diff options
| author | Mickaël Salaün <mic@digikod.net> | 2025-03-20 20:06:57 +0100 |
|---|---|---|
| committer | Mickaël Salaün <mic@digikod.net> | 2025-03-26 13:59:37 +0100 |
| commit | 14f6c14e9fbde4a802c10c7e770b5ba63853ebc6 (patch) | |
| tree | c69bc6499c6124362e65967b820e886661c6e0de /security/landlock/syscalls.c | |
| parent | 79625f1b3a3df63d3289a0781fdf121bc42966f7 (diff) | |
| download | linux-14f6c14e9fbde4a802c10c7e770b5ba63853ebc6.tar.gz linux-14f6c14e9fbde4a802c10c7e770b5ba63853ebc6.tar.bz2 linux-14f6c14e9fbde4a802c10c7e770b5ba63853ebc6.zip | |
landlock: Identify domain execution crossing
Extend struct landlock_cred_security with a domain_exec bitmask to
identify which Landlock domain were created by the current task's bprm.
The whole bitmask is reset on each execve(2) call.
Cc: Günther Noack <gnoack@google.com>
Cc: Paul Moore <paul@paul-moore.com>
Link: https://lore.kernel.org/r/20250320190717.2287696-9-mic@digikod.net
Signed-off-by: Mickaël Salaün <mic@digikod.net>
Diffstat (limited to 'security/landlock/syscalls.c')
| -rw-r--r-- | security/landlock/syscalls.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/security/landlock/syscalls.c b/security/landlock/syscalls.c index cf9e0483e542..b7b268f43a3b 100644 --- a/security/landlock/syscalls.c +++ b/security/landlock/syscalls.c @@ -510,5 +510,10 @@ SYSCALL_DEFINE2(landlock_restrict_self, const int, ruleset_fd, const __u32, /* Replaces the old (prepared) domain. */ landlock_put_ruleset(new_llcred->domain); new_llcred->domain = new_dom; + +#ifdef CONFIG_AUDIT + new_llcred->domain_exec |= 1 << (new_dom->num_layers - 1); +#endif /* CONFIG_AUDIT */ + return commit_creds(new_cred); } |