Re: [PATCH v3 18/23] landlock: Log scoped denials
From: Mickaël Salaün <mic@digikod.net>
Date: 2025-01-06 15:00:13
Also in:
lkml
On Sat, Jan 04, 2025 at 08:23:53PM -0500, Paul Moore wrote:
On Nov 22, 2024 =?UTF-8?q?Micka=C3=ABl=20Sala=C3=BCn?= [off-list ref] wrote:quoted
Add audit support for unix_stream_connect, unix_may_send, task_kill, and file_send_sigiotask hooks. Audit event sample: type=LL_DENY [...]: domain=195ba459b blockers=scope_abstract_unix_socket path=00666F6FSimilar to 17/23, I believe the SOCKADDR record should already capture the socket address information.
This might not be the case, which is why SELinux and others explicitly log it I guess.
It would also be nice to see an example record on a signal event.
Yes, I'll add such example.
quoted
Cc: Günther Noack <gnoack@google.com> Cc: Tahera Fahimi <redacted> Signed-off-by: Mickaël Salaün <mic@digikod.net> Link: https://lore.kernel.org/r/20241122143353.59367-19-mic@digikod.net (local) --- Changes since v1: - New patch. --- security/landlock/audit.c | 8 ++++++ security/landlock/audit.h | 2 ++ security/landlock/task.c | 58 ++++++++++++++++++++++++++++++++++++--- 3 files changed, 64 insertions(+), 4 deletions(-)-- paul-moore.com