projects/linux·blob master · refs

587 lines · 17.7 KiB

1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * Landlock - Log helpers
4 *
5 * Copyright © 2023-2025 Microsoft Corporation
6 * Copyright © 2026 Cloudflare, Inc.
7 */
8
9#include <kunit/test.h>
10#include <linux/bitops.h>
11#include <uapi/linux/landlock.h>
12
13#include "access.h"
14#include "audit.h"
15#include "common.h"
16#include "cred.h"
17#include "domain.h"
18#include "limits.h"
19#include "log.h"
20#include "ruleset.h"
21#include "trace.h"
22
23static struct landlock_hierarchy *
24get_hierarchy(const struct landlock_domain *const domain, const size_t layer)
25{
26 struct landlock_hierarchy *hierarchy = domain->hierarchy;
27 ssize_t i;
28
29 if (WARN_ON_ONCE(layer >= domain->num_layers))
30 return hierarchy;
31
32 for (i = domain->num_layers - 1; i > layer; i--) {
33 if (WARN_ON_ONCE(!hierarchy->parent))
34 break;
35
36 hierarchy = hierarchy->parent;
37 }
38
39 return hierarchy;
40}
41
42#ifdef CONFIG_SECURITY_LANDLOCK_KUNIT_TEST
43
44static void test_get_hierarchy(struct kunit *const test)
45{
46 struct landlock_hierarchy dom0_hierarchy = {
47 .id = 10,
48 };
49 struct landlock_hierarchy dom1_hierarchy = {
50 .parent = &dom0_hierarchy,
51 .id = 20,
52 };
53 struct landlock_hierarchy dom2_hierarchy = {
54 .parent = &dom1_hierarchy,
55 .id = 30,
56 };
57 struct landlock_domain dom2 = {
58 .hierarchy = &dom2_hierarchy,
59 .num_layers = 3,
60 };
61
62 KUNIT_EXPECT_EQ(test, 10, get_hierarchy(&dom2, 0)->id);
63 KUNIT_EXPECT_EQ(test, 20, get_hierarchy(&dom2, 1)->id);
64 KUNIT_EXPECT_EQ(test, 30, get_hierarchy(&dom2, 2)->id);
65 /* KUNIT_EXPECT_EQ(test, 30, get_hierarchy(&dom2, -1)->id); */
66}
67
68#endif /* CONFIG_SECURITY_LANDLOCK_KUNIT_TEST */
69
70/* Get the youngest layer that denied the access_request. */
71static size_t get_denied_layer(const struct landlock_domain *const domain,
72 access_mask_t *const access_request,
73 const struct layer_masks *masks)
74{
75 for (ssize_t i = ARRAY_SIZE(masks->layers) - 1; i >= 0; i--) {
76 if (masks->layers[i].access & *access_request) {
77 *access_request &= masks->layers[i].access;
78 return i;
79 }
80 }
81
82 /* Not found - fall back to default values */
83 *access_request = 0;
84 return domain->num_layers - 1;
85}
86
87#ifdef CONFIG_SECURITY_LANDLOCK_KUNIT_TEST
88
89static void test_get_denied_layer(struct kunit *const test)
90{
91 const struct landlock_domain dom = {
92 .num_layers = 5,
93 };
94 const struct layer_masks masks = {
95 .layers[0].access = LANDLOCK_ACCESS_FS_EXECUTE |
96 LANDLOCK_ACCESS_FS_READ_DIR,
97 .layers[1].access = LANDLOCK_ACCESS_FS_READ_FILE |
98 LANDLOCK_ACCESS_FS_READ_DIR,
99 .layers[2].access = LANDLOCK_ACCESS_FS_REMOVE_DIR,
100 };
101 access_mask_t access;
102
103 access = LANDLOCK_ACCESS_FS_EXECUTE;
104 KUNIT_EXPECT_EQ(test, 0, get_denied_layer(&dom, &access, &masks));
105 KUNIT_EXPECT_EQ(test, access, LANDLOCK_ACCESS_FS_EXECUTE);
106
107 access = LANDLOCK_ACCESS_FS_READ_FILE;
108 KUNIT_EXPECT_EQ(test, 1, get_denied_layer(&dom, &access, &masks));
