Cross-merge bpf and other fixes after downstream PRs. No conflicts.
Showing the changes to include/uapi/linux (3 of 288 files). Show all
Unified · Split
| @@ -53,43 +53,70 @@ struct landlock_ruleset_attr { · 52 unmodified lines | |||
| 53 | __u64 scoped; | 53 | __u64 scoped; |
| 54 | }; | 54 | }; |
| 55 | 55 | ||
| 56 | /* | 56 | /** |
| 57 | * sys_landlock_create_ruleset() flags: | 57 | * DOC: landlock_create_ruleset_flags |
| 58 | * | ||
| 59 | * **Flags** | ||
| 58 | * | 60 | * |
| 59 | * - %LANDLOCK_CREATE_RULESET_VERSION: Get the highest supported Landlock ABI | 61 | * %LANDLOCK_CREATE_RULESET_VERSION |
| 60 | * version. | 62 | * Get the highest supported Landlock ABI version (starting at 1). |
| 61 | * - %LANDLOCK_CREATE_RULESET_ERRATA: Get a bitmask of fixed issues. | 63 | * |
| 64 | * %LANDLOCK_CREATE_RULESET_ERRATA | ||
| 65 | * Get a bitmask of fixed issues for the current Landlock ABI version. | ||
| 62 | */ | 66 | */ |
| 63 | /* clang-format off */ | 67 | /* clang-format off */ |
| 64 | #define LANDLOCK_CREATE_RULESET_VERSION (1U << 0) | 68 | #define LANDLOCK_CREATE_RULESET_VERSION (1U << 0) |
| 65 | #define LANDLOCK_CREATE_RULESET_ERRATA (1U << 1) | 69 | #define LANDLOCK_CREATE_RULESET_ERRATA (1U << 1) |
| 66 | /* clang-format on */ | 70 | /* clang-format on */ |
| 67 | 71 | ||
| 68 | /* | 72 | /** |
| 69 | * sys_landlock_restrict_self() flags: | 73 | * DOC: landlock_restrict_self_flags |
| 70 | * | 74 | * |
| 71 | * - %LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF: Do not create any log related to the | 75 | * **Flags** |
| 72 | * enforced restrictions. This should only be set by tools launching unknown | 76 | * |
| 73 | * or untrusted programs (e.g. a sandbox tool, container runtime, system | 77 | * By default, denied accesses originating from programs that sandbox themselves |
| 74 | * service manager). Because programs sandboxing themselves should fix any | 78 | * are logged via the audit subsystem. Such events typically indicate unexpected |
| 75 | * denied access, they should not set this flag to be aware of potential | 79 | * behavior, such as bugs or exploitation attempts. However, to avoid excessive |
| 76 | * issues reported by system's logs (i.e. audit). | 80 | * logging, access requests denied by a domain not created by the originating |
| 77 | * - %LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON: Explicitly ask to continue | 81 | * program are not logged by default. The rationale is that programs should know |
| 78 | * logging denied access requests even after an :manpage:`execve(2)` call. | 82 | * their own behavior, but not necessarily the behavior of other programs. This |
| 79 | * This flag should only be set if all the programs than can legitimately be | 83 | * default configuration is suitable for most programs that sandbox themselves. |
| 80 | * executed will not try to request a denied access (which could spam audit | 84 | * For specific use cases, the following flags allow programs to modify this |
| 81 | * logs). | 85 | * default logging behavior. |
| 82 | * - %LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF: Do not create any log related | 86 | * |
| 83 | * to the enforced restrictions coming from future nested domains created by | 87 | * The %LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF and |
| 84 | * the caller or its descendants. This should only be set according to a | 88 | * %LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON flags apply to the newly created |
| 85 | * runtime configuration (i.e. not hardcoded) by programs launching other | 89 | * Landlock domain. |
| 86 | * unknown or untrusted programs that may create their own Landlock domains | 90 | * |
| 87 | * and spam logs. The main use case is for container runtimes to enable users | 91 | * %LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF |
| 88 | * to mute buggy sandboxed programs for a specific container image. Other use | 92 | * Disables logging of denied accesses originating from the thread creating |
| 89 | * cases include sandboxer tools and init systems. Unlike | 93 | * the Landlock domain, as well as its children, as long as they continue |
