const struct landlock_blockers *blockers, 832 const struct sock *sk, u16 socket_family, 833 const struct sockaddr_storage *address, int addrlen), 834 835 TP_ARGS(hierarchy, same_exec, logged, blockers, sk, socket_family, 836 address, addrlen), 837 838 TP_STRUCT__entry( 839 __field( u64, domain_id ) 840 __field( bool, same_exec ) 841 __field( bool, logged ) 842 __field( enum landlock_request_type, blockers_type ) 843 __field( access_mask_t, blockers_access ) 844 __field( s64, port ) 845 ), 846 847 TP_fast_assign( 848 const struct sockaddr *const addr = 849 (const struct sockaddr *)address; 850 const bool has_port = 851 addrlen >= (int)offsetofend(struct sockaddr_in, sin_port) && 852 (addr->sa_family == AF_INET || 853 addr->sa_family == AF_INET6 || 854 (addr->sa_family == AF_UNSPEC && 855 socket_family == AF_INET)); 856 857 __entry->domain_id = hierarchy->id; 858 __entry->same_exec = same_exec; 859 __entry->logged = logged; 860 __entry->blockers_type = blockers->type; 861 __entry->blockers_access = blockers->access; 862 __entry->port = 863 has_port ? 864 ntohs(((const struct sockaddr_in *)addr)->sin_port) : 865 -1; 866 ), 867 868 TP_printk("domain=%llx same_exec=%d logged=%d blockers=%s port=%lld", 869 __entry->domain_id, __entry->same_exec, __entry->logged, 870 __entry->blockers_type == LANDLOCK_REQUEST_NET_ACCESS ? 871 __print_flags(__entry->blockers_access, "|", _LANDLOCK_ACCESS_NET_NAMES) : 872 "unknown", 873 __entry->port) 874 ); 875 876 /** 877 * landlock_deny_ptrace - Ptrace access denied by a Landlock domain 878 * 879 * @hierarchy: Denying domain's hierarchy node (never NULL); its id is the 880 * domain field. 881 * @same_exec: Whether the tracer entered the denying domain itself. 882 * @logged: The domain's audit-logging decision for this denial. 883 * @tracee_domain_id: The tracee's Landlock domain ID, or 0 if the tracee 884 * is unsandboxed. 885 * @tracee: The target task ptrace acted on (never NULL). tracee_pid is 886 * the init-namespace TGID (like audit's opid). 887 * @tracer: The tracer or proposed tracer (never NULL); for PTRACE_TRACEME 888 * this is the parent, not the syscall caller. 889 * 890 * Emitted when a Landlock domain denies a ptrace operation. 891 */ 892 TRACE_EVENT(landlock_deny_ptrace, 893 894 TP_PROTO(const struct landlock_hierarchy *hierarchy, bool same_exec, 895 bool logged, u64 tracee_domain_id, 896 const struct task_struct *tracee, 897 const struct task_struct *tracer), 898 899 TP_ARGS(hierarchy, same_exec, logged, tracee_domain_id, tracee, tracer), 900 901 TP_STRUCT__entry( 902 __field( u64, domain_id ) 903 __field( bool, same_exec ) 904 __field( bool, logged ) 905 __field( u64, tracee_domain_id) 906 __field( pid_t, tracee_pid ) 907 __string( tracee_comm, tracee->comm ) 908 ), 909 910 TP_fast_assign( 911 __entry->domain_id = hierarchy->id; 912 __entry->same_exec = same_exec; 913 __entry->logged = logged; 914 __entry->tracee_domain_id = tracee_domain_id; 915 __entry->tracee_pid = task_tgid_nr((struct task_struct *)tracee); 916 __assign_str(tracee_comm); 917 ), 918 919 TP_printk("domain=%llx same_exec=%d logged=%d tracee_domain=%llx tracee_pid=%d tracee_comm=%s", 920 __entry->domain_id, __entry->same_exec, __entry->logged, 921 __entry->tracee_domain_id, __entry->tracee_pid, 922 __trace_print_untrusted_str(p, __get_str(tracee_comm), 923 __get_dynamic_array_len(tracee_comm) - 1)) 924 ); 925 926 /** 927 * landlock_deny_scope_signal - Signal delivery denied by 928 * LANDLOCK_SCOPE_SIGNAL 929 * 930 * @hierarchy: Denying domain's hierarchy node (never NULL); its id is the 931 * domain field. 932 * @same_exec: Whether the policy subject entered the denying domain itself. 933 * @logged: The domain's audit-logging decision for this denial. 934 * @target_domain_id: The target's Landlock domain ID, or 0 if the target 935 * is unsandboxed. 936 * @target: The task the signal was aimed at (never NULL). target_pid is 937 * the init-namespace TGID (like audit's opid). 938 * @signal: The signal selected by the denied check. Zero is a permission 939 * probe, not an absent value. 940 * 941 * Emitted when a Landlock domain denies signal delivery to a scoped-out 942 * target. 