Re: [PATCH v24 02/12] landlock: Add ruleset and domain management

2020-11-21 Thread Mickaël Salaün
On 21/11/2020 08:00, Jann Horn wrote: > On Thu, Nov 12, 2020 at 9:51 PM Mickaël Salaün wrote: >> A Landlock ruleset is mainly a red-black tree with Landlock rules as >> nodes. This enables quick update and lookup to match a requested >> access, e.g. to a file. A ruleset is usable through a ded

Re: [PATCH v24 02/12] landlock: Add ruleset and domain management

2020-11-20 Thread Jann Horn
On Thu, Nov 12, 2020 at 9:51 PM Mickaël Salaün wrote: > A Landlock ruleset is mainly a red-black tree with Landlock rules as > nodes. This enables quick update and lookup to match a requested > access, e.g. to a file. A ruleset is usable through a dedicated file > descriptor (cf. following commi

Re: [PATCH v24 02/12] landlock: Add ruleset and domain management

2020-11-19 Thread James Morris
On Thu, 12 Nov 2020, Mickaël Salaün wrote: > Cc: James Morris > Cc: Jann Horn > Cc: Kees Cook > Cc: Serge E. Hallyn > Signed-off-by: Mickaël Salaün > --- > > Changes since v23: > * Always intersect access rights. Following the filesystem change > logic, make ruleset updates more consisten

[PATCH v24 02/12] landlock: Add ruleset and domain management

2020-11-12 Thread Mickaël Salaün
From: Mickaël Salaün A Landlock ruleset is mainly a red-black tree with Landlock rules as nodes. This enables quick update and lookup to match a requested access, e.g. to a file. A ruleset is usable through a dedicated file descriptor (cf. following commit implementing syscalls) which enables a