1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Landlock - Log helpers 4 * 5 * Copyright © 2023-2025 Microsoft Corporation 6 * Copyright © 2026 Cloudflare, Inc. 7 */ 8 9 #include <kunit/test.h> 10 #include <linux/bitops.h> 11 #include <uapi/linux/landlock.h> 12 13 #include "access.h" 14 #include "audit.h" 15 #include "common.h" 16 #include "cred.h" 17 #include "domain.h" 18 #include "limits.h" 19 #include "log.h" 20 #include "ruleset.h" 21 #include "trace.h" 22 23 static struct landlock_hierarchy * 24 get_hierarchy(const struct landlock_domain *const domain, const size_t layer) 25 { 26 struct landlock_hierarchy *hierarchy = domain->hierarchy; 27 ssize_t i; 28 29 if (WARN_ON_ONCE(layer >= domain->num_layers)) 30 return hierarchy; 31 32 for (i = domain->num_layers - 1; i > layer; i--) { 33 if (WARN_ON_ONCE(!hierarchy->parent)) 34 break; 35 36 hierarchy = hierarchy->parent; 37 } 38 39 return hierarchy; 40 } 41 42 #ifdef CONFIG_SECURITY_LANDLOCK_KUNIT_TEST 43 44 static void test_get_hierarchy(struct kunit *const test) 45 { 46 struct landlock_hierarchy dom0_hierarchy = { 47 .id = 10, 48 }; 49 struct landlock_hierarchy dom1_hierarchy = { 50 .parent = &dom0_hierarchy, 51 .id = 20, 52 }; 53 struct landlock_hierarchy dom2_hierarchy = { 54 .parent = &dom1_hierarchy, 55 .id = 30, 56 }; 57 struct landlock_domain dom2 = { 58 .hierarchy = &dom2_hierarchy, 59 .num_layers = 3, 60 }; 61 62 KUNIT_EXPECT_EQ(test, 10, get_hierarchy(&dom2, 0)->id); 63 KUNIT_EXPECT_EQ(test, 20, get_hierarchy(&dom2, 1)->id); 64 KUNIT_EXPECT_EQ(test, 30, get_hierarchy(&dom2, 2)->id); 65 /* KUNIT_EXPECT_EQ(test, 30, get_hierarchy(&dom2, -1)->id); */ 66 } 67 68 #endif /* CONFIG_SECURITY_LANDLOCK_KUNIT_TEST */ 69 70 /* Get the youngest layer that denied the access_request. */ 71 static size_t get_denied_layer(const struct landlock_domain *const domain, 72 access_mask_t *const access_request, 73 const struct layer_masks *masks) 74 { 75 for (ssize_t i = ARRAY_SIZE(masks->layers) - 1; i >= 0; i--) { 76 if (masks->layers[i].access & *access_request) { 77 *access_request &= masks->layers[i].access; 78 return i; 79 } 80 } 81 82 /* Not found - fall back to default values */ 83 *access_request = 0; 84 return domain->num_layers - 1; 85 } 86 87 #ifdef CONFIG_SECURITY_LANDLOCK_KUNIT_TEST 88 89 static void test_get_denied_layer(struct kunit *const test) 90 { 91 const struct landlock_domain dom = { 92 .num_layers = 5, 93 }; 94 const struct layer_masks masks = { 95 .layers[0].access = LANDLOCK_ACCESS_FS_EXECUTE | 96 LANDLOCK_ACCESS_FS_READ_DIR, 97 .layers[1].access = LANDLOCK_ACCESS_FS_READ_FILE | 98 LANDLOCK_ACCESS_FS_READ_DIR, 99 .layers[2].access = LANDLOCK_ACCESS_FS_REMOVE_DIR, 100 }; 101 access_mask_t access; 102 103 access = LANDLOCK_ACCESS_FS_EXECUTE; 104 KUNIT_EXPECT_EQ(test, 