Re: [PATCH v24 07/12] landlock: Support filesystem access-control

2020-11-23 Thread Jann Horn
On Mon, Nov 23, 2020 at 10:16 PM Mickaël Salaün wrote: > On 23/11/2020 20:44, Jann Horn wrote: > > On Sat, Nov 21, 2020 at 11:06 AM Mickaël Salaün wrote: > >> On 21/11/2020 08:00, Jann Horn wrote: > >>> On Thu, Nov 12, 2020 at 9:52 PM Mickaël Salaün wrote: > Thanks to the Landlock objects a

Re: [PATCH v24 07/12] landlock: Support filesystem access-control

2020-11-23 Thread Mickaël Salaün
On 23/11/2020 20:44, Jann Horn wrote: > On Sat, Nov 21, 2020 at 11:06 AM Mickaël Salaün wrote: >> On 21/11/2020 08:00, Jann Horn wrote: >>> On Thu, Nov 12, 2020 at 9:52 PM Mickaël Salaün wrote: Thanks to the Landlock objects and ruleset, it is possible to identify inodes according to

Re: [PATCH v24 07/12] landlock: Support filesystem access-control

2020-11-23 Thread Jann Horn
On Sat, Nov 21, 2020 at 11:06 AM Mickaël Salaün wrote: > On 21/11/2020 08:00, Jann Horn wrote: > > On Thu, Nov 12, 2020 at 9:52 PM Mickaël Salaün wrote: > >> Thanks to the Landlock objects and ruleset, it is possible to identify > >> inodes according to a process's domain. To enable an unprivile

Re: [PATCH v24 07/12] landlock: Support filesystem access-control

2020-11-21 Thread Mickaël Salaün
On 21/11/2020 08:00, Jann Horn wrote: > On Thu, Nov 12, 2020 at 9:52 PM Mickaël Salaün wrote: >> Thanks to the Landlock objects and ruleset, it is possible to identify >> inodes according to a process's domain. To enable an unprivileged >> process to express a file hierarchy, it first needs to

Re: [PATCH v24 07/12] landlock: Support filesystem access-control

2020-11-20 Thread Jann Horn
On Thu, Nov 12, 2020 at 9:52 PM Mickaël Salaün wrote: > Thanks to the Landlock objects and ruleset, it is possible to identify > inodes according to a process's domain. To enable an unprivileged > process to express a file hierarchy, it first needs to open a directory > (or a file) and pass this

[PATCH v24 07/12] landlock: Support filesystem access-control

2020-11-12 Thread Mickaël Salaün
From: Mickaël Salaün Thanks to the Landlock objects and ruleset, it is possible to identify inodes according to a process's domain. To enable an unprivileged process to express a file hierarchy, it first needs to open a directory (or a file) and pass this file descriptor to the kernel through la