Re: [PATCH v26 07/12] landlock: Support filesystem access-control

2021-01-16 Thread Mickaël Salaün
On 15/01/2021 19:31, Jann Horn wrote: > On Fri, Jan 15, 2021 at 10:10 AM Mickaël Salaün wrote: >> On 14/01/2021 23:43, Jann Horn wrote: >>> On Thu, Jan 14, 2021 at 7:54 PM Mickaël Salaün wrote: On 14/01/2021 04:22, Jann Horn wrote: > On Wed, Dec 9, 2020 at 8:28 PM Mickaël Salaün wrote

Re: [PATCH v26 07/12] landlock: Support filesystem access-control

2021-01-15 Thread Jann Horn
On Fri, Jan 15, 2021 at 10:10 AM Mickaël Salaün wrote: > On 14/01/2021 23:43, Jann Horn wrote: > > On Thu, Jan 14, 2021 at 7:54 PM Mickaël Salaün wrote: > >> On 14/01/2021 04:22, Jann Horn wrote: > >>> On Wed, Dec 9, 2020 at 8:28 PM Mickaël Salaün wrote: > Thanks to the Landlock objects and

Re: [PATCH v26 07/12] landlock: Support filesystem access-control

2021-01-15 Thread Mickaël Salaün
On 14/01/2021 23:43, Jann Horn wrote: > On Thu, Jan 14, 2021 at 7:54 PM Mickaël Salaün wrote: >> On 14/01/2021 04:22, Jann Horn wrote: >>> On Wed, Dec 9, 2020 at 8:28 PM Mickaël Salaün wrote: Thanks to the Landlock objects and ruleset, it is possible to identify inodes according to a

Re: [PATCH v26 07/12] landlock: Support filesystem access-control

2021-01-14 Thread Jann Horn
On Thu, Jan 14, 2021 at 7:54 PM Mickaël Salaün wrote: > On 14/01/2021 04:22, Jann Horn wrote: > > On Wed, Dec 9, 2020 at 8:28 PM Mickaël Salaün wrote: > >> Thanks to the Landlock objects and ruleset, it is possible to identify > >> inodes according to a process's domain. To enable an unprivilege

Re: [PATCH v26 07/12] landlock: Support filesystem access-control

2021-01-14 Thread Mickaël Salaün
On 14/01/2021 04:22, Jann Horn wrote: > On Wed, Dec 9, 2020 at 8:28 PM Mickaël Salaün wrote: >> Thanks to the Landlock objects and ruleset, it is possible to identify >> inodes according to a process's domain. To enable an unprivileged >> process to express a file hierarchy, it first needs to o

Re: [PATCH v26 07/12] landlock: Support filesystem access-control

2021-01-13 Thread Jann Horn
On Wed, Dec 9, 2020 at 8:28 PM Mickaël Salaün wrote: > Thanks to the Landlock objects and ruleset, it is possible to identify > inodes according to a process's domain. To enable an unprivileged > process to express a file hierarchy, it first needs to open a directory > (or a file) and pass this f

[PATCH v26 07/12] landlock: Support filesystem access-control

2020-12-09 Thread Mickaël Salaün
From: Mickaël Salaün Thanks to the Landlock objects and ruleset, it is possible to identify inodes according to a process's domain. To enable an unprivileged process to express a file hierarchy, it first needs to open a directory (or a file) and pass this file descriptor to the kernel through la