| 90 | * %LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF, | 94 | * running the same executable code (i.e., without an intervening |
| 91 | * %LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF does not impact the requested | 95 | * :manpage:`execve(2)` call). This is intended for programs that execute |
| 92 | * restriction (if any) but only the future nested domains. | 96 | * unknown code without invoking :manpage:`execve(2)`, such as script |
| 97 | * interpreters. Programs that only sandbox themselves should not set this | ||
| 98 | * flag, so users can be notified of unauthorized access attempts via system | ||
| 99 | * logs. | ||
| 100 | * | ||
| 101 | * %LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON | ||
| 102 | * Enables logging of denied accesses after an :manpage:`execve(2)` call, | ||
| 103 | * providing visibility into unauthorized access attempts by newly executed | ||
| 104 | * programs within the created Landlock domain. This flag is recommended | ||
| 105 | * only when all potential executables in the domain are expected to comply | ||
| 106 | * with the access restrictions, as excessive audit log entries could make | ||
| 107 | * it more difficult to identify critical events. | ||
| 108 | * | ||
| 109 | * %LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF | ||
| 110 | * Disables logging of denied accesses originating from nested Landlock | ||
| 111 | * domains created by the caller or its descendants. This flag should be set | ||
| 112 | * according to runtime configuration, not hardcoded, to avoid suppressing | ||
| 113 | * important security events. It is useful for container runtimes or | ||
| 114 | * sandboxing tools that may launch programs which themselves create | ||
| 115 | * Landlock domains and could otherwise generate excessive logs. Unlike | ||
| 116 | * ``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF``, this flag only affects | ||
| 117 | * future nested domains, not the one being created. It can also be used | ||
| 118 | * with a @ruleset_fd value of -1 to mute subdomain logs without creating a | ||
| 119 | * domain. | ||
| 93 | */ | 120 | */ |
| 94 | /* clang-format off */ | 121 | /* clang-format off */ |
| 95 | #define LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF (1U << 0) | 122 | #define LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF (1U << 0) |
| @@ -28,10 +28,10 @@ · 27 unmodified lines | |||
| 28 | 28 | ||
| 29 | /* Set current process as the (exclusive) owner of this file descriptor. This | 29 | /* Set current process as the (exclusive) owner of this file descriptor. This |
| 30 | * must be called before any other vhost command. Further calls to | 30 | * must be called before any other vhost command. Further calls to |
| 31 | * VHOST_OWNER_SET fail until VHOST_OWNER_RESET is called. */ | 31 | * VHOST_SET_OWNER fail until VHOST_RESET_OWNER is called. */ |
| 32 | #define VHOST_SET_OWNER _IO(VHOST_VIRTIO, 0x01) | 32 | #define VHOST_SET_OWNER _IO(VHOST_VIRTIO, 0x01) |
| 33 | /* Give up ownership, and reset the device to default values. | 33 | /* Give up ownership, and reset the device to default values. |
| 34 | * Allows subsequent call to VHOST_OWNER_SET to succeed. */ | 34 | * Allows subsequent call to VHOST_SET_OWNER to succeed. */ |
| 35 | #define VHOST_RESET_OWNER _IO(VHOST_VIRTIO, 0x02) | 35 | #define VHOST_RESET_OWNER _IO(VHOST_VIRTIO, 0x02) |
| 36 | 36 | ||
| 37 | /* Set up/modify memory layout */ | 37 | /* Set up/modify memory layout */ |
| @@ -246,6 +246,7 @@ struct virtio_pci_cfg_cap { · 245 unmodified lines | |||
| 246 | #define VIRTIO_ADMIN_CMD_LIST_USE 0x1 | 246 | #define VIRTIO_ADMIN_CMD_LIST_USE 0x1 |
| 247 | 247 | ||
| 248 | /* Admin command group type. */ | 248 | /* Admin command group type. */ |
| 249 | #define VIRTIO_ADMIN_GROUP_TYPE_SELF 0x0 | ||
| 249 | #define VIRTIO_ADMIN_GROUP_TYPE_SRIOV 0x1 | 250 | #define VIRTIO_ADMIN_GROUP_TYPE_SRIOV 0x1 |
| 250 | 251 | ||
| 251 | /* Transitional device admin command. */ | 252 | /* Transitional device admin command. */ |