109 KUNIT_EXPECT_EQ(test, access, LANDLOCK_ACCESS_FS_READ_FILE);
110
111 access = LANDLOCK_ACCESS_FS_READ_DIR;
112 KUNIT_EXPECT_EQ(test, 1, get_denied_layer(&dom, &access, &masks));
113 KUNIT_EXPECT_EQ(test, access, LANDLOCK_ACCESS_FS_READ_DIR);
114
115 access = LANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_READ_DIR;
116 KUNIT_EXPECT_EQ(test, 1, get_denied_layer(&dom, &access, &masks));
117 KUNIT_EXPECT_EQ(test, access,
118 LANDLOCK_ACCESS_FS_READ_FILE |
119 LANDLOCK_ACCESS_FS_READ_DIR);
120
121 access = LANDLOCK_ACCESS_FS_EXECUTE | LANDLOCK_ACCESS_FS_READ_DIR;
122 KUNIT_EXPECT_EQ(test, 1, get_denied_layer(&dom, &access, &masks));
123 KUNIT_EXPECT_EQ(test, access, LANDLOCK_ACCESS_FS_READ_DIR);
124
125 access = LANDLOCK_ACCESS_FS_WRITE_FILE;
126 KUNIT_EXPECT_EQ(test, 4, get_denied_layer(&dom, &access, &masks));
127 KUNIT_EXPECT_EQ(test, access, 0);
128}
129
130#endif /* CONFIG_SECURITY_LANDLOCK_KUNIT_TEST */
131
132static size_t
133get_layer_from_deny_masks(access_mask_t *const access_request,
134 const access_mask_t all_existing_optional_access,
135 const deny_masks_t deny_masks,
136 optional_access_t quiet_optional_accesses,
137 bool *quiet)
138{
139 const unsigned long access_opt = all_existing_optional_access;
140 const unsigned long access_req = *access_request;
141 access_mask_t missing = 0;
142 size_t youngest_layer = 0;
143 size_t access_index = 0;
144 unsigned long access_bit;
145 bool should_quiet = false;
146
147 /* This will require change with new object types. */
148 WARN_ON_ONCE(access_opt != _LANDLOCK_ACCESS_FS_OPTIONAL);
149
150 for_each_set_bit(access_bit, &access_opt,
151 BITS_PER_TYPE(access_mask_t)) {
152 if (access_req & BIT(access_bit)) {
153 const size_t layer =
154 (deny_masks >>
155 (access_index *
156 HWEIGHT(LANDLOCK_MAX_NUM_LAYERS - 1))) &
157 (LANDLOCK_MAX_NUM_LAYERS - 1);
158 const bool layer_has_quiet =
159 !!(quiet_optional_accesses & BIT(access_index));
160
161 if (layer > youngest_layer) {
162 youngest_layer = layer;
163 missing = BIT(access_bit);
164 should_quiet = layer_has_quiet;
165 } else if (layer == youngest_layer) {
166 missing |= BIT(access_bit);
167 /*
168 * Whether the layer has rules with quiet flag
169 * covering the file accessed does not depend on
170 * the access, and so the following
171 * WARN_ON_ONCE() should not fail.
172 */
173 WARN_ON_ONCE(should_quiet && !layer_has_quiet);
174 should_quiet = layer_has_quiet;
175 }
176 }
177 access_index++;
178 }
179
180 *access_request = missing;
181 *quiet = should_quiet;
182 return youngest_layer;
183}
184
185#ifdef CONFIG_SECURITY_LANDLOCK_KUNIT_TEST
186
187static void test_get_layer_from_deny_masks(struct kunit *const test)
188{
189 deny_masks_t deny_mask;
190 access_mask_t access;
191 optional_access_t quiet_optional_accesses;
192 bool quiet;
193
194 /* truncate:0 ioctl_dev:2 */
195 deny_mask = 0x20;
196 quiet_optional_accesses = 0;
197
198 access = LANDLOCK_ACCESS_FS_TRUNCATE;
199 KUNIT_EXPECT_EQ(test, 0,
200 get_layer_from_deny_masks(
201 &access, _LANDLOCK_ACCESS_FS_OPTIONAL,
