Re: [kernel-hardening] [PATCH net-next v7 00/10] Landlock LSM: Toward unprivileged sandboxing

2017-08-27 Thread James Morris
On Mon, 21 Aug 2017, Mickaël Salaün wrote: > ## Why a new LSM? Are SELinux, AppArmor, Smack and Tomoyo not good enough? > > The current access control LSMs are fine for their purpose which is to give > the > *root* the ability to enforce a security policy for the *system*. What is > missing is

[PATCH net-next v7 00/10] Landlock LSM: Toward unprivileged sandboxing

2017-08-20 Thread Mickaël Salaün
Hi, This seventh series add some changes to the previous one [1], including a simplified landlock_context, architecture-independent rules, more documentation and multiples fixes. As planed [6], I simplified and make the FS event more generic for the IOCTL, LOCK or FCNTL actions. The action flags