Most of the time we want to log denied access because they should not happen and such information helps diagnose issues. However, when sandboxing processes that we know will try to access denied resources (e.g. unknown, bogus, or malicious binary), we might want to not log related access requests that might fill up logs. By default, denied requests are logged until the task call execve(2). If the LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF flag is set, denied requests will not be logged for the same executed file. If the LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON flag is set, denied requests from after an execve(2) call will be logged. The rationale is that a program should know its own behavior, but not necessarily the behavior of other programs. Because LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF is set for a specific Landlock domain, it makes it possible to selectively mask some access requests that would be logged by a parent domain, which might be handy for unprivileged processes to limit logs. However, system administrators should still use the audit filtering mechanism. There is intentionally no audit nor sysctl configuration to re-enable these logs. This is delegated to the user space program. Increment the Landlock ABI version to reflect this interface change.
Showing the changes to include/uapi/linux (1 of 7 files). Show all
Unified · Split
| @@ -4,6 +4,7 @@ · 3 unmodified lines | |||
| 4 | * | 4 | * |
| 5 | * Copyright © 2017-2020 Mickaël Salaün <mic@digikod.net> | 5 | * Copyright © 2017-2020 Mickaël Salaün <mic@digikod.net> |
| 6 | * Copyright © 2018-2020 ANSSI | 6 | * Copyright © 2018-2020 ANSSI |
| 7 | * Copyright © 2021-2025 Microsoft Corporation | ||
| 7 | */ | 8 | */ |
| 8 | 9 | ||
| 9 | #ifndef _UAPI_LINUX_LANDLOCK_H | 10 | #ifndef _UAPI_LINUX_LANDLOCK_H |
| @@ -64,6 +65,26 @@ struct landlock_ruleset_attr { · 54 unmodified lines | |||
| 64 | #define LANDLOCK_CREATE_RULESET_ERRATA (1U << 1) | 65 | #define LANDLOCK_CREATE_RULESET_ERRATA (1U << 1) |
| 65 | /* clang-format on */ | 66 | /* clang-format on */ |
| 66 | 67 | ||
| 68 | /* | ||
| 69 | * sys_landlock_restrict_self() flags: | ||
| 70 | * | ||
| 71 | * - %LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF: Do not create any log related to the | ||
| 72 | * enforced restrictions. This should only be set by tools launching unknown | ||
| 73 | * or untrusted programs (e.g. a sandbox tool, container runtime, system | ||
| 74 | * service manager). Because programs sandboxing themselves should fix any | ||
| 75 | * denied access, they should not set this flag to be aware of potential | ||
| 76 | * issues reported by system's logs (i.e. audit). | ||
| 77 | * - %LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON: Explicitly ask to continue | ||
| 78 | * logging denied access requests even after an :manpage:`execve(2)` call. | ||
| 79 | * This flag should only be set if all the programs than can legitimately be | ||
| 80 | * executed will not try to request a denied access (which could spam audit | ||
| 81 | * logs). | ||
| 82 | */ | ||
| 83 | /* clang-format off */ | ||
| 84 | #define LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF (1U << 0) | ||
| 85 | #define LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON (1U << 1) | ||
| 86 | /* clang-format on */ | ||
| 87 | |||
| 67 | /** | 88 | /** |
| 68 | * enum landlock_rule_type - Landlock rule type | 89 | * enum landlock_rule_type - Landlock rule type |
| 69 | * | 90 | * |