| 1 |
|
| 2 | |
| 3 | * Copyright © 2025 Microsoft Corporation
|
| 4 | * Copyright © 2026 Cloudflare, Inc.
|
| 5 |
|
| 6 |
|
| 7 | #undef TRACE_SYSTEM
|
| 8 | #define TRACE_SYSTEM landlock
|
| 9 |
|
| 10 | #if !defined(_TRACE_LANDLOCK_H) || defined(TRACE_HEADER_MULTI_READ)
|
| 11 | #define _TRACE_LANDLOCK_H
|
| 12 |
|
| 13 | #include <linux/in.h>
|
| 14 | #include <linux/in6.h>
|
| 15 | #include <linux/landlock.h>
|
| 16 | #include <linux/socket.h>
|
| 17 | #include <linux/string.h>
|
| 18 | #include <linux/string_helpers.h>
|
| 19 | #include <linux/tracepoint.h>
|
| 20 | #include <linux/trace_seq.h>
|
| 21 | #include <net/af_unix.h>
|
| 22 |
|
| 23 | enum landlock_request_type;
|
| 24 | struct dentry;
|
| 25 | struct landlock_blockers;
|
| 26 | struct landlock_domain;
|
| 27 | struct landlock_hierarchy;
|
| 28 | struct landlock_rule;
|
| 29 | struct landlock_ruleset;
|
| 30 | struct path;
|
| 31 | struct sock;
|
| 32 | struct task_struct;
|
| 33 |
|
| 34 | static_assert(sizeof(access_mask_t) <= sizeof(u64));
|
| 35 |
|
| 36 | TRACE_DEFINE_ENUM(LANDLOCK_REQUEST_FS_CHANGE_TOPOLOGY);
|
| 37 | TRACE_DEFINE_ENUM(LANDLOCK_REQUEST_FS_ACCESS);
|
| 38 | TRACE_DEFINE_ENUM(LANDLOCK_REQUEST_NET_ACCESS);
|
| 39 |
|
| 40 | #ifdef CREATE_TRACE_POINTS
|
| 41 |
|
| 42 |
|
| 43 | #define TRACE_UNTRUSTED_STR_OUTPUT_SIZE \
|
| 44 | (TRACE_SEQ_BUFFER_SIZE - TRACE_SEQ_BUFFER_SIZE / 4)
|
| 45 |
|
| 46 | |
| 47 | * A raw UTF-8 ellipsis (…) marks truncation and cannot collide with escaped
|
| 48 | * input: ESCAPE_NAP renders every non-ASCII input byte in octal.
|
| 49 |
|
| 50 | #define TRACE_TRUNCATION_MARKER "\xe2\x80\xa6"
|
| 51 |
|
| 52 | |
| 53 | * Escapes @len bytes of an untrusted string into the trace sequence @p so it
|
| 54 | * cannot inject field separators or control characters into the ftrace text
|
| 55 | * output, and can be unambiguously recovered. Called from the TP_printk() of
|
| 56 | * the tracepoints that expose paths and process names. @len is passed by the
|
| 57 | * caller (rather than derived with strlen()) so a name that is not
|
| 58 | * NUL-terminated or carries embedded NUL bytes (an abstract socket name) is
|
| 59 | * escaped in full instead of being truncated at the first NUL.
|
| 60 | *
|
| 61 | * Strings that exceed the output limit retain the largest complete escaped
|
| 62 | * prefix followed by the truncation marker.
|
| 63 | *
|
| 64 | * Return: a pointer into @p's buffer, or NULL if @src is NULL or the fixed
|
| 65 | * output reservation is unavailable.
|
| 66 |
|
| 67 | static inline const char *
|
| 68 | __trace_print_untrusted_str(struct trace_seq *p, const char *src, size_t len)
|
| 69 | {
|
| 70 | const unsigned int escape_flags = ESCAPE_SPACE | ESCAPE_SPECIAL |
|
| 71 | ESCAPE_NAP | ESCAPE_APPEND |
|
| 72 | ESCAPE_OCTAL;
|
| 73 | const size_t marker_len = sizeof(TRACE_TRUNCATION_MARKER) - 1;
|
| 74 | size_t buf_size, prefix_len, prefix_size;
|
| 75 | int escaped_size;
|
| 76 | char *buf;
|
| 77 | const char *ret;
|
| 78 |
|
| 79 | buf_size = seq_buf_get_buf(&p->seq, &buf);
|
| 80 | if (!src || buf_size < TRACE_UNTRUSTED_STR_OUTPUT_SIZE)
|
| 81 | return NULL;
|
| 82 |
|
| 83 | ret = trace_seq_buffer_ptr(p);
|
| 84 | escaped_size = string_escape_mem(src, len, buf,
|
| 85 | TRACE_UNTRUSTED_STR_OUTPUT_SIZE,
|
| 86 | escape_flags, " ='\"\\");
|
| 87 | if (likely(escaped_size < TRACE_UNTRUSTED_STR_OUTPUT_SIZE)) {
|
| 88 | seq_buf_commit(&p->seq, escaped_size);
|
| 89 | trace_seq_putc(p, 0);
|
| 90 | return ret;
|
| 91 | }
|
| 92 |
|
| 93 | prefix_len = 0;
|
| 94 | prefix_size = 0;
|
| 95 | while (prefix_len < len) {
|
| 96 | const char *const src_char = src + prefix_len;
|
| 97 | int char_size;
|
| 98 |
|
| 99 | char_size = string_escape_mem(src_char, 1, NULL, 0,
|
| 100 | escape_flags, " ='\"\\");
|
| 101 | if (char_size > TRACE_UNTRUSTED_STR_OUTPUT_SIZE - marker_len -
|
| 102 | 1 - prefix_size)
|
| 103 | break;
|
| 104 | prefix_size += char_size;
|
| 105 | prefix_len++;
|
| 106 | }
|
| 107 |
|
| 108 | escaped_size = string_escape_mem(src, prefix_len, buf, prefix_size,
|
| 109 | escape_flags, " ='\"\\");
|
| 110 | if (WARN_ON_ONCE(escaped_size != prefix_size))
|
| 111 | return NULL;
|
| 112 | memcpy(buf + prefix_size, TRACE_TRUNCATION_MARKER, marker_len);
|
| 113 | seq_buf_commit(&p->seq, prefix_size + marker_len);
|
| 114 | trace_seq_putc(p, 0);
|
| 115 | return ret;
|
| 116 | }
|
| 117 |
|
| 118 | |
| 119 | * Fills the dense per-domain-layer array layers (one access mask per layer,
|
| 120 | * indexed by level - 1) from rule's sparse layer stack, keeping only the
|
| 121 | * requested rights (access_request). Layers with no matching rule entry get
|
| 122 | * a zero mask. Shared by the check_rule_inode and check_rule_net_port events.
|
| 123 | *
|
| 124 | * rule->layers is sorted by ascending level, with levels in the domain's
|
| 125 | * [1, num_layers] range (see landlock_merge_ruleset()), so every entry maps
|
| 126 | * to a slot. A leftover entry would be a malformed rule; the zero-filled
|
| 127 | * slots keep the output and the array bounds safe regardless.
