From: David Laight <David.Laight@ACULAB.COM>
To: "'Mikhail Ivanov'" <ivanov.mikhail1@huawei-partners.com>,
"Mickaël Salaün" <mic@digikod.net>,
"Matthieu Baerts" <matttbe@kernel.org>,
"linux-sctp@vger.kernel.org" <linux-sctp@vger.kernel.org>
Cc: "gnoack@google.com" <gnoack@google.com>,
"willemdebruijn.kernel@gmail.com"
<willemdebruijn.kernel@gmail.com>,
"matthieu@buffet.re" <matthieu@buffet.re>,
"linux-security-module@vger.kernel.org"
<linux-security-module@vger.kernel.org>,
"netdev@vger.kernel.org" <netdev@vger.kernel.org>,
"netfilter-devel@vger.kernel.org"
<netfilter-devel@vger.kernel.org>,
"yusongping@huawei.com" <yusongping@huawei.com>,
"artem.kuzin@huawei.com" <artem.kuzin@huawei.com>,
"konstantin.meskhidze@huawei.com"
<konstantin.meskhidze@huawei.com>,
"MPTCP Linux" <mptcp@lists.linux.dev>
Subject: RE: [RFC PATCH v2 1/8] landlock: Fix non-TCP sockets restriction
Date: Fri, 8 Nov 2024 17:16:50 +0000 [thread overview]
Message-ID: <ed94e1e51c4545a7b4be6a756dcdc44d@AcuMS.aculab.com> (raw)
In-Reply-To: <62336067-18c2-3493-d0ec-6dd6a6d3a1b5@huawei-partners.com>
From: Mikhail Ivanov
> Sent: 31 October 2024 16:22
>
> On 10/18/2024 9:08 PM, Mickaël Salaün wrote:
> > On Thu, Oct 17, 2024 at 02:59:48PM +0200, Matthieu Baerts wrote:
> >> Hi Mikhail and Landlock maintainers,
> >>
> >> +cc MPTCP list.
> >
> > Thanks, we should include this list in the next series.
> >
> >>
> >> On 17/10/2024 13:04, Mikhail Ivanov wrote:
> >>> Do not check TCP access right if socket protocol is not IPPROTO_TCP.
> >>> LANDLOCK_ACCESS_NET_BIND_TCP and LANDLOCK_ACCESS_NET_CONNECT_TCP
> >>> should not restrict bind(2) and connect(2) for non-TCP protocols
> >>> (SCTP, MPTCP, SMC).
I suspect you should check all IP protocols.
After all if TCP is banned why should SCTP be allowed?
Maybe you should have a different (probably more severe) restriction on SCTP.
You'd also need to look at the socket options used to add additional
local and remote IP addresses to a connect attempt.
David
-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)
next prev parent reply other threads:[~2024-11-08 17:16 UTC|newest]
Thread overview: 50+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-10-17 11:04 [RFC PATCH v2 0/8] Fix non-TCP restriction and inconsistency of TCP errors Mikhail Ivanov
2024-10-17 11:04 ` [RFC PATCH v2 1/8] landlock: Fix non-TCP sockets restriction Mikhail Ivanov
2024-10-17 12:59 ` Matthieu Baerts
2024-10-18 18:08 ` Mickaël Salaün
2024-10-31 16:21 ` Mikhail Ivanov
2024-11-08 17:16 ` David Laight [this message]
2024-12-04 19:29 ` Mickaël Salaün
2024-12-12 18:43 ` Mickaël Salaün
2024-12-13 18:19 ` Mikhail Ivanov
2025-01-24 15:02 ` Mickaël Salaün
2025-01-27 12:40 ` Mikhail Ivanov
2025-01-27 19:48 ` Mickaël Salaün
2025-01-28 10:56 ` Mikhail Ivanov
2025-01-28 18:14 ` Matthieu Baerts
2025-01-29 9:52 ` Mikhail Ivanov
2025-01-29 10:25 ` Matthieu Baerts
2025-01-29 11:02 ` Mikhail Ivanov
2025-01-29 11:33 ` Matthieu Baerts
2025-01-29 11:47 ` Mikhail Ivanov
2025-01-29 11:57 ` Matthieu Baerts
2025-01-29 14:51 ` Mickaël Salaün
2025-01-29 15:44 ` Matthieu Baerts
2025-01-30 9:51 ` Mickaël Salaün
2025-01-30 10:18 ` Matthieu Baerts
2025-01-31 11:04 ` Mikhail Ivanov
2024-12-04 19:27 ` Mickaël Salaün
2024-12-04 19:35 ` Mickaël Salaün
2024-12-09 10:19 ` Mikhail Ivanov
2024-12-10 18:04 ` Mickaël Salaün
2024-12-10 18:05 ` Mickaël Salaün
2024-12-11 15:24 ` Mikhail Ivanov
2024-12-12 18:43 ` Mickaël Salaün
2024-12-13 11:42 ` Mikhail Ivanov
2024-12-04 19:30 ` Mickaël Salaün
2024-12-09 10:19 ` Mikhail Ivanov
2024-10-17 11:04 ` [RFC PATCH v2 2/8] landlock: Make network stack layer checks explicit for each TCP action Mikhail Ivanov
2024-10-17 11:04 ` [RFC PATCH v2 3/8] landlock: Fix inconsistency of errors for TCP actions Mikhail Ivanov
2024-10-17 11:34 ` Mikhail Ivanov
2024-10-17 12:48 ` Tetsuo Handa
2024-11-06 9:27 ` Mikhail Ivanov
2024-12-04 19:32 ` Mickaël Salaün
2024-10-17 11:04 ` [RFC PATCH v2 4/8] selftests/landlock: Test TCP accesses with protocol=IPPROTO_TCP Mikhail Ivanov
2024-10-17 11:04 ` [RFC PATCH v2 5/8] selftests/landlock: Test that MPTCP actions are not restricted Mikhail Ivanov
2024-10-17 11:04 ` [RFC PATCH v2 6/8] selftests/landlock: Test consistency of errors for TCP actions Mikhail Ivanov
2024-12-10 18:07 ` Mickaël Salaün
2024-12-11 15:29 ` Mikhail Ivanov
2024-10-17 11:04 ` [RFC PATCH v2 7/8] landlock: Add note about errors consistency in documentation Mikhail Ivanov
2024-12-10 18:08 ` Mickaël Salaün
2024-12-11 15:30 ` Mikhail Ivanov
2024-10-17 11:04 ` [RFC PATCH v2 8/8] selftests/landlock: Test that SCTP actions are not restricted Mikhail Ivanov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ed94e1e51c4545a7b4be6a756dcdc44d@AcuMS.aculab.com \
--to=david.laight@aculab.com \
--cc=artem.kuzin@huawei.com \
--cc=gnoack@google.com \
--cc=ivanov.mikhail1@huawei-partners.com \
--cc=konstantin.meskhidze@huawei.com \
--cc=linux-sctp@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=matthieu@buffet.re \
--cc=matttbe@kernel.org \
--cc=mic@digikod.net \
--cc=mptcp@lists.linux.dev \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=willemdebruijn.kernel@gmail.com \
--cc=yusongping@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).