0, get_denied_layer(&dom, &access, &masks)); 105 KUNIT_EXPECT_EQ(test, access, LANDLOCK_ACCESS_FS_EXECUTE); 106 107 access = LANDLOCK_ACCESS_FS_READ_FILE; 108 KUNIT_EXPECT_EQ(test, 1, get_denied_layer(&dom, &access, &masks)); 109 KUNIT_EXPECT_EQ(test, access, LANDLOCK_ACCESS_FS_READ_FILE); 110 111 access = LANDLOCK_ACCESS_FS_READ_DIR; 112 KUNIT_EXPECT_EQ(test, 1, get_denied_layer(&dom, &access, &masks)); 113 KUNIT_EXPECT_EQ(test, access, LANDLOCK_ACCESS_FS_READ_DIR); 114 115 access = LANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_READ_DIR; 116 KUNIT_EXPECT_EQ(test, 1, get_denied_layer(&dom, &access, &masks)); 117 KUNIT_EXPECT_EQ(test, access, 118 LANDLOCK_ACCESS_FS_READ_FILE | 119 LANDLOCK_ACCESS_FS_READ_DIR); 120 121 access = LANDLOCK_ACCESS_FS_EXECUTE | LANDLOCK_ACCESS_FS_READ_DIR; 122 KUNIT_EXPECT_EQ(test, 1, get_denied_layer(&dom, &access, &masks)); 123 KUNIT_EXPECT_EQ(test, access, LANDLOCK_ACCESS_FS_READ_DIR); 124 125 access = LANDLOCK_ACCESS_FS_WRITE_FILE; 126 KUNIT_EXPECT_EQ(test, 4, get_denied_layer(&dom, &access, &masks)); 127 KUNIT_EXPECT_EQ(test, access, 0); 128 } 129 130 #endif /* CONFIG_SECURITY_LANDLOCK_KUNIT_TEST */ 131 132 static size_t 133 get_layer_from_deny_masks(access_mask_t *const access_request, 134 const access_mask_t all_existing_optional_access, 135 const deny_masks_t deny_masks, 136 optional_access_t quiet_optional_accesses, 137 bool *quiet) 138 { 139 const unsigned long access_opt = all_existing_optional_access; 140 const unsigned long access_req = *access_request; 141 access_mask_t missing = 0; 142 size_t youngest_layer = 0; 143 size_t access_index = 0; 144 unsigned long access_bit; 145 bool should_quiet = false; 146 147 /* This will require change with new object types. */ 148 WARN_ON_ONCE(access_opt != _LANDLOCK_ACCESS_FS_OPTIONAL); 149 150 for_each_set_bit(access_bit, &access_opt, 151 BITS_PER_TYPE(access_mask_t)) { 152 if (access_req & BIT(access_bit)) { 153 const size_t layer = 154 (deny_masks >> 155 (access_index * 156 HWEIGHT(LANDLOCK_MAX_NUM_LAYERS - 1))) & 157 (LANDLOCK_MAX_NUM_LAYERS - 1); 158 const bool layer_has_quiet = 159 !!(quiet_optional_accesses & BIT(access_index)); 160 161 if (layer > youngest_layer) { 162 youngest_layer = layer; 163 missing = BIT(access_bit); 164 should_quiet = layer_has_quiet; 165 } else if (layer == youngest_layer) { 166 missing |= BIT(access_bit); 167 /* 168 * Whether the layer has rules with quiet flag 169 * covering the file accessed does not depend on 170 * the access, and so the following 171 * WARN_ON_ONCE() should not fail. 172 */ 173 WARN_ON_ONCE(should_quiet && !layer_has_quiet); 174 should_quiet = layer_has_quiet; 175 } 176 } 177 access_index++; 178 } 179 180 *access_request = missing; 181 *quiet = should_quiet; 182 return