1 /* SPDX-License-Identifier: GPL-2.0-only */ 2 /* 3 * Landlock - Log helpers 4 * 5 * Copyright © 2023-2025 Microsoft Corporation 6 * Copyright © 2026 Cloudflare, Inc. 7 */ 8 9 #ifndef _SECURITY_LANDLOCK_LOG_H 10 #define _SECURITY_LANDLOCK_LOG_H 11 12 #include <linux/lsm_audit.h> 13 14 #include "access.h" 15 16 struct landlock_cred_security; 17 struct landlock_hierarchy; 18 struct sockaddr; 19 struct task_struct; 20 21 enum landlock_request_type { 22 LANDLOCK_REQUEST_PTRACE = 1, 23 LANDLOCK_REQUEST_FS_CHANGE_TOPOLOGY, 24 LANDLOCK_REQUEST_FS_ACCESS, 25 LANDLOCK_REQUEST_NET_ACCESS, 26 LANDLOCK_REQUEST_SCOPE_ABSTRACT_UNIX_SOCKET, 27 LANDLOCK_REQUEST_SCOPE_SIGNAL, 28 }; 29 30 struct landlock_blockers { 31 access_mask_t access; 32 enum landlock_request_type type; 33 }; 34 35 #ifdef CONFIG_TRACEPOINTS 36 37 struct landlock_net_trace { 38 const struct sockaddr *address; 39 int addrlen; 40 u16 socket_family; 41 }; 42 43 struct landlock_ptrace_trace { 44 u64 tracee_domain_id; 45 const struct task_struct *tracer; 46 }; 47 48 struct landlock_signal_trace { 49 u64 target_domain_id; 50 int signal; 51 }; 52 53 #endif /* CONFIG_TRACEPOINTS */ 54 55 /* 56 * We should be careful to only use a variable of this type for 57 * landlock_log_denial(). This way, the compiler can remove it entirely if 58 * CONFIG_SECURITY_LANDLOCK_LOG is not set. 59 */ 60 struct landlock_request { 61 /* Mandatory fields. */ 62 enum landlock_request_type type; 63 struct common_audit_data audit; 64 65 /** 66 * layer_plus_one: First layer level that denies the request + 1. The 67 * extra one is useful to detect uninitialized field. 68 */ 69 size_t layer_plus_one; 70 71 /* Required field for configurable access control. */ 72 access_mask_t access; 73 74 /* Required fields for requests with layer masks. */ 75 const struct layer_masks *layer_masks; 76 77 /* Required fields for requests with deny masks. */ 78 const access_mask_t all_existing_optional_access; 79 deny_masks_t deny_masks; 80 optional_access_t quiet_optional_accesses; 81 82 #ifdef CONFIG_TRACEPOINTS 83 union { 84 /* 85 * Other-party domain ID for an abstract UNIX socket scope 86 * denial, or 0 if that party is unsandboxed. Store an ID, not 87 * a pointer: the other task can replace its credential and free 88 * the domain it referenced. 89 */ 90 u64 other_domain_id; 91 92 /* Synchronous context for a network denial. */ 93 const struct landlock_net_trace *trace_net; 94 /* Synchronous context for a ptrace denial. */ 95 const struct landlock_ptrace_trace *trace_ptrace; 96 /* Synchronous context for a signal denial. */ 97 const struct landlock_signal_trace *trace_signal; 98 }; 99 #endif /* CONFIG_TRACEPOINTS */ 100 }; 101 102 #ifdef CONFIG_SECURITY_LANDLOCK_LOG 103 104 void landlock_log_free_domain(const struct landlock_hierarchy *const hierarchy); 105 106 void landlock_log_denial(const struct landlock_cred_security *const subject, 107 const struct landlock_request *const request); 108 109 #else /* CONFIG_SECURITY_LANDLOCK_LOG */ 110 111 static inline void 112 landlock_log_free_domain(const struct landlock_hierarchy *const hierarchy) 113 { 114 } 115 116 static inline void 117 landlock_log_denial(const struct landlock_cred_security *const subject, 118 const struct landlock_request *const request) 119 { 120 } 121 122 #endif /* CONFIG_SECURITY_LANDLOCK_LOG */ 123 124 #endif /* _SECURITY_LANDLOCK_LOG_H */ 125