From 01a9ddbbee65ca04423ecf8402e9c55092c771d2 Mon Sep 17 00:00:00 2001 From: "Kelvin M. Klann" Date: Wed, 8 Nov 2023 09:59:15 -0300 Subject: landlock: improve logs for debugging Changes: * Print everything to stderr (to ensure that the messages are shown in order) * Print debug messages at the beginning of most functions * Include the function name and access flags used Relates to #6078. --- src/firejail/landlock.c | 35 +++++++++++++++++++++++++++-------- 1 file changed, 27 insertions(+), 8 deletions(-) diff --git a/src/firejail/landlock.c b/src/firejail/landlock.c index 65a4cd8df..054d31ee4 100644 --- a/src/firejail/landlock.c +++ b/src/firejail/landlock.c @@ -68,14 +68,16 @@ int ll_is_supported(void) { LANDLOCK_CREATE_RULESET_VERSION); if (ll_abi < 1) { ll_abi = 0; - fprintf(stderr, "Warning: Landlock is disabled or not supported: %s, " + fprintf(stderr, "Warning: %s: Landlock is disabled or not supported: %s, " "ignoring landlock commands\n", - strerror(errno)); + __func__, strerror(errno)); goto out; } - if (arg_debug) - printf("Detected Landlock ABI version %d\n", ll_abi); + if (arg_debug) { + fprintf(stderr, "%s: Detected Landlock ABI version %d\n", + __func__, ll_abi); + } out: return ll_abi; } @@ -100,9 +102,16 @@ static int ll_create_full_ruleset(void) { LANDLOCK_ACCESS_FS_REMOVE_FILE | LANDLOCK_ACCESS_FS_WRITE_FILE; + if (arg_debug) { + fprintf(stderr, "%s: Creating Landlock ruleset (abi=%d fs=%llx)\n", + __func__, ll_abi, attr.handled_access_fs); + } + int ruleset_fd = landlock_create_ruleset(&attr, sizeof(attr), 0); if (ruleset_fd < 0) { - fprintf(stderr, "Error: failed to create a Landlock ruleset: %s\n", + fprintf(stderr, "%s: Error: failed to create Landlock ruleset " + "(abi=%d fs=%llx): %s\n", + __func__, ll_abi, attr.handled_access_fs, strerror(errno)); } return ruleset_fd; @@ -116,6 +125,11 @@ static int ll_fs(const char *allowed_path, const __u64 allowed_access, if (ll_ruleset_fd == -1) ll_ruleset_fd = ll_create_full_ruleset(); + if (arg_debug) { + fprintf(stderr, "%s: Adding Landlock rule (abi=%d fs=%llx) for %s\n", + caller, ll_abi, allowed_access, allowed_path); + } + int error; int allowed_fd = open(allowed_path, O_PATH | O_CLOEXEC); if (allowed_fd < 0) { @@ -132,8 +146,10 @@ static int ll_fs(const char *allowed_path, const __u64 allowed_access, error = landlock_add_rule(ll_ruleset_fd, LANDLOCK_RULE_PATH_BENEATH, &target, 0); if (error) { - fprintf(stderr, "Error: %s: failed to add Landlock rule for %s: %s\n", - caller, allowed_path, strerror(errno)); + fprintf(stderr, "Error: %s: failed to add Landlock rule " + "(abi=%d fs=%llx) for %s: %s\n", + caller, ll_abi, allowed_access, allowed_path, + strerror(errno)); } close(allowed_fd); return error; @@ -232,6 +248,9 @@ int ll_restrict(__u32 flags) { if (!ll_is_supported()) return 0; + if (arg_debug) + fprintf(stderr, "%s: Starting Landlock restrict\n", __func__); + int (*fnc[])(const char *) = { ll_read, ll_write, @@ -263,7 +282,7 @@ int ll_restrict(__u32 flags) { goto out; } if (arg_debug) - printf("%s: Enforcing Landlock\n", __func__); + fprintf(stderr, "%s: Enforcing Landlock\n", __func__); out: close(ll_ruleset_fd); return error; -- cgit v1.2.3-70-g09d2