* [PATCH v3 2/2] landlock.7: Document Landlock ABI v3 (file truncation; Linux 6.2)
2023-03-04 17:16 [PATCH v3 1/2] landlock.7: Document Landlock ABI v2 (file reparenting; Linux 5.19) Günther Noack
@ 2023-03-04 17:16 ` Günther Noack
2023-03-07 22:41 ` Mickaël Salaün
2023-03-05 10:24 ` [PATCH v3 1/2] landlock.7: Document Landlock ABI v2 (file reparenting; Linux 5.19) Günther Noack
2023-03-07 22:40 ` Mickaël Salaün
2 siblings, 1 reply; 9+ messages in thread
From: Günther Noack @ 2023-03-04 17:16 UTC (permalink / raw)
To: Alejandro Colomar, Mickaël Salaün
Cc: Michael Kerrisk, linux-man, Günther Noack
https://git.kernel.org/torvalds/c/299e2b1967578b1442128ba8b3e86ed3427d3651
Signed-off-by: Günther Noack <gnoack3000@gmail.com>
---
man7/landlock.7 | 83 +++++++++++++++++++++++++++++++++++++++++++++++--
1 file changed, 81 insertions(+), 2 deletions(-)
diff --git a/man7/landlock.7 b/man7/landlock.7
index 1ab0a6cbc..f711000f1 100644
--- a/man7/landlock.7
+++ b/man7/landlock.7
@@ -64,9 +64,39 @@ Execute a file.
.TP
.B LANDLOCK_ACCESS_FS_WRITE_FILE
Open a file with write access.
+.IP
+When opening files for writing,
+you will often additionally need the
+.B LANDLOCK_ACCESS_FS_TRUNCATE
+right.
+In many cases,
+these system calls truncate existing files when overwriting them
+(e.g.,
+.BR creat (2)).
.TP
.B LANDLOCK_ACCESS_FS_READ_FILE
Open a file with read access.
+.TP
+.B LANDLOCK_ACCESS_FS_TRUNCATE
+Truncate a file with
+.BR truncate (2),
+.BR ftruncate (2),
+.BR creat (2),
+or
+.BR open (2)
+with
+.BR O_TRUNC .
+Whether an opened file can be truncated with
+.BR ftruncate (2)
+is determined during
+.BR open (2),
+in the same way as read and write permissions are checked during
+.BR open (2)
+using
+.B LANDLOCK_ACCESS_FS_READ_FILE
+and
+.BR LANDLOCK_ACCESS_FS_WRITE_FILE .
+This access right is available since the third version of the Landlock ABI.
.PP
A directory can receive access rights related to files or directories.
The following access right is applied to the directory itself,
@@ -231,6 +261,53 @@ To be allowed to use
and related syscalls on a target process,
a sandboxed process should have a subset of the target process rules,
which means the tracee must be in a sub-domain of the tracer.
+.\"
+.SS Truncating files
+The operations covered by
+.B LANDLOCK_ACCESS_FS_WRITE_FILE
+and
+.B LANDLOCK_ACCESS_FS_TRUNCATE
+both change the contents of a file and sometimes overlap in
+non-intuitive ways.
+It is recommended to always specify both of these together.
+.PP
+A particularly surprising example is
+.BR creat (2).
+The name suggests that this system call requires
+the rights to create and write files.
+However, it also requires the truncate right
+if an existing file under the same name is already present.
+.PP
+It should also be noted that truncating files does not require the
+.B LANDLOCK_ACCESS_FS_WRITE_FILE
+right.
+Apart from the
+.BR truncate (2)
+system call, this can also be done through
+.BR open (2)
+with the flags
+.IR "O_RDONLY\ |\ O_TRUNC" .
+.PP
+When opening a file, the availability of the
+.B LANDLOCK_ACCESS_FS_TRUNCATE
+right is associated with the newly created file descriptor
+and will be used for subsequent truncation attempts using
+.BR ftruncate (2).