|
| 128 |
|
| 129 | static inline void
|
| 130 | __trace_landlock_fill_layers(access_mask_t *const layers,
|
| 131 | const size_t num_layers,
|
| 132 | const struct landlock_rule *const rule,
|
| 133 | const access_mask_t access_request)
|
| 134 | {
|
| 135 | size_t i = 0;
|
| 136 |
|
| 137 | for (size_t level = 1; level <= num_layers; level++) {
|
| 138 | access_mask_t grants = 0;
|
| 139 |
|
| 140 | if (i < rule->num_layers && level == rule->layers[i].level) {
|
| 141 | grants = rule->layers[i].access & access_request;
|
| 142 | i++;
|
| 143 | }
|
| 144 | layers[level - 1] = grants;
|
| 145 | }
|
| 146 |
|
| 147 |
|
| 148 | WARN_ON_ONCE(i < rule->num_layers);
|
| 149 | }
|
| 150 |
|
| 151 | |
| 152 | * Renders the dense per-domain-layer access array as symbolic flag names for
|
| 153 | * the grants field: layers wrapped in "{}", flags within a layer joined by
|
| 154 | * "|", layers separated by ",", an empty layer rendered as nothing.
|
| 155 | * Open-codes the flag walk because trace_print_flags_seq() NUL-terminates per
|
| 156 | * call and so cannot be chained into a single field. The shared names table
|
| 157 | * covers every access right, so masked bits are always named. Returns the
|
| 158 | * trace_seq position like __print_flags().
|
| 159 |
|
| 160 | static inline const char *__trace_landlock_print_layers(
|
| 161 | struct trace_seq *p, const access_mask_t *const layers,
|
| 162 | const size_t num_layers, const struct trace_print_flags *const names,
|
| 163 | const size_t names_size)
|
| 164 | {
|
| 165 | const char *const ret = trace_seq_buffer_ptr(p);
|
| 166 |
|
| 167 | trace_seq_putc(p, '{');
|
| 168 | for (size_t i = 0; i < num_layers; i++) {
|
| 169 | access_mask_t mask = layers[i];
|
| 170 | bool first = true;
|
| 171 |
|
| 172 | if (i)
|
| 173 | trace_seq_putc(p, ',');
|
| 174 | for (size_t j = 0; mask && j < names_size; j++) {
|
| 175 | if ((mask & names[j].mask) != names[j].mask)
|
| 176 | continue;
|
| 177 | if (!first)
|
| 178 | trace_seq_putc(p, '|');
|
| 179 | trace_seq_puts(p, names[j].name);
|
| 180 | mask &= ~names[j].mask;
|
| 181 | first = false;
|
| 182 | }
|
| 183 | }
|
| 184 | trace_seq_putc(p, '}');
|
| 185 | trace_seq_putc(p, 0);
|
| 186 | return ret;
|
| 187 | }
|
| 188 |
|
| 189 | #endif
|
| 190 |
|
| 191 |
|
| 192 |
|
| 193 |
|
| 194 | #define _LANDLOCK_NAME_ENTRY(mask, name) { mask, name }
|
| 195 |
|
| 196 | #define _LANDLOCK_FS_BLOCKER_TYPE_NAMES \
|
| 197 | { LANDLOCK_REQUEST_FS_CHANGE_TOPOLOGY, "change_topology" }
|
| 198 |
|
| 199 | |
| 200 | * DOC: Landlock trace events
|
| 201 | *
|
| 202 | * These guarantees and constraints hold for every Landlock tracepoint.
|
| 203 | * A new tracepoint must uphold them, and an eBPF consumer can rely on
|
| 204 | * them.
|
| 205 | *
|
| 206 | * Decision context
|
| 207 | * ~~~~~~~~~~~~~~~~
|
| 208 | *
|
| 209 | * A denial event identifies the domain whose policy denied the request, the
|
| 210 | * Landlock operation and policy object that were checked, and the blocker or
|
| 211 | * domain relationship responsible for the denial. When tracing starts with
|
| 212 | * sandbox construction, ruleset and domain events provide the policy history
|
| 213 | * needed to interpret these identifiers. The denying domain is the subject
|
| 214 | * that enforced the policy, not necessarily current. Generic tracepoints can
|
| 215 | * provide additional operational context.
|
| 216 | *
|
| 217 | * Lifecycle consistency
|
| 218 | * ~~~~~~~~~~~~~~~~~~~~~~
|
| 219 | *
|
| 220 | * Lifecycle emission is balanced: a creation event always has a matching
|
| 221 | * deallocation event and vice versa. A consumer that observes an object's
|
| 222 | * complete lifetime can model it from this pair; one that attaches late or
|
| 223 | * loses exported records must reconcile incomplete state. A creation event
|
| 224 | * fires while the object is still private to the calling thread
|
| 225 | * (landlock_create_ruleset fires before the ruleset's file descriptor is
|
| 226 | * installed, so it cannot race a concurrent :manpage:`close(2)`); if fd
|
| 227 | * installation later fails and the ruleset is freed, free_ruleset still
|
| 228 | * fires, keeping the pair balanced. The domain pair (create_domain and
|
| 229 | * free_domain) is balanced the same way: create_domain fires when the
|
| 230 | * domain is created (under the ruleset lock, before thread-sync), and
|
| 231 | * free_domain fires when it is freed. A rare thread-sync failure aborts
|
| 232 | * the just-created domain, which then emits both events (its creation, then
|
| 233 | * an immediate free). Denial events fire only for denials that actually
|
| 234 | * happen.
|
| 235 | *
|
| 236 | * Pointer access
|
| 237 | * ~~~~~~~~~~~~~~
|
| 238 | *
|
| 239 | * All pointer arguments in TP_PROTO are guaranteed non-NULL by the
|
| 240 | * caller, but pointers reached through them may still be NULL (e.g.,
|
| 241 | * hierarchy->parent at a root domain) and must be checked. eBPF programs
|
| 242 | * read these pointers via BTF for richer introspection than the
|
| 243 | * TP_STRUCT__entry fields, which serve TP_printk display only.
|
| 244 | *
|
| 245 | * Mutable object pointers are passed while the caller holds the object's
|
| 246 | * lock, so TP_fast_assign and a BTF reader see the exact object the event
|
| 247 | * reports, a snapshot no concurrent writer can change: add_rule holds the
|
| 248 | * modified ruleset's lock, and create_domain holds the ruleset lock across
|
| 249 | * the emission (before the thread-sync wait) so the inspected ruleset is
|
| 250 | * the one merged into the domain. Objects immutable at the emission site
|
| 251 | * (a domain after creation, a hierarchy at its last reference) need no
|
| 252 | * lock. A few values that no held lock protects are a best-effort
|
| 253 | * lockless snapshot instead: a task's comm, and the deny_access_net struct
|
| 254 | * sock (whose network hook holds no socket lock), matching how the sched
|
| 255 | * and signal trace events sample comm.
|
| 256 | *
|
| 257 | * Field encoding
|
| 258 | * ~~~~~~~~~~~~~~
|
| 259 | *
|
| 260 | * Fields that mirror the Landlock UAPI preserve their widths and endianness
|
| 261 | * (e.g. network ports are u64 in host endianness, like
|
| 262 | * landlock_net_port_attr.port). Per-event details, such as where a value
|
| 263 | * is byte-swapped, live in the field's own kdoc.