943 */ 944 TRACE_EVENT(landlock_deny_scope_signal, 945 946 TP_PROTO(const struct landlock_hierarchy *hierarchy, bool same_exec, 947 bool logged, u64 target_domain_id, 948 const struct task_struct *target, int signal), 949 950 TP_ARGS(hierarchy, same_exec, logged, target_domain_id, target, signal), 951 952 TP_STRUCT__entry( 953 __field( u64, domain_id ) 954 __field( bool, same_exec ) 955 __field( bool, logged ) 956 __field( u64, target_domain_id) 957 __field( pid_t, target_pid ) 958 __string( target_comm, target->comm ) 959 ), 960 961 TP_fast_assign( 962 __entry->domain_id = hierarchy->id; 963 __entry->same_exec = same_exec; 964 __entry->logged = logged; 965 __entry->target_domain_id = target_domain_id; 966 __entry->target_pid = task_tgid_nr((struct task_struct *)target); 967 __assign_str(target_comm); 968 ), 969 970 TP_printk("domain=%llx same_exec=%d logged=%d target_domain=%llx target_pid=%d target_comm=%s", 971 __entry->domain_id, __entry->same_exec, __entry->logged, 972 __entry->target_domain_id, __entry->target_pid, 973 __trace_print_untrusted_str(p, __get_str(target_comm), 974 __get_dynamic_array_len(target_comm) - 1)) 975 ); 976 977 /** 978 * landlock_deny_scope_abstract_unix_socket - Abstract unix socket access 979 * denied by LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET 980 * 981 * @hierarchy: Denying domain's hierarchy node (never NULL); its id is the 982 * domain field. 983 * @same_exec: Whether the current task entered the denying domain itself. 984 * @logged: The domain's audit-logging decision for this denial. 985 * @peer_domain_id: The peer's Landlock domain ID, or 0 if the peer is 986 * unsandboxed. 987 * @peer: Peer socket (never NULL). peer_pid is best-effort: it is 0 for 988 * a datagram peer (no SO_PEERCRED), so sun_path is the reliable 989 * peer identifier. 990 * 991 * Emitted when a Landlock domain denies access to a scoped-out abstract 992 * unix socket. 993 */ 994 TRACE_EVENT(landlock_deny_scope_abstract_unix_socket, 995 996 TP_PROTO(const struct landlock_hierarchy *hierarchy, bool same_exec, 997 bool logged, u64 peer_domain_id, const struct sock *peer), 998 999 TP_ARGS(hierarchy, same_exec, logged, peer_domain_id, peer), 1000 1001 TP_STRUCT__entry( 1002 __field( u64, domain_id ) 1003 __field( bool, same_exec ) 1004 __field( bool, logged ) 1005 __field( u64, peer_domain_id ) 1006 __field( pid_t, peer_pid ) 1007 /* 1008 * Abstract socket names are untrusted binary data from 1009 * user space. Use __string_len because abstract names 1010 * are not NUL-terminated; their length is determined by 1011 * addr->len. unix_sk(peer)->addr is stable here because 1012 * the caller (hook_unix_stream_connect or 1013 * hook_unix_may_send) holds unix_state_lock(peer). 1014 */ 1015 __string_len( sun_path, 1016 unix_sk(peer)->addr ? 1017 unix_sk(peer)->addr->name->sun_path + 1 : 1018 "", 1019 unix_sk(peer)->addr ? 1020 unix_sk(peer)->addr->len - 1021 offsetof(struct sockaddr_un, 1022 sun_path) - 1 : 1023 0) 1024 ), 1025 1026 TP_fast_assign( 1027 struct pid *peer_pid; 1028 1029 lockdep_assert_held(&unix_sk(peer)->lock); 1030 __entry->domain_id = hierarchy->id; 1031 __entry->same_exec = same_exec; 1032 __entry->logged = logged; 1033 __entry->peer_domain_id = peer_domain_id; 1034 /* 1035 * Best-effort (0 for a datagram peer). The caller holds the 1036 * peer's AF_UNIX state lock, serializing published peercred 1037 * updates. The peer socket keeps a reference to sk_peer_pid 1038 * through pid_nr(); sun_path is the reliable identifier. 1039 */ 1040 peer_pid = READ_ONCE(peer->sk_peer_pid); 1041 __entry->peer_pid = peer_pid ? pid_nr(peer_pid) : 0; 1042 __assign_str(sun_path); 1043 ), 1044 1045 TP_printk("domain=%llx same_exec=%d logged=%d peer_domain=%llx peer_pid=%d sun_path=%s", 1046 __entry->domain_id, __entry->same_exec, __entry->logged, 1047 __entry->peer_domain_id, __entry->peer_pid, 1048 __trace_print_untrusted_str(p, __get_str(sun_path), 1049 __get_dynamic_array_len(sun_path) - 1)) 1050 ); 1051 1052 #undef _LANDLOCK_FS_BLOCKER_TYPE_NAMES 1053 #undef _LANDLOCK_NAME_ENTRY 1054 1055 #endif /* _TRACE_LANDLOCK_H */ 1056 1057 /* This part must be outside protection */ 1058 #include <trace/define_trace.h> 1059 1060 /* clang-format on */ 1061