mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2026-08-27 21:03:31 -04:00
bb91730f16
Scope and ptrace denials follow a different code path (a domain hierarchy check) than access-right denials, so they need dedicated tracepoints with type-specific TP_PROTO arguments. Complete the denial coverage with: - landlock_deny_ptrace: ptrace access denied by a domain hierarchy mismatch. - landlock_deny_scope_signal: signal delivery denied by LANDLOCK_SCOPE_SIGNAL. - landlock_deny_scope_abstract_unix_socket: abstract unix socket access denied by LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET. TP_PROTO passes the raw kernel object (struct task_struct or struct sock) for eBPF BTF access; the comm and sun_path string fields use __print_untrusted_str() because they hold untrusted input. Unlike the deny_access events, these omit the blockers field: each maps to exactly one denial type named by the event, so the bitmask would always be zero. Like the deny_access events they carry same_exec and logged. Audit logs the task-targeted denials with generic field names (opid, ocomm), but a strongly typed trace event can use role-prefixed names (tracee_pid/tracee_comm, target_pid/target_comm) that match the mainline task-name convention (sched_process_fork's parent_comm/child_comm) and say whose name each field holds; a bare comm= would collide across events. The abstract-unix-socket event reports peer_pid instead, a tracepoint-only field with no audit counterpart. A scope or ptrace verdict compares the subject domain against the other party's domain, so each event also reports that other party's Landlock domain (tracee_domain=, target_domain=, or peer_domain=); the subject domain= alone does not let a consumer redo domain_is_scoped() or domain_ptrace(). It is reported as a scalar ID rather than a domain pointer: a domain object is immutable, but the other task can replace its credential and free the domain that credential referenced, so a stored foreign pointer could dangle before the event is consumed. The scalar ID also honors the tracepoint no-nullable-pointer rule, since the other party is frequently unsandboxed. Passing the foreign domain hierarchy object so an eBPF consumer could walk the other party's ancestry live would lengthen the RCU section on the shared denial path and needs a deferred refcount put, so it is left as a future enhancement. The relational domain-ID field (tracee_domain, target_domain, or peer_domain) is trace-only and is not added to audit records, so audit's denial format is unchanged by this series. Cc: Günther Noack <gnoack@google.com> Cc: Justin Suess <utilityemal77@gmail.com> Cc: Masami Hiramatsu <mhiramat@kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Cc: Steven Rostedt <rostedt@goodmis.org> Cc: Tingmao Wang <m@maowtm.org> Link: https://patch.msgid.link/20260811094338.288094-14-mic@digikod.net Signed-off-by: Mickaël Salaün <mic@digikod.net>