|
| 264 | *
|
| 265 | * Rule-check fields
|
| 266 | * ~~~~~~~~~~~~~~~~~
|
| 267 | *
|
| 268 | * The check_rule events fire during an access check, once per matching
|
| 269 | * rule, before the final allow-or-deny verdict. They share domain (the
|
| 270 | * enforcing domain being evaluated), access_request (the access mask being
|
| 271 | * checked), and rule (the matching rule, with per-layer access masks).
|
| 272 | *
|
| 273 | * Denial fields
|
| 274 | * ~~~~~~~~~~~~~
|
| 275 | *
|
| 276 | * Every denial event shares three fields. domain is the ID of the
|
| 277 | * innermost domain that blocked the access. same_exec tells whether the
|
| 278 | * current task is the same executable that entered that domain. logged is
|
| 279 | * the domain's audit-logging decision for this denial (its log_status is
|
| 280 | * enabled and the per-execution flag selected by same_exec is set); a
|
| 281 | * stateless ftrace filter can select the denials the domain submits to
|
| 282 | * audit with logged==1, without reconstructing it from the per-execution
|
| 283 | * log flags. Denial events order their fields as domain, same_exec,
|
| 284 | * logged, then blockers (deny_access events only), then the type-specific
|
| 285 | * object fields, then any variable-length field.
|
| 286 | *
|
| 287 | * Relational referents
|
| 288 | * ~~~~~~~~~~~~~~~~~~~~~
|
| 289 | *
|
| 290 | * A scope or ptrace verdict compares two domains, so the other party's
|
| 291 | * domain is part of the decision context. It is exposed as a scalar
|
| 292 | * domain ID (0 when that party is unsandboxed): target_domain (signal),
|
| 293 | * peer_domain (abstract unix socket), tracee_domain (ptrace). With both
|
| 294 | * IDs in the stream, a consumer that tracked domain creation can relate
|
| 295 | * the two parties without kernel-internal state. The ID is a scalar
|
| 296 | * snapshot, not a live domain pointer that could dangle: an optional
|
| 297 | * relational referent is a scalar (0 sentinel), not a nullable pointer.
|
| 298 | * Nonzero IDs are unique within one boot. For ptrace, same_exec instead
|
| 299 | * describes the tracer, even for
|
| 300 | * PTRACE_TRACEME, and may differ from the current task.
|
| 301 | *
|
| 302 | * Blocker fields
|
| 303 | * ~~~~~~~~~~~~~~
|
| 304 | *
|
| 305 | * The filesystem and network blocker arguments identify the request type
|
| 306 | * and carry its final missing access subset when applicable. The type
|
| 307 | * determines how to interpret the access value.
|
| 308 |
|
| 309 |
|
| 310 | |
| 311 | * Prints a per-layer access mask array (the dynamic array @array) as symbolic
|
| 312 | * flag names using the shared @flag_names list (a _LANDLOCK_*_NAMES macro).
|
| 313 | * Stays outside CREATE_TRACE_POINTS: TP_printk is expanded in the print-output
|
| 314 | * pass where that macro is undefined.
|
| 315 |
|
| 316 | #define __print_landlock_layers(array, flag_names...) \
|
| 317 | ({ \
|
| 318 | static const struct trace_print_flags __layer_names[] = { \
|
| 319 | flag_names \
|
| 320 | }; \
|
| 321 | __trace_landlock_print_layers( \
|
| 322 | p, __get_dynamic_array(array), \
|
| 323 | __get_dynamic_array_len(array) / \
|
| 324 | sizeof(access_mask_t), \
|
| 325 | __layer_names, ARRAY_SIZE(__layer_names)); \
|
| 326 | })
|
| 327 |
|
| 328 | |
| 329 | * landlock_create_ruleset - New ruleset created
|
| 330 | *
|
| 331 | * @ruleset: Newly created ruleset (never NULL); not yet shared via an fd,
|
| 332 | * so no lock is needed.
|
| 333 | *
|
| 334 | * Emitted by sys_landlock_create_ruleset() while the new ruleset is still
|
| 335 | * private to the calling thread, before its file descriptor is installed,
|
| 336 | * so it cannot race a concurrent :manpage:`close(2)`. Balanced by a
|
| 337 | * matching landlock_free_ruleset event.
|
| 338 |
|
| 339 | TRACE_EVENT(landlock_create_ruleset,
|
| 340 |
|
| 341 | TP_PROTO(const struct landlock_ruleset *ruleset),
|
| 342 |
|
| 343 | TP_ARGS(ruleset),
|
| 344 |
|
| 345 | TP_STRUCT__entry(
|
| 346 | __field( u64, ruleset_id )
|
| 347 | __field( u64, ruleset_version )
|
| 348 | __field( access_mask_t, handled_fs )
|
| 349 | __field( access_mask_t, handled_net )
|
| 350 | __field( access_mask_t, scoped )
|
| 351 | ),
|
| 352 |
|
| 353 | TP_fast_assign(
|
| 354 | __entry->ruleset_id = ruleset->id;
|
| 355 | __entry->ruleset_version = ruleset->version;
|
| 356 | __entry->handled_fs = ruleset->handled_masks.fs;
|
| 357 | __entry->handled_net = ruleset->handled_masks.net;
|
| 358 | __entry->scoped = ruleset->handled_masks.scope;
|
| 359 | ),
|
| 360 |
|
| 361 | TP_printk("ruleset=%llx.%llu handled_fs=%s handled_net=%s scoped=%s",
|
| 362 | __entry->ruleset_id, __entry->ruleset_version,
|
| 363 | __print_flags(__entry->handled_fs, "|", _LANDLOCK_ACCESS_FS_NAMES),
|
| 364 | __print_flags(__entry->handled_net, "|", _LANDLOCK_ACCESS_NET_NAMES),
|
| 365 | __print_flags(__entry->scoped, "|", _LANDLOCK_SCOPE_NAMES))
|
| 366 | );
|
| 367 |
|
| 368 | |
| 369 | * landlock_free_ruleset - Ruleset freed
|
| 370 | *
|
| 371 | * @ruleset: Ruleset being freed (never NULL); at its last reference, so no
|
| 372 | * lock is needed.
|
| 373 | *
|
| 374 | * Emitted when a ruleset's last reference is dropped (typically when
|
| 375 | * the creating process closes the ruleset file descriptor). Fires even
|
| 376 | * when file-descriptor installation failed after creation, keeping the
|
| 377 | * create/free pair balanced.
|
| 378 |
|
| 379 | TRACE_EVENT(landlock_free_ruleset,
|
| 380 |
|
| 381 | TP_PROTO(const struct landlock_ruleset *ruleset),
|
| 382 |
|
| 383 | TP_ARGS(ruleset),
|
| 384 |
|
| 385 | TP_STRUCT__entry(
|
| 386 | __field( u64, ruleset_id )
|
| 387 | __field( u64, ruleset_version )
|
| 388 | ),
|
| 389 |
|
| 390 | TP_fast_assign(
|
| 391 | __entry->ruleset_id = ruleset->id;
|
| 392 | __entry->ruleset_version = ruleset->version;
|
| 393 | ),
|
| 394 |
|
| 395 | TP_printk("ruleset=%llx.%llu",
|
| 396 | __entry->ruleset_id, __entry->ruleset_version)
|
| 397 | );
|
| 398 |
|
| 399 | |
| 400 | * landlock_add_rule_path_beneath - Path-beneath rule added to a ruleset
|
| 401 | *
|
| 402 | * @ruleset: Source ruleset (never NULL).
