From: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
To: <mic@digikod.net>
Cc: <willemdebruijn.kernel@gmail.com>, <gnoack3000@gmail.com>,
<linux-security-module@vger.kernel.org>, <netdev@vger.kernel.org>,
<netfilter-devel@vger.kernel.org>, <yusongping@huawei.com>,
<hukeping@huawei.com>, <anton.sirazetdinov@huawei.com>
Subject: [PATCH v7 00/18] Network support for Landlock
Date: Tue, 30 Aug 2022 01:03:43 +0800 [thread overview]
Message-ID: <20220829170401.834298-1-konstantin.meskhidze@huawei.com> (raw)
Hi,
This is a new V7 patch related to Landlock LSM network confinement.
It is based on the landlock's -next branch on top of v5.19 kernel version:
https://git.kernel.org/pub/scm/linux/kernel/git/mic/linux.git/log/?h=next
It brings refactoring of previous patch version V6 and based on
Mickaёl's two commits in -tmp-net branch:
https://git.kernel.org/pub/scm/linux/kernel/git/mic/linux.git/commit/?id=8f4104b3dc59e7f110c9b83cdf034d010a2d006f
https://git.kernel.org/pub/scm/linux/kernel/git/mic/linux.git/commit/?id=7d6cf40a6f81adf607ad3cc17aaa11e256beeea4
All test were run in QEMU evironment and compiled with
-static flag.
1. network_test: 18/18 tests passed.
2. base_test: 7/7 tests passed.
3. fs_test: 61/61 tests passed.
4. ptrace_test: 8/8 tests passed.
LCOV - code coverage report:
Hit Total Coverage
Lines: 952 1010 94.2 %
Functions: 79 82 96.3 %
Previous versions:
v6: https://lore.kernel.org/linux-security-module/20220621082313.3330667-1-konstantin.meskhidze@huawei.com/
v5: https://lore.kernel.org/linux-security-module/20220516152038.39594-1-konstantin.meskhidze@huawei.com
v4: https://lore.kernel.org/linux-security-module/20220309134459.6448-1-konstantin.meskhidze@huawei.com/
v3: https://lore.kernel.org/linux-security-module/20220124080215.265538-1-konstantin.meskhidze@huawei.com/
v2: https://lore.kernel.org/linux-security-module/20211228115212.703084-1-konstantin.meskhidze@huawei.com/
v1: https://lore.kernel.org/linux-security-module/20211210072123.386713-1-konstantin.meskhidze@huawei.com/
Konstantin Meskhidze (18):
landlock: rename access mask
landlock: refactor landlock_find_rule/insert_rule
landlock: refactor merge/inherit_ruleset functions
landlock: move helper functions
landlock: refactor helper functions
landlock: refactor landlock_add_rule syscall
landlock: user space API network support
landlock: add network rules support
landlock: implement TCP network hooks
seltests/landlock: move helper function
seltests/landlock: add tests for bind() hooks
seltests/landlock: add tests for connect() hooks
seltests/landlock: add AF_UNSPEC family test
seltests/landlock: add rules overlapping test
seltests/landlock: add ruleset expanding test
seltests/landlock: add invalid input data test
samples/landlock: add network demo
landlock: Document Landlock's network support
Documentation/userspace-api/landlock.rst | 84 ++-
include/uapi/linux/landlock.h | 49 ++
samples/landlock/sandboxer.c | 123 ++-
security/landlock/Kconfig | 1 +
security/landlock/Makefile | 2 +
security/landlock/fs.c | 144 +---
security/landlock/limits.h | 7 +-
security/landlock/net.c | 161 ++++
security/landlock/net.h | 26 +
security/landlock/ruleset.c | 369 +++++++--
security/landlock/ruleset.h | 136 +++-
security/landlock/setup.c | 2 +
security/landlock/syscalls.c | 168 +++--
tools/testing/selftests/landlock/common.h | 10 +
tools/testing/selftests/landlock/config | 4 +
tools/testing/selftests/landlock/fs_test.c | 10 -
tools/testing/selftests/landlock/net_test.c | 786 ++++++++++++++++++++
17 files changed, 1796 insertions(+), 286 deletions(-)
create mode 100644 security/landlock/net.c
create mode 100644 security/landlock/net.h
create mode 100644 tools/testing/selftests/landlock/net_test.c
--
2.25.1
next reply other threads:[~2022-08-29 17:04 UTC|newest]
Thread overview: 64+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-08-29 17:03 Konstantin Meskhidze [this message]
