Re: [PATCH v17 02/10] landlock: Add ruleset and domain management

2020-05-14 Thread Mickaël Salaün
On 14/05/2020 05:09, James Morris wrote: > On Mon, 11 May 2020, Mickaël Salaün wrote: > >> + * .. warning:: >> + * >> + * It is currently not possible to restrict some file-related actions >> + * accessible through these syscall families: :manpage:`chdir(2)`, >> + * :manpage:`truncate(2)`,

Re: [PATCH v17 02/10] landlock: Add ruleset and domain management

2020-05-13 Thread James Morris
On Mon, 11 May 2020, Mickaël Salaün wrote: > + * .. warning:: > + * > + * It is currently not possible to restrict some file-related actions > + * accessible through these syscall families: :manpage:`chdir(2)`, > + * :manpage:`truncate(2)`, :manpage:`stat(2)`, :manpage:`flock(2)`, > + * :m

[PATCH v17 02/10] landlock: Add ruleset and domain management

2020-05-11 Thread Mickaël Salaün
A Landlock ruleset is mainly a red-black tree with Landlock rules as nodes. This enables quick update and lookup to match a requested access e.g., to a file. A ruleset is usable through a dedicated file descriptor (cf. following commit implementing the syscall) which enables a process to create a