[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 10 Oct 2023 06:31:34 +0300
From: "Konstantin Meskhidze (A)" <konstantin.meskhidze@...wei.com>
To: Mickaël Salaün <mic@...ikod.net>
CC: <willemdebruijn.kernel@...il.com>, <gnoack3000@...il.com>,
<linux-security-module@...r.kernel.org>, <netdev@...r.kernel.org>,
<netfilter-devel@...r.kernel.org>, <yusongping@...wei.com>,
<artem.kuzin@...wei.com>
Subject: Re: [PATCH v12 08/12] landlock: Add network rules and TCP hooks
support
10/9/2023 6:36 PM, Mickaël Salaün пишет:
> On Wed, Sep 20, 2023 at 05:26:36PM +0800, Konstantin Meskhidze wrote:
>> This commit adds network rules support in the ruleset management
>> helpers and the landlock_create_ruleset syscall.
>> Refactor user space API to support network actions. Add new network
>> access flags, network rule and network attributes. Increment Landlock
>> ABI version. Expand access_masks_t to u32 to be sure network access
>> rights can be stored. Implement socket_bind() and socket_connect()
>> LSM hooks, which enables to restrict TCP socket binding and connection
>> to specific ports.
>> The new landlock_net_port_attr structure has two fields. The allowed_access
>> field contains the LANDLOCK_ACCESS_NET_* rights. The port field contains
>> the port value according to the allowed protocol. This field can
>> take up to a 64-bit value [1] but the maximum value depends on the related
>> protocol (e.g. 16-bit for TCP).
>>
>> [1]
>> https://lore.kernel.org/r/278ab07f-7583-a4e0-3d37-1bacd091531d@digikod.net
>
> Could you please include here the rationale to not tie access rights to
> sockets' file descriptor, and link [2]?
>
> [2] https://lore.kernel.org/r/263c1eb3-602f-57fe-8450-3f138581bee7@digikod.net
Ok. I will include this description.
Thank you.
> .
Powered by blists - more mailing lists