1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
|
// SPDX-License-Identifier: GPL-2.0-only
/*
* Landlock - Tracepoint helpers
*
* Copyright © 2025 Microsoft Corporation
* Copyright © 2026 Cloudflare, Inc.
*/
#include <linux/cleanup.h>
#include <linux/dcache.h>
#include <linux/err.h>
#include <linux/fs.h>
#include <linux/lsm_audit.h>
#include <net/sock.h>
#include "access.h"
#include "domain.h"
#include "fs.h"
#include "log.h"
#include "ruleset.h"
#include "trace.h"
/*
* Generates the tracepoint definitions in this translation unit. The trace
* event header dereferences the traced objects in TP_fast_assign, so the full
* struct definitions (e.g. ruleset.h, domain.h) must be included before it.
*/
#define CREATE_TRACE_POINTS
#include <trace/events/landlock.h>
/**
* landlock_trace_free_domain - Emit a tracepoint on domain deallocation
*
* @hierarchy: The domain's hierarchy being deallocated.
*
* Fires only for a hierarchy whose creation event was emitted, i.e. one that
* left LANDLOCK_LOG_UNCOMMITTED in landlock_restrict_self(). This keeps the
* create/free pair balanced: a hierarchy that never became observable is freed
* silently, while a domain that landlock_restrict_self() created and a
* thread-sync failure then aborted still fires free_domain, because its
* creation event already fired.
*
* Called from landlock_log_free_domain().
*/
void landlock_trace_free_domain(const struct landlock_hierarchy *const hierarchy)
{
/*
* The log_status read is a correctness guard (keep the create/free pair
* balanced), not a cost guard, so this cold path needs no
* trace_..._enabled() check: the tracepoint is a static-branch no-op
* when disabled. The denial path guards trace_..._enabled() instead
* because it does expensive __getname()/path work before emitting.
*/
if (READ_ONCE(hierarchy->log_status) != LANDLOCK_LOG_UNCOMMITTED)
trace_landlock_free_domain(hierarchy);
}
/**
* landlock_trace_denial - Emit a tracepoint for a denied access request
*
* @request: Detail of the user space request.
* @youngest_denied: The youngest hierarchy node that denied the access.
* @missing: The set of denied access rights.
* @same_exec: Whether the current task is the same executable that called
* landlock_restrict_self() for the denying domain, as computed
* by landlock_log_denial().
* @logged: Whether the domain's policy selects this denial for logging, as
* computed by landlock_log_denial().
*
* Emits the tracepoint matching @request->type when its event is enabled.
* Unlike audit, fires regardless of @logged; the value is recorded in the event
* so consumers can filter on it.
*
* Called from landlock_log_denial().
*/
void landlock_trace_denial(
const struct landlock_request *const request,
const struct landlock_hierarchy *const youngest_denied,
const access_mask_t missing, const bool same_exec, const bool logged)
{
switch (request->type) {
case LANDLOCK_REQUEST_FS_ACCESS:
case LANDLOCK_REQUEST_FS_CHANGE_TOPOLOGY:
if (trace_landlock_deny_access_fs_enabled()) {
char *buf __free(__putname) = __getname();
struct path dentry_path;
const char *pathname;
const struct path *path = NULL;
/*
* Selects the path from the audit data type, as
* dump_common_audit_data() does. A FS_ACCESS denial
* carries a file (hook_file_truncate) or an ioctl op
* (hook_file_ioctl) rather than a path;
* FS_CHANGE_TOPOLOGY carries a path or a bare dentry.
* Reading the wrong union member would dereference
* garbage, so every reachable type is handled here.
*/
switch (request->audit.type) {
case LSM_AUDIT_DATA_FILE:
path = &request->audit.u.file->f_path;
break;
case LSM_AUDIT_DATA_IOCTL_OP:
path = &request->audit.u.op->path;
break;
case LSM_AUDIT_DATA_DENTRY:
/*
* Build a path on the stack with the real
* dentry so TP_fast_assign can extract dev and
* ino; the mnt field is unused there.
*/
dentry_path = (struct path){
.dentry = request->audit.u.dentry,
};
path = &dentry_path;
break;
case LSM_AUDIT_DATA_PATH:
path = &request->audit.u.path;
break;
default:
WARN_ONCE(1,
"Unhandled Landlock FS audit type %d",
request->audit.type);
break;
}
if (!path)
break;
if (!buf) {
pathname = "<no_mem>";
} else if (request->audit.type ==
LSM_AUDIT_DATA_DENTRY) {
/* No vfsmount: render the dentry path alone. */
pathname = dentry_path_raw(
request->audit.u.dentry, buf, PATH_MAX);
if (IS_ERR(pathname))
pathname =
PTR_ERR(pathname) ==
-ENAMETOOLONG ?
"<too_long>" :
"<unreachable>";
} else {
pathname = resolve_path_for_trace(path, buf);
}
trace_landlock_deny_access_fs(youngest_denied,
same_exec, logged,
missing, path, pathname);
}
break;
case LANDLOCK_REQUEST_NET_ACCESS:
if (trace_landlock_deny_access_net_enabled())
trace_landlock_deny_access_net(
youngest_denied, same_exec, logged, missing,
request->audit.u.net->sk,
ntohs(request->audit.u.net->sport),
ntohs(request->audit.u.net->dport));
break;
case LANDLOCK_REQUEST_PTRACE:
if (trace_landlock_deny_ptrace_enabled())
trace_landlock_deny_ptrace(youngest_denied, same_exec,
logged,
request->other_domain_id,
request->audit.u.tsk);
break;
case LANDLOCK_REQUEST_SCOPE_SIGNAL:
if (trace_landlock_deny_scope_signal_enabled())
trace_landlock_deny_scope_signal(
youngest_denied, same_exec, logged,
request->other_domain_id, request->audit.u.tsk);
break;
case LANDLOCK_REQUEST_SCOPE_ABSTRACT_UNIX_SOCKET:
if (trace_landlock_deny_scope_abstract_unix_socket_enabled())
trace_landlock_deny_scope_abstract_unix_socket(
youngest_denied, same_exec, logged,
request->other_domain_id,
request->audit.u.net->sk);
break;
default:
WARN_ONCE(1, "Unhandled Landlock request type %d",
request->type);
break;
}
}
|