|
| 403 | * @flags: Complete validated landlock_add_rule_flags value supplied by this
|
| 404 | * successful call, not the rule's accumulated quiet state.
|
| 405 | * @access_rights: Canonical per-call access mask passed to
|
| 406 | * landlock_insert_rule() after normalization, not the raw
|
| 407 | * sys_landlock_add_rule() argument or accumulated rule.
|
| 408 | * @path: Filesystem path for the rule (never NULL).
|
| 409 | * @pathname: Resolved absolute path string (never NULL; error placeholder
|
| 410 | * on resolution failure).
|
| 411 | *
|
| 412 | * Emitted by sys_landlock_add_rule() under the modified ruleset's lock, so
|
| 413 | * the reported ruleset is a stable snapshot that no concurrent writer can
|
| 414 | * change.
|
| 415 |
|
| 416 | TRACE_EVENT(landlock_add_rule_path_beneath,
|
| 417 |
|
| 418 | TP_PROTO(const struct landlock_ruleset *ruleset, u32 flags,
|
| 419 | u64 access_rights, const struct path *path,
|
| 420 | const char *pathname),
|
| 421 |
|
| 422 | TP_ARGS(ruleset, flags, access_rights, path, pathname),
|
| 423 |
|
| 424 | TP_STRUCT__entry(
|
| 425 | __field( u64, ruleset_id )
|
| 426 | __field( u64, ruleset_version )
|
| 427 | __field( access_mask_t, access_rights )
|
| 428 | __field( dev_t, dev )
|
| 429 | __field( ino_t, ino )
|
| 430 | __string( pathname, pathname )
|
| 431 | ),
|
| 432 |
|
| 433 | TP_fast_assign(
|
| 434 | lockdep_assert_held(&ruleset->lock);
|
| 435 | __entry->ruleset_id = ruleset->id;
|
| 436 | __entry->ruleset_version = ruleset->version;
|
| 437 | __entry->access_rights = access_rights;
|
| 438 | __entry->dev = path->dentry->d_sb->s_dev;
|
| 439 | |
| 440 | * The inode number may not be the user-visible one,
|
| 441 | * but it will be the same used by audit.
|
| 442 |
|
| 443 | __entry->ino = d_backing_inode(path->dentry)->i_ino;
|
| 444 | __assign_str(pathname);
|
| 445 | ),
|
| 446 |
|
| 447 | TP_printk("ruleset=%llx.%llu access_rights=%s dev=%u:%u ino=%lu path=%s",
|
| 448 | __entry->ruleset_id, __entry->ruleset_version,
|
| 449 | __print_flags(__entry->access_rights, "|", _LANDLOCK_ACCESS_FS_NAMES),
|
| 450 | MAJOR(__entry->dev), MINOR(__entry->dev), __entry->ino,
|
| 451 | __trace_print_untrusted_str(p, __get_str(pathname),
|
| 452 | __get_dynamic_array_len(pathname) - 1))
|
| 453 | );
|
| 454 |
|
| 455 | |
| 456 | * landlock_add_rule_net_port - Network-port rule added to a ruleset
|
| 457 | *
|
| 458 | * @ruleset: Source ruleset (never NULL).
|
| 459 | * @flags: Complete validated landlock_add_rule_flags value supplied by this
|
| 460 | * successful call, not the rule's accumulated quiet state.
|
| 461 | * @access_rights: Canonical per-call access mask passed to
|
| 462 | * landlock_insert_rule() after normalization, not the raw
|
| 463 | * sys_landlock_add_rule() argument or accumulated rule.
|
| 464 | * @port: Network port in host endianness, forwarded directly from
|
| 465 | * &landlock_net_port_attr.port.
|
| 466 | *
|
| 467 | * Emitted by sys_landlock_add_rule() under the modified ruleset's lock, so
|
| 468 | * the reported ruleset is a stable snapshot that no concurrent writer can
|
| 469 | * change.
|
| 470 |
|
| 471 | TRACE_EVENT(landlock_add_rule_net_port,
|
| 472 |
|
| 473 | TP_PROTO(const struct landlock_ruleset *ruleset, u32 flags,
|
| 474 | u64 access_rights, u64 port),
|
| 475 |
|
| 476 | TP_ARGS(ruleset, flags, access_rights, port),
|
| 477 |
|
| 478 | TP_STRUCT__entry(
|
| 479 | __field( u64, ruleset_id )
|
| 480 | __field( u64, ruleset_version )
|
| 481 | __field( access_mask_t, access_rights )
|
| 482 | __field( u64, port )
|
| 483 | ),
|
| 484 |
|
| 485 | TP_fast_assign(
|
| 486 | lockdep_assert_held(&ruleset->lock);
|
| 487 | __entry->ruleset_id = ruleset->id;
|
| 488 | __entry->ruleset_version = ruleset->version;
|
| 489 | __entry->access_rights = access_rights;
|
| 490 | __entry->port = port;
|
| 491 | ),
|
| 492 |
|
| 493 | TP_printk("ruleset=%llx.%llu access_rights=%s port=%llu",
|
| 494 | __entry->ruleset_id, __entry->ruleset_version,
|
| 495 | __print_flags(__entry->access_rights, "|", _LANDLOCK_ACCESS_NET_NAMES),
|
| 496 | __entry->port)
|
| 497 | );
|
| 498 |
|
| 499 | |
| 500 | * landlock_create_domain - New domain created
|
| 501 | *
|
| 502 | * @domain: Newly created domain (never NULL, immutable after creation).
|
| 503 | * @domain->hierarchy->id is its unique ID, shared with the
|
| 504 | * landlock_enforce_domain and landlock_free_domain events;
|
| 505 | * @domain->hierarchy->details holds the requesting process.
|
| 506 | * @ruleset: Source ruleset frozen into the domain (never NULL). The
|
| 507 | * ruleset lock is held across the emission, so a BPF program
|
| 508 | * reading it via BTF sees the exact merged ruleset;
|
| 509 | * @ruleset->id / @ruleset->version identify it.
|
| 510 | *
|
| 511 | * Emitted by sys_landlock_restrict_self() once, in the requesting
|
| 512 | * thread's context, right after the merge and before thread-sync. The
|
| 513 | * flags-only path (ruleset_fd == -1) creates no domain and does not
|
| 514 | * emit this event. Paired with the per-thread landlock_enforce_domain
|
| 515 | * (join on @domain->hierarchy->id) and balanced by a matching
|
| 516 | * landlock_free_domain event.
|
| 517 |
|
| 518 | TRACE_EVENT(landlock_create_domain,
|
| 519 |
|
| 520 | TP_PROTO(const struct landlock_domain *domain,
|
| 521 | const struct landlock_ruleset *ruleset),
|
| 522 |
|
| 523 | TP_ARGS(domain, ruleset),
|
| 524 |
|
| 525 | TP_STRUCT__entry(
|
| 526 | __field( u64, domain_id )
|
| 527 | __field( u64, parent_id )
|
| 528 | __field( u64, ruleset_id )
|
| 529 | __field( u64, ruleset_version )
|
| 530 | ),
|
| 531 |
|
| 532 | TP_fast_assign(
|
| 533 | lockdep_assert_held(&ruleset->lock);
|
| 534 | __entry->domain_id = domain->hierarchy->id;
|
| 535 | __entry->parent_id = domain->hierarchy->parent ?
