On 2023-02-21T21:50:22.000+01:00, Günther Noack wrote:
[...]
> .SH VERSIONS
> -Landlock was added in Linux 5.13.
> +Landlock was introduced in Linux 5.13.
> +.PP
> +The availability of individual Landlock features is versioned through
> +ABI levels:
> +.TS
> +box;
> +ntb| ntb| lbx
> +nt| nt| lbx.
> +ABI Kernel Newly introduced access rights
> +_ _ _
> +1 5.13 LANDLOCK_ACCESS_FS_EXECUTE
> +\^ \^ LANDLOCK_ACCESS_FS_WRITE_FILE
> +\^ \^ LANDLOCK_ACCESS_FS_READ_FILE
> +\^ \^ LANDLOCK_ACCESS_FS_READ_DIR
> +\^ \^ LANDLOCK_ACCESS_FS_REMOVE_DIR
> +\^ \^ LANDLOCK_ACCESS_FS_REMOVE_FILE
> +\^ \^ LANDLOCK_ACCESS_FS_MAKE_CHAR
> +\^ \^ LANDLOCK_ACCESS_FS_MAKE_DIR
> +\^ \^ LANDLOCK_ACCESS_FS_MAKE_REG
> +\^ \^ LANDLOCK_ACCESS_FS_MAKE_SOCK
> +\^ \^ LANDLOCK_ACCESS_FS_MAKE_FIFO
> +\^ \^ LANDLOCK_ACCESS_FS_MAKE_BLOCK
> +\^ \^ LANDLOCK_ACCESS_FS_MAKE_SYM
> +_ _ _
> +2 5.19 LANDLOCK_ACCESS_FS_REFER
> +.TE
> +.PP
> +To query the running kernel's Landlock ABI level, programs may pass
> +the
> +.B LANDLOCK_CREATE_RULESET_VERSION
> +flag to
> +.BR landlock_create_ruleset (2).
> +.PP
> +When building fallback mechanisms for compatibility with older kernels,
> +users are advised to consider the special semantics of the
> +.B LANDLOCK_ACCESS_FS_REFER
> +access right: In ABI v1, linking and moving of files between different
> +directories is always forbidden, so programs relying on such
> +operations are only compatible with Landlock ABI v2 and higher.
> .SH NOTES
> Landlock is enabled by
> .BR CONFIG_SECURITY_LANDLOCK .
> @@ -242,7 +327,8 @@ attr.handled_access_fs =
> LANDLOCK_ACCESS_FS_MAKE_SOCK |
> LANDLOCK_ACCESS_FS_MAKE_FIFO |
> LANDLOCK_ACCESS_FS_MAKE_BLOCK |
> - LANDLOCK_ACCESS_FS_MAKE_SYM;
> + LANDLOCK_ACCESS_FS_MAKE_SYM |
> + LANDLOCK_ACCESS_FS_REFER;
This code example should now query the Landlock ABI version and mask new access right to make it works with old kernels.
>
> ruleset_fd = landlock_create_ruleset(&attr, sizeof(attr), 0);
> if (ruleset_fd == -1) {
> --
2.39.2