+The behavior is similar to opening a file for reading or writing,
+where permissions are checked during
+.BR open (2),
+but not during the subsequent
+.BR read (2)
+and
+.BR write (2)
+calls.
+.PP
+As a consequence,
+it is possible to have multiple open file descriptors for the same file,
+where one grants the right to truncate the file and the other does not.
+It is also possible to pass such file descriptors between processes,
+keeping their Landlock properties,
+even when these processes do not have an enforced Landlock ruleset.
.SH VERSIONS
Landlock was introduced in Linux 5.13.
.PP
@@ -257,6 +334,8 @@ _ _ _
\^ \^ LANDLOCK_ACCESS_FS_MAKE_SYM
_ _ _
2 5.19 LANDLOCK_ACCESS_FS_REFER
+_ _ _
+3 6.2 LANDLOCK_ACCESS_FS_TRUNCATE
.TE
.sp 1
.PP
@@ -302,7 +381,6 @@ in kernel logs.
It is currently not possible to restrict some file-related actions
accessible through these system call families:
.BR chdir (2),
-.BR truncate (2),
.BR stat (2),
.BR flock (2),
.BR chmod (2),
@@ -340,7 +418,8 @@ attr.handled_access_fs =
LANDLOCK_ACCESS_FS_MAKE_FIFO |
LANDLOCK_ACCESS_FS_MAKE_BLOCK |
LANDLOCK_ACCESS_FS_MAKE_SYM |
- LANDLOCK_ACCESS_FS_REFER;
+ LANDLOCK_ACCESS_FS_REFER |
+ LANDLOCK_ACCESS_FS_TRUNCATE;
ruleset_fd = landlock_create_ruleset(&attr, sizeof(attr), 0);
if (ruleset_fd == -1) {
--
2.39.2
^ permalink raw reply related [flat|nested] 9+ messages in thread* Re: [PATCH v3 2/2] landlock.7: Document Landlock ABI v3 (file truncation; Linux 6.2)
2023-03-04 17:16 ` [PATCH v3 2/2] landlock.7: Document Landlock ABI v3 (file truncation; Linux 6.2) Günther Noack
@ 2023-03-07 22:41 ` Mickaël Salaün
0 siblings, 0 replies; 9+ messages in thread
From: Mickaël Salaün @ 2023-03-07 22:41 UTC (permalink / raw)
To: Günther Noack, Alejandro Colomar; +Cc: Michael Kerrisk, linux-man
On 04/03/2023 18:16, Günther Noack wrote:
> https://git.kernel.org/torvalds/c/299e2b1967578b1442128ba8b3e86ed3427d3651
>
> Signed-off-by: Günther Noack <gnoack3000@gmail.com>
Reviewed-by: Mickaël Salaün <mic@digikod.net>
> ---
> man7/landlock.7 | 83 +++++++++++++++++++++++++++++++++++++++++++++++--
> 1 file changed, 81 insertions(+), 2 deletions(-)
>
> diff --git a/man7/landlock.7 b/man7/landlock.7
> index 1ab0a6cbc..f711000f1 100644
> --- a/man7/landlock.7
> +++ b/man7/landlock.7
> @@ -64,9 +64,39 @@ Execute a file.
> .TP
> .B LANDLOCK_ACCESS_FS_WRITE_FILE
> Open a file with write access.
> +.IP
> +When opening files for writing,
> +you will often additionally need the
> +.B LANDLOCK_ACCESS_FS_TRUNCATE
> +right.
> +In many cases,
> +these system calls truncate existing files when overwriting them
> +(e.g.,
> +.BR creat (2)).
> .TP
> .B LANDLOCK_ACCESS_FS_READ_FILE
> Open a file with read access.
