From: "Günther Noack" <gnoack3000@gmail.com>
To: "Mickaël Salaün" <mic@digikod.net>
Cc: Justin Suess <utilityemal77@gmail.com>,
linux-security-module@vger.kernel.org,
Tingmao Wang <m@maowtm.org>,
Samasth Norway Ananda <samasth.norway.ananda@oracle.com>,
Matthieu Buffet <matthieu@buffet.re>,
Mikhail Ivanov <ivanov.mikhail1@huawei-partners.com>,
konstantin.meskhidze@huawei.com,
Demi Marie Obenour <demiobenour@gmail.com>,
Alyssa Ross <hi@alyssa.is>, Jann Horn <jannh@google.com>,
Tahera Fahimi <fahimitahera@gmail.com>
Subject: Re: [PATCH v2 3/5] samples/landlock: Add support for named UNIX domain socket restrictions
Date: Sun, 11 Jan 2026 10:50:00 +0100 [thread overview]
Message-ID: <20260111.485814f155b4@gnoack.org> (raw)
In-Reply-To: <20260110143300.71048-7-gnoack3000@gmail.com>
On Sat, Jan 10, 2026 at 03:33:00PM +0100, Günther Noack wrote:
> The access rights for UNIX domain socket lookups are grouped with the
> read-write rights in the sample tool. Rationale: In the general case,
> any operations are possible through a UNIX domain socket, including
> data-mutating operations.
Sorry, I missed a part of the discussion in V1, which was suggested by
Tingmao Wang in [1]:
You are right, the new access rights should indeed become part of
ACCESS_FILE in the sample tool. (When the sample tool is adding a
rule for a non-directory, it only applies access rights that are also
in ACCESS_FILE.)
Will add it in V3.
–Günther
[1] https://lore.kernel.org/all/423dd2ca-ecba-47cf-98a7-4d99a48939da@maowtm.org/
next prev parent reply other threads:[~2026-01-11 9:50 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-01-10 14:32 [PATCH v2 0/5] landlock: Pathname-based UNIX connect() control Günther Noack
2026-01-10 14:32 ` [PATCH v2 1/5] lsm: Add hook unix_path_connect Günther Noack
2026-01-10 16:45 ` Justin Suess
2026-01-11 9:55 ` Günther Noack
2026-01-13 22:51 ` Paul Moore
2026-01-13 23:30 ` Paul Moore
2026-01-13 9:34 ` Christian Brauner
2026-01-13 23:27 ` Paul Moore
2026-01-15 10:10 ` Günther Noack
2026-01-15 21:24 ` Demi Marie Obenour
2026-01-15 22:32 ` Günther Noack
2026-01-15 21:46 ` Paul Moore
2026-01-10 14:32 ` [PATCH v2 2/5] landlock: Control pathname UNIX domain socket resolution by path Günther Noack
2026-01-12 15:38 ` Justin Suess
2026-01-19 11:43 ` Mickaël Salaün
2026-01-10 14:33 ` [PATCH v2 3/5] samples/landlock: Add support for named UNIX domain socket restrictions Günther Noack
2026-01-11 9:50 ` Günther Noack [this message]
2026-01-10 14:33 ` [PATCH v2 4/5] landlock/selftests: Test " Günther Noack
2026-01-10 14:33 ` [PATCH v2 5/5] landlock: Document FS access rights for pathname UNIX sockets Günther Noack
2026-01-12 16:08 ` [PATCH v2 0/5] landlock: Pathname-based UNIX connect() control Mickaël Salaün
2026-01-12 20:53 ` Günther Noack
2026-01-17 18:57 ` Justin Suess
2026-01-18 17:44 ` Günther Noack
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260111.485814f155b4@gnoack.org \
--to=gnoack3000@gmail.com \
--cc=demiobenour@gmail.com \
--cc=fahimitahera@gmail.com \
--cc=hi@alyssa.is \
--cc=ivanov.mikhail1@huawei-partners.com \
--cc=jannh@google.com \
--cc=konstantin.meskhidze@huawei.com \
--cc=linux-security-module@vger.kernel.org \
--cc=m@maowtm.org \
--cc=matthieu@buffet.re \
--cc=mic@digikod.net \
--cc=samasth.norway.ananda@oracle.com \
--cc=utilityemal77@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.