From: "Mickaël Salaün" <mic@digikod.net>
To: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
Cc: willemdebruijn.kernel@gmail.com, gnoack3000@gmail.com,
linux-security-module@vger.kernel.org, netdev@vger.kernel.org,
netfilter-devel@vger.kernel.org, yusongping@huawei.com,
artem.kuzin@huawei.com
Subject: Re: [PATCH v12 08/12] landlock: Add network rules and TCP hooks support
Date: Mon, 9 Oct 2023 17:36:24 +0200 [thread overview]
Message-ID: <20231009.Aej2eequoodi@digikod.net> (raw)
In-Reply-To: <20230920092641.832134-9-konstantin.meskhidze@huawei.com>
On Wed, Sep 20, 2023 at 05:26:36PM +0800, Konstantin Meskhidze wrote:
> This commit adds network rules support in the ruleset management
> helpers and the landlock_create_ruleset syscall.
> Refactor user space API to support network actions. Add new network
> access flags, network rule and network attributes. Increment Landlock
> ABI version. Expand access_masks_t to u32 to be sure network access
> rights can be stored. Implement socket_bind() and socket_connect()
> LSM hooks, which enables to restrict TCP socket binding and connection
> to specific ports.
> The new landlock_net_port_attr structure has two fields. The allowed_access
> field contains the LANDLOCK_ACCESS_NET_* rights. The port field contains
> the port value according to the allowed protocol. This field can
> take up to a 64-bit value [1] but the maximum value depends on the related
> protocol (e.g. 16-bit for TCP).
>
> [1]
> https://lore.kernel.org/r/278ab07f-7583-a4e0-3d37-1bacd091531d@digikod.net
Could you please include here the rationale to not tie access rights to
sockets' file descriptor, and link [2]?
[2] https://lore.kernel.org/r/263c1eb3-602f-57fe-8450-3f138581bee7@digikod.net
next prev parent reply other threads:[~2023-10-09 15:37 UTC|newest]
Thread overview: 38+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-09-20 9:26 [PATCH v12 00/12] Network support for Landlock Konstantin Meskhidze
2023-09-20 9:26 ` [PATCH v12 01/12] landlock: Make ruleset's access masks more generic Konstantin Meskhidze
2023-09-20 9:26 ` [PATCH v12 02/12] landlock: Allow filesystem layout changes for domains without such rule type Konstantin Meskhidze
2023-10-02 20:26 ` Mickaël Salaün
2023-10-10 2:17 ` Konstantin Meskhidze (A)
2023-09-20 9:26 ` [PATCH v12 03/12] landlock: Refactor landlock_find_rule/insert_rule Konstantin Meskhidze
2023-09-20 9:26 ` [PATCH v12 04/12] landlock: Refactor merge/inherit_ruleset functions Konstantin Meskhidze
2023-09-20 9:26 ` [PATCH v12 05/12] landlock: Move and rename layer helpers Konstantin Meskhidze
2023-09-20 9:26 ` [PATCH v12 06/12] landlock: Refactor " Konstantin Meskhidze
2023-09-20 9:26 ` [PATCH v12 07/12] landlock: Refactor landlock_add_rule() syscall Konstantin Meskhidze
2023-09-20 9:26 ` [PATCH v12 08/12] landlock: Add network rules and TCP hooks support Konstantin Meskhidze
2023-10-02 20:26 ` Mickaël Salaün
2023-10-09 14:12 ` Mickaël Salaün
2023-10-09 14:13 ` Mickaël Salaün
2023-10-10 2:23 ` Konstantin Meskhidze (A)
2023-10-10 2:20 ` Konstantin Meskhidze (A)
2023-10-10 9:17 ` Mickaël Salaün
2023-10-10 11:22 ` Konstantin Meskhidze (A)
2023-10-10 3:29 ` Konstantin Meskhidze (A)
2023-10-10 9:28 ` Mickaël Salaün
2023-10-10 11:21 ` Konstantin Meskhidze (A)
2023-10-11 1:53 ` Konstantin Meskhidze (A)
2023-10-11 16:02 ` Mickaël Salaün
2023-10-11 16:04 ` Konstantin Meskhidze (A)
2023-10-09 15:36 ` Mickaël Salaün [this message]
2023-10-10 3:31 ` Konstantin Meskhidze (A)
2023-09-20 9:26 ` [PATCH v12 09/12] selftests/landlock: Share enforce_ruleset() Konstantin Meskhidze
2023-10-02 20:26 ` Mickaël Salaün
2023-10-10 2:47 ` Konstantin Meskhidze (A)
2023-09-20 9:26 ` [PATCH v12 10/12] selftests/landlock: Add 7 new test variants dedicated to network Konstantin Meskhidze
2023-09-20 9:26 ` [PATCH v12 11/12] samples/landlock: Add network demo Konstantin Meskhidze
2023-10-03 13:15 ` linux-next: build warning after merge of the landlock tree Mickaël Salaün
2023-10-03 13:23 ` Geert Uytterhoeven
2023-10-04 11:01 ` Mickaël Salaün
2023-10-03 13:40 ` Arnd Bergmann
2023-10-04 11:02 ` Mickaël Salaün
2023-09-20 9:26 ` [PATCH v12 12/12] landlock: Document Landlock's network support Konstantin Meskhidze
-- strict thread matches above, loose matches on Subject: below --
2023-10-03 3:27 linux-next: build warning after merge of the landlock tree Stephen Rothwell
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20231009.Aej2eequoodi@digikod.net \
--to=mic@digikod.net \
--cc=artem.kuzin@huawei.com \
--cc=gnoack3000@gmail.com \
--cc=konstantin.meskhidze@huawei.com \
--cc=linux-security-module@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=willemdebruijn.kernel@gmail.com \
--cc=yusongping@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.