Add audit support for ptrace and ptrace_traceme requests.
Signed-off-by: Mickaël Salaün <[email protected]>
---
security/landlock/audit.c | 2 ++
security/landlock/audit.h | 4 +++-
security/landlock/ptrace.c | 47 ++++++++++++++++++++++++++++++++++----
3 files changed, 47 insertions(+), 6 deletions(-)
diff --git a/security/landlock/audit.c b/security/landlock/audit.c
index 89bd701d124f..2ec2a00822d2 100644
--- a/security/landlock/audit.c
+++ b/security/landlock/audit.c
@@ -18,6 +18,8 @@ static const char *op_to_string(enum landlock_operation
operation)
{
const char *const desc[] = {
[0] = "",
+ [LANDLOCK_OP_PTRACE] = "ptrace",
+ [LANDLOCK_OP_PTRACE_TRACEME] = "ptrace_traceme",
[LANDLOCK_OP_MOUNT] = "mount",
[LANDLOCK_OP_MOVE_MOUNT] = "move_mount",
[LANDLOCK_OP_UMOUNT] = "umount",
diff --git a/security/landlock/audit.h b/security/landlock/audit.h
index e559fb6a89dd..b69bba7b908c 100644
--- a/security/landlock/audit.h
+++ b/security/landlock/audit.h
@@ -14,7 +14,9 @@
#include "ruleset.h"
enum landlock_operation {
- LANDLOCK_OP_MOUNT = 1,
+ LANDLOCK_OP_PTRACE = 1,
+ LANDLOCK_OP_PTRACE_TRACEME,
+ LANDLOCK_OP_MOUNT,
LANDLOCK_OP_MOVE_MOUNT,
LANDLOCK_OP_UMOUNT,
LANDLOCK_OP_REMOUNT,
diff --git a/security/landlock/ptrace.c b/security/landlock/ptrace.c
index 8a06d6c492bf..dbe219449a32 100644
--- a/security/landlock/ptrace.c
+++ b/security/landlock/ptrace.c
@@ -10,10 +10,12 @@
#include <linux/cred.h>
#include <linux/errno.h>
#include <linux/kernel.h>
+#include <linux/lsm_audit.h>
#include <linux/lsm_hooks.h>
#include <linux/rcupdate.h>
#include <linux/sched.h>
+#include "audit.h"
#include "common.h"
#include "cred.h"
#include "ptrace.h"
@@ -64,11 +66,9 @@ static bool task_is_scoped(const struct task_struct *const
parent,
static int task_ptrace(const struct task_struct *const parent,
const struct task_struct *const child)
{
- /* Quick return for non-landlocked tasks. */
- if (!landlocked(parent))
- return 0;
if (task_is_scoped(parent, child))
return 0;
+
return -EPERM;
}
@@ -88,7 +88,26 @@ static int task_ptrace(const struct task_struct *const
parent,
static int hook_ptrace_access_check(struct task_struct *const child,
const unsigned int mode)
{
- return task_ptrace(current, child);
+ const struct landlock_ruleset *const dom =
+ landlock_get_current_domain();
+ struct landlock_request request = {
+ .operation = LANDLOCK_OP_PTRACE,
+ .missing_permission = LANDLOCK_PERM_PTRACE,
+ .audit = {
+ .type = LSM_AUDIT_DATA_TASK,
+ .u.tsk = child,
+ },
+ };
+ int err;
+
+ if (!dom)
+ return 0;
+
+ err = task_ptrace(current, child);
+ if (!err)
+ return 0;
+
+ return landlock_log_request(err, &request, dom, 0, NULL);
}
/**
@@ -105,7 +124,25 @@ static int hook_ptrace_access_check(struct task_struct
*const child,
*/
static int hook_ptrace_traceme(struct task_struct *const parent)
{
- return task_ptrace(parent, current);
+ struct landlock_request request = {
+ .operation = LANDLOCK_OP_PTRACE_TRACEME,
+ .missing_permission = LANDLOCK_PERM_PTRACE,
+ .audit = {
+ .type = LSM_AUDIT_DATA_TASK,
+ .u.tsk = parent,
+ },
+ };
+ int err;
+
+ if (!landlock_get_task_domain(parent))
+ return 0;
+
+ err = task_ptrace(parent, current);
+ if (!err)
+ return 0;
+
+ return landlock_log_request(err, &request,
+ landlock_get_current_domain(), 0, NULL);
}
static struct security_hook_list landlock_hooks[] __ro_after_init = {
--
2.42.0
