mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2025-08-19 17:31:49 +00:00
8e2dd47b10
Because audit is dedicated to the system administrator, create a new entry in Documentation/admin-guide/LSM . Extend other Landlock documentation's pages with this new one. Extend UAPI with the new log flags. Extend the guiding principles with logs. Cc: Günther Noack <gnoack@google.com> Cc: Paul Moore <paul@paul-moore.com> Link: https://lore.kernel.org/r/20250320190717.2287696-29-mic@digikod.net Signed-off-by: Mickaël Salaün <mic@digikod.net>
159 lines
7.0 KiB
ReStructuredText
159 lines
7.0 KiB
ReStructuredText
.. SPDX-License-Identifier: GPL-2.0
|
|
.. Copyright © 2025 Microsoft Corporation
|
|
|
|
================================
|
|
Landlock: system-wide management
|
|
================================
|
|
|
|
:Author: Mickaël Salaün
|
|
:Date: March 2025
|
|
|
|
Landlock can leverage the audit framework to log events.
|
|
|
|
User space documentation can be found here:
|
|
Documentation/userspace-api/landlock.rst.
|
|
|
|
Audit
|
|
=====
|
|
|
|
Denied access requests are logged by default for a sandboxed program if `audit`
|
|
is enabled. This default behavior can be changed with the
|
|
sys_landlock_restrict_self() flags (cf.
|
|
Documentation/userspace-api/landlock.rst). Landlock logs can also be masked
|
|
thanks to audit rules. Landlock can generate 2 audit record types.
|
|
|
|
Record types
|
|
------------
|
|
|
|
AUDIT_LANDLOCK_ACCESS
|
|
This record type identifies a denied access request to a kernel resource.
|
|
The ``domain`` field indicates the ID of the domain that blocked the
|
|
request. The ``blockers`` field indicates the cause(s) of this denial
|
|
(separated by a comma), and the following fields identify the kernel object
|
|
(similar to SELinux). There may be more than one of this record type per
|
|
audit event.
|
|
|
|
Example with a file link request generating two records in the same event::
|
|
|
|
domain=195ba459b blockers=fs.refer path="/usr/bin" dev="vda2" ino=351
|
|
domain=195ba459b blockers=fs.make_reg,fs.refer path="/usr/local" dev="vda2" ino=365
|
|
|
|
AUDIT_LANDLOCK_DOMAIN
|
|
This record type describes the status of a Landlock domain. The ``status``
|
|
field can be either ``allocated`` or ``deallocated``.
|
|
|
|
The ``allocated`` status is part of the same audit event and follows
|
|
the first logged ``AUDIT_LANDLOCK_ACCESS`` record of a domain. It identifies
|
|
Landlock domain information at the time of the sys_landlock_restrict_self()
|
|
call with the following fields:
|
|
|
|
- the ``domain`` ID
|
|
- the enforcement ``mode``
|
|
- the domain creator's ``pid``
|
|
- the domain creator's ``uid``
|
|
- the domain creator's executable path (``exe``)
|
|
- the domain creator's command line (``comm``)
|
|
|
|
Example::
|
|
|
|
domain=195ba459b status=allocated mode=enforcing pid=300 uid=0 exe="/root/sandboxer" comm="sandboxer"
|
|
|
|
The ``deallocated`` status is an event on its own and it identifies a
|
|
Landlock domain release. After such event, it is guarantee that the
|
|
related domain ID will never be reused during the lifetime of the system.
|
|
The ``domain`` field indicates the ID of the domain which is released, and
|
|
the ``denials`` field indicates the total number of denied access request,
|
|
which might not have been logged according to the audit rules and
|
|
sys_landlock_restrict_self()'s flags.
|
|
|
|
Example::
|
|
|
|
domain=195ba459b status=deallocated denials=3
|
|
|
|
|
|
Event samples
|
|
--------------
|
|
|
|
Here are two examples of log events (see serial numbers).
|
|
|
|
In this example a sandboxed program (``kill``) tries to send a signal to the
|
|
init process, which is denied because of the signal scoping restriction
|
|
(``LL_SCOPED=s``)::
|
|
|
|
$ LL_FS_RO=/ LL_FS_RW=/ LL_SCOPED=s LL_FORCE_LOG=1 ./sandboxer kill 1
|
|
|
|
This command generates two events, each identified with a unique serial
|
|
number following a timestamp (``msg=audit(1729738800.268:30)``). The first
|
|
event (serial ``30``) contains 4 records. The first record
|
|
(``type=LANDLOCK_ACCESS``) shows an access denied by the domain `1a6fdc66f`.
|
|
The cause of this denial is signal scopping restriction
|
|
(``blockers=scope.signal``). The process that would have receive this signal
|
|
is the init process (``opid=1 ocomm="systemd"``).
