linux-kernel - [GIT PULL] Landlock updates for v6.10

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240516132624.1536065-1-mic@digikod.net>
Date: Thu, 16 May 2024 15:26:24 +0200
From: Mickaël Salaün <mic@...ikod.net>
To: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: Mickaël Salaün <mic@...ikod.net>,
	Günther Noack <gnoack@...gle.com>,
	Ivanov Mikhail <ivanov.mikhail1@...wei-partners.com>,
	Konstantin Meskhidze <konstantin.meskhidze@...wei.com>,
	Paul Moore <paul@...l-moore.com>,
	linux-kernel@...r.kernel.org,
	linux-security-module@...r.kernel.org
Subject: [GIT PULL] Landlock updates for v6.10

Hi Linus,

This PR mainly brings IOCTL control to Landlock, contributed by Günther Noack.
This also adds him as a Landlock reviewer, and fixes an issue in the sample.

Please pull these changes for v6.10-rc1.  This commit merged cleanly with your
master branch.  The kernel code has been tested in the latest linux-next
releases for a few weeks, but I rebased it on v6.9 to avoid a merge conflict
because of the recent Kselftest fixes.

syzkaller has also been patched to know about this new access right.

Regards,
 Mickaël

--
The following changes since commit a38297e3fb012ddfa7ce0321a7e5a8daeb1872b6:

  Linux 6.9 (2024-05-12 14:12:29 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux.git tags/landlock-6.10-rc1

for you to fetch changes up to 5bf9e57e634bd72a97b4b12c87186fc052a6a116:

  MAINTAINERS: Add Günther Noack as Landlock reviewer (2024-05-13 06:58:36 +0200)

----------------------------------------------------------------
Landlock updates for v6.10-rc1

----------------------------------------------------------------
Günther Noack (11):
      landlock: Add IOCTL access right for character and block devices
      selftests/landlock: Test IOCTL support
      selftests/landlock: Test IOCTL with memfds
      selftests/landlock: Test ioctl(2) and ftruncate(2) with open(O_PATH)
      selftests/landlock: Test IOCTLs on named pipes
      selftests/landlock: Check IOCTL restrictions for named UNIX domain sockets
      selftests/landlock: Exhaustive test for the IOCTL allow-list
      samples/landlock: Add support for LANDLOCK_ACCESS_FS_IOCTL_DEV
      landlock: Document IOCTL support
      MAINTAINERS: Notify Landlock maintainers about changes to fs/ioctl.c
      fs/ioctl: Add a comment to keep the logic in sync with LSM policies

Ivanov Mikhail (1):
      samples/landlock: Fix incorrect free in populate_ruleset_net

Mickaël Salaün (1):
      MAINTAINERS: Add Günther Noack as Landlock reviewer

 Documentation/userspace-api/landlock.rst     |  78 ++++-
 MAINTAINERS                                  |   2 +
 fs/ioctl.c                                   |   3 +
 include/uapi/linux/landlock.h                |  38 ++-
 samples/landlock/sandboxer.c                 |  18 +-
 security/landlock/fs.c                       | 225 ++++++++++++-
 security/landlock/limits.h                   |   2 +-
 security/landlock/syscalls.c                 |   2 +-
 tools/testing/selftests/landlock/base_test.c |   2 +-
 tools/testing/selftests/landlock/fs_test.c   | 487 ++++++++++++++++++++++++++-
 10 files changed, 811 insertions(+), 46 deletions(-)