youngest_layer; 183 } 184 185 #ifdef CONFIG_SECURITY_LANDLOCK_KUNIT_TEST 186 187 static void test_get_layer_from_deny_masks(struct kunit *const test) 188 { 189 deny_masks_t deny_mask; 190 access_mask_t access; 191 optional_access_t quiet_optional_accesses; 192 bool quiet; 193 194 /* truncate:0 ioctl_dev:2 */ 195 deny_mask = 0x20; 196 quiet_optional_accesses = 0; 197 198 access = LANDLOCK_ACCESS_FS_TRUNCATE; 199 KUNIT_EXPECT_EQ(test, 0, 200 get_layer_from_deny_masks( 201 &access, _LANDLOCK_ACCESS_FS_OPTIONAL, 202 deny_mask, quiet_optional_accesses, &quiet)); 203 KUNIT_EXPECT_EQ(test, access, LANDLOCK_ACCESS_FS_TRUNCATE); 204 KUNIT_EXPECT_EQ(test, quiet, false); 205 206 access = LANDLOCK_ACCESS_FS_IOCTL_DEV; 207 KUNIT_EXPECT_EQ(test, 2, 208 get_layer_from_deny_masks( 209 &access, _LANDLOCK_ACCESS_FS_OPTIONAL, 210 deny_mask, quiet_optional_accesses, &quiet)); 211 KUNIT_EXPECT_EQ(test, access, LANDLOCK_ACCESS_FS_IOCTL_DEV); 212 KUNIT_EXPECT_EQ(test, quiet, false); 213 214 access = LANDLOCK_ACCESS_FS_TRUNCATE | LANDLOCK_ACCESS_FS_IOCTL_DEV; 215 KUNIT_EXPECT_EQ(test, 2, 216 get_layer_from_deny_masks( 217 &access, _LANDLOCK_ACCESS_FS_OPTIONAL, 218 deny_mask, quiet_optional_accesses, &quiet)); 219 KUNIT_EXPECT_EQ(test, access, LANDLOCK_ACCESS_FS_IOCTL_DEV); 220 KUNIT_EXPECT_EQ(test, quiet, false); 221 222 /* layer denying truncate: quiet, ioctl: not quiet */ 223 quiet_optional_accesses = 0b01; 224 225 access = LANDLOCK_ACCESS_FS_TRUNCATE; 226 KUNIT_EXPECT_EQ(test, 0, 227 get_layer_from_deny_masks( 228 &access, _LANDLOCK_ACCESS_FS_OPTIONAL, 229 deny_mask, quiet_optional_accesses, &quiet)); 230 KUNIT_EXPECT_EQ(test, access, LANDLOCK_ACCESS_FS_TRUNCATE); 231 KUNIT_EXPECT_EQ(test, quiet, true); 232 233 access = LANDLOCK_ACCESS_FS_IOCTL_DEV; 234 KUNIT_EXPECT_EQ(test, 2, 235 get_layer_from_deny_masks( 236 &access, _LANDLOCK_ACCESS_FS_OPTIONAL, 237 deny_mask, quiet_optional_accesses, &quiet)); 238 KUNIT_EXPECT_EQ(test, access, LANDLOCK_ACCESS_FS_IOCTL_DEV); 239 KUNIT_EXPECT_EQ(test, quiet, false); 240 241 access = LANDLOCK_ACCESS_FS_TRUNCATE | LANDLOCK_ACCESS_FS_IOCTL_DEV; 242 KUNIT_EXPECT_EQ(test, 2, 243 get_layer_from_deny_masks( 244 &access, _LANDLOCK_ACCESS_FS_OPTIONAL, 245 deny_mask, quiet_optional_accesses, &quiet)); 246 KUNIT_EXPECT_EQ(test, access, LANDLOCK_ACCESS_FS_IOCTL_DEV); 247 KUNIT_EXPECT_EQ(test, quiet, false); 248 249 /* Reverse order - truncate:2 ioctl_dev:0 */ 250 deny_mask = 0x02; 251 quiet_optional_accesses = 0; 252 253 access = LANDLOCK_ACCESS_FS_TRUNCATE; 254 KUNIT_EXPECT_EQ(test, 2, 255 get_layer_from_deny_masks( 256 &access, _LANDLOCK_ACCESS_FS_OPTIONAL, 257 deny_mask, quiet_optional_accesses, &quiet)); 258 KUNIT_EXPECT_EQ(test, access, LANDLOCK_ACCESS_FS_TRUNCATE); 259 KUNIT_EXPECT_EQ(test, quiet, false); 260 261 access = LANDLOCK_ACCESS_FS_IOCTL_DEV; 262 KUNIT_EXPECT_EQ(test, 0, 263 get_layer_from_deny_masks( 264 &access, _LANDLOCK_ACCESS_FS_OPTIONAL, 265 deny_mask, quiet_optional_accesses, &quiet)); 266 KUNIT_EXPECT_EQ(test, access, LANDLOCK_ACCESS_FS_IOCTL_DEV); 267 KUNIT_EXPECT_EQ(test, quiet, false); 268 269 access = LANDLOCK_ACCESS_FS_TRUNCATE | LANDLOCK_ACCESS_FS_IOCTL_DEV; 270 KUNIT_EXPECT_EQ(test, 2, 271 get_layer_from_deny_masks( 272 &access, _LANDLOCK_ACCESS_FS_OPTIONAL, 273 deny_mask, quiet_optional_accesses, &quiet)); 274 KUNIT_EXPECT_EQ(test, access, LANDLOCK_ACCESS_FS_TRUNCATE); 275 KUNIT_EXPECT_EQ(test, quiet, false); 276 277 /* layer denying truncate: quiet, ioctl: not quiet */ 278 quiet_optional_accesses = 0b01; 279 280 access = LANDLOCK_ACCESS_FS_TRUNCATE; 281 KUNIT_EXPECT_EQ(test, 2, 282 get_layer_from_deny_masks( 283 &access, _LANDLOCK_ACCESS_FS_OPTIONAL, 284 deny_mask, quiet_optional_accesses, &quiet)); 285 KUNIT_EXPECT_EQ(test, access, LANDLOCK_ACCESS_FS_TRUNCATE); 286 KUNIT_EXPECT_EQ(test, quiet, true); 287 288 access = LANDLOCK_ACCESS_FS_IOCTL_DEV; 289 KUNIT_EXPECT_EQ(test, 0, 290 get_layer_from_deny_masks( 291 &access, _LANDLOCK_ACCESS_FS_OPTIONAL, 292 deny_mask, quiet_optional_accesses, &quiet)); 293 KUNIT_EXPECT_EQ(test, access, LANDLOCK_ACCESS_FS_IOCTL_DEV); 294 KUNIT_EXPECT_EQ(test, quiet, false); 295 296 access = LANDLOCK_ACCESS_FS_TRUNCATE | LANDLOCK_ACCESS_FS_IOCTL_DEV; 297 KUNIT_EXPECT_EQ(test, 2, 298 get_layer_from_deny_masks( 299 &access, _LANDLOCK_ACCESS_FS_OPTIONAL, 300 deny_mask, quiet_optional_accesses, &quiet)); 301 KUNIT_EXPECT_EQ(test, access, LANDLOCK_ACCESS_FS_TRUNCATE); 302 KUNIT_EXPECT_EQ(test, quiet, true); 303 304 /* layer denying truncate: not quiet, ioctl: quiet */ 305 quiet_optional_accesses = 0b10; 306 307 access = LANDLOCK_ACCESS_FS_TRUNCATE; 308 KUNIT_EXPECT_EQ(test, 2, 309 get_layer_from_deny_masks( 310 &access, _LANDLOCK_ACCESS_FS_OPTIONAL, 311 deny_mask, quiet_optional_accesses, &quiet)); 312 KUNIT_EXPECT_EQ(test, access, LANDLOCK_ACCESS_FS_TRUNCATE); 313 KUNIT_EXPECT_EQ(test, quiet, false); 314 315 access = LANDLOCK_ACCESS_FS_IOCTL_DEV; 316 KUNIT_EXPECT_EQ(test, 0, 317 get_layer_from_deny_masks( 318 &access, _LANDLOCK_ACCESS_FS_OPTIONAL, 319 deny_mask, quiet_optional_accesses, &quiet)); 320 KUNIT_EXPECT_EQ(test, access, LANDLOCK_ACCESS_FS_IOCTL_DEV); 321 KUNIT_EXPECT_EQ(test, quiet, true); 322 323 access = LANDLOCK_ACCESS_FS_TRUNCATE | LANDLOCK_ACCESS_FS_IOCTL_DEV; 324 KUNIT_EXPECT_EQ(test, 2, 325 get_layer_from_deny_masks( 326 &access, _LANDLOCK_ACCESS_FS_OPTIONAL, 327 deny_mask, quiet_optional_accesses, &quiet)); 328 KUNIT_EXPECT_EQ(test, access, LANDLOCK_ACCESS_FS_TRUNCATE); 329 KUNIT_EXPECT_EQ(test, quiet, false); 330 331 /* truncate:15 ioctl_dev:15 */ 332 deny_mask = 0xff; 