From: Paul Moore <paul@paul-moore.com>
To: "Mickaël Salaün" <mic@digikod.net>,
"Eric Paris" <eparis@redhat.com>,
"Günther Noack" <gnoack@google.com>,
"Serge E . Hallyn" <serge@hallyn.com>
Cc: "Mickaël Salaün" <mic@digikod.net>,
"Ben Scarlato" <akhna@google.com>,
"Casey Schaufler" <casey@schaufler-ca.com>,
"Charles Zaffery" <czaffery@roblox.com>,
"Daniel Burgener" <dburgener@linux.microsoft.com>,
"Francis Laniel" <flaniel@linux.microsoft.com>,
"James Morris" <jmorris@namei.org>,
"Jann Horn" <jannh@google.com>, "Jeff Xu" <jeffxu@google.com>,
"Jorge Lucangeli Obes" <jorgelo@google.com>,
"Kees Cook" <kees@kernel.org>,
"Konstantin Meskhidze" <konstantin.meskhidze@huawei.com>,
"Matt Bobrowski" <mattbobrowski@google.com>,
"Mikhail Ivanov" <ivanov.mikhail1@huawei-partners.com>,
"Phil Sutter" <phil@nwl.cc>,
"Praveen K Paladugu" <prapal@linux.microsoft.com>,
"Robert Salvet" <robert.salvet@roblox.com>,
"Shervin Oloumi" <enlightened@google.com>,
"Song Liu" <song@kernel.org>,
"Tahera Fahimi" <fahimitahera@gmail.com>,
"Tyler Hicks" <code@tyhicks.com>,
audit@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-security-module@vger.kernel.org
Subject: Re: [PATCH v4 28/30] audit,landlock: Add AUDIT_EXE_LANDLOCK_DENY rule type
Date: Wed, 15 Jan 2025 18:53:08 -0500 [thread overview]
Message-ID: <1ac8548a7b42eaed3f4392690011eb8b@paul-moore.com> (raw)
In-Reply-To: <20250108154338.1129069-29-mic@digikod.net>
On Jan 8, 2025 =?UTF-8?q?Micka=C3=ABl=20Sala=C3=BCn?= <mic@digikod.net> wrote:
>
> Landlock manages a set of standalone security policies, which can be
> loaded by any process. Because a sandbox policy may contain errors and
> can lead to log spam, we need a way to exclude some of them. It is
> simple and it makes sense to identify Landlock domains (i.e. security
> policies) per binary path that loaded such policy.
>
> Add a new AUDIT_EXE_LANDLOCK_DENY rule type to enables system
> administrator to filter logs according to the origin or the security
> policy responsible for a denial.
For reasons similar to why I didn't want to expose the audit timestamp
to users outside of audit, I'm not very enthusiastic about expanding
the audit filtering code at this point in time.
I'm not saying "no" exactly, just "not right now".
--
paul-moore.com
next prev parent reply other threads:[~2025-01-15 23:53 UTC|newest]
Thread overview: 58+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-01-08 15:43 [PATCH v4 00/30] Landlock audit support Mickaël Salaün
2025-01-08 15:43 ` [PATCH v4 01/30] lsm: Only build lsm_audit.c if CONFIG_SECURITY and CONFIG_AUDIT are set Mickaël Salaün
2025-01-08 15:43 ` [PATCH v4 02/30] lsm: Add audit_log_lsm_data() helper Mickaël Salaün
2025-01-08 15:43 ` [PATCH v4 03/30] landlock: Factor out check_access_path() Mickaël Salaün
2025-01-10 11:23 ` Mickaël Salaün
2025-01-08 15:43 ` [PATCH v4 04/30] landlock: Add unique ID generator Mickaël Salaün
2025-01-08 15:43 ` [PATCH v4 05/30] landlock: Move access types Mickaël Salaün
2025-01-10 11:23 ` Mickaël Salaün
2025-01-08 15:43 ` [PATCH v4 06/30] landlock: Simplify initially denied access rights Mickaël Salaün
2025-01-10 11:24 ` Mickaël Salaün
2025-01-08 15:43 ` [PATCH v4 07/30] landlock: Move domain hierarchy management and export helpers Mickaël Salaün
2025-01-08 15:43 ` [PATCH v4 08/30] landlock: Add AUDIT_LANDLOCK_DENY and log ptrace denials Mickaël Salaün
2025-01-15 23:53 ` [PATCH v4 8/30] " Paul Moore
2025-01-16 10:49 ` Mickaël Salaün
2025-01-16 20:00 ` Paul Moore
2025-01-08 15:43 ` [PATCH v4 09/30] landlock: Add AUDIT_LANDLOCK_DOM_{INFO,DROP} and log domain properties Mickaël Salaün
2025-01-15 23:53 ` [PATCH v4 9/30] " Paul Moore
2025-01-16 10:51 ` Mickaël Salaün
2025-01-16 20:19 ` Paul Moore