> +.TP
> +.B LANDLOCK_ACCESS_FS_TRUNCATE
> +Truncate a file with
> +.BR truncate (2),
> +.BR ftruncate (2),
> +.BR creat (2),
> +or
> +.BR open (2)
> +with
> +.BR O_TRUNC .
> +Whether an opened file can be truncated with
> +.BR ftruncate (2)
> +is determined during
> +.BR open (2),
> +in the same way as read and write permissions are checked during
> +.BR open (2)
> +using
> +.B LANDLOCK_ACCESS_FS_READ_FILE
> +and
> +.BR LANDLOCK_ACCESS_FS_WRITE_FILE .
> +This access right is available since the third version of the Landlock ABI.
> .PP
> A directory can receive access rights related to files or directories.
> The following access right is applied to the directory itself,
> @@ -231,6 +261,53 @@ To be allowed to use
> and related syscalls on a target process,
> a sandboxed process should have a subset of the target process rules,
> which means the tracee must be in a sub-domain of the tracer.
> +.\"
> +.SS Truncating files
> +The operations covered by
> +.B LANDLOCK_ACCESS_FS_WRITE_FILE
> +and
> +.B LANDLOCK_ACCESS_FS_TRUNCATE
> +both change the contents of a file and sometimes overlap in
> +non-intuitive ways.
> +It is recommended to always specify both of these together.
> +.PP
> +A particularly surprising example is
> +.BR creat (2).
> +The name suggests that this system call requires
> +the rights to create and write files.
> +However, it also requires the truncate right
> +if an existing file under the same name is already present.
> +.PP
> +It should also be noted that truncating files does not require the
> +.B LANDLOCK_ACCESS_FS_WRITE_FILE
> +right.
> +Apart from the
> +.BR truncate (2)
> +system call, this can also be done through
> +.BR open (2)
> +with the flags
> +.IR "O_RDONLY\ |\ O_TRUNC" .
> +.PP
> +When opening a file, the availability of the
> +.B LANDLOCK_ACCESS_FS_TRUNCATE
> +right is associated with the newly created file descriptor
> +and will be used for subsequent truncation attempts using
> +.BR ftruncate (2).
> +The behavior is similar to opening a file for reading or writing,
> +where permissions are checked during
> +.BR open (2),
> +but not during the subsequent
> +.BR read (2)
> +and
> +.BR write (2)
> +calls.
> +.PP
> +As a consequence,
> +it is possible to have multiple open file descriptors for the same file,
> +where one grants the right to truncate the file and the other does not.
> +It is also possible to pass such file descriptors between processes,
> +keeping their Landlock properties,
> +even when these processes do not have an enforced Landlock ruleset.
> .SH VERSIONS
> Landlock was introduced in Linux 5.13.
> .PP
> @@ -257,6 +334,8 @@ _ _ _
> \^ \^ LANDLOCK_ACCESS_FS_MAKE_SYM
> _ _ _
> 2 5.19 LANDLOCK_ACCESS_FS_REFER
> +_ _ _
> +3 6.2 LANDLOCK_ACCESS_FS_TRUNCATE
> .TE
> .sp 1
> .PP
> @@ -302,7 +381,6 @@ in kernel logs.
