public-mirrors/linux
1
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-11-01 09:13:37 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

landlock: Fix documentation for landlock_restrict_self(2)

Browse source 
Fix, deduplicate, and improve rendering of landlock_restrict_self(2)'s
flags documentation.

The flags are now rendered like the syscall's parameters and
description.

Cc: Günther Noack <gnoack@google.com>
Cc: Paul Moore <paul@paul-moore.com>
Link: https://lore.kernel.org/r/20250416154716.1799902-2-mic@digikod.net
Signed-off-by: Mickaël Salaün <mic@digikod.net>
This commit is contained in:
Mickaël Salaün 2025-04-16 17:47:12 +02:00
parent 50492f942c
commit 25b1fc1cdc
No known key found for this signature in database
GPG key ID: E5E3D0E88C82F6D2
2 changed files with 41 additions and 30 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

59
include/uapi/linux/landlock.h
View file

@ -69,31 +69,42 @@ struct landlock_ruleset_attr {
#define LANDLOCK_CREATE_RULESET_ERRATA (1U << 1)
/* clang-format on */
/*
* sys_landlock_restrict_self() flags:
/**
* DOC: landlock_restrict_self_flags
*
* **Flags**
*
* %LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF
* Do not create any log related to the enforced restrictions. This should
* only be set by tools launching unknown or untrusted programs (e.g. a
* sandbox tool, container runtime, system service manager). Because
* programs sandboxing themselves should fix any denied access, they should
* not set this flag to be aware of potential issues reported by system's
* logs (i.e. audit).
*
* %LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON
* Explicitly ask to continue logging denied access requests even after an
* :manpage:`execve(2)` call. This flag should only be set if all the
* programs than can legitimately be executed will not try to request a
* denied access (which could spam audit logs).
*
* %LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF
* Do not create any log related to the enforced restrictions coming from
* future nested domains created by the caller or its descendants. This
* should only be set according to a runtime configuration (i.e. not
* hardcoded) by programs launching other unknown or untrusted programs that
* may create their own Landlock domains and spam logs. The main use case
* is for container runtimes to enable users to mute buggy sandboxed
* programs for a specific container image. Other use cases include
* sandboxer tools and init systems. Unlike
* ``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF``,
* ``LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF`` does not impact the
* requested restriction (if any) but only the future nested domains.
*
* It is allowed to only pass the
* ``LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF`` flag with a @ruleset_fd
* value of -1.
*
* - %LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF: Do not create any log related to the
* enforced restrictions. This should only be set by tools launching unknown
* or untrusted programs (e.g. a sandbox tool, container runtime, system
* service manager). Because programs sandboxing themselves should fix any
* denied access, they should not set this flag to be aware of potential
* issues reported by system's logs (i.e. audit).
* - %LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON: Explicitly ask to continue
* logging denied access requests even after an :manpage:`execve(2)` call.
* This flag should only be set if all the programs than can legitimately be
* executed will not try to request a denied access (which could spam audit
* logs).
* - %LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF: Do not create any log related
* to the enforced restrictions coming from future nested domains created by
* the caller or its descendants. This should only be set according to a
* runtime configuration (i.e. not hardcoded) by programs launching other
* unknown or untrusted programs that may create their own Landlock domains
* and spam logs. The main use case is for container runtimes to enable users
* to mute buggy sandboxed programs for a specific container image. Other use
* cases include sandboxer tools and init systems. Unlike
* %LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF,
* %LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF does not impact the requested
* restriction (if any) but only the future nested domains.
*/
/* clang-format off */
#define LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF (1U << 0)

12
security/landlock/syscalls.c
View file

@ -451,18 +451,15 @@ SYSCALL_DEFINE4(landlock_add_rule, const int, ruleset_fd,
* @ruleset_fd: File descriptor tied to the ruleset to merge with the target.
* @flags: Supported values:
*
* - %LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF
* - %LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON
* - %LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF
* - %LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF
* - %LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON
* - %LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF
*
* This system call enables to enforce a Landlock ruleset on the current
* thread. Enforcing a ruleset requires that the task has %CAP_SYS_ADMIN in its
* namespace or is running with no_new_privs. This avoids scenarios where
* unprivileged tasks can affect the behavior of privileged children.
*
* It is allowed to only pass the %LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF
* flag with a @ruleset_fd value of -1.
*
* Possible returned errors are:
*
* - %EOPNOTSUPP: Landlock is supported by the kernel but disabled at boot time;
@ -474,6 +471,9 @@ SYSCALL_DEFINE4(landlock_add_rule, const int, ruleset_fd,
* %CAP_SYS_ADMIN in its namespace.
* - %E2BIG: The maximum number of stacked rulesets is reached for the current
* thread.
*
* .. kernel-doc:: include/uapi/linux/landlock.h
* :identifiers: landlock_restrict_self_flags
*/
SYSCALL_DEFINE2(landlock_restrict_self, const int, ruleset_fd, const __u32,
flags)