1 /* SPDX-License-Identifier: GPL-2.0-only */ 2 /* 3 * Landlock - Log helpers 4 * 5 * Copyright © 2023-2025 Microsoft Corporation 6 * Copyright © 2026 Cloudflare, Inc. 7 */ 8 9 #ifndef _SECURITY_LANDLOCK_LOG_H 10 #define _SECURITY_LANDLOCK_LOG_H 11 12 #include <linux/lsm_audit.h> 13 14 #include "access.h" 15 16 struct landlock_cred_security; 17 struct landlock_hierarchy; 18 19 enum landlock_request_type { 20 LANDLOCK_REQUEST_PTRACE = 1, 21 LANDLOCK_REQUEST_FS_CHANGE_TOPOLOGY, 22 LANDLOCK_REQUEST_FS_ACCESS, 23 LANDLOCK_REQUEST_NET_ACCESS, 24 LANDLOCK_REQUEST_SCOPE_ABSTRACT_UNIX_SOCKET, 25 LANDLOCK_REQUEST_SCOPE_SIGNAL, 26 }; 27 28 /* 29 * We should be careful to only use a variable of this type for 30 * landlock_log_denial(). This way, the compiler can remove it entirely if 31 * CONFIG_SECURITY_LANDLOCK_LOG is not set. 32 */ 33 struct landlock_request { 34 /* Mandatory fields. */ 35 enum landlock_request_type type; 36 struct common_audit_data audit; 37 38 /** 39 * layer_plus_one: First layer level that denies the request + 1. The 40 * extra one is useful to detect uninitialized field. 41 */ 42 size_t layer_plus_one; 43 44 /* Required field for configurable access control. */ 45 access_mask_t access; 46 47 /* Required fields for requests with layer masks. */ 48 const struct layer_masks *layer_masks; 49 50 /* Required fields for requests with deny masks. */ 51 const access_mask_t all_existing_optional_access; 52 deny_masks_t deny_masks; 53 optional_access_t quiet_optional_accesses; 54 55 /* 56 * Other-party domain ID for a relational (scope/ptrace) denial, or 0 if 57 * that party is unsandboxed. An ID, not a pointer: the other task can 58 * replace its credential and free the domain it referenced. Trace path 59 * only; audit ignores it. 60 */ 61 u64 other_domain_id; 62 }; 63 64 #ifdef CONFIG_SECURITY_LANDLOCK_LOG 65 66 void landlock_log_free_domain(const struct landlock_hierarchy *const hierarchy); 67 68 void landlock_log_denial(const struct landlock_cred_security *const subject, 69 const struct landlock_request *const request); 70 71 #else /* CONFIG_SECURITY_LANDLOCK_LOG */ 72 73 static inline void 74 landlock_log_free_domain(const struct landlock_hierarchy *const hierarchy) 75 { 76 } 77 78 static inline void 79 landlock_log_denial(const struct landlock_cred_security *const subject, 80 const struct landlock_request *const request) 81 { 82 } 83 84 #endif /* CONFIG_SECURITY_LANDLOCK_LOG */ 85 86 #endif /* _SECURITY_LANDLOCK_LOG_H */ 87