|
| 536 | domain->hierarchy->parent->id : 0;
|
| 537 | __entry->ruleset_id = ruleset->id;
|
| 538 | __entry->ruleset_version = ruleset->version;
|
| 539 | ),
|
| 540 |
|
| 541 | TP_printk("domain=%llx parent=%llx ruleset=%llx.%llu",
|
| 542 | __entry->domain_id, __entry->parent_id,
|
| 543 | __entry->ruleset_id, __entry->ruleset_version)
|
| 544 | );
|
| 545 |
|
| 546 | |
| 547 | * landlock_enforce_domain - Domain enforced on a thread
|
| 548 | *
|
| 549 | * @domain: Domain now enforced on the current thread (never NULL,
|
| 550 | * immutable; read locklessly). Correlate to
|
| 551 | * landlock_create_domain via @domain->hierarchy->id for the
|
| 552 | * source ruleset and requesting thread, or read
|
| 553 | * @domain->hierarchy->details for the requesting process.
|
| 554 | * @complete: Set on the single event that concludes the operation, after
|
| 555 | * all its other enforcements; filter on it for one event per
|
| 556 | * operation.
|
| 557 | * @process_wide: The enforcement covers every eligible (non-exiting)
|
| 558 | * thread of the process: set when the caller used
|
| 559 | * %LANDLOCK_RESTRICT_SELF_TSYNC or the process is
|
| 560 | * single-threaded. A lone thread whose group still
|
| 561 | * holds a zombie leader is not counted single-threaded,
|
| 562 | * so process_wide == 0 never proves the opposite.
|
| 563 | * @no_new_privs: The enforcing thread's no_new_privs state at
|
| 564 | * enforcement time: 1 if set (by a prior
|
| 565 | * :manpage:`prctl(2)` %PR_SET_NO_NEW_PRIVS or by
|
| 566 | * %LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS), 0 if the domain
|
| 567 | * was enforced with %CAP_SYS_ADMIN instead.
|
| 568 | *
|
| 569 | * Emitted for each thread sys_landlock_restrict_self() enforces the
|
| 570 | * domain on, in that thread's own context, right after its
|
| 571 | * commit_creds(), so it fires only once the thread is irreversibly
|
| 572 | * enforcing the domain (aborted operations emit none). Not
|
| 573 | * balanced; every enforcement falls between the domain's
|
| 574 | * landlock_create_domain and landlock_free_domain events.
|
| 575 | *
|
| 576 | * @complete == 1 && @process_wide == 1 means the whole process is
|
| 577 | * sandboxed by @domain, durably (Landlock domains are monotonic and
|
| 578 | * inherited on :manpage:`clone(2)`).
|
| 579 |
|
| 580 | TRACE_EVENT(landlock_enforce_domain,
|
| 581 |
|
| 582 | TP_PROTO(const struct landlock_domain *domain, bool complete,
|
| 583 | bool process_wide, bool no_new_privs),
|
| 584 |
|
| 585 | TP_ARGS(domain, complete, process_wide, no_new_privs),
|
| 586 |
|
| 587 | TP_STRUCT__entry(
|
| 588 | __field( u64, domain_id )
|
| 589 | __field( bool, complete )
|
| 590 | __field( bool, process_wide )
|
| 591 | __field( bool, no_new_privs )
|
| 592 | ),
|
| 593 |
|
| 594 | TP_fast_assign(
|
| 595 | __entry->domain_id = domain->hierarchy->id;
|
| 596 | __entry->complete = complete;
|
| 597 | __entry->process_wide = process_wide;
|
| 598 | __entry->no_new_privs = no_new_privs;
|
| 599 | ),
|
| 600 |
|
| 601 | TP_printk("domain=%llx complete=%d process_wide=%d no_new_privs=%d",
|
| 602 | __entry->domain_id, __entry->complete, __entry->process_wide,
|
| 603 | __entry->no_new_privs)
|
| 604 | );
|
| 605 |
|
| 606 | |
| 607 | * landlock_free_domain - Domain freed
|
| 608 | *
|
| 609 | * @hierarchy: Hierarchy node being freed (never NULL).
|
| 610 | *
|
| 611 | * Emitted when the hierarchy node's last reference is dropped: its
|
| 612 | * refcount reaches zero after all child domains have released their
|
| 613 | * parent reference. A committed domain is
|
| 614 | * freed from a kworker via landlock_put_domain_deferred() (the credential
|
| 615 | * free path runs in RCU context, where sleeping is forbidden), so the
|
| 616 | * current task is not the sandboxed task that triggered the free. Balanced
|
| 617 | * by a matching landlock_create_domain event.
|
| 618 |
|
| 619 | TRACE_EVENT(landlock_free_domain,
|
| 620 |
|
| 621 | TP_PROTO(const struct landlock_hierarchy *hierarchy),
|
| 622 |
|
| 623 | TP_ARGS(hierarchy),
|
| 624 |
|
| 625 | TP_STRUCT__entry(
|
| 626 | __field( u64, domain_id )
|
| 627 | __field( u64, denials )
|
| 628 | ),
|
| 629 |
|
| 630 | TP_fast_assign(
|
| 631 | __entry->domain_id = hierarchy->id;
|
| 632 | __entry->denials = atomic64_read(&hierarchy->num_denials);
|
| 633 | ),
|
| 634 |
|
| 635 | TP_printk("domain=%llx denials=%llu",
|
| 636 | __entry->domain_id, __entry->denials)
|
| 637 | );
|
| 638 |
|
| 639 | |
| 640 | * landlock_check_rule_inode - Inode rule evaluated during access check
|
| 641 | *
|
| 642 | * @domain: Enforcing domain (never NULL).
|
| 643 | * @rule: Matching rule with per-layer access masks (never NULL).
|
| 644 | * @access_request: Access mask evaluated against the rule (the domain's
|
| 645 | * handled mask during rename/link double-checks).
|
| 646 | * @dentry: Filesystem dentry being checked (never NULL).
|
| 647 | *
|
| 648 | * Emitted for each rule that matches during a filesystem access check.
|
| 649 | * The grants array shows the requested rights the rule grants at each
|
| 650 | * domain layer. See Documentation/trace/events-landlock.rst for how to
|
| 651 | * interpret it.
