> Network denial events report source and destination ports reconstructed > from audit data. Their zero values are ambiguous, and neither identifies > the complete endpoint that Landlock checked. > > Carry the checked sockaddr and its signed length in a private trace-only > context. For an enabled event, validate the length and copy only the > initialized prefix into zeroed local storage. This prevents a typed BPF > program from reading uninitialized bytes while exposing the socket > family, socket, address, and length. > > Replace the source and destination trace-record fields with one signed > port derived from the checked address. A value of -1 means that no port > was checked, zero is a valid port, and positive values use host > endianness. Bind blockers select the bind address; connect and send > blockers select the destination. > > Cc: Günther Noack <[email protected]> > Cc: Steven Rostedt <[email protected]> > Fixes: 01ce260f5ccf ("landlock: Add landlock_deny_access_fs and > landlock_deny_access_net") > Signed-off-by: Mickaël Salaün <[email protected]>
Sashiko has reviewed this patch and found no issues. It looks great! -- Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=4