> It is currently not possible to restrict some file-related actions
> accessible through these system call families:
> .BR chdir (2),
> -.BR truncate (2),
> .BR stat (2),
> .BR flock (2),
> .BR chmod (2),
> @@ -340,7 +418,8 @@ attr.handled_access_fs =
> LANDLOCK_ACCESS_FS_MAKE_FIFO |
> LANDLOCK_ACCESS_FS_MAKE_BLOCK |
> LANDLOCK_ACCESS_FS_MAKE_SYM |
> - LANDLOCK_ACCESS_FS_REFER;
> + LANDLOCK_ACCESS_FS_REFER |
> + LANDLOCK_ACCESS_FS_TRUNCATE;
>
> ruleset_fd = landlock_create_ruleset(&attr, sizeof(attr), 0);
> if (ruleset_fd == -1) {
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH v3 1/2] landlock.7: Document Landlock ABI v2 (file reparenting; Linux 5.19)
2023-03-04 17:16 [PATCH v3 1/2] landlock.7: Document Landlock ABI v2 (file reparenting; Linux 5.19) Günther Noack
2023-03-04 17:16 ` [PATCH v3 2/2] landlock.7: Document Landlock ABI v3 (file truncation; Linux 6.2) Günther Noack
@ 2023-03-05 10:24 ` Günther Noack
2023-03-07 22:16 ` Mickaël Salaün
2023-03-10 0:31 ` Alejandro Colomar
2023-03-07 22:40 ` Mickaël Salaün
2 siblings, 2 replies; 9+ messages in thread
From: Günther Noack @ 2023-03-05 10:24 UTC (permalink / raw)
To: Alejandro Colomar, Mickaël Salaün
Cc: Michael Kerrisk, linux-man, landlock
+landlock mailing list (feeback welcome)
Hello!
On Sat, Mar 04, 2023 at 06:16:06PM +0100, Günther Noack wrote:
> * Add LANDLOCK_ACCESS_FS_REFER to the code example.
To follow up on the discussion on the man page update v1 [1] -- let me
make a constructive proposal for a simpler code example for "best
effort" fallback in the man page.
I feel that implementing the full generic "best effort" fallback logic
would complicate the example too much:
(a) examples that try to demonstrate too many things at once
tend to become confusing to the reader
(b) there are readers to whom the full example might not matter:
- readers who know what kernel their software runs on
- readers in the future or on cutting-edge distributions
who can assume that their kernel is likely to be fresh enough
The main complication with the "best effort" logic is really just that
the "refer" right requires a different fallback logic, and this is
easy to overlook (has happened in multiple instances already).
I believe that many potential Landlock users, especially smaller
tools, probably do not need to reparent files ("refer").
We can group the existing Landlock use cases like this:
Case 1: Callers who know they *do not* need to reparent files
can skip the "refer" complications.
Case 2: Callers who know they *do* need to reparent files
need to fall back to no-op if the kernel only suppports ABI v1,
as reparenting files is always forbidden with ABI v1.
Case 3: Callers who *sometimes do and sometimes don't* reparent files
are the only ones where it's harder to implement.
I've put the required for code cases 1, 2, and 3 on my weblog at [2]
(skip to the "Implementation" section).
The complicated case 3 is what we need in the Go and Rust helper
libraries for Landlock, but it should hopefully not be needed for
most Landlock users who use it directly from C.
**This is how I think we should describe it in the man page**:
* Define the backwards compatibility table.
* Implement fallback logic for programs
which do *not* need to reparent files.
* Call it out prominently that the fallback code is different
if the program needs file reparenting, and explain that separately,
in the man page or elsewhere.
I believe this should cover the use cases for a large chunk of simple
Unix tools, and I would like to encourage the use of Landlock in
these. Readers should not have to adapt the example code to work in
their program.
Let me know what you think!
–Günther
[1] https://lore.kernel.org/linux-man/Y%2FcvfmEM1XEL%2FTPz@galopp/
[2] https://blog.gnoack.org/post/landlock-best-effort/
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [PATCH v3 1/2] landlock.7: Document Landlock ABI v2 (file reparenting; Linux 5.19)
2023-03-05 10:24 ` [PATCH v3 1/2] landlock.7: Document Landlock ABI v2 (file reparenting; Linux 5.19) Günther Noack
@ 2023-03-07 22:16 ` Mickaël Salaün
2023-03-10 0:31 ` Alejandro Colomar
1 sibling, 0 replies; 9+ messages in thread
From: Mickaël Salaün @ 2023-03-07 22:16 UTC (permalink / raw)
To: Günther Noack, Alejandro Colomar
Cc: Michael Kerrisk, linux-man, landlock
Thanks Günther. I agree with this approach. Let's start with a
common-enough example, and then point to exceptions. Targeting common
(and simple) utilities at first sounds reasonable.
