landlock: Add LANDLOCK_ADD_RULE_QUIET #13

micromaomao · 2025-09-07T22:01:11Z

TODO:
put struct rule_flags_masks in the audit request

root@73893fe444af:/# LL_FS_RO=/ LL_FS_RW= LL_FORCE_LOG=1 LL_FS_QUIET=/tmp linux/samples/landlock/sandboxer /bin/bash
Executing the sandboxed command...
[  229.650735][   T60] audit: type=1423 audit(1757288941.731:195): domain=1867a6c37 blockers=fs.write_file path="/dev/tty" dev="devtmpfs" ino=11
[  229.654681][   T60] audit: type=1424 audit(1757288941.731:195): domain=1867a6c37 status=allocated mode=enforcing pid=834 uid=0 exe="/linux/samples/landlock/sandboxer" comm="sandboxer"
...
root@73893fe444af:/# echo a > /aa
[  235.286198][   T60] audit: type=1423 audit(1757288947.367:196): domain=1867a6c37 blockers=fs.make_reg path="/" dev="virtiofs" ino=1
...``
bash: /aa: Permission denied
root@73893fe444af:/# echo quiet > /tmp/aa
bash: /tmp/aa: Permission denied
root@73893fe444af:/# echo not quiet > /usr/aa
[  258.740222][   T60] audit: type=1423 audit(1757288970.819:197): domain=1867a6c37 blockers=fs.make_reg path="/usr" dev="virtiofs" ino=840
...
bash: /usr/aa: Permission denied

Copilot

Pull Request Overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated 2 comments.

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot · 2025-10-04T17:46:35Z

security/landlock/syscalls.c

+	 * is there to hold a quiet flag
 	 */
-	if (!path_beneath_attr.allowed_access)
+	if (!flags && !path_beneath_attr.allowed_access)


The logic here is unclear. The condition !flags should specifically check for the absence of LANDLOCK_ADD_RULE_QUIET rather than the absence of any flags, for better maintainability and clarity.

Suggested change

if (!flags && !path_beneath_attr.allowed_access)

if (!(flags & LANDLOCK_ADD_RULE_QUIET) && !path_beneath_attr.allowed_access)

Copilot · 2025-10-04T17:46:36Z

security/landlock/syscalls.c

+	 * if it is there to hold a quiet flag
 	 */
-	if (!net_port_attr.allowed_access)
+	if (!flags && !net_port_attr.allowed_access)


Same issue as with filesystem rules: the condition !flags should specifically check for the absence of LANDLOCK_ADD_RULE_QUIET rather than the absence of any flags.

Suggested change

if (!flags && !net_port_attr.allowed_access)

if (!(flags & LANDLOCK_ADD_RULE_QUIET) && !net_port_attr.allowed_access)

To avoid unnecessarily increasing the size of struct landlock_layer, we make the layer level a u8 and use the space to store the flags struct. Signed-off-by: Tingmao Wang <[email protected]> --- Changes since v2: - Comment changes, move local variables, simplify if branch Changes since v1: - Comment changes - Rebased to include disconnected directory handling changes on mic/next and add backing up of collected_rule_flags.

Copilot

Pull Request Overview

Copilot reviewed 21 out of 21 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-11-16T21:20:13Z

tools/testing/selftests/landlock/scoped_abstract_unix_test.c

+	.quiet_scoped = LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET,
+};
+
+FIXTURE_VARIANT_ADD(scoped_audit, quiet_abstract_socket_2){


Missing space after closing brace in the struct initializer. Should be:

const struct a_layer layer1 = { // ... fields ... };

Suggested change

FIXTURE_VARIANT_ADD(scoped_audit, quiet_abstract_socket_2){

FIXTURE_VARIANT_ADD(scoped_audit, quiet_abstract_socket_2) {

Copilot · 2025-11-16T21:20:13Z

security/landlock/ruleset.c

 		.level = 0,
+		.flags = {
+			.quiet = !!(flags & LANDLOCK_ADD_RULE_QUIET),
+		}


Missing space after closing brace. The line should be:

