Re: [PATCH v11 08/12] landlock: Add network rules and TCP hooks support

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 




On 27/06/2023 18:14, Mickaël Salaün wrote:

On 15/05/2023 18:13, Konstantin Meskhidze wrote:
This commit adds network rules support in the ruleset management
helpers and the landlock_create_ruleset syscall.
Refactor user space API to support network actions. Add new network
access flags, network rule and network attributes. Increment Landlock
ABI version. Expand access_masks_t to u32 to be sure network access
rights can be stored. Implement socket_bind() and socket_connect()
LSM hooks, which enables to restrict TCP socket binding and connection
to specific ports.

It is important to explain the decision rationales. Please explain new types, something like this:

The new landlock_net_port_attr structure has two fields. The allowed_access field contains the LANDLOCK_ACCESS_NET_* rights. The port field contains the port value according to the the allowed protocol. This field can take up to a 64-bit value [1] but the maximum value depends on the related protocol (e.g. 16-bit for TCP).

[1] https://lore.kernel.org/r/278ab07f-7583-a4e0-3d37-1bacd091531d@xxxxxxxxxxx



[Index of Archives]     [Netfitler Users]     [Berkeley Packet Filter]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux