landlock: Allow FS topology changes for domains without such rule type

Browse source

Allow mount point and root directory changes when there is no filesystem
rule tied to the current Landlock domain. This doesn't change anything
for now because a domain must have at least a (filesystem) rule, but
this will change when other rule types will come. For instance, a domain
only restricting the network should have no impact on filesystem
restrictions.

Add a new get_current_fs_domain() helper to quickly check filesystem
rule existence for all filesystem LSM hooks.

Remove unnecessary inlining.

Link: https://lore.kernel.org/r/20231026014751.414649-3-konstantin.meskhidze@huawei.com
Signed-off-by: Mickaël Salaün <mic@digikod.net>

...

This commit is contained in:

Mickaël Salaün 2023-10-26 09:47:41 +08:00

parent 13fc6455fa

commit d722036403

No known key found for this signature in database

GPG key ID: E5E3D0E88C82F6D2

4 changed files with 63 additions and 43 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

6

Documentation/userspace-api/landlock.rst

View file

74

security/landlock/fs.c

View file

24

security/landlock/ruleset.h

View file

2

security/landlock/syscalls.c

View file