* [GIT PULL] Landlock changes for v5.19
@ 2022-05-23 16:12 Mickaël Salaün
2022-05-24 20:26 ` pr-tracker-bot
0 siblings, 1 reply; 4+ messages in thread
From: Mickaël Salaün @ 2022-05-23 16:12 UTC (permalink / raw)
To: Linus Torvalds
Cc: Mickaël Salaün, Alejandro Colomar, John Johansen,
Miguel Ojeda, Paul Moore, Tetsuo Handa, linux-kernel,
linux-security-module
Hi Linus,
Please pull these Landlock changes for v5.19-rc1 . These 30 commits
have been successfully tested in the latest linux-next releases for
several weeks, and with syzkaller:
https://github.com/google/syzkaller/pull/3133
Regards,
Mickaël
--
The following changes since commit 672c0c5173427e6b3e2a9bbb7be51ceeec78093a:
Linux 5.18-rc5 (2022-05-01 13:57:58 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux.git tags/landlock-5.19-rc1
for you to fetch changes up to 5e469829baa1b1320e843adf3631edef1d6d2cf2:
landlock: Explain how to support Landlock (2022-05-23 13:28:03 +0200)
----------------------------------------------------------------
Landlock updates for v5.19-rc1
Important changes:
* improve the path_rename LSM hook implementations for RENAME_EXCHANGE;
* fix a too-restrictive filesystem control for a rare corner case;
* set the nested sandbox limitation to 16 layers;
* add a new LANDLOCK_ACCESS_FS_REFER access right to properly handle
file reparenting (i.e. full rename and link support);
* add new tests and documentation;
* format code with clang-format to make it easier to maintain and
contribute.
Related patch series:
* [PATCH v1 0/7] Landlock: Clean up coding style with clang-format
https://lore.kernel.org/r/20220506160513.523257-1-mic@digikod.net
* [PATCH v2 00/10] Minor Landlock fixes and new tests
https://lore.kernel.org/r/20220506160820.524344-1-mic@digikod.net
* [PATCH v3 00/12] Landlock: file linking and renaming support
https://lore.kernel.org/r/20220506161102.525323-1-mic@digikod.net
* [PATCH v2] landlock: Explain how to support Landlock
https://lore.kernel.org/r/20220513112743.156414-1-mic@digikod.net
----------------------------------------------------------------
Mickaël Salaün (30):
landlock: Add clang-format exceptions
landlock: Format with clang-format
selftests/landlock: Add clang-format exceptions
selftests/landlock: Normalize array assignment
selftests/landlock: Format with clang-format
samples/landlock: Add clang-format exceptions
samples/landlock: Format with clang-format
landlock: Fix landlock_add_rule(2) documentation
selftests/landlock: Make tests build with old libc
selftests/landlock: Extend tests for minimal valid attribute size
selftests/landlock: Add tests for unknown access rights
selftests/landlock: Extend access right tests to directories
selftests/landlock: Fully test file rename with "remove" access
selftests/landlock: Add tests for O_PATH
landlock: Change landlock_add_rule(2) argument check ordering
landlock: Change landlock_restrict_self(2) check ordering
selftests/landlock: Test landlock_create_ruleset(2) argument check ordering
landlock: Define access_mask_t to enforce a consistent access mask size
landlock: Reduce the maximum number of layers to 16
landlock: Create find_rule() from unmask_layers()
landlock: Fix same-layer rule unions
landlock: Move filesystem helpers and add a new one
LSM: Remove double path_rename hook calls for RENAME_EXCHANGE
landlock: Add support for file reparenting with LANDLOCK_ACCESS_FS_REFER
selftests/landlock: Add 11 new test suites dedicated to file reparenting
samples/landlock: Add support for file reparenting
landlock: Document LANDLOCK_ACCESS_FS_REFER and ABI versioning
landlock: Document good practices about filesystem policies
landlock: Add design choices documentation for filesystem access rights
landlock: Explain how to support Landlock
Documentation/security/landlock.rst | 17 +-
Documentation/userspace-api/landlock.rst | 180 ++-
include/linux/lsm_hook_defs.h | 2 +-
include/linux/lsm_hooks.h | 1 +
include/uapi/linux/landlock.h | 36 +-
samples/landlock/sandboxer.c | 132 +-
security/apparmor/lsm.c | 30 +-
security/landlock/cred.c | 4 +-
security/landlock/cred.h | 8 +-
security/landlock/fs.c | 815 +++++++++---
security/landlock/fs.h | 11 +-
security/landlock/limits.h | 10 +-
security/landlock/object.c | 6 +-
security/landlock/object.h | 6 +-
security/landlock/ptrace.c | 10 +-
security/landlock/ruleset.c | 84 +-
security/landlock/ruleset.h | 35 +-
security/landlock/syscalls.c | 95 +-
security/security.c | 9 +-
security/tomoyo/tomoyo.c | 11 +-
tools/testing/selftests/landlock/base_test.c | 179 ++-
tools/testing/selftests/landlock/common.h | 66 +-
tools/testing/selftests/landlock/fs_test.c | 1619 +++++++++++++++++++-----
tools/testing/selftests/landlock/ptrace_test.c | 40 +-
24 files changed, 2646 insertions(+), 760 deletions(-)
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [GIT PULL] Landlock changes for v5.19
2022-05-23 16:12 [GIT PULL] Landlock changes for v5.19 Mickaël Salaün
@ 2022-05-24 20:26 ` pr-tracker-bot
2022-06-03 16:35 ` Alejandro Colomar
0 siblings, 1 reply; 4+ messages in thread
From: pr-tracker-bot @ 2022-05-24 20:26 UTC (permalink / raw)
To: Mickaël Salaün
Cc: Linus Torvalds, Mickaël Salaün, Alejandro Colomar,
John Johansen, Miguel Ojeda, Paul Moore, Tetsuo Handa,
linux-kernel, linux-security-module
The pull request you sent on Mon, 23 May 2022 18:12:45 +0200:
> git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux.git tags/landlock-5.19-rc1
has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/cb44e4f061e16be65b8a16505e121490c66d30d0
Thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/prtracker.html
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [GIT PULL] Landlock changes for v5.19
2022-05-24 20:26 ` pr-tracker-bot
@ 2022-06-03 16:35 ` Alejandro Colomar
2022-06-15 7:35 ` Mickaël Salaün
0 siblings, 1 reply; 4+ messages in thread
From: Alejandro Colomar @ 2022-06-03 16:35 UTC (permalink / raw)
To: Mickaël Salaün; +Cc: linux-man
[-- Attachment #1.1: Type: text/plain, Size: 736 bytes --]
Hi Mickaël,
On 5/24/22 22:26, pr-tracker-bot@kernel.org wrote:
> The pull request you sent on Mon, 23 May 2022 18:12:45 +0200:
>
>> git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux.git tags/landlock-5.19-rc1
>
> has been merged into torvalds/linux.git:
> https://git.kernel.org/torvalds/c/cb44e4f061e16be65b8a16505e121490c66d30d0
>
Do we need any update in the manual page? Is this already covered by
patches that I applied from you?
The latest one I have applied from you regarding landlock is
<http://www.alejandro-colomar.es/src/alx/linux/man-pages/man-pages.git/commit/?id=38454e3fcd7876dcd3441f4bb86246b9f3b8f9da>.
Cheers,
Alex
--
Alejandro Colomar
<http://www.alejandro-colomar.es/>
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [GIT PULL] Landlock changes for v5.19
2022-06-03 16:35 ` Alejandro Colomar
@ 2022-06-15 7:35 ` Mickaël Salaün
0 siblings, 0 replies; 4+ messages in thread
From: Mickaël Salaün @ 2022-06-15 7:35 UTC (permalink / raw)
To: Alejandro Colomar; +Cc: linux-man, landlock
Hi Alex,
On 03/06/2022 18:35, Alejandro Colomar wrote:
> Hi Mickaël,
>
> On 5/24/22 22:26, pr-tracker-bot@kernel.org wrote:
>> The pull request you sent on Mon, 23 May 2022 18:12:45 +0200:
>>
>>> git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux.git
>>> tags/landlock-5.19-rc1
>>
>> has been merged into torvalds/linux.git:
>> https://git.kernel.org/torvalds/c/cb44e4f061e16be65b8a16505e121490c66d30d0
>>
>>
>
> Do we need any update in the manual page? Is this already covered by
> patches that I applied from you?
Yes, this new release brings some changes and the man pages need update.
Documentation fixes:
* Fix landlock_add_rule(2) documentation:
https://git.kernel.org/torvalds/c/a13e248ff90e81e9322406c0e618cf2168702f4e
* Reduce the maximum number of layers to 16:
https://git.kernel.org/torvalds/c/75c542d6c6cc48720376862d5496d51509160dfd
New features:
* Add support for file reparenting with LANDLOCK_ACCESS_FS_REFER:
https://git.kernel.org/torvalds/c/b91c3e4ea756b12b7d992529226edce1cfd854d7
* Document LANDLOCK_ACCESS_FS_REFER and ABI versioning:
https://git.kernel.org/torvalds/c/6f59abfae35fbbe688ff790ff9638576956d760c
Documentation improvements:
* Document good practices about filesystem policies:
https://git.kernel.org/torvalds/c/09340cf4135f942d56742b36aaa3c37738aba000
* Explain how to support Landlock:
https://git.kernel.org/torvalds/c/5e469829baa1b1320e843adf3631edef1d6d2cf2
For a complete overview:
https://git.kernel.org/torvalds/c/cb44e4f061e16be65b8a16505e121490c66d30d0
It would be easier to have a way to easily/automatically synchronize the
kernel documentation and the man pages.
>
> The latest one I have applied from you regarding landlock is
> <http://www.alejandro-colomar.es/src/alx/linux/man-pages/man-pages.git/commit/?id=38454e3fcd7876dcd3441f4bb86246b9f3b8f9da>.
>
>
>
> Cheers,
>
> Alex
>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2022-06-15 11:42 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-05-23 16:12 [GIT PULL] Landlock changes for v5.19 Mickaël Salaün
2022-05-24 20:26 ` pr-tracker-bot
2022-06-03 16:35 ` Alejandro Colomar
2022-06-15 7:35 ` Mickaël Salaün
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.