Re: [RFC v4 00/18] Landlock LSM: Unprivileged sandboxing

[RFC v4 00/18] Landlock LSM: Unprivileged sandboxing · Mickaël Salaün <mic@digikod.net> · 2016-10-26
[RFC v4 06/18] fs: Constify path_is_under()'s arguments · Mickaël Salaün <mic@digikod.net> · 2016-10-26
[RFC v4 02/18] bpf: Move u64_to_ptr() to BPF headers and inline it · Mickaël Salaün <mic@digikod.net> · 2016-10-26
Re: [RFC v4 02/18] bpf: Move u64_to_ptr() to BPF headers and inline it · Arnd Bergmann <arnd@arndb.de> · 2016-10-26
Re: [kernel-hardening] Re: [RFC v4 02/18] bpf: Move u64_to_ptr() to BPF headers and inline it · David Sterba <hidden> · 2016-10-26
[RFC v4 01/18] landlock: Add Kconfig · Mickaël Salaün <mic@digikod.net> · 2016-10-26
[RFC v4 15/18] bpf/cgroup: Move capability check · Mickaël Salaün <mic@digikod.net> · 2016-10-26
[RFC v4 11/18] seccomp,landlock: Handle Landlock hooks per process hierarchy · Mickaël Salaün <mic@digikod.net> · 2016-10-26
[RFC v4 18/18] samples/landlock: Add sandbox example · Mickaël Salaün <mic@digikod.net> · 2016-10-26
[RFC v4 16/18] bpf/cgroup,landlock: Handle Landlock hooks per cgroup · Mickaël Salaün <mic@digikod.net> · 2016-10-26
[RFC v4 17/18] landlock: Add update and debug access flags · Mickaël Salaün <mic@digikod.net> · 2016-10-26
[RFC v4 08/18] landlock: Handle file comparisons · Mickaël Salaün <mic@digikod.net> · 2016-10-26
[RFC v4 07/18] landlock: Add LSM hooks · Mickaël Salaün <mic@digikod.net> · 2016-10-26
[RFC v4 09/18] landlock: Add manager functions · Mickaël Salaün <mic@digikod.net> · 2016-10-26
[RFC v4 05/18] bpf,landlock: Define an eBPF program type for Landlock · Mickaël Salaün <mic@digikod.net> · 2016-10-26
[RFC v4 14/18] bpf/cgroup: Make cgroup_bpf_update() return an error code · Mickaël Salaün <mic@digikod.net> · 2016-10-26
[RFC v4 12/18] bpf: Cosmetic change for bpf_prog_attach() · Mickaël Salaün <mic@digikod.net> · 2016-10-26
[RFC v4 13/18] bpf/cgroup: Replace struct bpf_prog with struct bpf_object · Mickaël Salaün <mic@digikod.net> · 2016-10-26
[RFC v4 10/18] seccomp: Split put_seccomp_filter() with put_seccomp() · Mickaël Salaün <mic@digikod.net> · 2016-10-26
[RFC v4 03/18] bpf,landlock: Add a new arraymap type to deal with (Landlock) handles · Mickaël Salaün <mic@digikod.net> · 2016-10-26
Re: [kernel-hardening] [RFC v4 03/18] bpf,landlock: Add a new arraymap type to deal with (Landlock) handles · Jann Horn <hidden> · 2016-10-26
Re: [kernel-hardening] [RFC v4 03/18] bpf,landlock: Add a new arraymap type to deal with (Landlock) handles · Mickaël Salaün <mic@digikod.net> · 2016-10-26
Re: [kernel-hardening] [RFC v4 03/18] bpf,landlock: Add a new arraymap type to deal with (Landlock) handles · Jann Horn <hidden> · 2016-10-26
[RFC v4 04/18] bpf,landlock: Add eBPF program subtype and is_valid_subtype() verifier · Mickaël Salaün <mic@digikod.net> · 2016-10-26
Re: [RFC v4 00/18] Landlock LSM: Unprivileged sandboxing · Jann Horn <hidden> · 2016-10-26
Re: [RFC v4 00/18] Landlock LSM: Unprivileged sandboxing · Mickaël Salaün <mic@digikod.net> · 2016-10-26
Re: [RFC v4 00/18] Landlock LSM: Unprivileged sandboxing · Mickaël Salaün <mic@digikod.net> · 2016-10-26
Re: [RFC v4 00/18] Landlock LSM: Unprivileged sandboxing · Mickaël Salaün <mic@digikod.net> · 2016-11-13
Re: [RFC v4 00/18] Landlock LSM: Unprivileged sandboxing · Sargun Dhillon <hidden> · 2016-11-14
Re: [RFC v4 00/18] Landlock LSM: Unprivileged sandboxing · Mickaël Salaün <mic@digikod.net> · 2016-11-14

From: Jann Horn <hidden>
Date: 2016-10-26 14:52:53
Also in: linux-api, lkml, netdev

On Wed, Oct 26, 2016 at 08:56:36AM +0200, Mickaël Salaün wrote:

The loaded Landlock eBPF programs can be triggered by a seccomp filter
returning RET_LANDLOCK. In addition, a cookie (16-bit value) can be passed from
a seccomp filter to eBPF programs. This allow flexible security policies
between seccomp and Landlock.

Is this still up to date, or was that removed in v3?

Attachments

signature.asc [application/pgp-signature] 819 bytes

`h`	back out one level
`j`	next message in thread
`k`	previous message in thread
`l`	drill in
`Esc`	close help / fold thread tree
`?`	toggle this help