Pull landlock fixes from Mickaël Salaün: "This fixes TCP handling, tests, documentation, non-audit elided code, and minor cosmetic changes" * tag 'landlock-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux: landlock: Clarify documentation for the IOCTL access right selftests/landlock: Properly close a file descriptor landlock: Improve the comment for domain_is_scoped selftests/landlock: Use scoped_base_variants.h for ptrace_test selftests/landlock: Fix missing semicolon selftests/landlock: Fix typo in fs_test landlock: Optimize stack usage when !CONFIG_AUDIT landlock: Fix spelling landlock: Clean up hook_ptrace_access_check() landlock: Improve erratum documentation landlock: Remove useless include landlock: Fix wrong type usage selftests/landlock: NULL-terminate unix pathname addresses selftests/landlock: Remove invalid unix socket bind() selftests/landlock: Add missing connect(minimal AF_UNSPEC) test selftests/landlock: Fix TCP bind(AF_UNSPEC) test case landlock: Fix TCP handling of short AF_UNSPEC addresses landlock: Fix formatting
Showing the changes to include/uapi/linux (1 of 14 files). Show all
Unified · Split
| @@ -216,6 +216,23 @@ struct landlock_net_port_attr { · 215 unmodified lines | ||
| 216 | 216 | * :manpage:`ftruncate(2)`, :manpage:`creat(2)`, or :manpage:`open(2)` with |
| 217 | 217 | * ``O_TRUNC``. This access right is available since the third version of the |
| 218 | 218 | * Landlock ABI. |
| 219 | + * - %LANDLOCK_ACCESS_FS_IOCTL_DEV: Invoke :manpage:`ioctl(2)` commands on an opened | |
| 220 | + * character or block device. | |
| 221 | + * | |
| 222 | + * This access right applies to all `ioctl(2)` commands implemented by device | |
| 223 | + * drivers. However, the following common IOCTL commands continue to be | |
| 224 | + * invokable independent of the %LANDLOCK_ACCESS_FS_IOCTL_DEV right: | |
| 225 | + * | |
| 226 | + * * IOCTL commands targeting file descriptors (``FIOCLEX``, ``FIONCLEX``), | |
| 227 | + * * IOCTL commands targeting file descriptions (``FIONBIO``, ``FIOASYNC``), | |
| 228 | + * * IOCTL commands targeting file systems (``FIFREEZE``, ``FITHAW``, | |
| 229 | + * ``FIGETBSZ``, ``FS_IOC_GETFSUUID``, ``FS_IOC_GETFSSYSFSPATH``) | |
| 230 | + * * Some IOCTL commands which do not make sense when used with devices, but | |
| 231 | + * whose implementations are safe and return the right error codes | |
| 232 | + * (``FS_IOC_FIEMAP``, ``FICLONE``, ``FICLONERANGE``, ``FIDEDUPERANGE``) | |
| 233 | + * | |
| 234 | + * This access right is available since the fifth version of the Landlock | |
| 235 | + * ABI. | |
| 219 | 236 | * |
| 220 | 237 | * Whether an opened file can be truncated with :manpage:`ftruncate(2)` or used |
| 221 | 238 | * with `ioctl(2)` is determined during :manpage:`open(2)`, in the same way as |
| @@ -275,26 +292,6 @@ struct landlock_net_port_attr { · 53 unmodified lines | ||
| 275 | 292 | * If multiple requirements are not met, the ``EACCES`` error code takes |
| 276 | 293 | * precedence over ``EXDEV``. |
| 277 | 294 | * |
| 278 | − * The following access right applies both to files and directories: | |
| 279 | − * | |
| 280 | − * - %LANDLOCK_ACCESS_FS_IOCTL_DEV: Invoke :manpage:`ioctl(2)` commands on an opened | |
| 281 | − * character or block device. | |
| 282 | − * | |
| 283 | − * This access right applies to all `ioctl(2)` commands implemented by device | |
| 284 | − * drivers. However, the following common IOCTL commands continue to be | |
| 285 | − * invokable independent of the %LANDLOCK_ACCESS_FS_IOCTL_DEV right: | |
| 286 | − * | |
| 287 | − * * IOCTL commands targeting file descriptors (``FIOCLEX``, ``FIONCLEX``), | |
| 288 | − * * IOCTL commands targeting file descriptions (``FIONBIO``, ``FIOASYNC``), | |
| 289 | − * * IOCTL commands targeting file systems (``FIFREEZE``, ``FITHAW``, | |
| 290 | − * ``FIGETBSZ``, ``FS_IOC_GETFSUUID``, ``FS_IOC_GETFSSYSFSPATH``) | |
| 291 | − * * Some IOCTL commands which do not make sense when used with devices, but | |
| 292 | − * whose implementations are safe and return the right error codes | |
| 293 | − * (``FS_IOC_FIEMAP``, ``FICLONE``, ``FICLONERANGE``, ``FIDEDUPERANGE``) | |
| 294 | − * | |
| 295 | − * This access right is available since the fifth version of the Landlock | |
| 296 | − * ABI. | |
| 297 | − * | |
| 298 | 295 | * .. warning:: |
| 299 | 296 | * |
| 300 | 297 | * It is currently not possible to restrict some file-related actions |