202 deny_mask, quiet_optional_accesses, &quiet));
203 KUNIT_EXPECT_EQ(test, access, LANDLOCK_ACCESS_FS_TRUNCATE);
204 KUNIT_EXPECT_EQ(test, quiet, false);
205
206 access = LANDLOCK_ACCESS_FS_IOCTL_DEV;
207 KUNIT_EXPECT_EQ(test, 2,
208 get_layer_from_deny_masks(
209 &access, _LANDLOCK_ACCESS_FS_OPTIONAL,
210 deny_mask, quiet_optional_accesses, &quiet));
211 KUNIT_EXPECT_EQ(test, access, LANDLOCK_ACCESS_FS_IOCTL_DEV);
212 KUNIT_EXPECT_EQ(test, quiet, false);
213
214 access = LANDLOCK_ACCESS_FS_TRUNCATE | LANDLOCK_ACCESS_FS_IOCTL_DEV;
215 KUNIT_EXPECT_EQ(test, 2,
216 get_layer_from_deny_masks(
217 &access, _LANDLOCK_ACCESS_FS_OPTIONAL,
218 deny_mask, quiet_optional_accesses, &quiet));
219 KUNIT_EXPECT_EQ(test, access, LANDLOCK_ACCESS_FS_IOCTL_DEV);
220 KUNIT_EXPECT_EQ(test, quiet, false);
221
222 /* layer denying truncate: quiet, ioctl: not quiet */
223 quiet_optional_accesses = 0b01;
224
225 access = LANDLOCK_ACCESS_FS_TRUNCATE;
226 KUNIT_EXPECT_EQ(test, 0,
227 get_layer_from_deny_masks(
228 &access, _LANDLOCK_ACCESS_FS_OPTIONAL,
229 deny_mask, quiet_optional_accesses, &quiet));
230 KUNIT_EXPECT_EQ(test, access, LANDLOCK_ACCESS_FS_TRUNCATE);
231 KUNIT_EXPECT_EQ(test, quiet, true);
232
233 access = LANDLOCK_ACCESS_FS_IOCTL_DEV;
234 KUNIT_EXPECT_EQ(test, 2,
235 get_layer_from_deny_masks(
236 &access, _LANDLOCK_ACCESS_FS_OPTIONAL,
237 deny_mask, quiet_optional_accesses, &quiet));
238 KUNIT_EXPECT_EQ(test, access, LANDLOCK_ACCESS_FS_IOCTL_DEV);
239 KUNIT_EXPECT_EQ(test, quiet, false);
240
241 access = LANDLOCK_ACCESS_FS_TRUNCATE | LANDLOCK_ACCESS_FS_IOCTL_DEV;
242 KUNIT_EXPECT_EQ(test, 2,
243 get_layer_from_deny_masks(
244 &access, _LANDLOCK_ACCESS_FS_OPTIONAL,
245 deny_mask, quiet_optional_accesses, &quiet));
246 KUNIT_EXPECT_EQ(test, access, LANDLOCK_ACCESS_FS_IOCTL_DEV);
247 KUNIT_EXPECT_EQ(test, quiet, false);
248
249 /* Reverse order - truncate:2 ioctl_dev:0 */
250 deny_mask = 0x02;
251 quiet_optional_accesses = 0;
252
253 access = LANDLOCK_ACCESS_FS_TRUNCATE;
254 KUNIT_EXPECT_EQ(test, 2,
255 get_layer_from_deny_masks(
256 &access, _LANDLOCK_ACCESS_FS_OPTIONAL,
257 deny_mask, quiet_optional_accesses, &quiet));
258 KUNIT_EXPECT_EQ(test, access, LANDLOCK_ACCESS_FS_TRUNCATE);
259 KUNIT_EXPECT_EQ(test, quiet, false);
260
261 access = LANDLOCK_ACCESS_FS_IOCTL_DEV;
262 KUNIT_EXPECT_EQ(test, 0,
263 get_layer_from_deny_masks(
264 &access, _LANDLOCK_ACCESS_FS_OPTIONAL,
265 deny_mask, quiet_optional_accesses, &quiet));
266 KUNIT_EXPECT_EQ(test, access, LANDLOCK_ACCESS_FS_IOCTL_DEV);
267 KUNIT_EXPECT_EQ(test, quiet, false);
268
269 access = LANDLOCK_ACCESS_FS_TRUNCATE | LANDLOCK_ACCESS_FS_IOCTL_DEV;
270 KUNIT_EXPECT_EQ(test, 2,
271 get_layer_from_deny_masks(
272 &access, _LANDLOCK_ACCESS_FS_OPTIONAL,
273 deny_mask, quiet_optional_accesses, &quiet));
274 KUNIT_EXPECT_EQ(test, access, LANDLOCK_ACCESS_FS_TRUNCATE);
275 KUNIT_EXPECT_EQ(test, quiet, false);
276
277 /* layer denying truncate: quiet, ioctl: not quiet */
278 quiet_optional_accesses = 0b01;
279
280 access = LANDLOCK_ACCESS_FS_TRUNCATE;
281 KUNIT_EXPECT_EQ(test, 2,