333 quiet_optional_accesses = 0; 334 335 access = LANDLOCK_ACCESS_FS_TRUNCATE; 336 KUNIT_EXPECT_EQ(test, 15, 337 get_layer_from_deny_masks( 338 &access, _LANDLOCK_ACCESS_FS_OPTIONAL, 339 deny_mask, quiet_optional_accesses, &quiet)); 340 KUNIT_EXPECT_EQ(test, access, LANDLOCK_ACCESS_FS_TRUNCATE); 341 KUNIT_EXPECT_EQ(test, quiet, false); 342 343 access = LANDLOCK_ACCESS_FS_TRUNCATE | LANDLOCK_ACCESS_FS_IOCTL_DEV; 344 KUNIT_EXPECT_EQ(test, 15, 345 get_layer_from_deny_masks( 346 &access, _LANDLOCK_ACCESS_FS_OPTIONAL, 347 deny_mask, quiet_optional_accesses, &quiet)); 348 KUNIT_EXPECT_EQ(test, access, 349 LANDLOCK_ACCESS_FS_TRUNCATE | 350 LANDLOCK_ACCESS_FS_IOCTL_DEV); 351 KUNIT_EXPECT_EQ(test, quiet, false); 352 353 /* Both quiet (same layer so quietness must be the same) */ 354 quiet_optional_accesses = 0b11; 355 356 access = LANDLOCK_ACCESS_FS_TRUNCATE; 357 KUNIT_EXPECT_EQ(test, 15, 358 get_layer_from_deny_masks( 359 &access, _LANDLOCK_ACCESS_FS_OPTIONAL, 360 deny_mask, quiet_optional_accesses, &quiet)); 361 KUNIT_EXPECT_EQ(test, access, LANDLOCK_ACCESS_FS_TRUNCATE); 362 KUNIT_EXPECT_EQ(test, quiet, true); 363 364 access = LANDLOCK_ACCESS_FS_TRUNCATE | LANDLOCK_ACCESS_FS_IOCTL_DEV; 365 KUNIT_EXPECT_EQ(test, 15, 366 get_layer_from_deny_masks( 367 &access, _LANDLOCK_ACCESS_FS_OPTIONAL, 368 deny_mask, quiet_optional_accesses, &quiet)); 369 KUNIT_EXPECT_EQ(test, access, 370 LANDLOCK_ACCESS_FS_TRUNCATE | 371 LANDLOCK_ACCESS_FS_IOCTL_DEV); 372 KUNIT_EXPECT_EQ(test, quiet, true); 373 } 374 375 #endif /* CONFIG_SECURITY_LANDLOCK_KUNIT_TEST */ 376 377 static bool is_valid_request(const struct landlock_request *const request) 378 { 379 if (WARN_ON_ONCE(request->layer_plus_one > LANDLOCK_MAX_NUM_LAYERS)) 380 return false; 381 382 if (WARN_ON_ONCE(!(!!request->layer_plus_one ^ !!request->access))) 383 return false; 384 385 if (request->access) { 386 if (WARN_ON_ONCE(!(!!request->layer_masks ^ 387 !!request->all_existing_optional_access))) 388 return false; 389 } else { 390 if (WARN_ON_ONCE(request->layer_masks || 391 request->all_existing_optional_access)) 392 return false; 393 } 394 395 if (request->deny_masks) { 396 if (WARN_ON_ONCE(!request->all_existing_optional_access)) 397 return false; 398 static_assert(sizeof(request->all_existing_optional_access) == 399 sizeof(u32)); 400 if (WARN_ON_ONCE( 401 request->quiet_optional_accesses >= 402 BIT(hweight32( 403 request->all_existing_optional_access)))) 404 return false; 405 } 406 407 return true; 408 } 409 410 static access_mask_t 411 pick_access_mask_for_request_type(const enum landlock_request_type type, 412 const struct access_masks access_masks) 413 { 414 switch (type) { 415 case LANDLOCK_REQUEST_FS_ACCESS: 416 return access_masks.fs; 417 case LANDLOCK_REQUEST_NET_ACCESS: 418 return access_masks.net; 419 default: 420 WARN_ONCE(1, "Invalid request type %d passed to %s", type, 421 __func__); 422 return 0; 423 } 424 } 425 426 /* 427 * Whether a quiet rule silences the denial: the rule must cover the whole 428 * denied access in the layer that denied it (a quiet rule in a non-denying 429 * layer does not suppress the denial). 