Replace hook_sb_mount() with granular mount hooks. Landlock denies all mount operations for sandboxed processes regardless of flags, so all new hooks share a common hook_mount_deny() helper. The mount_move hook reuses hook_move_mount(). Code generated with the assistance of Claude, reviewed by human. Signed-off-by: Song Liu --- security/landlock/fs.c | 40 ++++++++++++++++++++++++++++++++++++---- 1 file changed, 36 insertions(+), 4 deletions(-) diff --git a/security/landlock/fs.c b/security/landlock/fs.c index e764470f588c..6e810550efcb 100644 --- a/security/landlock/fs.c +++ b/security/landlock/fs.c @@ -1417,9 +1417,7 @@ static void log_fs_change_topology_dentry( * inherit these new constraints. Anyway, for backward compatibility reasons, * a dedicated user space option would be required (e.g. as a ruleset flag). */ -static int hook_sb_mount(const char *const dev_name, - const struct path *const path, const char *const type, - const unsigned long flags, void *const data) +static int hook_mount_deny(const struct path *const path) { size_t handle_layer; const struct landlock_cred_security *const subject = @@ -1433,6 +1431,35 @@ static int hook_sb_mount(const char *const dev_name, return -EPERM; } +static int hook_mount_bind(const struct path *const from, + const struct path *const to, bool recurse) +{ + return hook_mount_deny(to); +} + +static int hook_mount_new(struct fs_context *fc, const struct path *const mp, + int mnt_flags, unsigned long flags, void *data) +{ + return hook_mount_deny(mp); +} + +static int hook_mount_remount(struct fs_context *fc, const struct path *mp, + int mnt_flags, unsigned long flags, void *data) +{ + return hook_mount_deny(mp); +} + +static int hook_mount_reconfigure(const struct path *const mp, + unsigned int mnt_flags, unsigned long flags) +{ + return hook_mount_deny(mp); +} + +static int hook_mount_change_type(const struct path *const mp, int ms_flags) +{ + return hook_mount_deny(mp); +} + static int hook_move_mount(const struct path *const from_path, const struct path *const to_path) { @@ -1824,7 +1851,12 @@ static struct security_hook_list landlock_hooks[] __ro_after_init = { LSM_HOOK_INIT(inode_free_security_rcu, hook_inode_free_security_rcu), LSM_HOOK_INIT(sb_delete, hook_sb_delete), - LSM_HOOK_INIT(sb_mount, hook_sb_mount), + LSM_HOOK_INIT(mount_bind, hook_mount_bind), + LSM_HOOK_INIT(mount_new, hook_mount_new), + LSM_HOOK_INIT(mount_remount, hook_mount_remount), + LSM_HOOK_INIT(mount_reconfigure, hook_mount_reconfigure), + LSM_HOOK_INIT(mount_change_type, hook_mount_change_type), + LSM_HOOK_INIT(mount_move, hook_move_mount), LSM_HOOK_INIT(move_mount, hook_move_mount), LSM_HOOK_INIT(sb_umount, hook_sb_umount), LSM_HOOK_INIT(sb_remount, hook_sb_remount), -- 2.52.0