From: "Mickaël Salaün" <mic@digikod.net>
To: "Konstantin Meskhidze (A)" <konstantin.meskhidze@huawei.com>
Cc: artem.kuzin@huawei.com, gnoack3000@gmail.com,
willemdebruijn.kernel@gmail.com,
linux-security-module@vger.kernel.org, netdev@vger.kernel.org,
netfilter-devel@vger.kernel.org
Subject: Re: [PATCH] landlock: Allow filesystem layout changes for domains without such rule type
Date: Mon, 28 Nov 2022 21:25:31 +0100 [thread overview]
Message-ID: <787e7546-25b9-4e32-6560-b6907cdd6401@digikod.net> (raw)
In-Reply-To: <1956e8c2-fd4c-898e-dd0f-22ad20a69740@huawei.com>
On 28/11/2022 04:02, Konstantin Meskhidze (A) wrote:
>
>
> 11/17/2022 9:55 PM, Mickaël Salaün пишет:
>> Allow mount point and root directory changes when there is no filesystem
>> rule tied to the current Landlock domain. This doesn't change anything
>> for now because a domain must have at least a (filesystem) rule, but
>> this will change when other rule types will come. For instance, a
>> domain only restricting the network should have no impact on filesystem
>> restrictions.
>>
>> Add a new get_current_fs_domain() helper to quickly check filesystem
>> rule existence for all filesystem LSM hooks.
>
> Ok. I got it.
> Do I need also to add a new network helper:
> like landlock_get_raw_net_access_mask?
A get_raw helper would not be useful if there is not network access
initially denied (like for FS_REFER).
next prev parent reply other threads:[~2022-11-28 20:25 UTC|newest]
Thread overview: 87+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-10-21 15:26 [PATCH v8 00/12] Network support for Landlock Konstantin Meskhidze
2022-10-21 15:26 ` [PATCH v8 01/12] landlock: Make ruleset's access masks more generic Konstantin Meskhidze
2022-11-17 18:41 ` Mickaël Salaün
2022-11-28 2:53 ` Konstantin Meskhidze (A)
2022-11-28 20:22 ` Mickaël Salaün
2022-12-02 2:49 ` Konstantin Meskhidze (A)
2022-10-21 15:26 ` [PATCH v8 02/12] landlock: Refactor landlock_find_rule/insert_rule Konstantin Meskhidze
2022-11-17 18:41 ` Mickaël Salaün
2022-11-17 18:55 ` [PATCH] landlock: Allow filesystem layout changes for domains without such rule type Mickaël Salaün
2022-11-18 9:16 ` Mickaël Salaün
2022-11-28 3:04 ` Konstantin Meskhidze (A)
2022-11-28 20:23 ` Mickaël Salaün
2022-12-02 2:50 ` Konstantin Meskhidze (A)
2022-12-24 3:10 ` Konstantin Meskhidze (A)
2022-12-26 21:24 ` Mickaël Salaün
2022-12-27 1:47 ` Konstantin Meskhidze (A)
2022-11-28 3:02 ` Konstantin Meskhidze (A)
2022-11-28 20:25 ` Mickaël Salaün [this message]
2022-12-02 2:51 ` Konstantin Meskhidze (A)
2022-11-22 17:17 ` [PATCH v8 02/12] landlock: Refactor landlock_find_rule/insert_rule Mickaël Salaün
2022-11-28 3:06 ` Konstantin Meskhidze (A)
2022-11-28 2:58 ` Konstantin Meskhidze (A)
2022-10-21 15:26 ` [PATCH v8 03/12] landlock: Refactor merge/inherit_ruleset functions Konstantin Meskhidze
2022-11-17 18:41 ` Mickaël Salaün
2022-11-28 3:07 ` Konstantin Meskhidze (A)
2022-10-21 15:26 ` [PATCH v8 04/12] landlock: Move unmask_layers() and init_layer_masks() Konstantin Meskhidze
2022-11-17 18:42 ` Mickaël Salaün
2022-11-28 3:25 ` Konstantin Meskhidze (A)
2022-11-28 20:25 ` Mickaël Salaün
2022-12-02 2:52 ` Konstantin Meskhidze (A)
2022-10-21 15:26 ` [PATCH v8 05/12] landlock: Refactor " Konstantin Meskhidze
2022-11-17 18:42 ` Mickaël Salaün
2022-11-28 3:30 ` Konstantin Meskhidze (A)
2022-10-21 15:26 ` [PATCH v8 06/12] landlock: Refactor landlock_add_rule() syscall Konstantin Meskhidze
2022-11-17 18:42 ` Mickaël Salaün
2022-11-28 3:32 ` Konstantin Meskhidze (A)
2022-10-21 15:26 ` [PATCH v8 07/12] landlock: Add network rules support Konstantin Meskhidze
2022-11-17 18:43 ` Mickaël Salaün
2022-11-28 4:01 ` Konstantin Meskhidze (A)
2022-11-28 20:26 ` Mickaël Salaün
2022-12-02 2:54 ` Konstantin Meskhidze (A)
2023-01-03 12:44 ` Konstantin Meskhidze (A)
2023-01-04 11:41 ` Konstantin Meskhidze (A)
2023-01-06 19:22 ` Mickaël Salaün
2023-01-09 7:59 ` Konstantin Meskhidze (A)
2023-01-09 8:58 ` Dan Carpenter
2023-01-09 9:26 ` Konstantin Meskhidze (A)
2023-01-09 10:20 ` Dan Carpenter
2023-01-09 11:39 ` Konstantin Meskhidze (A)
2023-01-09 11:53 ` Dan Carpenter
2023-01-09 12:18 ` Konstantin Meskhidze (A)
2022-10-21 15:26 ` [PATCH v8 08/12] landlock: Implement TCP network hooks Konstantin Meskhidze
2022-11-17 18:43 ` Mickaël Salaün
2022-11-28 8:21 ` Konstantin Meskhidze (A)
2022-11-28 21:00 ` Mickaël Salaün
2022-12-02 3:13 ` Konstantin Meskhidze (A)
2022-12-02 13:01 ` Mickaël Salaün
2022-12-05 2:55 ` Konstantin Meskhidze (A)
2022-12-05 13:18 ` Mickaël Salaün
2023-01-05 8:57 ` Konstantin Meskhidze (A)
2023-01-06 19:30 ` Mickaël Salaün
2023-01-09 8:07 ` Konstantin Meskhidze (A)
2023-01-09 12:38 ` Mickaël Salaün
2023-01-10 4:45 ` Konstantin Meskhidze (A)
2023-01-10 17:24 ` Mickaël Salaün
2023-01-11 1:54 ` Konstantin Meskhidze (A)
2022-10-21 15:26 ` [PATCH v8 09/12] selftests/landlock: Share enforce_ruleset() Konstantin Meskhidze
2022-11-17 18:43 ` Mickaël Salaün
2022-11-28 4:02 ` Konstantin Meskhidze (A)
2022-10-21 15:26 ` [PATCH v8 10/12] selftests/landlock: Add 10 new test suites dedicated to network Konstantin Meskhidze
2023-01-09 12:46 ` Mickaël Salaün
2023-01-10 5:03 ` Konstantin Meskhidze (A)
2023-01-10 17:40 ` Mickaël Salaün
2023-01-11 1:52 ` Konstantin Meskhidze (A)
2022-10-21 15:26 ` [PATCH v8 11/12] samples/landlock: Add network demo Konstantin Meskhidze
2022-11-16 14:25 ` Mickaël Salaün
2022-11-28 2:49 ` Konstantin Meskhidze (A)
2022-11-28 20:26 ` Mickaël Salaün
2022-12-02 2:48 ` Konstantin Meskhidze (A)
2023-01-05 3:46 ` Konstantin Meskhidze (A)
2023-01-06 19:34 ` Mickaël Salaün
2023-01-09 7:57 ` Konstantin Meskhidze (A)
2022-10-21 15:26 ` [PATCH v8 12/12] landlock: Document Landlock's network support Konstantin Meskhidze
2022-11-17 18:44 ` Mickaël Salaün
2022-11-28 6:44 ` Konstantin Meskhidze (A)
2022-11-28 20:26 ` Mickaël Salaün
2022-12-02 3:14 ` Konstantin Meskhidze (A)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=787e7546-25b9-4e32-6560-b6907cdd6401@digikod.net \
--to=mic@digikod.net \
--cc=artem.kuzin@huawei.com \
--cc=gnoack3000@gmail.com \
--cc=konstantin.meskhidze@huawei.com \
--cc=linux-security-module@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=willemdebruijn.kernel@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.