430 */ 431 static bool 432 is_denial_quieted(const struct landlock_request *const request, 433 const struct landlock_hierarchy *const youngest_denied, 434 const access_mask_t missing, const bool object_quiet_flag) 435 { 436 if (object_quiet_flag) { 437 const access_mask_t quiet_mask = 438 pick_access_mask_for_request_type( 439 request->type, youngest_denied->quiet_masks); 440 441 return (quiet_mask & missing) == missing; 442 } 443 444 /* 445 * Either the object is not quiet, or this is a scope request. We check 446 * request->type to distinguish between the two cases. 447 */ 448 switch (request->type) { 449 case LANDLOCK_REQUEST_SCOPE_SIGNAL: 450 return !!(youngest_denied->quiet_masks.scope & 451 LANDLOCK_SCOPE_SIGNAL); 452 case LANDLOCK_REQUEST_SCOPE_ABSTRACT_UNIX_SOCKET: 453 return !!(youngest_denied->quiet_masks.scope & 454 LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET); 455 /* 456 * Leave LANDLOCK_REQUEST_PTRACE and LANDLOCK_REQUEST_FS_CHANGE_TOPOLOGY 457 * unhandled for now - they are never quiet. 458 */ 459 default: 460 return false; 461 } 462 } 463 464 /* 465 * Computes whether a denial from youngest_denied is selected for logging by the 466 * domain's policy: its logging must not be disabled (by both per-execution 467 * flags being off, or by an ancestor's 468 * LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF), the per-execution flag matching 469 * same_exec must be set, and no quiet rule may cover the denied access. 470 * landlock_log_denial() computes this once and passes it to 471 * landlock_audit_denial(), which additionally requires audit_enabled. 472 */ 473 static bool 474 is_denial_logged(const struct landlock_request *const request, 475 const struct landlock_hierarchy *const youngest_denied, 476 const access_mask_t missing, const bool same_exec, 477 const bool object_quiet_flag) 478 { 479 if (READ_ONCE(youngest_denied->log_status) == LANDLOCK_LOG_DISABLED) 480 return false; 481 482 if (!(same_exec ? youngest_denied->log_same_exec : 483 youngest_denied->log_new_exec)) 484 return false; 485 486 return !is_denial_quieted(request, youngest_denied, missing, 487 object_quiet_flag); 488 } 489 490 /** 491 * landlock_log_denial - Log a denied access 492 * 493 * @subject: The Landlock subject's credential denying an action. 494 * @request: Detail of the user space request. 