Re: [PATCH v33 07/12] landlock: Support filesystem access-control

[PATCH v33 00/12] Landlock LSM · Mickaël Salaün <mic@digikod.net> · 2021-04-07
[PATCH v33 01/12] landlock: Add object management · Mickaël Salaün <mic@digikod.net> · 2021-04-07
[PATCH v33 02/12] landlock: Add ruleset and domain management · Mickaël Salaün <mic@digikod.net> · 2021-04-07
[PATCH v33 03/12] landlock: Set up the security framework and manage credentials · Mickaël Salaün <mic@digikod.net> · 2021-04-07
[PATCH v33 05/12] LSM: Infrastructure management of the superblock · Mickaël Salaün <mic@digikod.net> · 2021-04-07
[PATCH v33 06/12] fs,security: Add sb_delete hook · Mickaël Salaün <mic@digikod.net> · 2021-04-07
[PATCH v33 04/12] landlock: Add ptrace restrictions · Mickaël Salaün <mic@digikod.net> · 2021-04-07
[PATCH v33 07/12] landlock: Support filesystem access-control · Mickaël Salaün <mic@digikod.net> · 2021-04-07
Re: [PATCH v33 07/12] landlock: Support filesystem access-control · James Morris <jmorris@namei.org> · 2021-04-08
[PATCH v33 08/12] landlock: Add syscall implementations · Mickaël Salaün <mic@digikod.net> · 2021-04-07
[PATCH v33 10/12] selftests/landlock: Add user space tests · Mickaël Salaün <mic@digikod.net> · 2021-04-07
[PATCH v33 11/12] samples/landlock: Add a sandbox manager example · Mickaël Salaün <mic@digikod.net> · 2021-04-07
[PATCH v33 09/12] arch: Wire up Landlock syscalls · Mickaël Salaün <mic@digikod.net> · 2021-04-07
[PATCH v33 12/12] landlock: Add user and kernel documentation · Mickaël Salaün <mic@digikod.net> · 2021-04-07
Re: [PATCH v33 00/12] Landlock LSM · James Morris <jmorris@namei.org> · 2021-04-09
Re: [PATCH v33 00/12] Landlock LSM · Casey Schaufler <casey@schaufler-ca.com> · 2021-04-09

From: James Morris <jmorris@namei.org>
Date: 2021-04-08 20:32:15
Also in: linux-arch, linux-doc, linux-fsdevel, linux-kselftest, linux-security-module, lkml

On Wed, 7 Apr 2021, Mickaël Salaün wrote:

Changes since v31:
* Gracefully forbid reparenting by returning EXDEV in hook_path_link()
  and hook_path_rename() (hinted by Al Viro).
* Replace excessive WARN_ON_ONCE() with unlikely() in
  hook_path_rename() and use ENOENT instead of EACCES.
* Improve comment in unmask_layers() (pointed out by Al Viro).  Also use
  filesystem "topology" instead of "layout", which seems more
  appropriate.
* Add access(2) to the documented list of unsupported syscall families.
* Replace "option" with "flag" in hook_sb_mount() comment.

Good to see these changes.

Al: any further comments now on this patch?

-- 
James Morris
[off-list ref]

`h`	back out one level
`j`	next message in thread
`k`	previous message in thread
`l`	drill in
`Esc`	close help / fold thread tree
`?`	toggle this help