From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
To: "Günther Noack" <gnoack3000@gmail.com>
Cc: "Mickaël Salaün" <mic@digikod.net>,
"John Johansen" <john.johansen@canonical.com>,
"Tingmao Wang" <m@maowtm.org>,
"Justin Suess" <utilityemal77@gmail.com>,
"Kuniyuki Iwashima" <kuniyu@google.com>,
"Jann Horn" <jannh@google.com>,
linux-security-module@vger.kernel.org,
"Samasth Norway Ananda" <samasth.norway.ananda@oracle.com>,
"Matthieu Buffet" <matthieu@buffet.re>,
"Mikhail Ivanov" <ivanov.mikhail1@huawei-partners.com>,
konstantin.meskhidze@huawei.com,
"Demi Marie Obenour" <demiobenour@gmail.com>,
"Alyssa Ross" <hi@alyssa.is>,
"Tahera Fahimi" <fahimitahera@gmail.com>,
"Georgia Garcia" <georgia.garcia@canonical.com>
Subject: Re: [PATCH v8 04/12] landlock: Control pathname UNIX domain socket resolution by path
Date: Thu, 2 Apr 2026 11:51:42 +0200 [thread overview]
Message-ID: <20260402095142.c9sySV-h@linutronix.de> (raw)
In-Reply-To: <20260327164838.38231-5-gnoack3000@gmail.com>
On 2026-03-27 17:48:29 [+0100], Günther Noack wrote:
> * Add a new access right LANDLOCK_ACCESS_FS_RESOLVE_UNIX, which
> controls the lookup operations for named UNIX domain sockets. The
> resolution happens during connect() and sendmsg() (depending on
> socket type).
…
> Cc: Tingmao Wang <m@maowtm.org>
> Cc: Justin Suess <utilityemal77@gmail.com>
> Cc: Mickaël Salaün <mic@digikod.net>
> Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
> Cc: Kuniyuki Iwashima <kuniyu@google.com>
> Suggested-by: Jann Horn <jannh@google.com>
> Link[1]: https://github.com/landlock-lsm/linux/issues/36
> Link[2]: https://lore.kernel.org/all/20260205.8531e4005118@gnoack.org/
> Signed-off-by: Günther Noack <gnoack3000@gmail.com>
The unix bits look okay to me,
Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Sebastian
next prev parent reply other threads:[~2026-04-02 9:51 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-27 16:48 [PATCH v8 00/12] landlock: UNIX connect() control by pathname and scope Günther Noack
2026-03-27 16:48 ` [PATCH v8 01/12] lsm: Add LSM hook security_unix_find Günther Noack
2026-03-27 17:55 ` Paul Moore
2026-03-30 16:02 ` Mickaël Salaün
2026-03-30 19:02 ` Günther Noack
2026-03-27 16:48 ` [PATCH v8 02/12] landlock: Use mem_is_zero() in is_layer_masks_allowed() Günther Noack
2026-03-27 16:48 ` [PATCH v8 03/12] landlock: Replace union access_masks_all with helper functions Günther Noack
2026-03-30 9:56 ` Mickaël Salaün
2026-03-30 10:53 ` Mickaël Salaün
2026-03-30 19:00 ` Günther Noack
2026-04-01 17:57 ` Mickaël Salaün
2026-03-27 16:48 ` [PATCH v8 04/12] landlock: Control pathname UNIX domain socket resolution by path Günther Noack
2026-04-02 9:51 ` Sebastian Andrzej Siewior [this message]
2026-04-02 18:09 ` Kuniyuki Iwashima
2026-03-27 16:48 ` [PATCH v8 05/12] landlock: Clarify BUILD_BUG_ON check in scoping logic Günther Noack
2026-03-27 16:48 ` [PATCH v8 06/12] samples/landlock: Add support for named UNIX domain socket restrictions Günther Noack
2026-03-27 16:48 ` [PATCH v8 07/12] selftests/landlock: Replace access_fs_16 with ACCESS_ALL in fs_test Günther Noack
2026-03-27 16:48 ` [PATCH v8 08/12] selftests/landlock: Test LANDLOCK_ACCESS_FS_RESOLVE_UNIX Günther Noack
2026-03-27 16:48 ` [PATCH v8 09/12] selftests/landlock: Audit test for LANDLOCK_ACCESS_FS_RESOLVE_UNIX Günther Noack
2026-03-27 16:48 ` [PATCH v8 10/12] selftests/landlock: Check that coredump sockets stay unrestricted Günther Noack
2026-03-27 16:48 ` [PATCH v8 11/12] selftests/landlock: fs_test: Simplify ruleset creation and enforcement Günther Noack
2026-03-27 16:48 ` [PATCH v8 12/12] landlock: Document FS access right for pathname UNIX sockets Günther Noack
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260402095142.c9sySV-h@linutronix.de \
--to=bigeasy@linutronix.de \
--cc=demiobenour@gmail.com \
--cc=fahimitahera@gmail.com \
--cc=georgia.garcia@canonical.com \
--cc=gnoack3000@gmail.com \
--cc=hi@alyssa.is \
--cc=ivanov.mikhail1@huawei-partners.com \
--cc=jannh@google.com \
--cc=john.johansen@canonical.com \
--cc=konstantin.meskhidze@huawei.com \
--cc=kuniyu@google.com \
--cc=linux-security-module@vger.kernel.org \
--cc=m@maowtm.org \
--cc=matthieu@buffet.re \
--cc=mic@digikod.net \
--cc=samasth.norway.ananda@oracle.com \
--cc=utilityemal77@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.