Le mardi 22 octobre 2024, 18:10:07 CEST Mickaël Salaün a écrit :
> Add audit support to socket_bind and socket_connect hooks.
>
> Audit record sample:
>
> DENY: domain=4533720601 blockers=net_connect_tcp daddr=127.0.0.1
> dest=80 SYSCALL: arch=c000003e syscall=42 success=no exit=-13 ...
>
> Cc: Günther Noack <gno...@google.com>
> Cc: Konstantin Meskhidze <konstantin.meskhi...@huawei.com>
> Cc: Mikhail Ivanov <ivanov.mikha...@huawei-partners.com>
> Signed-off-by: Mickaël Salaün <m...@digikod.net>
> Link: https://lore.kernel.org/r/20241022161009.982584-13-...@digikod.net
> ---
> security/landlock/audit.c | 11 +++++++++
> security/landlock/audit.h | 1 +
> security/landlock/net.c | 52 ++++++++++++++++++++++++++++++++++++---
> 3 files changed, 60 insertions(+), 4 deletions(-)
>
> diff --git a/security/landlock/audit.c b/security/landlock/audit.c
> index 898c95ebe847..c31a4a8719ee 100644
> --- a/security/landlock/audit.c
> +++ b/security/landlock/audit.c
> @@ -41,6 +41,12 @@ static const char *const fs_access_strings[] = {
> };
> static_assert(ARRAY_SIZE(fs_access_strings) == LANDLOCK_NUM_ACCESS_FS);
>
> +static const char *const net_access_strings[] = {
> + [BIT_INDEX(LANDLOCK_ACCESS_NET_BIND_TCP)] = "net_bind_tcp",
> + [BIT_INDEX(LANDLOCK_ACCESS_NET_CONNECT_TCP)] = "net_connect_tcp",
> +};
> +static_assert(ARRAY_SIZE(net_access_strings) == LANDLOCK_NUM_ACCESS_NET);
> +
> static __attribute_const__ const char *
> get_blocker(const enum landlock_request_type type,
> const unsigned long access_bit)
> @@ -58,6 +64,11 @@ get_blocker(const enum landlock_request_type type,
> if (WARN_ON_ONCE(access_bit >= ARRAY_SIZE(fs_access_strings)))
> return "unknown";
> return fs_access_strings[access_bit];
> +
> + case LANDLOCK_REQUEST_NET_ACCESS:
> + if (WARN_ON_ONCE(access_bit >= ARRAY_SIZE(net_access_strings)))
> + return "unknown";
> + return net_access_strings[access_bit];
> }
>
> WARN_ON_ONCE(1);
> diff --git a/security/landlock/audit.h b/security/landlock/audit.h
> index 320394fd6b84..1075b0c8401f 100644
> --- a/security/landlock/audit.h
> +++ b/security/landlock/audit.h
> @@ -18,6 +18,7 @@ enum landlock_request_type {
> LANDLOCK_REQUEST_PTRACE = 1,
> LANDLOCK_REQUEST_FS_CHANGE_LAYOUT,
> LANDLOCK_REQUEST_FS_ACCESS,
> + LANDLOCK_REQUEST_NET_ACCESS,
> };
>
> /*
> diff --git a/security/landlock/net.c b/security/landlock/net.c
> index 27872d0f7e11..c21afd6e0b4d 100644
> --- a/security/landlock/net.c
> +++ b/security/landlock/net.c
> @@ -7,10 +7,12 @@
> */
>
> #include <linux/in.h>
> +#include <linux/lsm_audit.h>
> #include <linux/net.h>
> #include <linux/socket.h>
> #include <net/ipv6.h>
>
> +#include "audit.h"
> #include "common.h"
> #include "cred.h"
> #include "limits.h"
> @@ -56,6 +58,10 @@ static int current_check_access_socket(struct socket
> *const sock, };
> const struct landlock_ruleset *const dom =
> landlock_match_ruleset(landlock_get_current_domain(), any_net);
> + struct lsm_network_audit audit_net = {};
> + struct landlock_request request = {
> + .type = LANDLOCK_REQUEST_NET_ACCESS,
> + };
>
> if (!dom)
> return 0;
> @@ -72,18 +78,49 @@ static int current_check_access_socket(struct socket
> *const sock,
>
> switch (address->sa_family) {
> case AF_UNSPEC:
> - case AF_INET:
> + case AF_INET: {
> + const struct sockaddr_in *addr4;
> +
> if (addrlen < sizeof(struct sockaddr_in))
> return -EINVAL;
> - port = ((struct sockaddr_in *)address)->sin_port;
> +
> + addr4 = (struct sockaddr_in *)address;
> + port = addr4->sin_port;
> +
> + if (access_request == LANDLOCK_ACCESS_NET_CONNECT_TCP) {
> + audit_net.dport = port;
> + audit_net.v4info.daddr = addr4->sin_addr.s_addr;
> + } else if (access_request == LANDLOCK_ACCESS_NET_BIND_TCP) {
> + audit_net.sport = port;
> + audit_net.v4info.saddr = addr4->sin_addr.s_addr;
> + } else {
> + WARN_ON_ONCE(1);
> + }
> break;
> + }
>
> #if IS_ENABLED(CONFIG_IPV6)
> - case AF_INET6:
> + case AF_INET6: {
> + const struct sockaddr_in6 *addr6;
> +
> if (addrlen < SIN6_LEN_RFC2133)
> return -EINVAL;
> - port = ((struct sockaddr_in6 *)address)->sin6_port;
> +
> + addr6 = (struct sockaddr_in6 *)address;
> + port = addr6->sin6_port;
> + audit_net.v6info.saddr = addr6->sin6_addr;
You set this for all access_request, but not for IPv4, is this done on
purpose?
> +
> + if (access_request == LANDLOCK_ACCESS_NET_CONNECT_TCP) {
> + audit_net.dport = port;
> + audit_net.v6info.daddr = addr6->sin6_addr;
> + } else if (access_request == LANDLOCK_ACCESS_NET_BIND_TCP) {
> + audit_net.sport = port;
> + audit_net.v6info.saddr = addr6->sin6_addr;
> + } else {
> + WARN_ON_ONCE(1);
> + }
> break;
> + }
> #endif /* IS_ENABLED(CONFIG_IPV6) */
>
> default:
> @@ -152,6 +189,13 @@ static int current_check_access_socket(struct socket
> *const sock, ARRAY_SIZE(layer_masks)))
> return 0;
>
> + audit_net.family = address->sa_family;
> + request.audit.type = LSM_AUDIT_DATA_NET;
> + request.audit.u.net = &audit_net;
> + request.access = access_request;
> + request.layer_masks = &layer_masks;
> + request.layer_masks_size = ARRAY_SIZE(layer_masks);
> + landlock_log_denial(dom, &request);
> return -EACCES;
> }