2025-01-08 15:43 ` [PATCH v4 10/30] landlock: Log mount-related denials Mickaël Salaün
2025-01-08 15:43 ` [PATCH v4 11/30] landlock: Align partial refer access checks with final ones Mickaël Salaün
2025-01-10 11:24 ` Mickaël Salaün
2025-01-08 15:43 ` [PATCH v4 12/30] selftests/landlock: Add test to check partial access in a mount tree Mickaël Salaün
2025-01-10 11:24 ` Mickaël Salaün
2025-01-08 15:43 ` [PATCH v4 13/30] landlock: Optimize file path walks and prepare for audit support Mickaël Salaün
2025-01-10 11:24 ` Mickaël Salaün
2025-01-08 15:43 ` [PATCH v4 14/30] landlock: Log file-related denials Mickaël Salaün
2025-01-08 15:43 ` [PATCH v4 15/30] landlock: Log truncate and IOCTL denials Mickaël Salaün
2025-01-08 15:43 ` [PATCH v4 16/30] landlock: Log TCP bind and connect denials Mickaël Salaün
2025-01-08 15:43 ` [PATCH v4 17/30] landlock: Log scoped denials Mickaël Salaün
2025-01-08 15:43 ` [PATCH v4 18/30] landlock: Control log events with LANDLOCK_RESTRICT_SELF_QUIET Mickaël Salaün
2025-01-08 15:43 ` [PATCH v4 19/30] samples/landlock: Do not log denials from the sandboxer by default Mickaël Salaün
2025-01-08 15:43 ` [PATCH v4 20/30] selftests/landlock: Fix error message Mickaël Salaün
2025-01-10 11:24 ` Mickaël Salaün
2025-01-08 15:43 ` [PATCH v4 21/30] selftests/landlock: Add wrappers.h Mickaël Salaün
2025-01-10 11:24 ` Mickaël Salaün
2025-01-08 15:43 ` [PATCH v4 22/30] selftests/landlock: Add layout1.umount_sandboxer tests Mickaël Salaün
2025-01-10 11:25 ` Mickaël Salaün
2025-01-08 15:43 ` [PATCH v4 23/30] selftests/landlock: Extend tests for landlock_restrict_self()'s flags Mickaël Salaün
2025-01-08 15:43 ` [PATCH v4 24/30] selftests/landlock: Add tests for audit and LANDLOCK_RESTRICT_SELF_QUIET Mickaël Salaün
2025-01-08 15:43 ` [PATCH v4 25/30] selftests/landlock: Add audit tests for ptrace Mickaël Salaün
2025-01-08 15:43 ` [PATCH v4 26/30] landlock: Export and rename landlock_get_inode_object() Mickaël Salaün
2025-01-08 15:43 ` [PATCH v4 27/30] fs: Add iput() cleanup helper Mickaël Salaün
2025-01-13 11:15 ` Mickaël Salaün
2025-01-13 16:45 ` Al Viro
2025-01-13 14:00 ` Jann Horn
2025-01-13 15:00 ` Christian Brauner
2025-01-13 16:55 ` Mickaël Salaün
2025-01-13 14:36 ` (subset) " Christian Brauner
2025-01-08 15:43 ` [PATCH v4 28/30] audit,landlock: Add AUDIT_EXE_LANDLOCK_DENY rule type Mickaël Salaün
2025-01-13 14:55 ` Jann Horn
2025-01-13 15:02 ` Christian Brauner
2025-01-13 16:55 ` Mickaël Salaün
2025-01-15 23:53 ` Paul Moore [this message]
2025-01-16 10:57 ` Mickaël Salaün
2025-01-16 20:24 ` Paul Moore
2025-01-08 15:43 ` [PATCH v4 29/30] selftests/landlock: Test audit rule with AUDIT_EXE_LANDLOCK_DOM Mickaël Salaün
2025-01-08 15:43 ` [PATCH v4 30/30] selftests/landlock: Test compatibility with audit rule lists Mickaël Salaün
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1ac8548a7b42eaed3f4392690011eb8b@paul-moore.com \
--to=paul@paul-moore.com \
--cc=akhna@google.com \
--cc=audit@vger.kernel.org \
--cc=casey@schaufler-ca.com \
--cc=code@tyhicks.com \
--cc=czaffery@roblox.com \
--cc=dburgener@linux.microsoft.com \
--cc=enlightened@google.com \
--cc=eparis@redhat.com \
--cc=fahimitahera@gmail.com \
--cc=flaniel@linux.microsoft.com \
--cc=gnoack@google.com \
--cc=ivanov.mikhail1@huawei-partners.com \
--cc=jannh@google.com \
--cc=jeffxu@google.com \
--cc=jmorris@namei.org \
--cc=jorgelo@google.com \
--cc=kees@kernel.org \
--cc=konstantin.meskhidze@huawei.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=mattbobrowski@google.com \
--cc=mic@digikod.net \
--cc=phil@nwl.cc \
--cc=prapal@linux.microsoft.com \
--cc=robert.salvet@roblox.com \
--cc=serge@hallyn.com \
--cc=song@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox