Unverified Commit 9f74411a authored by Mickaël Salaün's avatar Mickaël Salaün
Browse files

landlock: Log TCP bind and connect denials 

Add audit support to socket_bind and socket_connect hooks.

The related blockers are:
- net.bind_tcp
- net.connect_tcp

Audit event sample:

  type=LANDLOCK_DENY msg=audit(1729738800.349:44): domain=195ba459b blockers=net.connect_tcp daddr=127.0.0.1 dest=80

Cc: Günther Noack <gnoack@google.com>
Cc: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
Cc: Mikhail Ivanov <ivanov.mikhail1@huawei-partners.com>
Link: https://lore.kernel.org/r/20250320190717.2287696-16-mic@digikod.net


Signed-off-by: default avatarMickaël Salaün <mic@digikod.net>
parent 20fd2954

security/landlock/audit.c

+12 −0
Original line number Diff line number Diff line
@@ -41,6 +41,13 @@ static const char *const fs_access_strings[] = { 


static_assert(ARRAY_SIZE(fs_access_strings) == LANDLOCK_NUM_ACCESS_FS);



static const char *const net_access_strings[] = {

	[BIT_INDEX(LANDLOCK_ACCESS_NET_BIND_TCP)] = "net.bind_tcp",

	[BIT_INDEX(LANDLOCK_ACCESS_NET_CONNECT_TCP)] = "net.connect_tcp",

};



static_assert(ARRAY_SIZE(net_access_strings) == LANDLOCK_NUM_ACCESS_NET);



static __attribute_const__ const char *

get_blocker(const enum landlock_request_type type,

	    const unsigned long access_bit)
@@ -58,6 +65,11 @@ get_blocker(const enum landlock_request_type type, 
		if (WARN_ON_ONCE(access_bit >= ARRAY_SIZE(fs_access_strings)))

			return "unknown";

		return fs_access_strings[access_bit];



	case LANDLOCK_REQUEST_NET_ACCESS:

		if (WARN_ON_ONCE(access_bit >= ARRAY_SIZE(net_access_strings)))

			return "unknown";

		return net_access_strings[access_bit];

	}



	WARN_ON_ONCE(1);

security/landlock/audit.h

+1 −0
Original line number Diff line number Diff line
@@ -18,6 +18,7 @@ enum landlock_request_type { 
	LANDLOCK_REQUEST_PTRACE = 1,

	LANDLOCK_REQUEST_FS_CHANGE_TOPOLOGY,

	LANDLOCK_REQUEST_FS_ACCESS,

	LANDLOCK_REQUEST_NET_ACCESS,

};



/*

security/landlock/net.c

+47 −4
Original line number Diff line number Diff line
@@ -7,10 +7,12 @@ 
 */



#include <linux/in.h>

#include <linux/lsm_audit.h>

#include <linux/net.h>

#include <linux/socket.h>

#include <net/ipv6.h>



#include "audit.h"

#include "common.h"

#include "cred.h"

#include "limits.h"
@@ -55,6 +57,7 @@ static int current_check_access_socket(struct socket *const sock, 
	};

	const struct landlock_cred_security *const subject =

		landlock_get_applicable_subject(current_cred(), masks, NULL);

	struct lsm_network_audit audit_net = {};



	if (!subject)

		return 0;
@@ -68,18 +71,48 @@ static int current_check_access_socket(struct socket *const sock, 


	switch (address->sa_family) {

	case AF_UNSPEC:

	case AF_INET:

	case AF_INET: {

		const struct sockaddr_in *addr4;



		if (addrlen < sizeof(struct sockaddr_in))

			return -EINVAL;

		port = ((struct sockaddr_in *)address)->sin_port;



		addr4 = (struct sockaddr_in *)address;

		port = addr4->sin_port;



		if (access_request == LANDLOCK_ACCESS_NET_CONNECT_TCP) {

			audit_net.dport = port;

			audit_net.v4info.daddr = addr4->sin_addr.s_addr;

		} else if (access_request == LANDLOCK_ACCESS_NET_BIND_TCP) {

			audit_net.sport = port;

			audit_net.v4info.saddr = addr4->sin_addr.s_addr;

		} else {

			WARN_ON_ONCE(1);

		}

		break;

	}



#if IS_ENABLED(CONFIG_IPV6)

	case AF_INET6:

	case AF_INET6: {

		const struct sockaddr_in6 *addr6;



		if (addrlen < SIN6_LEN_RFC2133)

			return -EINVAL;

		port = ((struct sockaddr_in6 *)address)->sin6_port;



		addr6 = (struct sockaddr_in6 *)address;

		port = addr6->sin6_port;



		if (access_request == LANDLOCK_ACCESS_NET_CONNECT_TCP) {

			audit_net.dport = port;

			audit_net.v6info.daddr = addr6->sin6_addr;

		} else if (access_request == LANDLOCK_ACCESS_NET_BIND_TCP) {

			audit_net.sport = port;

			audit_net.v6info.saddr = addr6->sin6_addr;

		} else {

			WARN_ON_ONCE(1);

		}

		break;

	}

#endif /* IS_ENABLED(CONFIG_IPV6) */



	default:
@@ -149,6 +182,16 @@ static int current_check_access_socket(struct socket *const sock, 
				   ARRAY_SIZE(layer_masks)))

		return 0;



	audit_net.family = address->sa_family;

	landlock_log_denial(subject,

			    &(struct landlock_request){

				    .type = LANDLOCK_REQUEST_NET_ACCESS,

				    .audit.type = LSM_AUDIT_DATA_NET,

				    .audit.u.net = &audit_net,

				    .access = access_request,

				    .layer_masks = &layer_masks,

				    .layer_masks_size = ARRAY_SIZE(layer_masks),

			    });

	return -EACCES;

}