1 /* SPDX-License-Identifier: GPL-2.0-only */ 2 /* 3 * Landlock - Audit helpers 4 * 5 * Copyright © 2023-2025 Microsoft Corporation 6 */ 7 8 #ifndef _SECURITY_LANDLOCK_AUDIT_H 9 #define _SECURITY_LANDLOCK_AUDIT_H 10 11 #include <linux/audit.h> 12 #include <linux/lsm_audit.h> 13 14 #include "access.h" 15 #include "cred.h" 16 17 enum landlock_request_type { 18 LANDLOCK_REQUEST_PTRACE = 1, 19 LANDLOCK_REQUEST_FS_CHANGE_TOPOLOGY, 20 LANDLOCK_REQUEST_FS_ACCESS, 21 LANDLOCK_REQUEST_NET_ACCESS, 22 LANDLOCK_REQUEST_SCOPE_ABSTRACT_UNIX_SOCKET, 23 LANDLOCK_REQUEST_SCOPE_SIGNAL, 24 }; 25 26 /* 27 * We should be careful to only use a variable of this type for 28 * landlock_log_denial(). This way, the compiler can remove it entirely if 29 * CONFIG_AUDIT is not set. 30 */ 31 struct landlock_request { 32 /* Mandatory fields. */ 33 enum landlock_request_type type; 34 struct common_audit_data audit; 35 36 /** 37 * layer_plus_one: First layer level that denies the request + 1. The 38 * extra one is useful to detect uninitialized field. 39 */ 40 size_t layer_plus_one; 41 42 /* Required field for configurable access control. */ 43 access_mask_t access; 44 45 /* Required fields for requests with layer masks. */ 46 const struct layer_access_masks *layer_masks; 47 48 /* Required fields for requests with deny masks. */ 49 const access_mask_t all_existing_optional_access; 50 deny_masks_t deny_masks; 51 }; 52 53 #ifdef CONFIG_AUDIT 54 55 void landlock_log_drop_domain(const struct landlock_hierarchy *const hierarchy); 56 57 void landlock_log_denial(const struct landlock_cred_security *const subject, 58 const struct landlock_request *const request); 59 60 #else /* CONFIG_AUDIT */ 61 62 static inline void 63 landlock_log_drop_domain(const struct landlock_hierarchy *const hierarchy) 64 { 65 } 66 67 static inline void 68 landlock_log_denial(const struct landlock_cred_security *const subject, 69 const struct landlock_request *const request) 70 { 71 } 72 73 #endif /* CONFIG_AUDIT */ 74 75 #endif /* _SECURITY_LANDLOCK_AUDIT_H */ 76