netdev - Re: [RFC PATCH 0/2] landlock network implementation cover letter

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 7 Feb 2022 14:35:03 +0100
From:   Mickaël Salaün <mic@...ikod.net>
To:     Konstantin Meskhidze <konstantin.meskhidze@...wei.com>
Cc:     linux-security-module@...r.kernel.org, netdev@...r.kernel.org,
        netfilter@...r.kernel.org, yusongping@...wei.com,
        artem.kuzin@...wei.com
Subject: Re: [RFC PATCH 0/2] landlock network implementation cover letter


On 07/02/2022 14:18, Konstantin Meskhidze wrote:
> 
> 
> 2/1/2022 8:53 PM, Mickaël Salaün пишет:
>>
>> On 24/01/2022 09:02, Konstantin Meskhidze wrote:
>>> Hi, all!
>>>
>>> This is a new bunch of RFC patches related to Landlock LSM network 
>>> confinement.
>>> Here are previous discussions:
>>> 1. 
>>> https://lore.kernel.org/linux-security-module/20211210072123.386713-1-konstantin.meskhidze@huawei.com/ 
>>>
>>> 2. 
>>> https://lore.kernel.org/linux-security-module/20211228115212.703084-1-konstantin.meskhidze@huawei.com/ 
>>>
>>>
>>> As in previous RFCs, 2 hooks are supported:
>>>    - hook_socket_bind()
>>>    - hook_socket_connect()
>>>
>>> Selftest are provided in 
>>> tools/testing/selftests/landlock/network_test.c;
>>> Implementation was tested in QEMU invironment with 5.13 kernel version:
>>
>> Again, you need to base your work on the latest kernel version.
>>
>    Is it because there are new Landlock features in a latest kernel
>    version?
>    I thought 5.13 kernel version and the latest one have the same
>    Landlock functionality and there will not be rebasing problems in
>    future. But anyway I will base the work on the latest kernel.
>    Which kernel version do you work on now?


For now, the security/landlock/ files didn't changed yet, but that will 
come. All other kernel APIs (and semantic) may change over time (e.g. 
LSM API, network types…). I'm working on Linus's master branch (when it 
becomes stable enough) or the linux-rolling-stable branch (from the 
stable repository). When it will be ready for a merge, we need to base 
our work on linux-next.