.flags = { .quiet = !!(flags & LANDLOCK_ADD_RULE_QUIET), },

Suggested change

}

}

Adds the UAPI for the quiet flags feature (but not the implementation yet). According to pahole, even after adding the struct access_masks quiet_masks in struct landlock_hierarchy, the u32 log_* bitfield still only has a size of 2 bytes, so there's minimal wasted space. Signed-off-by: Tingmao Wang <[email protected]> --- Changes since v3: - Minor update to this commit message. - Fix minor formatting Changes since v2: - Updated docs from Mickaël's suggestions. Changes since v1: - Per suggestion, added support for quieting only certain access bits, controlled by extra quiet_access_* fields in the ruleset_attr. - Added docs for the extra fields and made updates to doc changes in v1. In particular, call out that the effect of LANDLOCK_ADD_RULE_QUIET is independent from the access bits passed in rule_attr - landlock_add_rule will return -EINVAL when LANDLOCK_ADD_RULE_QUIET is used but the ruleset does not have any quiet access bits set for the given rule type. - ABI version bump to v8 - Syntactic and comment changes per suggestion.

The quietness behaviour is as documented in the previous patch. For optional accesses, since the existing deny_masks can only store 2x4bit of layer index, with no way to represent "no layer", we need to either expand it or have another field to correctly handle quieting of those. This commit uses the latter approach - we add another field to store which optional access (of the 2) are covered by quiet rules in their respective layers as stored in deny_masks. We can avoid making struct landlock_file_security larger by converting the existing fown_layer to a 4bit field. This commit does that, and adds test to ensure that it is large enough for LANDLOCK_MAX_NUM_LAYERS-1. Signed-off-by: Tingmao Wang <[email protected]> --- Changes since v2: - Renamed patch title from "Check for quiet flag in landlock_log_denial" to this given the growth. - Moved quiet bit check after domain_exec check - Rename, style and comment fixes suggested by Mickaël. - Squashed patch 6/6 from v2 "Implement quiet for optional accesses" into this one. Changes to that below: - Refactor the quiet flag setting in get_layer_from_deny_masks() to be more clear. - Add KUnit tests - Fix comments, add WARN_ON_ONCE, use __const_hweight64() as suggested by review - Move build_check_file_security to fs.c - Use a typedef for quiet_optional_accesses, add static_assert, and improve docs on landlock_get_quiet_optional_accesses. Changes since v1: - Supports the new quiet access masks. - Support quieting scope requests (but not ptrace and attempted mounting for now)

I think, based on my best understanding, that this type is likely a typo (even though in the end both are u16) Signed-off-by: Tingmao Wang <[email protected]> Fixes: 2fc80c6 ("landlock: Log file-related denials") --- Changes since v1: - Added Fixes tag

Adds ability to set which access bits to quiet via LL_*_QUIET_ACCESS (FS, NET or SCOPED), and attach quiet flags to individual objects via LL_*_QUIET for FS and NET. Signed-off-by: Tingmao Wang <[email protected]> --- Changes since v2: - Minor change to the above commit message. Changes since v1: - Added new environment variables to control which quiet access bits to set on the rule, and populate quiet_access_* from it. - Added support for quieting net rules and scoped access. Renamed patch title. - Increment ABI version

The next commit will reuse this number. Make it a shared constant to future-proof changes. Signed-off-by: Tingmao Wang <[email protected]> --- Changes since v2: - New patch

Test various interactions of the quiet flag with filesystem rules: - Non-optional access (tested with open and rename). - Optional access (tested with truncate and ioctl). - Behaviour around mounts matches with normal Landlock rules. - Behaviour around disconnected directories matches with normal Landlock rules (test expected behaviour of 9a868cd ("landlock: Fix handling of disconnected directories") applied to the collected quiet flag). - Multiple layers works as expected. Signed-off-by: Tingmao Wang <[email protected]> --- Changes since v2: - New patch

Tests that: - Quiet flag works on network rules - Quiet flag applied to unrelated ports has no effect - Denied access not in quiet_access_net is still logged This is not as thorough as the fs tests, but given the shared logic it should be sufficient. There is also no "optional" access for network rules. Signed-off-by: Tingmao Wang <[email protected]> --- Changes since v2: - New patch

Copilot

Pull Request Overview

Copilot reviewed 21 out of 21 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-11-16T21:40:02Z

tools/testing/selftests/landlock/base_test.c


 	/* Checks invalid flags. */
-	ASSERT_EQ(-1, landlock_add_rule(-1, 0, NULL, 1));
+	ASSERT_EQ(-1, landlock_add_rule(-1, 0, NULL, 100));


[nitpick] The magic number 100 is used for testing invalid flags. Consider using a named constant or adding a comment explaining why 100 specifically is chosen (e.g., "A value outside the valid flag range").

