From: David Laight <David.Laight@ACULAB.COM>
To: "'Mikhail Ivanov'" <ivanov.mikhail1@huawei-partners.com>,
"Mickaël Salaün" <mic@digikod.net>,
"Matthieu Baerts" <matttbe@kernel.org>,
"linux-sctp@vger.kernel.org" <linux-sctp@vger.kernel.org>
Cc: "gnoack@google.com" <gnoack@google.com>,
"willemdebruijn.kernel@gmail.com"
<willemdebruijn.kernel@gmail.com>,
"matthieu@buffet.re" <matthieu@buffet.re>,
"linux-security-module@vger.kernel.org"
<linux-security-module@vger.kernel.org>,
"netdev@vger.kernel.org" <netdev@vger.kernel.org>,
"netfilter-devel@vger.kernel.org"
<netfilter-devel@vger.kernel.org>,
"yusongping@huawei.com" <yusongping@huawei.com>,
"artem.kuzin@huawei.com" <artem.kuzin@huawei.com>,
"konstantin.meskhidze@huawei.com"
<konstantin.meskhidze@huawei.com>,
"MPTCP Linux" <mptcp@lists.linux.dev>
Subject: RE: [RFC PATCH v2 1/8] landlock: Fix non-TCP sockets restriction
Date: Fri, 8 Nov 2024 17:16:50 +0000 [thread overview]
Message-ID: <ed94e1e51c4545a7b4be6a756dcdc44d@AcuMS.aculab.com> (raw)
In-Reply-To: <62336067-18c2-3493-d0ec-6dd6a6d3a1b5@huawei-partners.com>
From: Mikhail Ivanov
> Sent: 31 October 2024 16:22
>
> On 10/18/2024 9:08 PM, Mickaël Salaün wrote:
> > On Thu, Oct 17, 2024 at 02:59:48PM +0200, Matthieu Baerts wrote:
> >> Hi Mikhail and Landlock maintainers,
> >>
> >> +cc MPTCP list.
> >
> > Thanks, we should include this list in the next series.
> >
> >>
> >> On 17/10/2024 13:04, Mikhail Ivanov wrote:
> >>> Do not check TCP access right if socket protocol is not IPPROTO_TCP.
> >>> LANDLOCK_ACCESS_NET_BIND_TCP and LANDLOCK_ACCESS_NET_CONNECT_TCP
> >>> should not restrict bind(2) and connect(2) for non-TCP protocols
> >>> (SCTP, MPTCP, SMC).
I suspect you should check all IP protocols.
After all if TCP is banned why should SCTP be allowed?
Maybe you should have a different (probably more severe) restriction on SCTP.
You'd also need to look at the socket options used to add additional
local and remote IP addresses to a connect attempt.
David
-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)
next parent reply other threads:[~2024-11-08 17:16 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20241017110454.265818-1-ivanov.mikhail1@huawei-partners.com>
[not found] ` <20241017110454.265818-2-ivanov.mikhail1@huawei-partners.com>
[not found] ` <49bc2227-d8e1-4233-8bc4-4c2f0a191b7c@kernel.org>
[not found] ` <20241018.Kahdeik0aaCh@digikod.net>
[not found] ` <62336067-18c2-3493-d0ec-6dd6a6d3a1b5@huawei-partners.com>
2024-11-08 17:16 ` David Laight [this message]
2024-12-04 19:29 ` [RFC PATCH v2 1/8] landlock: Fix non-TCP sockets restriction Mickaël Salaün
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ed94e1e51c4545a7b4be6a756dcdc44d@AcuMS.aculab.com \
--to=david.laight@aculab.com \
--cc=artem.kuzin@huawei.com \
--cc=gnoack@google.com \
--cc=ivanov.mikhail1@huawei-partners.com \
--cc=konstantin.meskhidze@huawei.com \
--cc=linux-sctp@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=matthieu@buffet.re \
--cc=matttbe@kernel.org \
--cc=mic@digikod.net \
--cc=mptcp@lists.linux.dev \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=willemdebruijn.kernel@gmail.com \
--cc=yusongping@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).