On 05/03/2023 11:24, Günther Noack wrote:
> +landlock mailing list (feeback welcome)
>
> Hello!
>
> On Sat, Mar 04, 2023 at 06:16:06PM +0100, Günther Noack wrote:
>> * Add LANDLOCK_ACCESS_FS_REFER to the code example.
>
> To follow up on the discussion on the man page update v1 [1] -- let me
> make a constructive proposal for a simpler code example for "best
> effort" fallback in the man page.
>
> I feel that implementing the full generic "best effort" fallback logic
> would complicate the example too much:
>
> (a) examples that try to demonstrate too many things at once
> tend to become confusing to the reader
> (b) there are readers to whom the full example might not matter:
> - readers who know what kernel their software runs on
> - readers in the future or on cutting-edge distributions
> who can assume that their kernel is likely to be fresh enough
>
> The main complication with the "best effort" logic is really just that
> the "refer" right requires a different fallback logic, and this is
> easy to overlook (has happened in multiple instances already).
>
> I believe that many potential Landlock users, especially smaller
> tools, probably do not need to reparent files ("refer").
>
> We can group the existing Landlock use cases like this:
>
> Case 1: Callers who know they *do not* need to reparent files
> can skip the "refer" complications.
>
> Case 2: Callers who know they *do* need to reparent files
> need to fall back to no-op if the kernel only suppports ABI v1,
> as reparenting files is always forbidden with ABI v1.
>
> Case 3: Callers who *sometimes do and sometimes don't* reparent files
> are the only ones where it's harder to implement.
>
> I've put the required for code cases 1, 2, and 3 on my weblog at [2]
> (skip to the "Implementation" section).
>
> The complicated case 3 is what we need in the Go and Rust helper
> libraries for Landlock, but it should hopefully not be needed for
> most Landlock users who use it directly from C.
>
>
> **This is how I think we should describe it in the man page**:
>
> * Define the backwards compatibility table.
> * Implement fallback logic for programs
> which do *not* need to reparent files.
> * Call it out prominently that the fallback code is different
> if the program needs file reparenting, and explain that separately,
> in the man page or elsewhere.
>
> I believe this should cover the use cases for a large chunk of simple
> Unix tools, and I would like to encourage the use of Landlock in
> these. Readers should not have to adapt the example code to work in
> their program.
>
> Let me know what you think!
> –Günther
>
> [1] https://lore.kernel.org/linux-man/Y%2FcvfmEM1XEL%2FTPz@galopp/
> [2] https://blog.gnoack.org/post/landlock-best-effort/
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [PATCH v3 1/2] landlock.7: Document Landlock ABI v2 (file reparenting; Linux 5.19)
2023-03-05 10:24 ` [PATCH v3 1/2] landlock.7: Document Landlock ABI v2 (file reparenting; Linux 5.19) Günther Noack
2023-03-07 22:16 ` Mickaël Salaün
@ 2023-03-10 0:31 ` Alejandro Colomar
2023-03-10 21:31 ` Günther Noack
1 sibling, 1 reply; 9+ messages in thread
From: Alejandro Colomar @ 2023-03-10 0:31 UTC (permalink / raw)
To: Günther Noack, Mickaël Salaün; +Cc: linux-man, landlock
[-- Attachment #1.1: Type: text/plain, Size: 1233 bytes --]
Hello Günther!
On 3/5/23 11:24, Günther Noack wrote:
> +landlock mailing list (feeback welcome)
>
> Hello!
>
> On Sat, Mar 04, 2023 at 06:16:06PM +0100, Günther Noack wrote:
>> * Add LANDLOCK_ACCESS_FS_REFER to the code example.
>
> To follow up on the discussion on the man page update v1 [1] -- let me
> make a constructive proposal for a simpler code example for "best
> effort" fallback in the man page.
