Re: [PATCH v1 0/5] Landlock support for UML

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Richard, Anton, Johannes, what do you think about these UML changes?


On 09/03/2023 17:54, Mickaël Salaün wrote:
Hi,

Commit cb2c7d1a1776 ("landlock: Support filesystem access-control")
introduced a new ARCH_EPHEMERAL_INODES configuration, only enabled for
User-Mode Linux.  The reason was that UML's hostfs managed inodes in an
ephemeral way: from the kernel point of view, the same inode struct
could be created several times while being used by user space because
the kernel didn't hold references to inodes.  Because Landlock (and
probably other subsystems) ties properties (i.e. access rights) to inode
objects, it wasn't possible to create rules that match inodes and then
allow specific accesses.

This patch series fixes the way UML manages inodes according to the
underlying filesystem.  They are now properly handles as for other
filesystems, which enables to support Landlock (and probably other
features).

Backporting these patches requires some selftest harness patches
backports too.

Regards,

Mickaël Salaün (5):
   hostfs: Fix ephemeral inodes
   selftests/landlock: Don't create useless file layouts
   selftests/landlock: Add supports_filesystem() helper
   selftests/landlock: Make mounts configurable
   selftests/landlock: Add tests for pseudo filesystems

  arch/Kconfig                               |   7 -
  arch/um/Kconfig                            |   1 -
  fs/hostfs/hostfs.h                         |   1 +
  fs/hostfs/hostfs_kern.c                    | 213 ++++++------
  fs/hostfs/hostfs_user.c                    |   1 +
  security/landlock/Kconfig                  |   2 +-
  tools/testing/selftests/landlock/config    |   8 +-
  tools/testing/selftests/landlock/fs_test.c | 381 +++++++++++++++++++--
  8 files changed, 472 insertions(+), 142 deletions(-)


base-commit: fe15c26ee26efa11741a7b632e9f23b01aca4cc6



[Index of Archives]     [Linux Wireless]     [Linux Kernel]     [ATH6KL]     [Linux Bluetooth]     [Linux Netdev]     [Kernel Newbies]     [Share Photos]     [IDE]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux ATA RAID]     [Samba]     [Device Mapper]

  Powered by Linux