Pull Landlock update from Mickaël Salaün: "This adds a new Landlock access right for pathname UNIX domain sockets thanks to a new LSM hook, and a few fixes" * tag 'landlock-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux: (23 commits) landlock: Document fallocate(2) as another truncation corner case landlock: Document FS access right for pathname UNIX sockets selftests/landlock: Simplify ruleset creation and enforcement in fs_test selftests/landlock: Check that coredump sockets stay unrestricted selftests/landlock: Audit test for LANDLOCK_ACCESS_FS_RESOLVE_UNIX selftests/landlock: Test LANDLOCK_ACCESS_FS_RESOLVE_UNIX selftests/landlock: Replace access_fs_16 with ACCESS_ALL in fs_test samples/landlock: Add support for named UNIX domain socket restrictions landlock: Clarify BUILD_BUG_ON check in scoping logic landlock: Control pathname UNIX domain socket resolution by path landlock: Use mem_is_zero() in is_layer_masks_allowed() lsm: Add LSM hook security_unix_find landlock: Fix kernel-doc warning for pointer-to-array parameters landlock: Fix formatting in tsync.c landlock: Improve kernel-doc "Return:" section consistency landlock: Add missing kernel-doc "Return:" sections selftests/landlock: Fix format warning for __u64 in net_test selftests/landlock: Skip stale records in audit_match_record() selftests/landlock: Drain stale audit records on init selftests/landlock: Fix socket file descriptor leaks in audit helpers ...
Showing the changes to include/uapi/linux (1 of 29 files). Show all
Unified · Split
| @@ -116,7 +116,9 @@ struct landlock_ruleset_attr { · 115 unmodified lines | ||
| 116 | 116 | * ``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF``, this flag only affects |
| 117 | 117 | * future nested domains, not the one being created. It can also be used |
| 118 | 118 | * with a @ruleset_fd value of -1 to mute subdomain logs without creating a |
| 119 | − * domain. | |
| 119 | + * domain. When combined with %LANDLOCK_RESTRICT_SELF_TSYNC and a | |
| 120 | + * @ruleset_fd value of -1, this configuration is propagated to all threads | |
| 121 | + * of the current process. | |
| 120 | 122 | * |
| 121 | 123 | * The following flag supports policy enforcement in multithreaded processes: |
| 122 | 124 | * |
| @@ -248,6 +250,26 @@ struct landlock_net_port_attr { · 125 unmodified lines | ||
| 248 | 250 | * |
| 249 | 251 | * This access right is available since the fifth version of the Landlock |
| 250 | 252 | * ABI. |
| 253 | + * - %LANDLOCK_ACCESS_FS_RESOLVE_UNIX: Look up pathname UNIX domain sockets | |
| 254 | + * (:manpage:`unix(7)`). On UNIX domain sockets, this restricts both calls to | |
| 255 | + * :manpage:`connect(2)` as well as calls to :manpage:`sendmsg(2)` with an | |
| 256 | + * explicit recipient address. | |
| 257 | + * | |
| 258 | + * This access right only applies to connections to UNIX server sockets which | |
| 259 | + * were created outside of the newly created Landlock domain (e.g. from within | |
| 260 | + * a parent domain or from an unrestricted process). Newly created UNIX | |
| 261 | + * servers within the same Landlock domain continue to be accessible. In this | |
| 262 | + * regard, %LANDLOCK_ACCESS_FS_RESOLVE_UNIX has the same semantics as the | |
| 263 | + * ``LANDLOCK_SCOPE_*`` flags. | |
| 264 | + * | |
| 265 | + * If a resolve attempt is denied, the operation returns an ``EACCES`` error, | |
| 266 | + * in line with other filesystem access rights (but different to denials for | |
| 267 | + * abstract UNIX domain sockets). | |
| 268 | + * | |
| 269 | + * This access right is available since the ninth version of the Landlock ABI. | |
| 270 | + * | |
| 271 | + * The rationale for this design is described in | |
| 272 | + * :ref:`Documentation/security/landlock.rst <scoped-flags-interaction>`. | |
| 251 | 273 | * |
| 252 | 274 | * Whether an opened file can be truncated with :manpage:`ftruncate(2)` or used |
| 253 | 275 | * with `ioctl(2)` is determined during :manpage:`open(2)`, in the same way as |
| @@ -333,6 +355,7 @@ struct landlock_net_port_attr { · 79 unmodified lines | ||
| 333 | 355 | #define LANDLOCK_ACCESS_FS_REFER (1ULL << 13) |
| 334 | 356 | #define LANDLOCK_ACCESS_FS_TRUNCATE (1ULL << 14) |
| 335 | 357 | #define LANDLOCK_ACCESS_FS_IOCTL_DEV (1ULL << 15) |
| 358 | +#define LANDLOCK_ACCESS_FS_RESOLVE_UNIX (1ULL << 16) | |
| 336 | 359 | /* clang-format on */ |
| 337 | 360 | |
| 338 | 361 | /** |