kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-08 18:57:22 +00:00
Code Issues Releases Packages Activity

landlock: Prepare ruleset and domain type split

Browse source 
Rulesets and domains serve fundamentally different purposes: a ruleset
is mutable and user-facing, created by landlock_create_ruleset(), while
a domain is immutable after construction and enforced on tasks via
landlock_restrict_self().  Today both are represented by struct
landlock_ruleset, which conflates mutable and immutable state in a
single type: the lock field is unused by domains, the hierarchy field is
unused by rulesets, and lifecycle functions must handle both cases.

Prepare for a clean type split by introducing two new structures:

- struct landlock_rules: the red-black tree roots and rule count, shared
  by both rulesets and domains.  Decoupling rule storage from the domain
  API lets the backing data structure change independently (e.g. to a
  hash table, cf. [1]).
- struct landlock_domain: the immutable domain enforced on tasks, with
  no lock field because its rules and access masks are fixed once
  construction completes.  The name reflects the role, not the internal
  data structure.

Add the domain lifecycle helpers (landlock_get_domain(),
landlock_put_domain(), landlock_put_domain_deferred()) and move domain.o
from landlock-$(CONFIG_AUDIT) to landlock-y, because these are needed
unconditionally, not just for audit logging.

No behavioral change.  The new types and lifecycle functions are not yet
used by any caller.

Cc: Günther Noack <gnoack@google.com>
Link: https://patch.msgid.link/20250523165741.693976-1-mic@digikod.net [1]
Link: https://patch.msgid.link/20260811094338.288094-2-mic@digikod.net
Reviewed-by: Tingmao Wang <m@maowtm.org>
[mic: Update copyright]
Signed-off-by: Mickaël Salaün <mic@digikod.net>
This commit is contained in:
Mickaël Salaün 2026-08-11 11:43:15 +02:00
commit e76ef456bb
No known key found for this signature in database
GPG key ID: E5E3D0E88C82F6D2
5 changed files with 202 additions and 60 deletions
Download patch file Download diff file Expand all files Collapse all files