Pull landlock fixes from Mickaël Salaün: "This fixes TCP handling, tests, documentation, non-audit elided code, and minor cosmetic changes" * tag 'landlock-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux: landlock: Clarify documentation for the IOCTL access right selftests/landlock: Properly close a file descriptor landlock: Improve the comment for domain_is_scoped selftests/landlock: Use scoped_base_variants.h for ptrace_test selftests/landlock: Fix missing semicolon selftests/landlock: Fix typo in fs_test landlock: Optimize stack usage when !CONFIG_AUDIT landlock: Fix spelling landlock: Clean up hook_ptrace_access_check() landlock: Improve erratum documentation landlock: Remove useless include landlock: Fix wrong type usage selftests/landlock: NULL-terminate unix pathname addresses selftests/landlock: Remove invalid unix socket bind() selftests/landlock: Add missing connect(minimal AF_UNSPEC) test selftests/landlock: Fix TCP bind(AF_UNSPEC) test case landlock: Fix TCP handling of short AF_UNSPEC addresses landlock: Fix formatting
Showing the changes to include/uapi/linux (1 of 14 files). Show all
Unified · Split
| @@ -216,6 +216,23 @@ struct landlock_net_port_attr { · 215 unmodified lines | |||
| 216 | * :manpage:`ftruncate(2)`, :manpage:`creat(2)`, or :manpage:`open(2)` with | 216 | * :manpage:`ftruncate(2)`, :manpage:`creat(2)`, or :manpage:`open(2)` with |
| 217 | * ``O_TRUNC``. This access right is available since the third version of the | 217 | * ``O_TRUNC``. This access right is available since the third version of the |
| 218 | * Landlock ABI. | 218 | * Landlock ABI. |
| 219 | * - %LANDLOCK_ACCESS_FS_IOCTL_DEV: Invoke :manpage:`ioctl(2)` commands on an opened | ||
| 220 | * character or block device. | ||
| 221 | * | ||
| 222 | * This access right applies to all `ioctl(2)` commands implemented by device | ||
| 223 | * drivers. However, the following common IOCTL commands continue to be | ||
| 224 | * invokable independent of the %LANDLOCK_ACCESS_FS_IOCTL_DEV right: | ||
| 225 | * | ||
| 226 | * * IOCTL commands targeting file descriptors (``FIOCLEX``, ``FIONCLEX``), | ||
| 227 | * * IOCTL commands targeting file descriptions (``FIONBIO``, ``FIOASYNC``), | ||
| 228 | * * IOCTL commands targeting file systems (``FIFREEZE``, ``FITHAW``, | ||
| 229 | * ``FIGETBSZ``, ``FS_IOC_GETFSUUID``, ``FS_IOC_GETFSSYSFSPATH``) | ||
| 230 | * * Some IOCTL commands which do not make sense when used with devices, but | ||
| 231 | * whose implementations are safe and return the right error codes | ||
| 232 | * (``FS_IOC_FIEMAP``, ``FICLONE``, ``FICLONERANGE``, ``FIDEDUPERANGE``) | ||
| 233 | * | ||
| 234 | * This access right is available since the fifth version of the Landlock | ||
| 235 | * ABI. | ||
| 219 | * | 236 | * |
| 220 | * Whether an opened file can be truncated with :manpage:`ftruncate(2)` or used | 237 | * Whether an opened file can be truncated with :manpage:`ftruncate(2)` or used |
| 221 | * with `ioctl(2)` is determined during :manpage:`open(2)`, in the same way as | 238 | * with `ioctl(2)` is determined during :manpage:`open(2)`, in the same way as |
| @@ -275,26 +292,6 @@ struct landlock_net_port_attr { · 53 unmodified lines | |||
| 275 | * If multiple requirements are not met, the ``EACCES`` error code takes | 292 | * If multiple requirements are not met, the ``EACCES`` error code takes |
| 276 | * precedence over ``EXDEV``. | 293 | * precedence over ``EXDEV``. |
| 277 | * | 294 | * |
| 278 | * The following access right applies both to files and directories: | ||
| 279 | * | ||
| 280 | * - %LANDLOCK_ACCESS_FS_IOCTL_DEV: Invoke :manpage:`ioctl(2)` commands on an opened | ||
| 281 | * character or block device. | ||
| 282 | * | ||
| 283 | * This access right applies to all `ioctl(2)` commands implemented by device | ||
| 284 | * drivers. However, the following common IOCTL commands continue to be | ||
| 285 | * invokable independent of the %LANDLOCK_ACCESS_FS_IOCTL_DEV right: | ||
| 286 | * | ||
| 287 | * * IOCTL commands targeting file descriptors (``FIOCLEX``, ``FIONCLEX``), | ||
| 288 | * * IOCTL commands targeting file descriptions (``FIONBIO``, ``FIOASYNC``), | ||
| 289 | * * IOCTL commands targeting file systems (``FIFREEZE``, ``FITHAW``, | ||
| 290 | * ``FIGETBSZ``, ``FS_IOC_GETFSUUID``, ``FS_IOC_GETFSSYSFSPATH``) | ||
| 291 | * * Some IOCTL commands which do not make sense when used with devices, but | ||
| 292 | * whose implementations are safe and return the right error codes | ||
| 293 | * (``FS_IOC_FIEMAP``, ``FICLONE``, ``FICLONERANGE``, ``FIDEDUPERANGE``) | ||
| 294 | * | ||
| 295 | * This access right is available since the fifth version of the Landlock | ||
| 296 | * ABI. | ||
| 297 | * | ||
| 298 | * .. warning:: | 295 | * .. warning:: |
| 299 | * | 296 | * |
| 300 | * It is currently not possible to restrict some file-related actions | 297 | * It is currently not possible to restrict some file-related actions |