Copilot · 2025-11-16T21:40:02Z

security/landlock/ruleset.h

 */
 struct landlock_layer {
 	/**
 	 * @level: Position of this layer in the layer stack.  Starts from 1.


The level field is changed from u16 to u8, reducing its capacity from 65535 to 255 layers. While LANDLOCK_MAX_NUM_LAYERS is defined as 16, this change reduces the theoretical maximum. Ensure this is intentional and that 255 is sufficient for future growth, or document why this change was made.

Suggested change

* @level: Position of this layer in the layer stack. Starts from 1.

* @level: Position of this layer in the layer stack. Starts from 1.

*

* Note: The type of @level was changed from u16 to u8 to reduce memory usage.

* While this reduces the theoretical maximum from 65535 to 255 layers,

* LANDLOCK_MAX_NUM_LAYERS is currently defined as 16, and 255 is considered

* sufficient for future growth. If a higher limit is ever required, this

* type can be revisited.

Copilot · 2025-11-16T21:40:02Z

security/landlock/audit.c

 get_layer_from_deny_masks(access_mask_t *const access_request,
 			  const access_mask_t all_existing_optional_access,
-			  const deny_masks_t deny_masks)
+			  const deny_masks_t deny_masks, u8 quiet_optional_accesses, bool *quiet)


[nitpick] The function signature shows u8 quiet_optional_accesses as a parameter but the field in struct landlock_request is defined without a bit width. For consistency and to match the field definition in struct landlock_file_security (line 73), consider adding the bit width constraint here as well, or ensure the field can handle the full range of values.

Enhance scoped_audit.connect_to_child and audit_flags.signal to test interaction with various quiet flag settings. Signed-off-by: Tingmao Wang <[email protected]> --- Changes since v3: - New patch

Signed-off-by: Tingmao Wang <[email protected]> --- Changes since v3: - New patch

micromaomao force-pushed the landlock-quiet-flag branch from 52a5b61 to de15882 Compare September 7, 2025 23:51

micromaomao changed the title ~~Landlock quiet flag~~ landlock: Add LANDLOCK_ADD_RULE_QUIET Sep 7, 2025

micromaomao requested a review from Copilot September 7, 2025 23:52

This comment was marked as outdated.

Sign in to view

micromaomao force-pushed the landlock-quiet-flag branch 5 times, most recently from ee7bedc to 434a24b Compare September 9, 2025 00:05

micromaomao requested a review from Copilot September 9, 2025 00:11

This comment was marked as outdated.

Sign in to view

micromaomao force-pushed the landlock-quiet-flag branch 2 times, most recently from af4c481 to 92db84c Compare September 28, 2025 18:28

micromaomao force-pushed the landlock-quiet-flag branch 4 times, most recently from fcbc967 to de94a09 Compare October 1, 2025 00:09

micromaomao requested a review from Copilot October 1, 2025 00:10

This comment was marked as outdated.

Sign in to view

micromaomao force-pushed the landlock-quiet-flag branch from de94a09 to 135d51a Compare October 1, 2025 00:13

micromaomao requested a review from Copilot October 1, 2025 00:13

This comment was marked as outdated.

Sign in to view

micromaomao force-pushed the landlock-quiet-flag branch 5 times, most recently from 0f12d29 to c0cd55c Compare October 4, 2025 17:44

micromaomao requested a review from Copilot October 4, 2025 17:45

Copilot AI reviewed Oct 4, 2025

View reviewed changes

micromaomao force-pushed the landlock-quiet-flag branch from c0cd55c to ab6bfc6 Compare October 4, 2025 17:51

micromaomao force-pushed the landlock-quiet-flag branch from 0eaec7f to 6c68cf1 Compare October 26, 2025 21:05

micromaomao force-pushed the landlock-quiet-flag-base branch from 72fb017 to 00f1413 Compare November 1, 2025 15:39

micromaomao force-pushed the landlock-quiet-flag branch from 6c68cf1 to 3b82b36 Compare November 1, 2025 15:40

