Re: [PATCH v30 07/12] landlock: Support filesystem access-control

2021-03-23 Thread Jann Horn
On Tue, Mar 23, 2021 at 8:22 PM Mickaël Salaün wrote: > On 23/03/2021 18:49, Jann Horn wrote: > > On Tue, Mar 23, 2021 at 4:54 PM Mickaël Salaün wrote: > >> On 23/03/2021 01:13, Jann Horn wrote: > >>> On Tue, Mar 16, 2021 at 9:43 PM Mickaël Salaün wrote: > Using Landlock objects and rulese

Re: [PATCH v30 07/12] landlock: Support filesystem access-control

2021-03-23 Thread Mickaël Salaün
On 19/03/2021 20:19, Mickaël Salaün wrote: > > On 19/03/2021 19:57, Kees Cook wrote: >> On Tue, Mar 16, 2021 at 09:42:47PM +0100, Mickaël Salaün wrote: >>> From: Mickaël Salaün >>> >>> Using Landlock objects and ruleset, it is possible to tag inodes >>> according to a process's domain. To enab

Re: [PATCH v30 07/12] landlock: Support filesystem access-control

2021-03-23 Thread Mickaël Salaün
On 23/03/2021 18:49, Jann Horn wrote: > On Tue, Mar 23, 2021 at 4:54 PM Mickaël Salaün wrote: >> On 23/03/2021 01:13, Jann Horn wrote: >>> On Tue, Mar 16, 2021 at 9:43 PM Mickaël Salaün wrote: Using Landlock objects and ruleset, it is possible to tag inodes according to a process's d

Re: [PATCH v30 07/12] landlock: Support filesystem access-control

2021-03-23 Thread Jann Horn
On Tue, Mar 23, 2021 at 4:54 PM Mickaël Salaün wrote: > On 23/03/2021 01:13, Jann Horn wrote: > > On Tue, Mar 16, 2021 at 9:43 PM Mickaël Salaün wrote: > >> Using Landlock objects and ruleset, it is possible to tag inodes > >> according to a process's domain. > > [...] > >> +static void release_

Re: [PATCH v30 07/12] landlock: Support filesystem access-control

2021-03-23 Thread Mickaël Salaün
On 23/03/2021 01:13, Jann Horn wrote: > On Tue, Mar 16, 2021 at 9:43 PM Mickaël Salaün wrote: >> Using Landlock objects and ruleset, it is possible to tag inodes >> according to a process's domain. > [...] >> +static void release_inode(struct landlock_object *const object) >> + __releases

Re: [PATCH v30 07/12] landlock: Support filesystem access-control

2021-03-22 Thread Jann Horn
On Tue, Mar 16, 2021 at 9:43 PM Mickaël Salaün wrote: > Using Landlock objects and ruleset, it is possible to tag inodes > according to a process's domain. [...] > +static void release_inode(struct landlock_object *const object) > + __releases(object->lock) > +{ > + struct inode *cons

Re: [PATCH v30 07/12] landlock: Support filesystem access-control

2021-03-19 Thread Mickaël Salaün
On 19/03/2021 19:57, Kees Cook wrote: > On Tue, Mar 16, 2021 at 09:42:47PM +0100, Mickaël Salaün wrote: >> From: Mickaël Salaün >> >> Using Landlock objects and ruleset, it is possible to tag inodes >> according to a process's domain. To enable an unprivileged process to >> express a file hiera

Re: [PATCH v30 07/12] landlock: Support filesystem access-control

2021-03-19 Thread Kees Cook
On Tue, Mar 16, 2021 at 09:42:47PM +0100, Mickaël Salaün wrote: > From: Mickaël Salaün > > Using Landlock objects and ruleset, it is possible to tag inodes > according to a process's domain. To enable an unprivileged process to > express a file hierarchy, it first needs to open a directory (or a

Re: [PATCH v30 07/12] landlock: Support filesystem access-control

2021-03-18 Thread James Morris
> This commit adds a minimal set of supported filesystem access-control > which doesn't enable to restrict all file-related actions. It would be great to get some more review/acks on this patch, particularly from VFS/FS folk. -- James Morris

[PATCH v30 07/12] landlock: Support filesystem access-control

2021-03-16 Thread Mickaël Salaün
From: Mickaël Salaün Using Landlock objects and ruleset, it is possible to tag inodes according to a process's domain. To enable an unprivileged process to express a file hierarchy, it first needs to open a directory (or a file) and pass this file descriptor to the kernel through landlock_add_ru