linux - security/landlock/log.h

124 lines · 3.0 KiB

1	/* SPDX-License-Identifier: GPL-2.0-only */
2	/*
3	* Landlock - Log helpers
4	*
5	* Copyright © 2023-2025 Microsoft Corporation
6	* Copyright © 2026 Cloudflare, Inc.
7	*/
8
9	#ifndef _SECURITY_LANDLOCK_LOG_H
10	#define _SECURITY_LANDLOCK_LOG_H
11
12	#include <linux/lsm_audit.h>
13
14	#include "access.h"
15
16	struct landlock_cred_security;
17	struct landlock_hierarchy;
18	struct sockaddr;
19	struct task_struct;
20
21	enum landlock_request_type {
22	LANDLOCK_REQUEST_PTRACE = 1,
23	LANDLOCK_REQUEST_FS_CHANGE_TOPOLOGY,
24	LANDLOCK_REQUEST_FS_ACCESS,
25	LANDLOCK_REQUEST_NET_ACCESS,
26	LANDLOCK_REQUEST_SCOPE_ABSTRACT_UNIX_SOCKET,
27	LANDLOCK_REQUEST_SCOPE_SIGNAL,
28	};
29
30	struct landlock_blockers {
31	access_mask_t access;
32	enum landlock_request_type type;
33	};
34
35	#ifdef CONFIG_TRACEPOINTS
36
37	struct landlock_net_trace {
38	const struct sockaddr *address;
39	int addrlen;
40	u16 socket_family;
41	};
42
43	struct landlock_ptrace_trace {
44	u64 tracee_domain_id;
45	const struct task_struct *tracer;
46	};
47
48	struct landlock_signal_trace {
49	u64 target_domain_id;
50	int signal;
51	};
52
53	#endif /* CONFIG_TRACEPOINTS */
54
55	/*
56	* We should be careful to only use a variable of this type for
57	* landlock_log_denial(). This way, the compiler can remove it entirely if
58	* CONFIG_SECURITY_LANDLOCK_LOG is not set.
59	*/
60	struct landlock_request {
61	/* Mandatory fields. */
62	enum landlock_request_type type;
63	struct common_audit_data audit;
64
65	/**
66	* layer_plus_one: First layer level that denies the request + 1. The
67	* extra one is useful to detect uninitialized field.
68	*/
69	size_t layer_plus_one;
70
71	/* Required field for configurable access control. */
72	access_mask_t access;
73
74	/* Required fields for requests with layer masks. */
75	const struct layer_masks *layer_masks;
76
77	/* Required fields for requests with deny masks. */
78	const access_mask_t all_existing_optional_access;
79	deny_masks_t deny_masks;
80	optional_access_t quiet_optional_accesses;
81
82	#ifdef CONFIG_TRACEPOINTS
83	union {
84	/*
85	* Other-party domain ID for an abstract UNIX socket scope
86	* denial, or 0 if that party is unsandboxed. Store an ID, not
87	* a pointer: the other task can replace its credential and free
88	* the domain it referenced.
89	*/
90	u64 other_domain_id;
91
92	/* Synchronous context for a network denial. */
93	const struct landlock_net_trace *trace_net;
94	/* Synchronous context for a ptrace denial. */
95	const struct landlock_ptrace_trace *trace_ptrace;
96	/* Synchronous context for a signal denial. */
97	const struct landlock_signal_trace *trace_signal;
98	};
99	#endif /* CONFIG_TRACEPOINTS */
100	};
101
102	#ifdef CONFIG_SECURITY_LANDLOCK_LOG
103
104	void landlock_log_free_domain(const struct landlock_hierarchy *const hierarchy);
105
106	void landlock_log_denial(const struct landlock_cred_security *const subject,
107	const struct landlock_request *const request);
108
109	#else /* CONFIG_SECURITY_LANDLOCK_LOG */
110
111	static inline void
112	landlock_log_free_domain(const struct landlock_hierarchy *const hierarchy)
113	{
114	}
115
116	static inline void
117	landlock_log_denial(const struct landlock_cred_security *const subject,
118	const struct landlock_request *const request)
119	{
120	}
121
122	#endif /* CONFIG_SECURITY_LANDLOCK_LOG */
123
124	#endif /* _SECURITY_LANDLOCK_LOG_H */