lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 16 Mar 2022 21:26:16 -0400 From: Paul Moore <paul@...l-moore.com> To: Mickaël Salaün <mic@...ikod.net> Cc: James Morris <jmorris@...ei.org>, "Serge E . Hallyn" <serge@...lyn.com>, Al Viro <viro@...iv.linux.org.uk>, Jann Horn <jannh@...gle.com>, Kees Cook <keescook@...omium.org>, Konstantin Meskhidze <konstantin.meskhidze@...wei.com>, Shuah Khan <shuah@...nel.org>, linux-doc@...r.kernel.org, linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org, linux-security-module@...r.kernel.org, Mickaël Salaün <mic@...ux.microsoft.com> Subject: Re: [PATCH v1 02/11] landlock: Reduce the maximum number of layers to 16 On Mon, Feb 21, 2022 at 4:15 PM Mickaël Salaün <mic@...ikod.net> wrote: > > From: Mickaël Salaün <mic@...ux.microsoft.com> > > The maximum number of nested Landlock domains is currently 64. Because > of the following fix and to help reduce the stack size, let's reduce it > to 16. This seems large enough for a lot of use cases (e.g. sandboxed > init service, spawning a sandboxed SSH service, in nested sandboxed > containers). Reducing the number of nested domains may also help to > discover misuse of Landlock (e.g. creating a domain per rule). > > Add and use a dedicated layer_mask_t typedef to fit with the number of > layers. This might be useful when changing it and to keep it consistent > with the maximum number of layers. > > Signed-off-by: Mickaël Salaün <mic@...ux.microsoft.com> > Link: https://lore.kernel.org/r/20220221212522.320243-3-mic@digikod.net > --- > security/landlock/fs.c | 13 +++++-------- > security/landlock/limits.h | 2 +- > security/landlock/ruleset.h | 4 ++++ > tools/testing/selftests/landlock/fs_test.c | 2 +- > 4 files changed, 11 insertions(+), 10 deletions(-) I'm assuming that the drop in Landlock nesting down to 16 isn't going to cause any userspace breakage :) Reviewed-by: Paul Moore <paul@...l-moore.com> -- paul-moore.com
Powered by blists - more mailing lists