282 get_layer_from_deny_masks(
283 &access, _LANDLOCK_ACCESS_FS_OPTIONAL,
284 deny_mask, quiet_optional_accesses, &quiet));
285 KUNIT_EXPECT_EQ(test, access, LANDLOCK_ACCESS_FS_TRUNCATE);
286 KUNIT_EXPECT_EQ(test, quiet, true);
287
288 access = LANDLOCK_ACCESS_FS_IOCTL_DEV;
289 KUNIT_EXPECT_EQ(test, 0,
290 get_layer_from_deny_masks(
291 &access, _LANDLOCK_ACCESS_FS_OPTIONAL,
292 deny_mask, quiet_optional_accesses, &quiet));
293 KUNIT_EXPECT_EQ(test, access, LANDLOCK_ACCESS_FS_IOCTL_DEV);
294 KUNIT_EXPECT_EQ(test, quiet, false);
295
296 access = LANDLOCK_ACCESS_FS_TRUNCATE | LANDLOCK_ACCESS_FS_IOCTL_DEV;
297 KUNIT_EXPECT_EQ(test, 2,
298 get_layer_from_deny_masks(
299 &access, _LANDLOCK_ACCESS_FS_OPTIONAL,
300 deny_mask, quiet_optional_accesses, &quiet));
301 KUNIT_EXPECT_EQ(test, access, LANDLOCK_ACCESS_FS_TRUNCATE);
302 KUNIT_EXPECT_EQ(test, quiet, true);
303
304 /* layer denying truncate: not quiet, ioctl: quiet */
305 quiet_optional_accesses = 0b10;
306
307 access = LANDLOCK_ACCESS_FS_TRUNCATE;
308 KUNIT_EXPECT_EQ(test, 2,
309 get_layer_from_deny_masks(
310 &access, _LANDLOCK_ACCESS_FS_OPTIONAL,
311 deny_mask, quiet_optional_accesses, &quiet));
312 KUNIT_EXPECT_EQ(test, access, LANDLOCK_ACCESS_FS_TRUNCATE);
313 KUNIT_EXPECT_EQ(test, quiet, false);
314
315 access = LANDLOCK_ACCESS_FS_IOCTL_DEV;
316 KUNIT_EXPECT_EQ(test, 0,
317 get_layer_from_deny_masks(
318 &access, _LANDLOCK_ACCESS_FS_OPTIONAL,
319 deny_mask, quiet_optional_accesses, &quiet));
320 KUNIT_EXPECT_EQ(test, access, LANDLOCK_ACCESS_FS_IOCTL_DEV);
321 KUNIT_EXPECT_EQ(test, quiet, true);
322
323 access = LANDLOCK_ACCESS_FS_TRUNCATE | LANDLOCK_ACCESS_FS_IOCTL_DEV;
324 KUNIT_EXPECT_EQ(test, 2,
325 get_layer_from_deny_masks(
326 &access, _LANDLOCK_ACCESS_FS_OPTIONAL,
327 deny_mask, quiet_optional_accesses, &quiet));
328 KUNIT_EXPECT_EQ(test, access, LANDLOCK_ACCESS_FS_TRUNCATE);
329 KUNIT_EXPECT_EQ(test, quiet, false);
330
331 /* truncate:15 ioctl_dev:15 */
332 deny_mask = 0xff;
333 quiet_optional_accesses = 0;
334
335 access = LANDLOCK_ACCESS_FS_TRUNCATE;
336 KUNIT_EXPECT_EQ(test, 15,
337 get_layer_from_deny_masks(
338 &access, _LANDLOCK_ACCESS_FS_OPTIONAL,
339 deny_mask, quiet_optional_accesses, &quiet));
340 KUNIT_EXPECT_EQ(test, access, LANDLOCK_ACCESS_FS_TRUNCATE);
341 KUNIT_EXPECT_EQ(test, quiet, false);
342
343 access = LANDLOCK_ACCESS_FS_TRUNCATE | LANDLOCK_ACCESS_FS_IOCTL_DEV;
344 KUNIT_EXPECT_EQ(test, 15,
345 get_layer_from_deny_masks(
346 &access, _LANDLOCK_ACCESS_FS_OPTIONAL,
347 deny_mask, quiet_optional_accesses, &quiet));
348 KUNIT_EXPECT_EQ(test, access,
349 LANDLOCK_ACCESS_FS_TRUNCATE |
350 LANDLOCK_ACCESS_FS_IOCTL_DEV);
351 KUNIT_EXPECT_EQ(test, quiet, false);
352
353 /* Both quiet (same layer so quietness must be the same) */
354 quiet_optional_accesses = 0b11;
355
356 access = LANDLOCK_ACCESS_FS_TRUNCATE;
357 KUNIT_EXPECT_EQ(test, 15,
358 get_layer_from_deny_masks(
359 &access, _LANDLOCK_ACCESS_FS_OPTIONAL,
360 deny_mask, quiet_optional_accesses, &quiet));
361 KUNIT_EXPECT_EQ(test, access, LANDLOCK_ACCESS_FS_TRUNCATE);
