netdev - Re: [PATCH v11 08/12] landlock: Add network rules and TCP hooks support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 3 Jul 2023 13:44:43 +0300
From: "Konstantin Meskhidze (A)" <konstantin.meskhidze@...wei.com>
To: Mickaël Salaün <mic@...ikod.net>
CC: <willemdebruijn.kernel@...il.com>, <gnoack3000@...il.com>,
	<linux-security-module@...r.kernel.org>, <netdev@...r.kernel.org>,
	<netfilter-devel@...r.kernel.org>, <yusongping@...wei.com>,
	<artem.kuzin@...wei.com>
Subject: Re: [PATCH v11 08/12] landlock: Add network rules and TCP hooks
 support



6/29/2023 5:04 PM, Mickaël Salaün пишет:
> 
> On 27/06/2023 18:14, Mickaël Salaün wrote:
>> 
>> On 15/05/2023 18:13, Konstantin Meskhidze wrote:
>>> This commit adds network rules support in the ruleset management
>>> helpers and the landlock_create_ruleset syscall.
>>> Refactor user space API to support network actions. Add new network
>>> access flags, network rule and network attributes. Increment Landlock
>>> ABI version. Expand access_masks_t to u32 to be sure network access
>>> rights can be stored. Implement socket_bind() and socket_connect()
>>> LSM hooks, which enables to restrict TCP socket binding and connection
>>> to specific ports.
> 
> It is important to explain the decision rationales. Please explain new
> types, something like this:
> 
> The new landlock_net_port_attr structure has two fields. The
> allowed_access field contains the LANDLOCK_ACCESS_NET_* rights. The port
> field contains the port value according to the the allowed protocol.
> This field can take up to a 64-bit value [1] but the maximum value
> depends on the related protocol (e.g. 16-bit for TCP).
> 
   Ok. Thanks.
> [1]
> https://lore.kernel.org/r/278ab07f-7583-a4e0-3d37-1bacd091531d@digikod.net
> .