Re: [PATCH 4/6] landlock: Mediate CAP_SYS_ADMIN for the admin memory reserve

[sashiko-bot@kernel.org]

> With vm.overcommit_memory set to 2, __vm_enough_memory() keeps the
> vm.admin_reserve_kbytes reserve for callers whose LSMs all agree that
> they hold CAP_SYS_ADMIN.  cap_vm_enough_memory() checks it with
> cap_capable(), so a process in a domain that denies CAP_SYS_ADMIN could
> still use this reserve, which is meant to let an administrator recover
> from memory exhaustion.
> 
> Add a Landlock vm_enough_memory hook that withholds the reserve when the
> domain denies CAP_SYS_ADMIN.  Like commoncap and SELinux, do not audit
> this check: it only selects a limit, it runs for every accounted
> mapping, and withholding the reserve can only make an allocation fail
> with -ENOMEM.  As with the previous hooks, LSMs implement their own
> policy in this hook: SELinux already checks CAP_SYS_ADMIN in its own
> vm_enough_memory hook, so making commoncap call security_capable() would
> make SELinux check it twice.
> 
> Cc: Günther Noack <gnoack@google.com>
> Cc: Paul Moore <paul@paul-moore.com>
> Cc: Serge Hallyn <serge@hallyn.com>
> Reported-by: Ada Smith <adasmithgt@gmail.com>
> Fixes: 97c8386f1d74 ("landlock: Enforce capability restrictions")
> Signed-off-by: Mickaël Salaün <mic@digikod.net>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261110202436.2408244-1-mic@digikod.net?part=4