362 KUNIT_EXPECT_EQ(test, quiet, true);
363
364 access = LANDLOCK_ACCESS_FS_TRUNCATE | LANDLOCK_ACCESS_FS_IOCTL_DEV;
365 KUNIT_EXPECT_EQ(test, 15,
366 get_layer_from_deny_masks(
367 &access, _LANDLOCK_ACCESS_FS_OPTIONAL,
368 deny_mask, quiet_optional_accesses, &quiet));
369 KUNIT_EXPECT_EQ(test, access,
370 LANDLOCK_ACCESS_FS_TRUNCATE |
371 LANDLOCK_ACCESS_FS_IOCTL_DEV);
372 KUNIT_EXPECT_EQ(test, quiet, true);
373}
374
375#endif /* CONFIG_SECURITY_LANDLOCK_KUNIT_TEST */
376
377static bool is_valid_request(const struct landlock_request *const request)
378{
379 if (WARN_ON_ONCE(request->layer_plus_one > LANDLOCK_MAX_NUM_LAYERS))
380 return false;
381
382 if (WARN_ON_ONCE(!(!!request->layer_plus_one ^ !!request->access)))
383 return false;
384
385 if (request->access) {
386 if (WARN_ON_ONCE(!(!!request->layer_masks ^
387 !!request->all_existing_optional_access)))
388 return false;
389 } else {
390 if (WARN_ON_ONCE(request->layer_masks ||
391 request->all_existing_optional_access))
392 return false;
393 }
394
395 if (request->deny_masks) {
396 if (WARN_ON_ONCE(!request->all_existing_optional_access))
397 return false;
398 static_assert(sizeof(request->all_existing_optional_access) ==
399 sizeof(u32));
400 if (WARN_ON_ONCE(
401 request->quiet_optional_accesses >=
402 BIT(hweight32(
403 request->all_existing_optional_access))))
404 return false;
405 }
406
407 return true;
408}
409
410static access_mask_t
411pick_access_mask_for_request_type(const enum landlock_request_type type,
412 const struct access_masks access_masks)
413{
414 switch (type) {
415 case LANDLOCK_REQUEST_FS_ACCESS:
416 return access_masks.fs;
417 case LANDLOCK_REQUEST_NET_ACCESS:
418 return access_masks.net;
419 default:
420 WARN_ONCE(1, "Invalid request type %d passed to %s", type,
421 __func__);
422 return 0;
423 }
424}
425
426/*
427 * Whether a quiet rule silences the denial: the rule must cover the whole
428 * denied access in the layer that denied it (a quiet rule in a non-denying
429 * layer does not suppress the denial).
430 */
431static bool
432is_denial_quieted(const struct landlock_request *const request,
433 const struct landlock_hierarchy *const youngest_denied,
434 const access_mask_t missing, const bool object_quiet_flag)
435{
436 if (object_quiet_flag) {
437 const access_mask_t quiet_mask =
438 pick_access_mask_for_request_type(
439 request->type, youngest_denied->quiet_masks);
440
441 return (quiet_mask & missing) == missing;
442 }
443
444 /*
445 * Either the object is not quiet, or this is a scope request. We check
446 * request->type to distinguish between the two cases.
447 */
448 switch (request->type) {
449 case LANDLOCK_REQUEST_SCOPE_SIGNAL:
450 return !!(youngest_denied->quiet_masks.scope &
451 LANDLOCK_SCOPE_SIGNAL);
452 case LANDLOCK_REQUEST_SCOPE_ABSTRACT_UNIX_SOCKET:
453 return !!(youngest_denied->quiet_masks.scope &
454 LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET);
455 /*
456 * Leave LANDLOCK_REQUEST_PTRACE and LANDLOCK_REQUEST_FS_CHANGE_TOPOLOGY
457 * unhandled for now - they are never quiet.
