Re: [PATCH v1 0/5] Landlock support for UML

Mickaël Salaün
2023-03-21T21:18:30Z

Richard, Anton, Johannes, what do you think about these UML changes?

On 09/03/2023 17:54, Mickaël Salaün wrote:
> Hi,
>
> Commit cb2c7d1a1776 ("landlock: Support filesystem access-control")
> introduced a new ARCH_EPHEMERAL_INODES configuration, only enabled for
> User-Mode Linux. The reason was that UML's hostfs managed inodes in an
> ephemeral way: from the kernel point of view, the same inode struct
> could be created several times while being used by user space because
> the kernel didn't hold references to inodes. Because Landlock (and
> probably other subsystems) ties properties (i.e. access rights) to inode
> objects, it wasn't possible to create rules that match inodes and then
> allow specific accesses.
>
> This patch series fixes the way UML manages inodes according to the
> underlying filesystem. They are now properly handles as for other
> filesystems, which enables to support Landlock (and probably other
> features).
>
> Backporting these patches requires some selftest harness patches
> backports too.
>
> Regards,
>
> Mickaël Salaün (5):
> hostfs: Fix ephemeral inodes
> selftests/landlock: Don't create useless file layouts
> selftests/landlock: Add supports_filesystem() helper
> selftests/landlock: Make mounts configurable
> selftests/landlock: Add tests for pseudo filesystems
>
> arch/Kconfig | 7 -
> arch/um/Kconfig | 1 -
> fs/hostfs/hostfs.h | 1 +
> fs/hostfs/hostfs_kern.c | 213 ++++++------
> fs/hostfs/hostfs_user.c | 1 +
> security/landlock/Kconfig | 2 +-
> tools/testing/selftests/landlock/config | 8 +-
> tools/testing/selftests/landlock/fs_test.c | 381 +++++++++++++++++++--
> 8 files changed, 472 insertions(+), 142 deletions(-)
>
>
> base-commit: fe15c26ee26efa11741a7b632e9f23b01aca4cc6