[RFC,v1,7/7] landlock: Log ptrace requests

Commit Message

Mickaël Salaün Sept. 21, 2023, 6:16 a.m. UTC

Add audit support for ptrace and ptrace_traceme requests.

Signed-off-by: Mickaël Salaün <[e-mail]>
---
 security/landlock/audit.c  |  2 ++
 security/landlock/audit.h  |  4 +++-
 security/landlock/ptrace.c | 47 ++++++++++++++++++++++++++++++++++----
 3 files changed, 47 insertions(+), 6 deletions(-)

Patch

diff --git a/security/landlock/audit.c b/security/landlock/audit.c
index 89bd701d124f..2ec2a00822d2 100644
--- a/security/landlock/audit.c
+++ b/security/landlock/audit.c
@@ -18,6 +18,8 @@  static const char *op_to_string(enum landlock_operation operation)
 {
 	const char *const desc[] = {
 		[0] = "",
+		[LANDLOCK_OP_PTRACE] = "ptrace",
+		[LANDLOCK_OP_PTRACE_TRACEME] = "ptrace_traceme",
 		[LANDLOCK_OP_MOUNT] = "mount",
 		[LANDLOCK_OP_MOVE_MOUNT] = "move_mount",
 		[LANDLOCK_OP_UMOUNT] = "umount",
diff --git a/security/landlock/audit.h b/security/landlock/audit.h
index e559fb6a89dd..b69bba7b908c 100644
--- a/security/landlock/audit.h
+++ b/security/landlock/audit.h
@@ -14,7 +14,9 @@ 
 #include "ruleset.h"
 
 enum landlock_operation {
-	LANDLOCK_OP_MOUNT = 1,
+	LANDLOCK_OP_PTRACE = 1,
+	LANDLOCK_OP_PTRACE_TRACEME,
+	LANDLOCK_OP_MOUNT,
 	LANDLOCK_OP_MOVE_MOUNT,
 	LANDLOCK_OP_UMOUNT,
 	LANDLOCK_OP_REMOUNT,
diff --git a/security/landlock/ptrace.c b/security/landlock/ptrace.c
index 8a06d6c492bf..dbe219449a32 100644
--- a/security/landlock/ptrace.c
+++ b/security/landlock/ptrace.c
@@ -10,10 +10,12 @@ 
 #include <linux/cred.h>
 #include <linux/errno.h>
 #include <linux/kernel.h>
+#include <linux/lsm_audit.h>
 #include <linux/lsm_hooks.h>
 #include <linux/rcupdate.h>
 #include <linux/sched.h>
 
+#include "audit.h"
 #include "common.h"
 #include "cred.h"
 #include "ptrace.h"
@@ -64,11 +66,9 @@  static bool task_is_scoped(const struct task_struct *const parent,
 static int task_ptrace(const struct task_struct *const parent,
 		       const struct task_struct *const child)
 {
-	/* Quick return for non-landlocked tasks. */
-	if (!landlocked(parent))
-		return 0;
 	if (task_is_scoped(parent, child))
 		return 0;
+
 	return -EPERM;
 }
 
@@ -88,7 +88,26 @@  static int task_ptrace(const struct task_struct *const parent,
 static int hook_ptrace_access_check(struct task_struct *const child,
 				    const unsigned int mode)
 {
-	return task_ptrace(current, child);
+	const struct landlock_ruleset *const dom =
+		landlock_get_current_domain();
+	struct landlock_request request = {
+		.operation = LANDLOCK_OP_PTRACE,
+		.missing_permission = LANDLOCK_PERM_PTRACE,
+		.audit = {
+			.type = LSM_AUDIT_DATA_TASK,
+			.u.tsk = child,
+		},
+	};
+	int err;
+
+	if (!dom)
+		return 0;
+
+	err = task_ptrace(current, child);
+	if (!err)
+		return 0;
+
+	return landlock_log_request(err, &request, dom, 0, NULL);
 }
 
 /**
@@ -105,7 +124,25 @@  static int hook_ptrace_access_check(struct task_struct *const child,
  */
 static int hook_ptrace_traceme(struct task_struct *const parent)
 {
-	return task_ptrace(parent, current);
+	struct landlock_request request = {
+		.operation = LANDLOCK_OP_PTRACE_TRACEME,
+		.missing_permission = LANDLOCK_PERM_PTRACE,
+		.audit = {
+			.type = LSM_AUDIT_DATA_TASK,
+			.u.tsk = parent,
+		},
+	};
+	int err;
+
+	if (!landlock_get_task_domain(parent))
+		return 0;
+
+	err = task_ptrace(parent, current);
+	if (!err)
+		return 0;
+
+	return landlock_log_request(err, &request,
+				    landlock_get_current_domain(), 0, NULL);
 }
 
 static struct security_hook_list landlock_hooks[] __ro_after_init = {