458 */
459 default:
460 return false;
461 }
462}
463
464/*
465 * Computes whether a denial from youngest_denied is selected for logging by the
466 * domain's policy: its logging must not be disabled (by both per-execution
467 * flags being off, or by an ancestor's
468 * LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF), the per-execution flag matching
469 * same_exec must be set, and no quiet rule may cover the denied access.
470 * landlock_log_denial() computes this once and passes it to
471 * landlock_audit_denial(), which additionally requires audit_enabled.
472 */
473static bool
474is_denial_logged(const struct landlock_request *const request,
475 const struct landlock_hierarchy *const youngest_denied,
476 const access_mask_t missing, const bool same_exec,
477 const bool object_quiet_flag)
478{
479 if (READ_ONCE(youngest_denied->log_status) == LANDLOCK_LOG_DISABLED)
480 return false;
481
482 if (!(same_exec ? youngest_denied->log_same_exec :
483 youngest_denied->log_new_exec))
484 return false;
485
486 return !is_denial_quieted(request, youngest_denied, missing,
487 object_quiet_flag);
488}
489
490/**
491 * landlock_log_denial - Log a denied access
492 *
493 * @subject: The Landlock subject's credential denying an action.
494 * @request: Detail of the user space request.
495 */
496void landlock_log_denial(const struct landlock_cred_security *const subject,
497 const struct landlock_request *const request)
498{
499 struct landlock_hierarchy *youngest_denied;
500 size_t youngest_layer;
501 access_mask_t missing;
502 bool object_quiet_flag = false;
503
504 if (WARN_ON_ONCE(!subject || !subject->domain ||
505 !subject->domain->hierarchy || !request))
506 return;
507
508 if (!is_valid_request(request))
509 return;
510
511 missing = request->access;
512 if (missing) {
513 /* Gets the nearest domain that denies the request. */
514 if (request->layer_masks) {
515 youngest_layer = get_denied_layer(subject->domain,
516 &missing,
517 request->layer_masks);
518 object_quiet_flag =
519 request->layer_masks->layers[youngest_layer]
520 .quiet;
521 } else {
522 youngest_layer = get_layer_from_deny_masks(
523 &missing, _LANDLOCK_ACCESS_FS_OPTIONAL,
524 request->deny_masks,
525 request->quiet_optional_accesses,
526 &object_quiet_flag);
527 }
528 youngest_denied =
529 get_hierarchy(subject->domain, youngest_layer);
530 } else {
531 youngest_layer = request->layer_plus_one - 1;
532 youngest_denied =
533 get_hierarchy(subject->domain, youngest_layer);
534 }
535
536 const bool same_exec = !!(subject->domain_exec & BIT(youngest_layer));
537 const bool logged = is_denial_logged(request, youngest_denied, missing,
538 same_exec, object_quiet_flag);
539
540 /*
541 * Consistently keeps track of the number of denied access requests even
542 * if audit is currently disabled, or if audit rules currently exclude
543 * this record type, or if landlock_restrict_self(2)'s flags quiet logs.
544 */
545 atomic64_inc(&youngest_denied->num_denials);
546
547 landlock_trace_denial(request, youngest_denied, missing, same_exec,
548 logged);
549 landlock_audit_denial(request, youngest_denied, missing, logged);
550}
551
552/**
553 * landlock_log_free_domain - Log domain deallocation
554 *
555 * @hierarchy: The domain's hierarchy being deallocated.
556 *
557 * Called from landlock_put_domain_deferred() (via a work queue scheduled by
558 * hook_cred_free()) or directly from landlock_put_domain().
559 */
560void landlock_log_free_domain(const struct landlock_hierarchy *const hierarchy)
561{
562 if (WARN_ON_ONCE(!hierarchy))
563 return;
564
565 landlock_trace_free_domain(hierarchy);
566 landlock_audit_free_domain(hierarchy);
567}
568
569#ifdef CONFIG_SECURITY_LANDLOCK_KUNIT_TEST
570
571static struct kunit_case test_cases[] = {
572 /* clang-format off */
573 KUNIT_CASE(test_get_hierarchy),
574 KUNIT_CASE(test_get_denied_layer),
575 KUNIT_CASE(test_get_layer_from_deny_masks),
576 {}
577 /* clang-format on */
578};
579
580static struct kunit_suite test_suite = {
581 .name = "landlock_log",
582 .test_cases = test_cases,
583};
584
585kunit_test_suite(test_suite);
586
587#endif /* CONFIG_SECURITY_LANDLOCK_KUNIT_TEST */