[PATCH v5 08/24] landlock: Identify domain execution crossing

Mickaël Salaün
2025-01-31T16:31:28Z

Extend struct landlock_cred_security with a domain_exec bitmask
identifying if the current task created its domain. This is reset on
cross-execution.

Cc: Günther Noack <gnoack@google.com>
Cc: Paul Moore <paul@paul-moore.com>
Signed-off-by: Mickaël Salaün <mic@digikod.net>
Link: https://lore.kernel.org/r/20250131163059.1139617-9-mic@digikod.net
---

Changes since v4:
- New patch.
---
security/landlock/cred.c | 26 ++++++++++++++++++++++----
security/landlock/cred.h | 15 +++++++++++++++
security/landlock/syscalls.c | 5 +++++
3 files changed, 42 insertions(+), 4 deletions(-)

diff --git a/security/landlock/cred.c b/security/landlock/cred.c
index db9fe7d906ba..a22756fe3b71 100644
--- a/security/landlock/cred.c
+++ b/security/landlock/cred.c
@@ -4,8 +4,10 @@
*
* Copyright © 2017-2020 Mickaël Salaün <mic@digikod.net>
* Copyright © 2018-2020 ANSSI
+ * Copyright © 2025 Microsoft Corporation
*/

+#include <linux/binfmts.h>
#include <linux/cred.h>
#include <linux/lsm_hooks.h>

@@ -17,11 +19,12 @@
static void hook_cred_transfer(struct cred *const new,
const struct cred *const old)
{
- struct landlock_ruleset *const old_dom = landlock_cred(old)->domain;
+ const struct landlock_cred_security *const old_llcred =
+ landlock_cred(old);

- if (old_dom) {
- landlock_get_ruleset(old_dom);
- landlock_cred(new)->domain = old_dom;
+ if (old_llcred->domain) {
+ landlock_get_ruleset(old_llcred->domain);
+ *landlock_cred(new) = *old_llcred;
}
}

@@ -40,10 +43,25 @@ static void hook_cred_free(struct cred *const cred)
landlock_put_ruleset_deferred(dom);
}

+#ifdef CONFIG_AUDIT
+
+static int hook_bprm_creds_for_exec(struct linux_binprm *const bprm)
+{
+ /* Resets for each execution. */
+ landlock_cred(bprm->cred)->domain_exec = 0;
+ return 0;
+}
+
+#endif /* CONFIG_AUDIT */
+
static struct security_hook_list landlock_hooks[] __ro_after_init = {
LSM_HOOK_INIT(cred_prepare, hook_cred_prepare),
LSM_HOOK_INIT(cred_transfer, hook_cred_transfer),
LSM_HOOK_INIT(cred_free, hook_cred_free),
+
+#ifdef CONFIG_AUDIT
+ LSM_HOOK_INIT(bprm_creds_for_exec, hook_bprm_creds_for_exec),
+#endif /* CONFIG_AUDIT */
};

__init void landlock_add_cred_hooks(void)
diff --git a/security/landlock/cred.h b/security/landlock/cred.h
index fdbbaf66d151..47cdf0fa1a4e 100644
--- a/security/landlock/cred.h
+++ b/security/landlock/cred.h
@@ -9,18 +9,33 @@
#ifndef _SECURITY_LANDLOCK_CRED_H
#define _SECURITY_LANDLOCK_CRED_H

+#include <linux/container_of.h>
#include <linux/cred.h>
#include <linux/init.h>
#include <linux/rcupdate.h>

#include "access.h"
+#include "limits.h"
#include "ruleset.h"
#include "setup.h"

struct landlock_cred_security {
struct landlock_ruleset *domain;
+
+#ifdef CONFIG_AUDIT
+ u16 domain_exec;
+#endif /* CONFIG_AUDIT */
};

+#ifdef CONFIG_AUDIT
+
+/* Makes sure all layer executions can be stored. */
+static_assert(BITS_PER_TYPE(typeof_member(struct landlock_cred_security,
+ domain_exec)) >=
+ LANDLOCK_MAX_NUM_LAYERS);
+
+#endif /* CONFIG_AUDIT */
+
static inline struct landlock_cred_security *
landlock_cred(const struct cred *cred)
{
diff --git a/security/landlock/syscalls.c b/security/landlock/syscalls.c
index a9760d252fc2..5129981fec8b 100644
--- a/security/landlock/syscalls.c
+++ b/security/landlock/syscalls.c
@@ -496,5 +496,10 @@ SYSCALL_DEFINE2(landlock_restrict_self, const int, ruleset_fd, const __u32,
/* Replaces the old (prepared) domain. */
landlock_put_ruleset(new_llcred->domain);
new_llcred->domain = new_dom;
+
+#ifdef CONFIG_AUDIT
+ new_llcred->domain_exec |= 1 << (new_dom->num_layers - 1);
+#endif /* CONFIG_AUDIT */
+
return commit_creds(new_cred);
}
--
2.48.1