|
| 652 |
|
| 653 | TRACE_EVENT(landlock_check_rule_inode,
|
| 654 |
|
| 655 | TP_PROTO(const struct landlock_domain *domain,
|
| 656 | const struct landlock_rule *rule,
|
| 657 | u64 access_request, const struct dentry *dentry),
|
| 658 |
|
| 659 | TP_ARGS(domain, rule, access_request, dentry),
|
| 660 |
|
| 661 | TP_STRUCT__entry(
|
| 662 | __field( u64, domain_id )
|
| 663 | __field( access_mask_t, access_request )
|
| 664 | __field( dev_t, dev )
|
| 665 | __field( ino_t, ino )
|
| 666 | __dynamic_array(access_mask_t, grants,
|
| 667 | domain->num_layers)
|
| 668 | ),
|
| 669 |
|
| 670 | TP_fast_assign(
|
| 671 | __entry->domain_id = domain->hierarchy->id;
|
| 672 | __entry->access_request = access_request;
|
| 673 | __entry->dev = dentry->d_sb->s_dev;
|
| 674 | __entry->ino = d_backing_inode(dentry)->i_ino;
|
| 675 |
|
| 676 | __trace_landlock_fill_layers(__get_dynamic_array(grants),
|
| 677 | __get_dynamic_array_len(grants) /
|
| 678 | sizeof(access_mask_t),
|
| 679 | rule,
|
| 680 | (access_mask_t)access_request);
|
| 681 | ),
|
| 682 |
|
| 683 | TP_printk("domain=%llx access_request=%s dev=%u:%u ino=%lu grants=%s",
|
| 684 | __entry->domain_id,
|
| 685 | __print_flags(__entry->access_request, "|", _LANDLOCK_ACCESS_FS_NAMES),
|
| 686 | MAJOR(__entry->dev), MINOR(__entry->dev), __entry->ino,
|
| 687 | __print_landlock_layers(grants, _LANDLOCK_ACCESS_FS_NAMES))
|
| 688 | );
|
| 689 |
|
| 690 | |
| 691 | * landlock_check_rule_net_port - Network port rule evaluated
|
| 692 | *
|
| 693 | * @domain: Enforcing domain (never NULL).
|
| 694 | * @rule: Matching rule with per-layer access masks (never NULL).
|
| 695 | * @access_request: Access mask being requested.
|
| 696 | * @port: Network port being checked (host endianness).
|
| 697 | *
|
| 698 | * Emitted for each rule that matches during a network access check. The
|
| 699 | * grants array shows the requested rights the rule grants at each domain
|
| 700 | * layer. See Documentation/trace/events-landlock.rst for how to
|
| 701 | * interpret it.
|
| 702 |
|
| 703 | TRACE_EVENT(landlock_check_rule_net_port,
|
| 704 |
|
| 705 | TP_PROTO(const struct landlock_domain *domain,
|
| 706 | const struct landlock_rule *rule,
|
| 707 | u64 access_request, u64 port),
|
| 708 |
|
| 709 | TP_ARGS(domain, rule, access_request, port),
|
| 710 |
|
| 711 | TP_STRUCT__entry(
|
| 712 | __field( u64, domain_id )
|
| 713 | __field( access_mask_t, access_request )
|
| 714 | __field( u64, port )
|
| 715 | __dynamic_array(access_mask_t, grants,
|
| 716 | domain->num_layers)
|
| 717 | ),
|
| 718 |
|
| 719 | TP_fast_assign(
|
| 720 | __entry->domain_id = domain->hierarchy->id;
|
| 721 | __entry->access_request = access_request;
|
| 722 | __entry->port = port;
|
| 723 |
|
| 724 | __trace_landlock_fill_layers(__get_dynamic_array(grants),
|
| 725 | __get_dynamic_array_len(grants) /
|
| 726 | sizeof(access_mask_t),
|
| 727 | rule,
|
| 728 | (access_mask_t)access_request);
|
| 729 | ),
|
| 730 |
|
| 731 | TP_printk("domain=%llx access_request=%s port=%llu grants=%s",
|
| 732 | __entry->domain_id,
|
| 733 | __print_flags(__entry->access_request, "|", _LANDLOCK_ACCESS_NET_NAMES),
|
| 734 | __entry->port,
|
| 735 | __print_landlock_layers(grants, _LANDLOCK_ACCESS_NET_NAMES))
|
| 736 | );
|
| 737 |
|
| 738 | |
| 739 | * landlock_deny_access_fs - Filesystem access denied
|
| 740 | *
|
| 741 | * @hierarchy: Denying domain's hierarchy node (never NULL); its id is the
|
| 742 | * domain field.
|
| 743 | * @same_exec: Whether the current task entered the denying domain itself.
|
| 744 | * @logged: The domain's audit-logging decision for this denial.
|
| 745 | * @blockers: Request type and final missing access subset (never NULL).
|
| 746 | * @path: Filesystem path that was denied (never NULL).
|
| 747 | * @pathname: Resolved path string (never NULL; an error placeholder on
|
| 748 | * resolution failure).
|
| 749 | *
|
| 750 | * Emitted when a Landlock domain denies a filesystem access.
|
| 751 |
|
| 752 | TRACE_EVENT(landlock_deny_access_fs,
|
| 753 |
|
| 754 | TP_PROTO(const struct landlock_hierarchy *hierarchy, bool same_exec,
|
| 755 | bool logged, const struct landlock_blockers *blockers,
|
| 756 | const struct path *path, const char *pathname),
|
| 757 |
|
| 758 | TP_ARGS(hierarchy, same_exec, logged, blockers, path, pathname),
|
| 759 |
|
| 760 | TP_STRUCT__entry(
|
| 761 | __field( u64, domain_id )
|
| 762 | __field( bool, same_exec )
|
| 763 | __field( bool, logged )
|
| 764 | __field( enum landlock_request_type, blockers_type )
|
| 765 | __field( access_mask_t, blockers_access )
|
| 766 | __field( dev_t, dev )
|
| 767 | __field( ino_t, ino )
|
| 768 | __string( pathname, pathname )
|
| 769 | ),
|
| 770 |
|
| 771 | TP_fast_assign(
|
| 772 | const struct inode *inode = d_backing_inode(path->dentry);
|
| 773 |
|
| 774 | __entry->domain_id = hierarchy->id;
|
| 775 | __entry->same_exec = same_exec;
|
| 776 | __entry->logged = logged;
|
| 777 | __entry->blockers_type = blockers->type;
|
| 778 | __entry->blockers_access = blockers->access;
|
| 779 | __entry->dev = path->dentry->d_sb->s_dev;
|
| 780 | |
| 781 | * A negative dentry has no backing inode, so mirror the
|
| 782 | * guard in dump_common_audit_data() and report inode 0.
|
| 783 |
|
| 784 | __entry->ino = inode ? inode->i_ino : 0;
|
| 785 | __assign_str(pathname);
|
| 786 | ),
|
| 787 |
|
| 788 | TP_printk("domain=%llx same_exec=%d logged=%d blockers=%s dev=%u:%u ino=%lu path=%s",
|
| 789 | __entry->domain_id, __entry->same_exec, __entry->logged,
|
| 790 | __entry->blockers_type == LANDLOCK_REQUEST_FS_ACCESS ?
|
| 791 | __print_flags(__entry->blockers_access, "|", _LANDLOCK_ACCESS_FS_NAMES) :
|
| 792 | __print_symbolic(__entry->blockers_type,
|
| 793 | _LANDLOCK_FS_BLOCKER_TYPE_NAMES),
|
| 794 | MAJOR(__entry->dev), MINOR(__entry->dev), __entry->ino,
|
| 795 | __trace_print_untrusted_str(p, __get_str(pathname),
|
| 796 | __get_dynamic_array_len(pathname) - 1))
|
| 797 | );
|
| 798 |
|
| 799 | static_assert(offsetof(struct sockaddr_in, sin_port) ==
|
| 800 | offsetof(struct sockaddr_in6, sin6_port));
|
| 801 | static_assert(sizeof_field(struct sockaddr_in, sin_port) ==
|
| 802 | sizeof_field(struct sockaddr_in6, sin6_port));
|
| 803 |
|
| 804 | |
| 805 | * landlock_deny_access_net - Network access denied
|
| 806 | *
|
| 807 | * @hierarchy: Denying domain's hierarchy node (never NULL); its id is the
|
| 808 | * domain field.
