On Tue, Mar 16, 2021 at 09:42:42PM +0100, Mickaël Salaün wrote:
From: Mickaël Salaün mic@linux.microsoft.com
A Landlock ruleset is mainly a red-black tree with Landlock rules as nodes. This enables quick update and lookup to match a requested access, e.g. to a file. A ruleset is usable through a dedicated file descriptor (cf. following commit implementing syscalls) which enables a process to create and populate a ruleset with new rules.
A domain is a ruleset tied to a set of processes. This group of rules defines the security policy enforced on these processes and their future children. A domain can transition to a new domain which is the intersection of all its constraints and those of a ruleset provided by the current process. This modification only impact the current process. This means that a process can only gain more constraints (i.e. lose accesses) over time.
Cc: James Morris jmorris@namei.org Cc: Jann Horn jannh@google.com Cc: Kees Cook keescook@chromium.org Signed-off-by: Mickaël Salaün mic@linux.microsoft.com Acked-by: Serge Hallyn serge@hallyn.com Link: https://lore.kernel.org/r/20210316204252.427806-3-mic@digikod.net
(Aside: you appear to be self-adding your Link: tags -- AIUI, this is normally done by whoever pulls your series. I've only seen Link: tags added when needing to refer to something else not included in the series.)
[...] +static void put_rule(struct landlock_rule *const rule) +{
- might_sleep();
- if (!rule)
return;- landlock_put_object(rule->object);
- kfree(rule);
+}
I'd expect this to be named "release" rather than "put" since it doesn't do any lifetime reference counting.
+static void build_check_ruleset(void) +{
- const struct landlock_ruleset ruleset = {
.num_rules = ~0,.num_layers = ~0,- };
- BUILD_BUG_ON(ruleset.num_rules < LANDLOCK_MAX_NUM_RULES);
- BUILD_BUG_ON(ruleset.num_layers < LANDLOCK_MAX_NUM_LAYERS);
+}
This is checking that the largest possible stored value is correctly within the LANDLOCK_MAX_* macro value?
[...]
The locking all looks right, and given your test coverage and syzkaller work, it's hard for me to think of ways to prove it out any better. :)
Reviewed-by: Kees Cook keescook@chromium.org