>
> I feel that implementing the full generic "best effort" fallback logic
> would complicate the example too much:
>
> (a) examples that try to demonstrate too many things at once
> tend to become confusing to the reader
> (b) there are readers to whom the full example might not matter:
> - readers who know what kernel their software runs on
> - readers in the future or on cutting-edge distributions
> who can assume that their kernel is likely to be fresh enough
I prefer if examples assume latest and greatest kernel.
Examples of how to support old kernels would be good in complete
tutorials, but over-complicate a short example.
Cheers,
Alex
--
<http://www.alejandro-colomar.es/>
GPG key fingerprint: A9348594CE31283A826FBDD8D57633D441E25BB5
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH v3 1/2] landlock.7: Document Landlock ABI v2 (file reparenting; Linux 5.19)
2023-03-10 0:31 ` Alejandro Colomar
@ 2023-03-10 21:31 ` Günther Noack
0 siblings, 0 replies; 9+ messages in thread
From: Günther Noack @ 2023-03-10 21:31 UTC (permalink / raw)
To: Alejandro Colomar; +Cc: Mickaël Salaün, linux-man, landlock
Hello Alex!
On Fri, Mar 10, 2023 at 01:31:22AM +0100, Alejandro Colomar wrote:
> On 3/5/23 11:24, Günther Noack wrote:
> > I feel that implementing the full generic "best effort" fallback logic
> > would complicate the example too much:
> >
> > [...]
>
> I prefer if examples assume latest and greatest kernel.
>
> Examples of how to support old kernels would be good in complete
> tutorials, but over-complicate a short example.
Thank you for the review!
Fair enough, let's use the variant then where we just assume the
newest kernel -- that is the code which we already have right now, in
fact. I'll add a small remark to point out the place where people
might want to handle the backwards compatibility with older kernels.
–-Günther
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH v3 1/2] landlock.7: Document Landlock ABI v2 (file reparenting; Linux 5.19)
2023-03-04 17:16 [PATCH v3 1/2] landlock.7: Document Landlock ABI v2 (file reparenting; Linux 5.19) Günther Noack
2023-03-04 17:16 ` [PATCH v3 2/2] landlock.7: Document Landlock ABI v3 (file truncation; Linux 6.2) Günther Noack
2023-03-05 10:24 ` [PATCH v3 1/2] landlock.7: Document Landlock ABI v2 (file reparenting; Linux 5.19) Günther Noack
@ 2023-03-07 22:40 ` Mickaël Salaün
2023-03-10 21:24 ` Günther Noack
2 siblings, 1 reply; 9+ messages in thread
From: Mickaël Salaün @ 2023-03-07 22:40 UTC (permalink / raw)
To: Günther Noack, Alejandro Colomar; +Cc: Michael Kerrisk, linux-man
On 04/03/2023 18:16, Günther Noack wrote:
> * Add the description for LANDLOCK_ACCESS_FS_REFER,
> in line with recent update to the uapi headers:
> https://lore.kernel.org/linux-security-module/20230202204623.10345-1-gnoack3000@gmail.com/T/
> * VERSIONS: Add a table of Landlock versions and their changes.
> Briefly talk about how to probe ABI levels and warn users about the
> special semantics of the LANDLOCK_ACCESS_FS_REFER right.
> * Add LANDLOCK_ACCESS_FS_REFER to the code example.
>
> Code review threads for the "refer" feature:
> * https://lore.kernel.org/all/20220506161102.525323-1-mic@digikod.net/ (initial commit)
> * https://lore.kernel.org/all/20220823144123.633721-1-mic@digikod.net/ (bugfix)
You can replace these links with
https://git.kernel.org/torvalds/c/cb44e4f061e16be65b8a16505e121490c66d30d0
I don't think the fix is worth mentioning because it doesn't change the
documentation
> * https://lore.kernel.org/all/20230221165205.4231-1-gnoack3000@gmail.com/ (documentation update)
FYI, this patch is in my -next tree and will be merged with the next
release.
