public inbox for linux-security-module@vger.kernel.org
 help / color / mirror / Atom feed
From: Jeffrey Bencteux <jeff@bencteux.fr>
To: mic@digikod.net, gnoack@google.com, paul@paul-moore.com,
	jmorris@namei.org, serge@hallyn.com
Cc: linux-security-module@vger.kernel.org, jeff@bencteux.fr
Subject: landlock: Add support for chmod and chown system calls families
Date: Sun, 12 Apr 2026 11:50:39 +0200	[thread overview]
Message-ID: <20260412095233.34306-1-jeff@bencteux.fr> (raw)

Hi,

This patch serie add support for chmod and chown system calls families
in Landlock.

These system calls could be used when exploiting applications. Two new
flags are added for struct landlock_ruleset_attr:

* LANDLOCK_ACCESS_FS_CHMOD
* LANDLOCK_ACCESS_FS_CHOWN

Restriction is limited to files as the security.c hooks for both
system calls seem to only applies to files. More digging is needed
before being able to restrict calls to chmod and chown on directories.

It adds basic tests for both family operations, one for when it is
allowed, one for when it is not.

First patch also fixes a bug I encountered when writing the tests.


             reply	other threads:[~2026-04-12 10:08 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-04-12  9:50 Jeffrey Bencteux [this message]
2026-04-12  9:50 ` [PATCH 1/5] selftests/landlock: fix return condition on create_directory Jeffrey Bencteux
2026-04-12  9:50 ` [PATCH 2/5] landlock: add support for chmod and chown Jeffrey Bencteux
2026-04-12  9:50 ` [PATCH 3/5] selftests/landlock: add tests for chmod and chown restrictions Jeffrey Bencteux
2026-04-12  9:50 ` [PATCH 4/5] samples/landlock: add support for chown and chmod Jeffrey Bencteux
2026-04-12  9:50 ` [PATCH 5/5] landlock: Document chmod and chown support in example code Jeffrey Bencteux
2026-04-13 12:36 ` landlock: Add support for chmod and chown system calls families Günther Noack
2026-04-13 19:51   ` Jeffrey Bencteux

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260412095233.34306-1-jeff@bencteux.fr \
    --to=jeff@bencteux.fr \
    --cc=gnoack@google.com \
    --cc=jmorris@namei.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=mic@digikod.net \
    --cc=paul@paul-moore.com \
    --cc=serge@hallyn.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox