Mickaël Salaün c56f649646 landlock: Log mount-related denials ...

Add audit support for sb_mount, move_mount, sb_umount, sb_remount, and
sb_pivot_root hooks.

The new related blocker is "fs.change_topology".

Audit event sample:

  type=LANDLOCK_DENY msg=audit(1729738800.349:44): domain=195ba459b blockers=fs.change_topology name="/" dev="tmpfs" ino=1

Remove landlock_get_applicable_domain() and get_current_fs_domain()
which are now fully replaced with landlock_get_applicable_subject().

Cc: Günther Noack <gnoack@google.com>
Link: https://lore.kernel.org/r/20250320190717.2287696-12-mic@digikod.net
Signed-off-by: Mickaël Salaün <mic@digikod.net>

2025-03-26 13:59:39 +01:00

..

errata

landlock: Always allow signals between threads of the same process

2025-03-26 13:59:29 +01:00

.kunitconfig

landlock: Add unique ID generator

2025-03-26 13:59:34 +01:00

access.h

landlock: Simplify initially denied access rights

2025-01-17 19:05:35 +01:00

audit.c

landlock: Log mount-related denials

2025-03-26 13:59:39 +01:00

audit.h

landlock: Log mount-related denials

2025-03-26 13:59:39 +01:00

common.h

landlock: Add support for KUnit tests

2024-02-27 11:21:45 +01:00

cred.c

landlock: Identify domain execution crossing

2025-03-26 13:59:37 +01:00

cred.h

landlock: Identify domain execution crossing

2025-03-26 13:59:37 +01:00

domain.c

landlock: Add AUDIT_LANDLOCK_DOMAIN and log domain status

2025-03-26 13:59:38 +01:00

domain.h

landlock: Add AUDIT_LANDLOCK_DOMAIN and log domain status

2025-03-26 13:59:38 +01:00

errata.h

landlock: Prepare to add second errata

2025-03-21 12:12:21 +01:00

fs.c

landlock: Log mount-related denials

2025-03-26 13:59:39 +01:00

fs.h

landlock: Prepare to use credential instead of domain for fowner

2025-03-26 13:59:37 +01:00

id.c

landlock: Add unique ID generator

2025-03-26 13:59:34 +01:00

id.h

landlock: Add unique ID generator

2025-03-26 13:59:34 +01:00

Kconfig

landlock: Add support for KUnit tests

2024-02-27 11:21:45 +01:00

limits.h

landlock: Add signal scoping

2024-09-16 23:50:52 +02:00

Makefile

landlock: Add AUDIT_LANDLOCK_ACCESS and log ptrace denials

2025-03-26 13:59:38 +01:00

net.c

landlock: Prepare to use credential instead of domain for network

2025-03-26 13:59:35 +01:00

net.h

landlock: Support network rules with TCP bind and connect

2023-10-26 21:07:15 +02:00

object.c

landlock: Format with clang-format

2022-05-09 12:31:10 +02:00

object.h

landlock: Format with clang-format

2022-05-09 12:31:10 +02:00

ruleset.c

landlock: Add AUDIT_LANDLOCK_DOMAIN and log domain status

2025-03-26 13:59:38 +01:00

ruleset.h

landlock: Log mount-related denials

2025-03-26 13:59:39 +01:00

setup.c

landlock: Add unique ID generator

2025-03-26 13:59:34 +01:00

setup.h

landlock: Add the errata interface

2025-03-21 12:12:19 +01:00

syscalls.c

landlock: Identify domain execution crossing

2025-03-26 13:59:37 +01:00

task.c

landlock: Add AUDIT_LANDLOCK_ACCESS and log ptrace denials

2025-03-26 13:59:38 +01:00

task.h

landlock: Rename "ptrace" files to "task"

2024-03-08 18:22:16 +01:00