Pull Landlock update from Mickaël Salaün: "This adds a new Landlock access right for pathname UNIX domain sockets thanks to a new LSM hook, and a few fixes" * tag 'landlock-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux: (23 commits) landlock: Document fallocate(2) as another truncation corner case landlock: Document FS access right for pathname UNIX sockets selftests/landlock: Simplify ruleset creation and enforcement in fs_test selftests/landlock: Check that coredump sockets stay unrestricted selftests/landlock: Audit test for LANDLOCK_ACCESS_FS_RESOLVE_UNIX selftests/landlock: Test LANDLOCK_ACCESS_FS_RESOLVE_UNIX selftests/landlock: Replace access_fs_16 with ACCESS_ALL in fs_test samples/landlock: Add support for named UNIX domain socket restrictions landlock: Clarify BUILD_BUG_ON check in scoping logic landlock: Control pathname UNIX domain socket resolution by path landlock: Use mem_is_zero() in is_layer_masks_allowed() lsm: Add LSM hook security_unix_find landlock: Fix kernel-doc warning for pointer-to-array parameters landlock: Fix formatting in tsync.c landlock: Improve kernel-doc "Return:" section consistency landlock: Add missing kernel-doc "Return:" sections selftests/landlock: Fix format warning for __u64 in net_test selftests/landlock: Skip stale records in audit_match_record() selftests/landlock: Drain stale audit records on init selftests/landlock: Fix socket file descriptor leaks in audit helpers ...
Showing the changes to include/uapi/linux (1 of 29 files). Show all
Unified · Split
| @@ -116,7 +116,9 @@ struct landlock_ruleset_attr { · 115 unmodified lines | |||
| 116 | * ``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF``, this flag only affects | 116 | * ``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF``, this flag only affects |
| 117 | * future nested domains, not the one being created. It can also be used | 117 | * future nested domains, not the one being created. It can also be used |
| 118 | * with a @ruleset_fd value of -1 to mute subdomain logs without creating a | 118 | * with a @ruleset_fd value of -1 to mute subdomain logs without creating a |
| 119 | * domain. | 119 | * domain. When combined with %LANDLOCK_RESTRICT_SELF_TSYNC and a |
| 120 | * @ruleset_fd value of -1, this configuration is propagated to all threads | ||
| 121 | * of the current process. | ||
| 120 | * | 122 | * |
| 121 | * The following flag supports policy enforcement in multithreaded processes: | 123 | * The following flag supports policy enforcement in multithreaded processes: |
| 122 | * | 124 | * |
| @@ -248,6 +250,26 @@ struct landlock_net_port_attr { · 125 unmodified lines | |||
| 248 | * | 250 | * |
| 249 | * This access right is available since the fifth version of the Landlock | 251 | * This access right is available since the fifth version of the Landlock |
| 250 | * ABI. | 252 | * ABI. |
| 253 | * - %LANDLOCK_ACCESS_FS_RESOLVE_UNIX: Look up pathname UNIX domain sockets | ||
| 254 | * (:manpage:`unix(7)`). On UNIX domain sockets, this restricts both calls to | ||
| 255 | * :manpage:`connect(2)` as well as calls to :manpage:`sendmsg(2)` with an | ||
| 256 | * explicit recipient address. | ||
| 257 | * | ||
| 258 | * This access right only applies to connections to UNIX server sockets which | ||
| 259 | * were created outside of the newly created Landlock domain (e.g. from within | ||
| 260 | * a parent domain or from an unrestricted process). Newly created UNIX | ||
| 261 | * servers within the same Landlock domain continue to be accessible. In this | ||
| 262 | * regard, %LANDLOCK_ACCESS_FS_RESOLVE_UNIX has the same semantics as the | ||
| 263 | * ``LANDLOCK_SCOPE_*`` flags. | ||
| 264 | * | ||
| 265 | * If a resolve attempt is denied, the operation returns an ``EACCES`` error, | ||
| 266 | * in line with other filesystem access rights (but different to denials for | ||
| 267 | * abstract UNIX domain sockets). | ||
| 268 | * | ||
| 269 | * This access right is available since the ninth version of the Landlock ABI. | ||
| 270 | * | ||
| 271 | * The rationale for this design is described in | ||
| 272 | * :ref:`Documentation/security/landlock.rst <scoped-flags-interaction>`. | ||
| 251 | * | 273 | * |
| 252 | * Whether an opened file can be truncated with :manpage:`ftruncate(2)` or used | 274 | * Whether an opened file can be truncated with :manpage:`ftruncate(2)` or used |
| 253 | * with `ioctl(2)` is determined during :manpage:`open(2)`, in the same way as | 275 | * with `ioctl(2)` is determined during :manpage:`open(2)`, in the same way as |
| @@ -333,6 +355,7 @@ struct landlock_net_port_attr { · 79 unmodified lines | |||
| 333 | #define LANDLOCK_ACCESS_FS_REFER (1ULL << 13) | 355 | #define LANDLOCK_ACCESS_FS_REFER (1ULL << 13) |
| 334 | #define LANDLOCK_ACCESS_FS_TRUNCATE (1ULL << 14) | 356 | #define LANDLOCK_ACCESS_FS_TRUNCATE (1ULL << 14) |
| 335 | #define LANDLOCK_ACCESS_FS_IOCTL_DEV (1ULL << 15) | 357 | #define LANDLOCK_ACCESS_FS_IOCTL_DEV (1ULL << 15) |
| 358 | #define LANDLOCK_ACCESS_FS_RESOLVE_UNIX (1ULL << 16) | ||
| 336 | /* clang-format on */ | 359 | /* clang-format on */ |
| 337 | 360 | ||
| 338 | /** | 361 | /** |