Re: [PATCH v21 07/12] landlock: Support filesystem access-control

[PATCH v21 00/12] Landlock LSM · Mickaël Salaün <mic@digikod.net> · 2020-10-08
[PATCH v21 01/12] landlock: Add object management · Mickaël Salaün <mic@digikod.net> · 2020-10-08
[PATCH v21 11/12] samples/landlock: Add a sandbox manager example · Mickaël Salaün <mic@digikod.net> · 2020-10-08
[PATCH v21 09/12] arch: Wire up Landlock syscalls · Mickaël Salaün <mic@digikod.net> · 2020-10-08
[PATCH v21 12/12] landlock: Add user and kernel documentation · Mickaël Salaün <mic@digikod.net> · 2020-10-08
Re: [PATCH v21 12/12] landlock: Add user and kernel documentation · Mickaël Salaün <mic@digikod.net> · 2020-10-15
[PATCH v21 10/12] selftests/landlock: Add initial tests · Mickaël Salaün <mic@digikod.net> · 2020-10-08
[PATCH v21 08/12] landlock: Add syscall implementations · Mickaël Salaün <mic@digikod.net> · 2020-10-08
[PATCH v21 07/12] landlock: Support filesystem access-control · Mickaël Salaün <mic@digikod.net> · 2020-10-08
Re: [PATCH v21 07/12] landlock: Support filesystem access-control · James Morris <jmorris@namei.org> · 2020-10-14
Re: [PATCH v21 07/12] landlock: Support filesystem access-control · Mickaël Salaün <mic@digikod.net> · 2020-10-14
Re: [PATCH v21 07/12] landlock: Support filesystem access-control · Mickaël Salaün <mic@digikod.net> · 2020-10-14
Re: [PATCH v21 07/12] landlock: Support filesystem access-control · James Morris <jmorris@namei.org> · 2020-10-14
[PATCH v21 04/12] landlock: Add ptrace restrictions · Mickaël Salaün <mic@digikod.net> · 2020-10-08
[PATCH v21 05/12] LSM: Infrastructure management of the superblock · Mickaël Salaün <mic@digikod.net> · 2020-10-08
[PATCH v21 02/12] landlock: Add ruleset and domain management · Mickaël Salaün <mic@digikod.net> · 2020-10-08
[PATCH v21 06/12] fs,security: Add sb_delete hook · Mickaël Salaün <mic@digikod.net> · 2020-10-08
[PATCH v21 03/12] landlock: Set up the security framework and manage credentials · Mickaël Salaün <mic@digikod.net> · 2020-10-08

From: Mickaël Salaün <mic@digikod.net>
Date: 2020-10-14 18:52:18
Also in: linux-api, linux-arch, linux-doc, linux-fsdevel, linux-kselftest, lkml

On 14/10/2020 20:07, James Morris wrote:

On Thu, 8 Oct 2020, Mickaël Salaün wrote:

quoted

+config ARCH_EPHEMERAL_STATES
+	def_bool n
+	help
+	  An arch should select this symbol if it does not keep an internal kernel
+	  state for kernel objects such as inodes, but instead relies on something
+	  else (e.g. the host kernel for an UML kernel).
+

This is used to disable Landlock for UML, correct?

Yes

I wonder if it could be 
more specific: "ephemeral states" is a very broad term.

How about something like ARCH_OWN_INODES ?

Sounds good. We may need add new ones (e.g. for network socket, UID,
etc.) in the future though.

`h`	back out one level
`j`	next message in thread
`k`	previous message in thread
`l`	drill in
`Esc`	close help / fold thread tree
`?`	toggle this help