>
> Signed-off-by: Günther Noack <gnoack3000@gmail.com>
Reviewed-by: Mickaël Salaün <mic@digikod.net>
> ---
> man7/landlock.7 | 102 +++++++++++++++++++++++++++++++++++++++++++++++-
> 1 file changed, 100 insertions(+), 2 deletions(-)
>
> diff --git a/man7/landlock.7 b/man7/landlock.7
> index b2bc9e10b..1ab0a6cbc 100644
> --- a/man7/landlock.7
> +++ b/man7/landlock.7
> @@ -105,6 +105,56 @@ Create (or rename or link) a block device.
> .TP
> .B LANDLOCK_ACCESS_FS_MAKE_SYM
> Create (or rename or link) a symbolic link.
> +.TP
> +.B LANDLOCK_ACCESS_FS_REFER
> +Link or rename a file from or to a different directory
> +(i.e. reparent a file hierarchy).
> +.IP
> +This access right is available since the second version of the Landlock ABI.
> +.IP
> +This is the only access right which is denied by default by any ruleset,
> +even if the right is not specified as handled at ruleset creation time.
> +The only way to make a ruleset grant this right
> +is to explicitly allow it for a specific directory
> +by adding a matching rule to the ruleset.
> +.IP
> +In particular, when using the first Landlock ABI version,
> +Landlock will always deny attempts to reparent files
> +between different directories.
> +.IP
> +In addition to the source and destination directories having the
> +.B LANDLOCK_ACCESS_FS_REFER
> +access right,
> +the attempted link or rename operation must meet the following constraints:
> +.RS
> +.IP \[bu] 3
> +The reparented file may not gain more access rights in the destination directory
> +than it previously had in the source directory.
> +If this is attempted, the operation results in an
> +.B EXDEV
> +error.
> +.IP \[bu]
> +When linking or renaming, the
> +.BI LANDLOCK_ACCESS_FS_MAKE_ *
> +right for the respective file type must be granted
> +for the destination directory.
> +Otherwise, the operation results in an
> +.BR EACCES
> +error.
> +.IP \[bu]
> +When renaming, the
> +.BI LANDLOCK_ACCESS_FS_REMOVE_ *
> +right for the respective file type must be granted
> +for the source directory.
> +Otherwise, the operation results in an
> +.B EACCES
> +error.
> +.RE
> +.IP
> +If multiple requirements are not met, the
> +.B EACCES
> +error code takes precedence over
> +.BR EXDEV .
> .\"
> .SS Layers of file path access rights
> Each time a thread enforces a ruleset on itself,
> @@ -182,7 +232,54 @@ and related syscalls on a target process,
> a sandboxed process should have a subset of the target process rules,
> which means the tracee must be in a sub-domain of the tracer.
> .SH VERSIONS
> -Landlock was added in Linux 5.13.
> +Landlock was introduced in Linux 5.13.
> +.PP
> +To determine which Landlock features are available,
> +users should query the Landlock ABI version:
> +.TS
> +box;
> +ntb| ntb| lbx
> +nt| nt| lbx.