micromaomao force-pushed the landlock-quiet-flag-base branch from 00f1413 to 82df083 Compare November 9, 2025 14:53

micromaomao force-pushed the landlock-quiet-flag branch from 3b82b36 to 67c5e24 Compare November 9, 2025 14:53

micromaomao force-pushed the landlock-quiet-flag-base branch from 82df083 to 0df88b3 Compare November 9, 2025 15:19

micromaomao force-pushed the landlock-quiet-flag branch from 67c5e24 to 0abf8bc Compare November 9, 2025 15:19

micromaomao force-pushed the landlock-quiet-flag-base branch from 0df88b3 to 0f29956 Compare November 16, 2025 20:44

micromaomao force-pushed the landlock-quiet-flag branch 2 times, most recently from b046839 to 3751092 Compare November 16, 2025 21:16

micromaomao requested a review from Copilot November 16, 2025 21:17

Copilot started reviewing on behalf of micromaomao November 16, 2025 21:18 View session

Copilot finished reviewing on behalf of micromaomao November 16, 2025 21:19

Copilot AI reviewed Nov 16, 2025

View reviewed changes

micromaomao force-pushed the landlock-quiet-flag branch from 3751092 to 538b5fd Compare November 16, 2025 21:36

micromaomao added 6 commits November 16, 2025 21:37

landlock: Fix wrong type usage

4859d86

I think, based on my best understanding, that this type is likely a typo (even though in the end both are u16) Signed-off-by: Tingmao Wang <[email protected]> Fixes: 2fc80c6 ("landlock: Log file-related denials") --- Changes since v1: - Added Fixes tag

selftests/landlock: Replace hard-coded 16 with a constant

f7f2c9d

The next commit will reuse this number. Make it a shared constant to future-proof changes. Signed-off-by: Tingmao Wang <[email protected]> --- Changes since v2: - New patch

micromaomao requested a review from Copilot November 16, 2025 21:37

Copilot started reviewing on behalf of micromaomao November 16, 2025 21:38 View session

Copilot finished reviewing on behalf of micromaomao November 16, 2025 21:39

Copilot AI reviewed Nov 16, 2025

View reviewed changes

selftests/landlock: Add tests for quiet flag with scope

bc60565

Enhance scoped_audit.connect_to_child and audit_flags.signal to test interaction with various quiet flag settings. Signed-off-by: Tingmao Wang <[email protected]> --- Changes since v3: - New patch

micromaomao force-pushed the landlock-quiet-flag branch from 538b5fd to 969ec5a Compare November 16, 2025 21:49

selftests/landlock: Add tests for invalid use of quiet flag

969ec5a

Signed-off-by: Tingmao Wang <[email protected]> --- Changes since v3: - New patch

	if (!flags && !path_beneath_attr.allowed_access)
	if (!(flags & LANDLOCK_ADD_RULE_QUIET) && !path_beneath_attr.allowed_access)

	if (!flags && !net_port_attr.allowed_access)
	if (!(flags & LANDLOCK_ADD_RULE_QUIET) && !net_port_attr.allowed_access)

	FIXTURE_VARIANT_ADD(scoped_audit, quiet_abstract_socket_2){
	FIXTURE_VARIANT_ADD(scoped_audit, quiet_abstract_socket_2) {

-	 * @level: Position of this layer in the layer stack.  Starts from 1.
+	 * @level: Position of this layer in the layer stack.  Starts from 1.
+	 *
+	 * Note: The type of @level was changed from u16 to u8 to reduce memory usage.
+	 * While this reduces the theoretical maximum from 65535 to 255 layers,
+	 * LANDLOCK_MAX_NUM_LAYERS is currently defined as 16, and 255 is considered
+	 * sufficient for future growth. If a higher limit is ever required, this
+	 * type can be revisited.

landlock: Add LANDLOCK_ADD_RULE_QUIET #13

Are you sure you want to change the base?

landlock: Add LANDLOCK_ADD_RULE_QUIET #13

Uh oh!

Conversation

micromaomao commented Sep 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Copilot AI Oct 4, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 4, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Copilot AI Nov 16, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 16, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Copilot AI Nov 16, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 16, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 16, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

micromaomao commented Sep 7, 2025 •

edited

Loading