From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp-190e.mail.infomaniak.ch (smtp-190e.mail.infomaniak.ch [185.125.25.14]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 31B0364AA0 for ; Thu, 21 Dec 2023 18:57:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=digikod.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=digikod.net Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=digikod.net header.i=@digikod.net header.b="gbsSrKQa" Received: from smtp-2-0001.mail.infomaniak.ch (unknown [10.5.36.108]) by smtp-3-3000.mail.infomaniak.ch (Postfix) with ESMTPS id 4SwzvM3WT2zMpvn6; Thu, 21 Dec 2023 18:47:43 +0000 (UTC) Received: from unknown by smtp-2-0001.mail.infomaniak.ch (Postfix) with ESMTPA id 4SwzvL5s6czMpnPc; Thu, 21 Dec 2023 19:47:42 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=digikod.net; s=20191114; t=1703184463; bh=ihKZ9/9Nu3FIEKBVZmn+cxwP3cY4ydFvIOriawEZ2hU=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=gbsSrKQanKGS3Ae+aAOHcqWLg0yMM0rw7tT7KBVY5SgpIATiyZEcunKvxxOZRvjr3 HUTtTk3stKPVbVsKxw+85VKhKCEfRj/1AmIw0d4ucDykcothCQlU0z0j3OdMYWbAYP 5hYxetvpLbFWyuHxO4wToNrwvu14YRJe8UdWl840= Date: Thu, 21 Dec 2023 19:47:40 +0100 From: =?utf-8?Q?Micka=C3=ABl_Sala=C3=BCn?= To: Paul Moore Cc: Eric Paris , James Morris , "Serge E . Hallyn" , Ben Scarlato , =?utf-8?Q?G=C3=BCnther?= Noack , Jeff Xu , Jorge Lucangeli Obes , Konstantin Meskhidze , Shervin Oloumi , audit@vger.kernel.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org Subject: Re: [RFC PATCH v1 5/7] landlock: Log file-related requests Message-ID: <20231221.inae1eThoeva@digikod.net> References: <20230921061641.273654-1-mic@digikod.net> <20230921061641.273654-6-mic@digikod.net> Precedence: bulk X-Mailing-List: audit@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: X-Infomaniak-Routing: alpha On Wed, Dec 20, 2023 at 04:22:33PM -0500, Paul Moore wrote: > On Thu, Sep 21, 2023 at 2:17 AM Mickaël Salaün wrote: > > > > Add audit support for mkdir, mknod, symlink, unlink, rmdir, truncate, > > and open requests. > > > > Signed-off-by: Mickaël Salaün > > --- > > security/landlock/audit.c | 114 ++++++++++++++++++++++++++++++++++++++ > > security/landlock/audit.h | 32 +++++++++++ > > security/landlock/fs.c | 62 ++++++++++++++++++--- > > 3 files changed, 199 insertions(+), 9 deletions(-) > > > > diff --git a/security/landlock/audit.c b/security/landlock/audit.c > > index d9589d07e126..148fc0fafef4 100644 > > --- a/security/landlock/audit.c > > +++ b/security/landlock/audit.c > > @@ -14,6 +14,25 @@ > > > > atomic64_t ruleset_and_domain_counter = ATOMIC64_INIT(0); > > > > +static const char *op_to_string(enum landlock_operation operation) > > +{ > > + const char *const desc[] = { > > + [0] = "", > > + [LANDLOCK_OP_MKDIR] = "mkdir", > > + [LANDLOCK_OP_MKNOD] = "mknod", > > + [LANDLOCK_OP_SYMLINK] = "symlink", > > + [LANDLOCK_OP_UNLINK] = "unlink", > > + [LANDLOCK_OP_RMDIR] = "rmdir", > > + [LANDLOCK_OP_TRUNCATE] = "truncate", > > + [LANDLOCK_OP_OPEN] = "open", > > + }; > > If you're going to be using a single AUDIT_LANDLOCK record type, do > you want to somehow encode that the above are access/permission > requests in the "op=" field name? I'll use several audit record types, one for a denial and others for the related kernel objects. See my other reply. > > > +static void > > +log_request(const int error, struct landlock_request *const request, > > + const struct landlock_ruleset *const domain, > > + const access_mask_t access_request, > > + const layer_mask_t (*const layer_masks)[LANDLOCK_NUM_ACCESS_FS]) > > +{ > > + struct audit_buffer *ab; > > + > > + if (WARN_ON_ONCE(!error)) > > + return; > > + if (WARN_ON_ONCE(!request)) > > + return; > > + if (WARN_ON_ONCE(!domain || !domain->hierarchy)) > > + return; > > + > > + /* Uses GFP_ATOMIC to not sleep. */ > > + ab = audit_log_start(audit_context(), GFP_ATOMIC | __GFP_NOWARN, > > + AUDIT_LANDLOCK); > > + if (!ab) > > + return; > > + > > + update_request(request, domain, access_request, layer_masks); > > + > > + log_task(ab); > > + audit_log_format(ab, " domain=%llu op=%s errno=%d missing-fs-accesses=", > > + request->youngest_domain, > > + op_to_string(request->operation), -error); > > + log_accesses(ab, request->missing_access); > > + audit_log_lsm_data(ab, &request->audit); > > + audit_log_end(ab); > > +} > > See my previous comments about record format consistency. right > > -- > paul-moore.com >