2022-08-29 17:03 ` [PATCH v7 01/18] landlock: rename access mask Konstantin Meskhidze
2022-09-06 8:06 ` Mickaël Salaün
2022-09-09 10:42 ` Konstantin Meskhidze (A)
2022-09-12 17:16 ` Mickaël Salaün
2022-08-29 17:03 ` [PATCH v7 02/18] landlock: refactor landlock_find_rule/insert_rule Konstantin Meskhidze
2022-09-06 8:07 ` Mickaël Salaün
2022-09-09 10:48 ` Konstantin Meskhidze (A)
2022-09-12 17:17 ` Mickaël Salaün
2022-10-12 8:37 ` Konstantin Meskhidze (A)
2022-10-12 10:06 ` Mickaël Salaün
2022-10-12 11:13 ` Konstantin Meskhidze (A)
2022-08-29 17:03 ` [PATCH v7 03/18] landlock: refactor merge/inherit_ruleset functions Konstantin Meskhidze
2022-09-06 8:07 ` Mickaël Salaün
2022-09-09 14:53 ` Konstantin Meskhidze (A)
2022-09-12 17:17 ` Mickaël Salaün
2022-08-29 17:03 ` [PATCH v7 04/18] landlock: move helper functions Konstantin Meskhidze
2022-09-06 8:07 ` Mickaël Salaün
2022-09-10 16:50 ` Konstantin Meskhidze (A)
2022-08-29 17:03 ` [PATCH v7 05/18] landlock: refactor " Konstantin Meskhidze
2022-09-06 8:07 ` Mickaël Salaün
2022-09-10 17:20 ` Konstantin Meskhidze (A)
2022-09-12 17:18 ` Mickaël Salaün
2022-08-29 17:03 ` [PATCH v7 06/18] landlock: refactor landlock_add_rule syscall Konstantin Meskhidze
2022-08-29 17:03 ` [PATCH v7 07/18] landlock: user space API network support Konstantin Meskhidze
2022-09-06 8:08 ` Mickaël Salaün
2022-09-10 17:25 ` Konstantin Meskhidze (A)
2022-08-29 17:03 ` [PATCH v7 08/18] landlock: add network rules support Konstantin Meskhidze
2022-09-06 8:08 ` Mickaël Salaün
2022-09-10 18:27 ` Konstantin Meskhidze (A)
2022-09-12 17:18 ` Mickaël Salaün
2022-08-29 17:03 ` [PATCH v7 09/18] landlock: implement TCP network hooks Konstantin Meskhidze
2022-09-06 8:08 ` Mickaël Salaün
2022-09-10 20:28 ` Konstantin Meskhidze (A)
2022-09-12 17:18 ` Mickaël Salaün
2022-08-29 17:03 ` [PATCH v7 10/18] seltests/landlock: move helper function Konstantin Meskhidze
2022-09-06 8:09 ` Mickaël Salaün
2022-09-10 20:29 ` Konstantin Meskhidze (A)
2022-08-29 17:03 ` [PATCH v7 11/18] seltests/landlock: add tests for bind() hooks Konstantin Meskhidze
2022-09-06 8:09 ` Mickaël Salaün
2022-09-10 20:47 ` Konstantin Meskhidze (A)
2022-08-29 17:03 ` [PATCH v7 12/18] seltests/landlock: add tests for connect() hooks Konstantin Meskhidze
2022-08-29 17:03 ` [PATCH v7 13/18] seltests/landlock: add AF_UNSPEC family test Konstantin Meskhidze
2022-09-06 8:09 ` Mickaël Salaün
2022-09-10 20:48 ` Konstantin Meskhidze (A)
2022-08-29 17:03 ` [PATCH v7 14/18] seltests/landlock: add rules overlapping test Konstantin Meskhidze
2022-09-06 8:09 ` Mickaël Salaün
2022-09-10 20:49 ` Konstantin Meskhidze (A)
2022-08-29 17:03 ` [PATCH v7 15/18] seltests/landlock: add ruleset expanding test Konstantin Meskhidze
2022-08-29 17:03 ` [PATCH v7 16/18] seltests/landlock: add invalid input data test Konstantin Meskhidze
2022-09-06 8:09 ` Mickaël Salaün
2022-09-10 20:51 ` Konstantin Meskhidze (A)
2022-09-12 17:22 ` Mickaël Salaün
2022-10-10 10:37 ` Mickaël Salaün
2022-10-11 7:55 ` Konstantin Meskhidze (A)
2022-10-11 8:32 ` Mickaël Salaün
2022-08-29 17:04 ` [PATCH v7 17/18] samples/landlock: add network demo Konstantin Meskhidze
2022-09-06 8:10 ` Mickaël Salaün
2022-09-10 20:59 ` Konstantin Meskhidze (A)
2022-09-12 17:23 ` Mickaël Salaün
2022-08-29 17:04 ` [PATCH v7 18/18] landlock: Document Landlock's network support Konstantin Meskhidze
2022-09-06 8:12 ` Mickaël Salaün
2022-09-10 21:14 ` Konstantin Meskhidze (A)
2022-09-12 17:23 ` Mickaël Salaün
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220829170401.834298-1-konstantin.meskhidze@huawei.com \
--to=konstantin.meskhidze@huawei.com \
--cc=anton.sirazetdinov@huawei.com \
--cc=gnoack3000@gmail.com \
--cc=hukeping@huawei.com \
--cc=linux-security-module@vger.kernel.org \
--cc=mic@digikod.net \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=willemdebruijn.kernel@gmail.com \
--cc=yusongping@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).