10/9/2023 6:36 PM, Mickaël Salaün пишет:

On Wed, Sep 20, 2023 at 05:26:36PM +0800, Konstantin Meskhidze wrote:

quoted

This commit adds network rules support in the ruleset management
helpers and the landlock_create_ruleset syscall.
Refactor user space API to support network actions. Add new network
access flags, network rule and network attributes. Increment Landlock
ABI version. Expand access_masks_t to u32 to be sure network access
rights can be stored. Implement socket_bind() and socket_connect()
LSM hooks, which enables to restrict TCP socket binding and connection
to specific ports.
The new landlock_net_port_attr structure has two fields. The allowed_access
field contains the LANDLOCK_ACCESS_NET_* rights. The port field contains
the port value according to the allowed protocol. This field can
take up to a 64-bit value [1] but the maximum value depends on the related
protocol (e.g. 16-bit for TCP).

[1]
https://lore.kernel.org/r/278ab07f-7583-a4e0-3d37-1bacd091531d@digikod.net (local)

Could you please include here the rationale to not tie access rights to
sockets' file descriptor, and link [2]?

[2] https://lore.kernel.org/r/263c1eb3-602f-57fe-8450-3f138581bee7@digikod.net (local)

   Ok. I will include this description.
   Thank you.

.