|
| 809 | * @same_exec: Whether the current task entered the denying domain itself.
|
| 810 | * @logged: The domain's audit-logging decision for this denial.
|
| 811 | * @blockers: Request type and final missing access subset (never NULL).
|
| 812 | * @sk: Socket object (never NULL), read without a socket lock, so its fields
|
| 813 | * are a best-effort snapshot.
|
| 814 | * @socket_family: Socket-family snapshot used by the verdict.
|
| 815 | * @address: Authoritative address checked by the verdict (never NULL).
|
| 816 | * The producer copies @addrlen bytes from the checked address and
|
| 817 | * zeroes the remaining storage before emission. The
|
| 818 | * &sockaddr_in.sin_port or &sockaddr_in6.sin6_port member, when
|
| 819 | * present, remains in network endianness.
|
| 820 | * @addrlen: Validated signed length of @address.
|
| 821 | *
|
| 822 | * Emitted when a Landlock domain denies a network operation. The blocker
|
| 823 | * identifies whether the address is a bind or connect/send policy object.
|
| 824 | * The flattened port field is converted from the checked address to host
|
| 825 | * endianness, or is -1 when no port was checked. Zero is a valid checked
|
| 826 | * port.
|
| 827 |
|
| 828 | TRACE_EVENT(landlock_deny_access_net,
|
| 829 |
|
| 830 | TP_PROTO(const struct landlock_hierarchy *hierarchy, bool same_exec,
|
| 831 | bool logged, const struct landlock_blockers *blockers,
|
| 832 | const struct sock *sk, u16 socket_family,
|
| 833 | const struct sockaddr_storage *address, int addrlen),
|
| 834 |
|
| 835 | TP_ARGS(hierarchy, same_exec, logged, blockers, sk, socket_family,
|
| 836 | address, addrlen),
|
| 837 |
|
| 838 | TP_STRUCT__entry(
|
| 839 | __field( u64, domain_id )
|
| 840 | __field( bool, same_exec )
|
| 841 | __field( bool, logged )
|
| 842 | __field( enum landlock_request_type, blockers_type )
|
| 843 | __field( access_mask_t, blockers_access )
|
| 844 | __field( s64, port )
|
| 845 | ),
|
| 846 |
|
| 847 | TP_fast_assign(
|
| 848 | const struct sockaddr *const addr =
|
| 849 | (const struct sockaddr *)address;
|
| 850 | const bool has_port =
|
| 851 | addrlen >= (int)offsetofend(struct sockaddr_in, sin_port) &&
|
| 852 | (addr->sa_family == AF_INET ||
|
| 853 | addr->sa_family == AF_INET6 ||
|
| 854 | (addr->sa_family == AF_UNSPEC &&
|
| 855 | socket_family == AF_INET));
|
| 856 |
|
| 857 | __entry->domain_id = hierarchy->id;
|
| 858 | __entry->same_exec = same_exec;
|
| 859 | __entry->logged = logged;
|
| 860 | __entry->blockers_type = blockers->type;
|
| 861 | __entry->blockers_access = blockers->access;
|
| 862 | __entry->port =
|
| 863 | has_port ?
|
| 864 | ntohs(((const struct sockaddr_in *)addr)->sin_port) :
|
| 865 | -1;
|
| 866 | ),
|
| 867 |
|
| 868 | TP_printk("domain=%llx same_exec=%d logged=%d blockers=%s port=%lld",
|
| 869 | __entry->domain_id, __entry->same_exec, __entry->logged,
|
| 870 | __entry->blockers_type == LANDLOCK_REQUEST_NET_ACCESS ?
|
| 871 | __print_flags(__entry->blockers_access, "|", _LANDLOCK_ACCESS_NET_NAMES) :
|
| 872 | "unknown",
|
| 873 | __entry->port)
|
| 874 | );
|
| 875 |
|
| 876 | |
| 877 | * landlock_deny_ptrace - Ptrace access denied by a Landlock domain
|
| 878 | *
|
| 879 | * @hierarchy: Denying domain's hierarchy node (never NULL); its id is the
|
| 880 | * domain field.
|
| 881 | * @same_exec: Whether the tracer entered the denying domain itself.
|
| 882 | * @logged: The domain's audit-logging decision for this denial.
|
| 883 | * @tracee_domain_id: The tracee's Landlock domain ID, or 0 if the tracee
|
| 884 | * is unsandboxed.
|
| 885 | * @tracee: The target task ptrace acted on (never NULL). tracee_pid is
|
| 886 | * the init-namespace TGID (like audit's opid).
|
| 887 | * @tracer: The tracer or proposed tracer (never NULL); for PTRACE_TRACEME
|
| 888 | * this is the parent, not the syscall caller.
|
| 889 | *
|
| 890 | * Emitted when a Landlock domain denies a ptrace operation.
|
| 891 |
|
| 892 | TRACE_EVENT(landlock_deny_ptrace,
|
| 893 |
|
| 894 | TP_PROTO(const struct landlock_hierarchy *hierarchy, bool same_exec,
|
| 895 | bool logged, u64 tracee_domain_id,
|
| 896 | const struct task_struct *tracee,
|
| 897 | const struct task_struct *tracer),
|
| 898 |
|
| 899 | TP_ARGS(hierarchy, same_exec, logged, tracee_domain_id, tracee, tracer),
|
| 900 |
|
| 901 | TP_STRUCT__entry(
|
| 902 | __field( u64, domain_id )
|
| 903 | __field( bool, same_exec )
|
| 904 | __field( bool, logged )
|
| 905 | __field( u64, tracee_domain_id)
|
| 906 | __field( pid_t, tracee_pid )
|
| 907 | __string( tracee_comm, tracee->comm )
|
| 908 | ),
|
| 909 |
|
| 910 | TP_fast_assign(
|
| 911 | __entry->domain_id = hierarchy->id;
|
| 912 | __entry->same_exec = same_exec;
|
| 913 | __entry->logged = logged;
|
| 914 | __entry->tracee_domain_id = tracee_domain_id;
|
| 915 | __entry->tracee_pid = task_tgid_nr((struct task_struct *)tracee);
|
| 916 | __assign_str(tracee_comm);
|
| 917 | ),
|
| 918 |
|
| 919 | TP_printk("domain=%llx same_exec=%d logged=%d tracee_domain=%llx tracee_pid=%d tracee_comm=%s",
|
| 920 | __entry->domain_id, __entry->same_exec, __entry->logged,
|
| 921 | __entry->tracee_domain_id, __entry->tracee_pid,
|
| 922 | __trace_print_untrusted_str(p, __get_str(tracee_comm),
|
| 923 | __get_dynamic_array_len(tracee_comm) - 1))
|
| 924 | );
|
| 925 |
|
| 926 | |
| 927 | * landlock_deny_scope_signal - Signal delivery denied by
|
| 928 | * LANDLOCK_SCOPE_SIGNAL
|
| 929 | *
|
| 930 | * @hierarchy: Denying domain's hierarchy node (never NULL); its id is the
|
| 931 | * domain field.