|
|
|
|
The second record (``type=LANDLOCK_DOMAIN``) describes (``status=allocated``)
|
|
domain `1a6fdc66f`. This domain was created by process ``286`` executing the
|
|
``/root/sandboxer`` program launched by the root user.
|
|
|
|
The third record (``type=SYSCALL``) describes the syscall, its provided
|
|
arguments, its result (``success=no exit=-1``), and the process that called it.
|
|
|
|
The fourth record (``type=PROCTITLE``) shows the command's name as an
|
|
hexadecimal value. This can be translated with ``python -c
|
|
'print(bytes.fromhex("6B696C6C0031"))'``.
|
|
|
|
Finally, the last record (``type=LANDLOCK_DOMAIN``) is also the only one from
|
|
the second event (serial ``31``). It is not tied to a direct user space action
|
|
but an asynchronous one to free resources tied to a Landlock domain
|
|
(``status=deallocated``). This can be useful to know that the following logs
|
|
will not concern the domain ``1a6fdc66f`` anymore. This record also summarize
|
|
the number of requests this domain denied (``denials=1``), whether they were
|
|
logged or not.
|
|
|
|
.. code-block::
|
|
|
|
type=LANDLOCK_ACCESS msg=audit(1729738800.268:30): domain=1a6fdc66f blockers=scope.signal opid=1 ocomm="systemd"
|
|
type=LANDLOCK_DOMAIN msg=audit(1729738800.268:30): domain=1a6fdc66f status=allocated mode=enforcing pid=286 uid=0 exe="/root/sandboxer" comm="sandboxer"
|
|
type=SYSCALL msg=audit(1729738800.268:30): arch=c000003e syscall=62 success=no exit=-1 [..] ppid=272 pid=286 auid=0 uid=0 gid=0 [...] comm="kill" [...]
|
|
type=PROCTITLE msg=audit(1729738800.268:30): proctitle=6B696C6C0031
|
|
type=LANDLOCK_DOMAIN msg=audit(1729738800.324:31): domain=1a6fdc66f status=deallocated denials=1
|
|
|
|
Here is another example showcasing filesystem access control::
|
|
|
|
$ LL_FS_RO=/ LL_FS_RW=/tmp LL_FORCE_LOG=1 ./sandboxer sh -c "echo > /etc/passwd"
|
|
|
|
The related audit logs contains 8 records from 3 different events (serials 33,
|
|
34 and 35) created by the same domain `1a6fdc679`::
|
|
|
|
type=LANDLOCK_ACCESS msg=audit(1729738800.221:33): domain=1a6fdc679 blockers=fs.write_file path="/dev/tty" dev="devtmpfs" ino=9
|
|
type=LANDLOCK_DOMAIN msg=audit(1729738800.221:33): domain=1a6fdc679 status=allocated mode=enforcing pid=289 uid=0 exe="/root/sandboxer" comm="sandboxer"
|
|
type=SYSCALL msg=audit(1729738800.221:33): arch=c000003e syscall=257 success=no exit=-13 [...] ppid=272 pid=289 auid=0 uid=0 gid=0 [...] comm="sh" [...]
|
|
type=PROCTITLE msg=audit(1729738800.221:33): proctitle=7368002D63006563686F203E202F6574632F706173737764
|
|
type=LANDLOCK_ACCESS msg=audit(1729738800.221:34): domain=1a6fdc679 blockers=fs.write_file path="/etc/passwd" dev="vda2" ino=143821
|
|
type=SYSCALL msg=audit(1729738800.221:34): arch=c000003e syscall=257 success=no exit=-13 [...] ppid=272 pid=289 auid=0 uid=0 gid=0 [...] comm="sh" [...]
|
|
type=PROCTITLE msg=audit(1729738800.221:34): proctitle=7368002D63006563686F203E202F6574632F706173737764
|
|
type=LANDLOCK_DOMAIN msg=audit(1729738800.261:35): domain=1a6fdc679 status=deallocated denials=2
|
|
|
|
|
|
Event filtering
|
|
---------------
|
|
|
|
If you get spammed with audit logs related to Landlock, this is either an
|
|
attack attempt or a bug in the security policy. We can put in place some
|
|
filters to limit noise with two complementary ways:
|
|
|
|
- with sys_landlock_restrict_self()'s flags if we can fix the sandboxed
|
|
programs,
|
|
- or with audit rules (see :manpage:`auditctl(8)`).
|
|
|
|
Additional documentation
|
|
========================
|
|
|
|
* `Linux Audit Documentation`_
|
|
* Documentation/userspace-api/landlock.rst
|
|
* Documentation/security/landlock.rst
|
|
* https://landlock.io
|
|
|
|
.. Links
|
|
.. _Linux Audit Documentation:
|
|
https://github.com/linux-audit/audit-documentation/wiki
|