From: Demi Marie Obenour <demiobenour@gmail.com>
To: "Günther Noack" <gnoack3000@gmail.com>,
"Mickaël Salaün" <mic@digikod.net>,
"Paul Moore" <paul@paul-moore.com>
Cc: linux-security-module@vger.kernel.org,
Tingmao Wang <m@maowtm.org>,
Justin Suess <utilityemal77@gmail.com>,
Samasth Norway Ananda <samasth.norway.ananda@oracle.com>,
Matthieu Buffet <matthieu@buffet.re>,
Mikhail Ivanov <ivanov.mikhail1@huawei-partners.com>,
konstantin.meskhidze@huawei.com, Alyssa Ross <hi@alyssa.is>,
Jann Horn <jannh@google.com>,
Tahera Fahimi <fahimitahera@gmail.com>
Subject: Re: [RFC PATCH 0/5] landlock: Pathname-based UNIX connect() control
Date: Thu, 1 Jan 2026 17:14:40 -0500 [thread overview]
Message-ID: <61a6be66-a9bd-4d68-98ed-29aac65b7dfb@gmail.com> (raw)
In-Reply-To: <20260101134102.25938-1-gnoack3000@gmail.com>
[-- Attachment #1.1.1: Type: text/plain, Size: 432 bytes --]
On 1/1/26 08:40, Günther Noack wrote:
> Happy New Year!
>
> This patch set introduces a file-system-based Landlock restriction
> mechanism for connecting to Unix sockets.
(snip)
Does this leave directory traversal as the only missing Landlock
filesystem access control? Ideally Landlock could provide the same
isolation from the filesystem that mount namespaces do.
--
Sincerely,
Demi Marie Obenour (she/her/hers)
[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 7253 bytes --]
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
next prev parent reply other threads:[~2026-01-01 22:14 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-01-01 13:40 [RFC PATCH 0/5] landlock: Pathname-based UNIX connect() control Günther Noack
2026-01-01 13:40 ` [RFC PATCH 1/5] landlock/selftests: add a missing close(srv_fd) call Günther Noack
2026-01-01 13:40 ` [RFC PATCH 2/5] landlock: Control connections to pathname UNIX sockets by path Günther Noack
2026-01-01 13:41 ` [RFC PATCH 3/5] samples/landlock: Add support for LANDLOCK_ACCESS_FS_CONNECT_UNIX Günther Noack
2026-01-01 19:30 ` Justin Suess
2026-01-01 22:07 ` Tingmao Wang
2026-01-01 22:11 ` Demi Marie Obenour
2026-01-01 22:19 ` Tingmao Wang
2026-01-01 22:36 ` Demi Marie Obenour
2026-01-01 22:38 ` Justin Suess
2026-01-01 22:39 ` Demi Marie Obenour
2026-01-02 9:53 ` Günther Noack
2026-01-01 13:41 ` [RFC PATCH 4/5] landlock/selftests: test LANDLOCK_ACCESS_FS_CONNECT_UNIX Günther Noack
2026-01-01 13:41 ` [RFC PATCH 5/5] landlock: Document LANDLOCK_ACCESS_FS_UNIX_CONNECT Günther Noack
2026-01-01 22:14 ` Demi Marie Obenour [this message]
2026-01-01 22:34 ` [RFC PATCH 0/5] landlock: Pathname-based UNIX connect() control Tingmao Wang
2026-01-01 22:44 ` Demi Marie Obenour
2026-01-02 10:16 ` Günther Noack
2026-01-02 10:25 ` Günther Noack
2026-01-02 10:27 ` Demi Marie Obenour
2026-01-02 10:50 ` Günther Noack
2026-01-02 18:37 ` Demi Marie Obenour
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=61a6be66-a9bd-4d68-98ed-29aac65b7dfb@gmail.com \
--to=demiobenour@gmail.com \
--cc=fahimitahera@gmail.com \
--cc=gnoack3000@gmail.com \
--cc=hi@alyssa.is \
--cc=ivanov.mikhail1@huawei-partners.com \
--cc=jannh@google.com \
--cc=konstantin.meskhidze@huawei.com \
--cc=linux-security-module@vger.kernel.org \
--cc=m@maowtm.org \
--cc=matthieu@buffet.re \
--cc=mic@digikod.net \
--cc=paul@paul-moore.com \
--cc=samasth.norway.ananda@oracle.com \
--cc=utilityemal77@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).