lkml.org 
[lkml]   [2023]   [Dec]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [RFC PATCH v1 4/7] landlock: Log domain creation and enforcement
    On Wed, Dec 20, 2023 at 04:22:22PM -0500, Paul Moore wrote:
    > On Thu, Sep 21, 2023 at 2:17 AM Mickaël Salaün <mic@digikod.net> wrote:
    > >
    > > Add audit support for domain creation, i.e. task self-restriction.
    > >
    > > Signed-off-by: Mickaël Salaün <mic@digikod.net>
    > > ---
    > > security/landlock/audit.c | 24 ++++++++++++++++++++++++
    > > security/landlock/audit.h | 8 ++++++++
    > > security/landlock/syscalls.c | 4 ++++
    > > 3 files changed, 36 insertions(+)
    > >
    > > diff --git a/security/landlock/audit.c b/security/landlock/audit.c
    > > index f58bd529784a..d9589d07e126 100644
    > > --- a/security/landlock/audit.c
    > > +++ b/security/landlock/audit.c
    > > @@ -84,6 +84,30 @@ void landlock_log_create_ruleset(struct landlock_ruleset *const ruleset)
    > > audit_log_end(ab);
    > > }
    > >
    > > +void landlock_log_restrict_self(struct landlock_ruleset *const domain,
    > > + struct landlock_ruleset *const ruleset)
    > > +{
    > > + struct audit_buffer *ab;
    > > +
    > > + WARN_ON_ONCE(domain->id);
    > > + WARN_ON_ONCE(!ruleset->id);
    > > +
    > > + ab = audit_log_start(audit_context(), GFP_ATOMIC, AUDIT_LANDLOCK);
    > > + if (!ab)
    > > + /* audit_log_lost() call */
    > > + return;
    > > +
    > > + domain->hierarchy->id =
    > > + atomic64_inc_return(&ruleset_and_domain_counter);
    > > + log_task(ab);
    > > + audit_log_format(ab, " op=restrict-self domain=%llu ruleset=%llu",
    > > + domain->hierarchy->id, ruleset->id);
    >
    > If domain creation and self restriction are the same, I would suggest
    > going with "op=create-domain" so it better matches "op=release-domain"
    > in patch 3/7.

    OK, I'll do something more consistent.

    >
    > Also see my previous comment about consistency between AUDIT_LANDLOCK records.
    >
    > > + audit_log_format(
    > > + ab, " parent=%llu",
    > > + domain->hierarchy->parent ? domain->hierarchy->parent->id : 0);
    > > + audit_log_end(ab);
    > > +}
    >
    > --
    > paul-moore.com
    >

    \
     
     \ /
      Last update: 2023-12-21 19:46    [W:5.981 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site