Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf after rc4

Cross-merge bpf and other fixes after downstream PRs. No conflicts.

Alexei Starovoitov committed 1 year ago

Commit 224ee862 parents 91dbac4 b443265288 files · +3369 −2043Browse files

Showing the changes to include/uapi (3 of 288 files). Show all

Unified · Split

3 files

include/uapi/linux/landlock.h +57 −30
include/uapi/linux/vhost.h +2 −2
include/uapi/linux/virtio_pci.h +1 −0

@@ -53,43 +53,70 @@ struct landlock_ruleset_attr { · 52 unmodified lines
53	53	__u64 scoped;
54	54	};
55	55
56		−/*
57		− * sys_landlock_create_ruleset() flags:
	56	+/**
	57	+ * DOC: landlock_create_ruleset_flags
	58	+ *
	59	+ * Flags
58	60	*
59		− * - %LANDLOCK_CREATE_RULESET_VERSION: Get the highest supported Landlock ABI
60		− * version.
61		− * - %LANDLOCK_CREATE_RULESET_ERRATA: Get a bitmask of fixed issues.
	61	+ * %LANDLOCK_CREATE_RULESET_VERSION
	62	+ * Get the highest supported Landlock ABI version (starting at 1).
	63	+ *
	64	+ * %LANDLOCK_CREATE_RULESET_ERRATA
	65	+ * Get a bitmask of fixed issues for the current Landlock ABI version.
62	66	*/
63	67	/* clang-format off */
64	68	#define LANDLOCK_CREATE_RULESET_VERSION (1U << 0)
65	69	#define LANDLOCK_CREATE_RULESET_ERRATA (1U << 1)
66	70	/* clang-format on */
67	71
68		−/*
69		− * sys_landlock_restrict_self() flags:
70		− *
71		− * - %LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF: Do not create any log related to the
72		− * enforced restrictions. This should only be set by tools launching unknown
73		− * or untrusted programs (e.g. a sandbox tool, container runtime, system
74		− * service manager). Because programs sandboxing themselves should fix any
75		− * denied access, they should not set this flag to be aware of potential
76		− * issues reported by system's logs (i.e. audit).
77		− * - %LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON: Explicitly ask to continue
78		− * logging denied access requests even after an :manpage:`execve(2)` call.
79		− * This flag should only be set if all the programs than can legitimately be
80		− * executed will not try to request a denied access (which could spam audit
81		− * logs).
82		− * - %LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF: Do not create any log related
83		− * to the enforced restrictions coming from future nested domains created by
84		− * the caller or its descendants. This should only be set according to a
85		− * runtime configuration (i.e. not hardcoded) by programs launching other
86		− * unknown or untrusted programs that may create their own Landlock domains
87		− * and spam logs. The main use case is for container runtimes to enable users
88		− * to mute buggy sandboxed programs for a specific container image. Other use
89		− * cases include sandboxer tools and init systems. Unlike
90		− * %LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF,
91		− * %LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF does not impact the requested
92		− * restriction (if any) but only the future nested domains.
	72	+/**
	73	+ * DOC: landlock_restrict_self_flags
	74	+ *
	75	+ * Flags
	76	+ *
	77	+ * By default, denied accesses originating from programs that sandbox themselves
	78	+ * are logged via the audit subsystem. Such events typically indicate unexpected
	79	+ * behavior, such as bugs or exploitation attempts. However, to avoid excessive
	80	+ * logging, access requests denied by a domain not created by the originating
	81	+ * program are not logged by default. The rationale is that programs should know
	82	+ * their own behavior, but not necessarily the behavior of other programs. This
	83	+ * default configuration is suitable for most programs that sandbox themselves.
	84	+ * For specific use cases, the following flags allow programs to modify this
	85	+ * default logging behavior.
	86	+ *
	87	+ * The %LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF and
	88	+ * %LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON flags apply to the newly created
	89	+ * Landlock domain.
	90	+ *
	91	+ * %LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF
	92	+ * Disables logging of denied accesses originating from the thread creating
	93	+ * the Landlock domain, as well as its children, as long as they continue
	94	+ * running the same executable code (i.e., without an intervening
	95	+ * :manpage:`execve(2)` call). This is intended for programs that execute
	96	+ * unknown code without invoking :manpage:`execve(2)`, such as script
	97	+ * interpreters. Programs that only sandbox themselves should not set this
	98	+ * flag, so users can be notified of unauthorized access attempts via system
	99	+ * logs.
	100	+ *
	101	+ * %LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON
	102	+ * Enables logging of denied accesses after an :manpage:`execve(2)` call,
	103	+ * providing visibility into unauthorized access attempts by newly executed
	104	+ * programs within the created Landlock domain. This flag is recommended
	105	+ * only when all potential executables in the domain are expected to comply
	106	+ * with the access restrictions, as excessive audit log entries could make
	107	+ * it more difficult to identify critical events.
	108	+ *
	109	+ * %LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF
	110	+ * Disables logging of denied accesses originating from nested Landlock
	111	+ * domains created by the caller or its descendants. This flag should be set
	112	+ * according to runtime configuration, not hardcoded, to avoid suppressing
	113	+ * important security events. It is useful for container runtimes or
	114	+ * sandboxing tools that may launch programs which themselves create
	115	+ * Landlock domains and could otherwise generate excessive logs. Unlike
	116	+ * ``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF``, this flag only affects
	117	+ * future nested domains, not the one being created. It can also be used
	118	+ * with a @ruleset_fd value of -1 to mute subdomain logs without creating a
	119	+ * domain.
93	120	*/
94	121	/* clang-format off */
95	122	#define LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF (1U << 0)

include/uapi/linux/vhost.h+2−2

@@ -28,10 +28,10 @@ · 27 unmodified lines
28	28
29	29	/* Set current process as the (exclusive) owner of this file descriptor. This
30	30	* must be called before any other vhost command. Further calls to
31		− * VHOST_OWNER_SET fail until VHOST_OWNER_RESET is called. */
	31	+ * VHOST_SET_OWNER fail until VHOST_RESET_OWNER is called. */
32	32	#define VHOST_SET_OWNER _IO(VHOST_VIRTIO, 0x01)
33	33	/* Give up ownership, and reset the device to default values.
34		− * Allows subsequent call to VHOST_OWNER_SET to succeed. */
	34	+ * Allows subsequent call to VHOST_SET_OWNER to succeed. */
35	35	#define VHOST_RESET_OWNER _IO(VHOST_VIRTIO, 0x02)
36	36
37	37	/* Set up/modify memory layout */

include/uapi/linux/virtio_pci.h+1−0

@@ -246,6 +246,7 @@ struct virtio_pci_cfg_cap { · 245 unmodified lines
246	246	#define VIRTIO_ADMIN_CMD_LIST_USE 0x1
247	247
248	248	/* Admin command group type. */
	249	+#define VIRTIO_ADMIN_GROUP_TYPE_SELF 0x0
249	250	#define VIRTIO_ADMIN_GROUP_TYPE_SRIOV 0x1
250	251
251	252	/* Transitional device admin command. */