|
| 932 | * @same_exec: Whether the policy subject entered the denying domain itself.
|
| 933 | * @logged: The domain's audit-logging decision for this denial.
|
| 934 | * @target_domain_id: The target's Landlock domain ID, or 0 if the target
|
| 935 | * is unsandboxed.
|
| 936 | * @target: The task the signal was aimed at (never NULL). target_pid is
|
| 937 | * the init-namespace TGID (like audit's opid).
|
| 938 | * @signal: The signal selected by the denied check. Zero is a permission
|
| 939 | * probe, not an absent value.
|
| 940 | *
|
| 941 | * Emitted when a Landlock domain denies signal delivery to a scoped-out
|
| 942 | * target.
|
| 943 |
|
| 944 | TRACE_EVENT(landlock_deny_scope_signal,
|
| 945 |
|
| 946 | TP_PROTO(const struct landlock_hierarchy *hierarchy, bool same_exec,
|
| 947 | bool logged, u64 target_domain_id,
|
| 948 | const struct task_struct *target, int signal),
|
| 949 |
|
| 950 | TP_ARGS(hierarchy, same_exec, logged, target_domain_id, target, signal),
|
| 951 |
|
| 952 | TP_STRUCT__entry(
|
| 953 | __field( u64, domain_id )
|
| 954 | __field( bool, same_exec )
|
| 955 | __field( bool, logged )
|
| 956 | __field( u64, target_domain_id)
|
| 957 | __field( pid_t, target_pid )
|
| 958 | __string( target_comm, target->comm )
|
| 959 | ),
|
| 960 |
|
| 961 | TP_fast_assign(
|
| 962 | __entry->domain_id = hierarchy->id;
|
| 963 | __entry->same_exec = same_exec;
|
| 964 | __entry->logged = logged;
|
| 965 | __entry->target_domain_id = target_domain_id;
|
| 966 | __entry->target_pid = task_tgid_nr((struct task_struct *)target);
|
| 967 | __assign_str(target_comm);
|
| 968 | ),
|
| 969 |
|
| 970 | TP_printk("domain=%llx same_exec=%d logged=%d target_domain=%llx target_pid=%d target_comm=%s",
|
| 971 | __entry->domain_id, __entry->same_exec, __entry->logged,
|
| 972 | __entry->target_domain_id, __entry->target_pid,
|
| 973 | __trace_print_untrusted_str(p, __get_str(target_comm),
|
| 974 | __get_dynamic_array_len(target_comm) - 1))
|
| 975 | );
|
| 976 |
|
| 977 | |
| 978 | * landlock_deny_scope_abstract_unix_socket - Abstract unix socket access
|
| 979 | * denied by LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET
|
| 980 | *
|
| 981 | * @hierarchy: Denying domain's hierarchy node (never NULL); its id is the
|
| 982 | * domain field.
|
| 983 | * @same_exec: Whether the current task entered the denying domain itself.
|
| 984 | * @logged: The domain's audit-logging decision for this denial.
|
| 985 | * @peer_domain_id: The peer's Landlock domain ID, or 0 if the peer is
|
| 986 | * unsandboxed.
|
| 987 | * @peer: Peer socket (never NULL). peer_pid is best-effort: it is 0 for
|
| 988 | * a datagram peer (no SO_PEERCRED), so sun_path is the reliable
|
| 989 | * peer identifier.
|
| 990 | *
|
| 991 | * Emitted when a Landlock domain denies access to a scoped-out abstract
|
| 992 | * unix socket.
|
| 993 |
|
| 994 | TRACE_EVENT(landlock_deny_scope_abstract_unix_socket,
|
| 995 |
|
| 996 | TP_PROTO(const struct landlock_hierarchy *hierarchy, bool same_exec,
|
| 997 | bool logged, u64 peer_domain_id, const struct sock *peer),
|
| 998 |
|
| 999 | TP_ARGS(hierarchy, same_exec, logged, peer_domain_id, peer),
|
| 1000 |
|
| 1001 | TP_STRUCT__entry(
|
| 1002 | __field( u64, domain_id )
|
| 1003 | __field( bool, same_exec )
|
| 1004 | __field( bool, logged )
|
| 1005 | __field( u64, peer_domain_id )
|
| 1006 | __field( pid_t, peer_pid )
|
| 1007 | |
| 1008 | * Abstract socket names are untrusted binary data from
|
| 1009 | * user space. Use __string_len because abstract names
|
| 1010 | * are not NUL-terminated; their length is determined by
|
| 1011 | * addr->len. unix_sk(peer)->addr is stable here because
|
| 1012 | * the caller (hook_unix_stream_connect or
|
| 1013 | * hook_unix_may_send) holds unix_state_lock(peer).
|
| 1014 |
|
| 1015 | __string_len( sun_path,
|
| 1016 | unix_sk(peer)->addr ?
|
| 1017 | unix_sk(peer)->addr->name->sun_path + 1 :
|
| 1018 | "",
|
| 1019 | unix_sk(peer)->addr ?
|
| 1020 | unix_sk(peer)->addr->len -
|
| 1021 | offsetof(struct sockaddr_un,
|
| 1022 | sun_path) - 1 :
|
| 1023 | 0)
|
| 1024 | ),
|
| 1025 |
|
| 1026 | TP_fast_assign(
|
| 1027 | struct pid *peer_pid;
|
| 1028 |
|
| 1029 | lockdep_assert_held(&unix_sk(peer)->lock);
|
| 1030 | __entry->domain_id = hierarchy->id;
|
| 1031 | __entry->same_exec = same_exec;
|
| 1032 | __entry->logged = logged;
|
| 1033 | __entry->peer_domain_id = peer_domain_id;
|
| 1034 | |
| 1035 | * Best-effort (0 for a datagram peer). The caller holds the
|
| 1036 | * peer's AF_UNIX state lock, serializing published peercred
|
| 1037 | * updates. The peer socket keeps a reference to sk_peer_pid
|
| 1038 | * through pid_nr(); sun_path is the reliable identifier.
|
| 1039 |
|
| 1040 | peer_pid = READ_ONCE(peer->sk_peer_pid[PIDTYPE_TGID]);
|
| 1041 | __entry->peer_pid = peer_pid ? pid_nr(peer_pid) : 0;
|
| 1042 | __assign_str(sun_path);
|
| 1043 | ),
|
| 1044 |
|
| 1045 | TP_printk("domain=%llx same_exec=%d logged=%d peer_domain=%llx peer_pid=%d sun_path=%s",
|
| 1046 | __entry->domain_id, __entry->same_exec, __entry->logged,
|
| 1047 | __entry->peer_domain_id, __entry->peer_pid,
|
| 1048 | __trace_print_untrusted_str(p, __get_str(sun_path),
|
| 1049 | __get_dynamic_array_len(sun_path) - 1))
|
| 1050 | );
|
| 1051 |
|
| 1052 | #undef _LANDLOCK_FS_BLOCKER_TYPE_NAMES
|
| 1053 | #undef _LANDLOCK_NAME_ENTRY
|
| 1054 |
|
| 1055 | #endif
|
| 1056 |
|
| 1057 |
|
| 1058 | #include <trace/define_trace.h>
|
| 1059 |
|
| 1060 |
|