495 */ 496 void landlock_log_denial(const struct landlock_cred_security *const subject, 497 const struct landlock_request *const request) 498 { 499 struct landlock_hierarchy *youngest_denied; 500 size_t youngest_layer; 501 access_mask_t missing; 502 bool object_quiet_flag = false; 503 504 if (WARN_ON_ONCE(!subject || !subject->domain || 505 !subject->domain->hierarchy || !request)) 506 return; 507 508 if (!is_valid_request(request)) 509 return; 510 511 missing = request->access; 512 if (missing) { 513 /* Gets the nearest domain that denies the request. */ 514 if (request->layer_masks) { 515 youngest_layer = get_denied_layer(subject->domain, 516 &missing, 517 request->layer_masks); 518 object_quiet_flag = 519 request->layer_masks->layers[youngest_layer] 520 .quiet; 521 } else { 522 youngest_layer = get_layer_from_deny_masks( 523 &missing, _LANDLOCK_ACCESS_FS_OPTIONAL, 524 request->deny_masks, 525 request->quiet_optional_accesses, 526 &object_quiet_flag); 527 } 528 youngest_denied = 529 get_hierarchy(subject->domain, youngest_layer); 530 } else { 531 youngest_layer = request->layer_plus_one - 1; 532 youngest_denied = 533 get_hierarchy(subject->domain, youngest_layer); 534 } 535 536 const bool same_exec = !!(subject->domain_exec & BIT(youngest_layer)); 537 const bool logged = is_denial_logged(request, youngest_denied, missing, 538 same_exec, object_quiet_flag); 539 540 /* 541 * Consistently keeps track of the number of denied access requests even 542 * if audit is currently disabled, or if audit rules currently exclude 543 * this record type, or if landlock_restrict_self(2)'s flags quiet logs. 544 */ 545 atomic64_inc(&youngest_denied->num_denials); 546 547 landlock_trace_denial(request, youngest_denied, missing, same_exec, 548 logged); 549 landlock_audit_denial(request, youngest_denied, missing, logged); 550 } 551 552 /** 553 * landlock_log_free_domain - Log domain deallocation 554 * 555 * @hierarchy: The domain's hierarchy being deallocated. 556 * 557 * Called from landlock_put_domain_deferred() (via a work queue scheduled by 558 * hook_cred_free()) or directly from landlock_put_domain(). 559 */ 560 void landlock_log_free_domain(const struct landlock_hierarchy *const hierarchy) 561 { 562 if (WARN_ON_ONCE(!hierarchy)) 563 return; 564 565 landlock_trace_free_domain(hierarchy); 566 landlock_audit_free_domain(hierarchy); 567 } 568 569 #ifdef CONFIG_SECURITY_LANDLOCK_KUNIT_TEST 570 571 static struct kunit_case test_cases[] = { 572 /* clang-format off */ 573 KUNIT_CASE(test_get_hierarchy), 574 KUNIT_CASE(test_get_denied_layer), 575 KUNIT_CASE(test_get_layer_from_deny_masks), 576 {} 577 /* clang-format on */ 578 }; 579 580 static struct kunit_suite test_suite = { 581 .name = "landlock_log", 582 .test_cases = test_cases, 583 }; 584 585 kunit_test_suite(test_suite); 586 587 #endif /* CONFIG_SECURITY_LANDLOCK_KUNIT_TEST */ 588