> +ABI Kernel Newly introduced access rights
> +_ _ _
> +1 5.13 LANDLOCK_ACCESS_FS_EXECUTE
> +\^ \^ LANDLOCK_ACCESS_FS_WRITE_FILE
> +\^ \^ LANDLOCK_ACCESS_FS_READ_FILE
> +\^ \^ LANDLOCK_ACCESS_FS_READ_DIR
> +\^ \^ LANDLOCK_ACCESS_FS_REMOVE_DIR
> +\^ \^ LANDLOCK_ACCESS_FS_REMOVE_FILE
> +\^ \^ LANDLOCK_ACCESS_FS_MAKE_CHAR
> +\^ \^ LANDLOCK_ACCESS_FS_MAKE_DIR
> +\^ \^ LANDLOCK_ACCESS_FS_MAKE_REG
> +\^ \^ LANDLOCK_ACCESS_FS_MAKE_SOCK
> +\^ \^ LANDLOCK_ACCESS_FS_MAKE_FIFO
> +\^ \^ LANDLOCK_ACCESS_FS_MAKE_BLOCK
> +\^ \^ LANDLOCK_ACCESS_FS_MAKE_SYM
> +_ _ _
> +2 5.19 LANDLOCK_ACCESS_FS_REFER
> +.TE
> +.sp 1
> +.PP
> +Users should use the Landlock ABI version rather than the kernel version
> +to determine which features are available.
> +The mainline kernel versions listed here are only included for orientation.
> +Kernels from other sources may contain backported features,
> +and their version numbers may not match.
> +.PP
> +To query the running kernel's Landlock ABI version,
> +programs may pass the
> +.B LANDLOCK_CREATE_RULESET_VERSION
> +flag to
> +.BR landlock_create_ruleset (2).
> +.PP
> +When building fallback mechanisms for compatibility with older kernels,
> +users are advised to consider the special semantics of the
> +.B LANDLOCK_ACCESS_FS_REFER
> +access right:
> +In ABI v1,
> +linking and moving of files between different directories is always forbidden,
> +so programs relying on such operations are only compatible
> +with Landlock ABI v2 and higher.
> .SH NOTES
> Landlock is enabled by
> .BR CONFIG_SECURITY_LANDLOCK .
> @@ -242,7 +339,8 @@ attr.handled_access_fs =
> LANDLOCK_ACCESS_FS_MAKE_SOCK |
> LANDLOCK_ACCESS_FS_MAKE_FIFO |
> LANDLOCK_ACCESS_FS_MAKE_BLOCK |
> - LANDLOCK_ACCESS_FS_MAKE_SYM;
> + LANDLOCK_ACCESS_FS_MAKE_SYM |
> + LANDLOCK_ACCESS_FS_REFER;
>
> ruleset_fd = landlock_create_ruleset(&attr, sizeof(attr), 0);
> if (ruleset_fd == -1) {
>
> base-commit: 184ecd225079567aa3dede2b63c7ddf962cfdbdf
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [PATCH v3 1/2] landlock.7: Document Landlock ABI v2 (file reparenting; Linux 5.19)
2023-03-07 22:40 ` Mickaël Salaün
@ 2023-03-10 21:24 ` Günther Noack
0 siblings, 0 replies; 9+ messages in thread
From: Günther Noack @ 2023-03-10 21:24 UTC (permalink / raw)
To: Mickaël Salaün; +Cc: Alejandro Colomar, Michael Kerrisk, linux-man
On Tue, Mar 07, 2023 at 11:40:53PM +0100, Mickaël Salaün wrote:
> On 04/03/2023 18:16, Günther Noack wrote:
> > Code review threads for the "refer" feature:
> > * https://lore.kernel.org/all/20220506161102.525323-1-mic@digikod.net/ (initial commit)
> > * https://lore.kernel.org/all/20220823144123.633721-1-mic@digikod.net/ (bugfix)
>
> You can replace these links with
> https://git.kernel.org/torvalds/c/cb44e4f061e16be65b8a16505e121490c66d30d0
> I don't think the fix is worth mentioning because it doesn't change the
> documentation
Thanks, applied.
> > * https://lore.kernel.org/all/20230221165205.4231-1-gnoack3000@gmail.com/ (documentation update)
>
> FYI, this patch is in my -next tree and will be merged with the next
> release.
Ack, thanks.
> > Signed-off-by: Günther Noack <gnoack3000@gmail.com>
>
> Reviewed-by: Mickaël Salaün <mic@digikod.net>
Applied.
–-Günther
^ permalink raw reply [flat|nested] 9+ messages in thread