diff options
| author | Mickaël Salaün <mic@digikod.net> | 2026-04-07 18:41:04 +0200 |
|---|---|---|
| committer | Mickaël Salaün <mic@digikod.net> | 2026-04-07 18:50:56 +0200 |
| commit | 874c8f83826c95c62c21d9edfe9ef43e5c346724 (patch) | |
| tree | e8516bed3bad96040cdbec259621c4edcfa73d45 /security | |
| parent | 7aaa8047eafd0bd628065b15757d9b48c5f9c07d (diff) | |
| download | linux-next-history-874c8f83826c95c62c21d9edfe9ef43e5c346724.tar.gz | |
landlock: Fix LOG_SUBDOMAINS_OFF inheritance across fork()
hook_cred_transfer() only copies the Landlock security blob when the
source credential has a domain. This is inconsistent with
landlock_restrict_self() which can set LOG_SUBDOMAINS_OFF on a
credential without creating a domain (via the ruleset_fd=-1 path): the
field is committed but not preserved across fork() because the child's
prepare_creds() calls hook_cred_transfer() which skips the copy when
domain is NULL.
This breaks the documented use case where a process mutes subdomain logs
before forking sandboxed children: the children lose the muting and
their domains produce unexpected audit records.
Fix this by unconditionally copying the Landlock credential blob.
Cc: Günther Noack <gnoack@google.com>
Cc: Jann Horn <jannh@google.com>
Cc: stable@vger.kernel.org
Fixes: ead9079f7569 ("landlock: Add LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF")
Reviewed-by: Günther Noack <gnoack3000@gmail.com>
Link: https://lore.kernel.org/r/20260407164107.2012589-1-mic@digikod.net
Signed-off-by: Mickaël Salaün <mic@digikod.net>
Diffstat (limited to 'security')
| -rw-r--r-- | security/landlock/cred.c | 6 |
1 files changed, 2 insertions, 4 deletions
diff --git a/security/landlock/cred.c b/security/landlock/cred.c index 0cb3edde4d18a..cc419de75cd6b 100644 --- a/security/landlock/cred.c +++ b/security/landlock/cred.c @@ -22,10 +22,8 @@ static void hook_cred_transfer(struct cred *const new, const struct landlock_cred_security *const old_llcred = landlock_cred(old); - if (old_llcred->domain) { - landlock_get_ruleset(old_llcred->domain); - *landlock_cred(new) = *old_llcred; - } + landlock_get_ruleset(old_llcred->domain); + *landlock_cred(new) = *old_llcred; } static int hook_cred_prepare(struct cred *const new, |