Re: [PATCH v30 02/12] landlock: Add ruleset and domain management

[PATCH v30 00/12] Landlock LSM · Mickaël Salaün <mic@digikod.net> · 2021-03-16
[PATCH v30 03/12] landlock: Set up the security framework and manage credentials · Mickaël Salaün <mic@digikod.net> · 2021-03-16
Re: [PATCH v30 03/12] landlock: Set up the security framework and manage credentials · Kees Cook <hidden> · 2021-03-19
Re: [PATCH v30 03/12] landlock: Set up the security framework and manage credentials · Mickaël Salaün <mic@digikod.net> · 2021-03-19
[PATCH v30 02/12] landlock: Add ruleset and domain management · Mickaël Salaün <mic@digikod.net> · 2021-03-16
Re: [PATCH v30 02/12] landlock: Add ruleset and domain management · Kees Cook <hidden> · 2021-03-19
Re: [PATCH v30 02/12] landlock: Add ruleset and domain management · Mickaël Salaün <mic@digikod.net> · 2021-03-19
Re: [PATCH v30 02/12] landlock: Add ruleset and domain management · Kees Cook <hidden> · 2021-03-19
Re: [PATCH v30 02/12] landlock: Add ruleset and domain management · James Morris <jmorris@namei.org> · 2021-03-24
Re: [PATCH v30 02/12] landlock: Add ruleset and domain management · Mickaël Salaün <mic@digikod.net> · 2021-03-25
Re: [PATCH v30 02/12] landlock: Add ruleset and domain management · Jann Horn <jannh@google.com> · 2021-03-23
[PATCH v30 01/12] landlock: Add object management · Mickaël Salaün <mic@digikod.net> · 2021-03-16
Re: [PATCH v30 01/12] landlock: Add object management · Kees Cook <hidden> · 2021-03-19
Re: [PATCH v30 01/12] landlock: Add object management · Mickaël Salaün <mic@digikod.net> · 2021-03-19
[PATCH v30 04/12] landlock: Add ptrace restrictions · Mickaël Salaün <mic@digikod.net> · 2021-03-16
Re: [PATCH v30 04/12] landlock: Add ptrace restrictions · Kees Cook <hidden> · 2021-03-19
[PATCH v30 06/12] fs,security: Add sb_delete hook · Mickaël Salaün <mic@digikod.net> · 2021-03-16
Re: [PATCH v30 06/12] fs,security: Add sb_delete hook · Kees Cook <hidden> · 2021-03-19
[PATCH v30 08/12] landlock: Add syscall implementations · Mickaël Salaün <mic@digikod.net> · 2021-03-16
Re: [PATCH v30 08/12] landlock: Add syscall implementations · Kees Cook <hidden> · 2021-03-19
Re: [PATCH v30 08/12] landlock: Add syscall implementations · Mickaël Salaün <mic@digikod.net> · 2021-03-19
Re: [PATCH v30 08/12] landlock: Add syscall implementations · Mickaël Salaün <mic@digikod.net> · 2021-03-24
[PATCH v30 09/12] arch: Wire up Landlock syscalls · Mickaël Salaün <mic@digikod.net> · 2021-03-16
[PATCH v30 05/12] LSM: Infrastructure management of the superblock · Mickaël Salaün <mic@digikod.net> · 2021-03-16
Re: [PATCH v30 05/12] LSM: Infrastructure management of the superblock · Kees Cook <hidden> · 2021-03-19
[PATCH v30 07/12] landlock: Support filesystem access-control · Mickaël Salaün <mic@digikod.net> · 2021-03-16
Re: [PATCH v30 07/12] landlock: Support filesystem access-control · James Morris <jmorris@namei.org> · 2021-03-18
Re: [PATCH v30 07/12] landlock: Support filesystem access-control · Kees Cook <hidden> · 2021-03-19
Re: [PATCH v30 07/12] landlock: Support filesystem access-control · Mickaël Salaün <mic@digikod.net> · 2021-03-19
Re: [PATCH v30 07/12] landlock: Support filesystem access-control · Mickaël Salaün <mic@digikod.net> · 2021-03-23
Re: [PATCH v30 07/12] landlock: Support filesystem access-control · Jann Horn <jannh@google.com> · 2021-03-23
Re: [PATCH v30 07/12] landlock: Support filesystem access-control · Mickaël Salaün <mic@digikod.net> · 2021-03-23
Re: [PATCH v30 07/12] landlock: Support filesystem access-control · Jann Horn <jannh@google.com> · 2021-03-23
Re: [PATCH v30 07/12] landlock: Support filesystem access-control · Mickaël Salaün <mic@digikod.net> · 2021-03-23
Re: [PATCH v30 07/12] landlock: Support filesystem access-control · Jann Horn <jannh@google.com> · 2021-03-24
[PATCH v30 11/12] samples/landlock: Add a sandbox manager example · Mickaël Salaün <mic@digikod.net> · 2021-03-16
Re: [PATCH v30 11/12] samples/landlock: Add a sandbox manager example · Kees Cook <hidden> · 2021-03-19
[PATCH v30 12/12] landlock: Add user and kernel documentation · Mickaël Salaün <mic@digikod.net> · 2021-03-16
Re: [PATCH v30 12/12] landlock: Add user and kernel documentation · Kees Cook <hidden> · 2021-03-19
Re: [PATCH v30 12/12] landlock: Add user and kernel documentation · Mickaël Salaün <mic@digikod.net> · 2021-03-19
Re: [PATCH v30 12/12] landlock: Add user and kernel documentation · Mickaël Salaün <mic@digikod.net> · 2021-03-23
Re: [PATCH v30 12/12] landlock: Add user and kernel documentation · Mickaël Salaün <mic@digikod.net> · 2021-03-24
Re: [PATCH v30 00/12] Landlock LSM · James Morris <jmorris@namei.org> · 2021-03-18
Re: [PATCH v30 00/12] Landlock LSM · Mickaël Salaün <mic@digikod.net> · 2021-03-19

From: Kees Cook <hidden>
Date: 2021-03-19 19:16:23
Also in: linux-api, linux-arch, linux-doc, linux-fsdevel, linux-kselftest, lkml

On Fri, Mar 19, 2021 at 08:03:22PM +0100, Mickaël Salaün wrote:

On 19/03/2021 19:40, Kees Cook wrote:

quoted

On Tue, Mar 16, 2021 at 09:42:42PM +0100, Mickaël Salaün wrote:

quoted

[...]
+static void put_rule(struct landlock_rule *const rule)
+{
+	might_sleep();
+	if (!rule)
+		return;
+	landlock_put_object(rule->object);
+	kfree(rule);
+}

I'd expect this to be named "release" rather than "put" since it doesn't
do any lifetime reference counting.

It does decrement rule->object->usage .

Well, landlock_put_object() decrements rule->object's lifetime. It seems
"rule" doesn't have a lifetime. (There is no refcounter on rule.) I just
find it strange to see "put" without a matching "get". Not a big deal.

-- 
Kees Cook

`h`	back out one level
`j`	next message in thread
`k`	previous message in thread
`l`	drill in
`Esc`	close help / fold thread tree
`?`	toggle this help