Hi, This is a new V14 patch related to Landlock LSM network confinement. It is based on v6.6-rc2 kernel version. It brings refactoring of previous patch version V13. Mostly there are fixes of logic and typos, refactoring some selftests. All test were run in QEMU evironment and compiled with -static flag. 1. network_test: 82/82 tests passed. 2. base_test: 7/7 tests passed. 3. fs_test: 107/107 tests passed. 4. ptrace_test: 8/8 tests passed. Previous versions: v13: https://lore.kernel.org/linux-security-module/20231016015030.1684504-1-konstantin.meskhidze@xxxxxxxxxx/ v12: https://lore.kernel.org/linux-security-module/20230920092641.832134-1-konstantin.meskhidze@xxxxxxxxxx/ v11: https://lore.kernel.org/linux-security-module/20230515161339.631577-1-konstantin.meskhidze@xxxxxxxxxx/ v10: https://lore.kernel.org/linux-security-module/20230323085226.1432550-1-konstantin.meskhidze@xxxxxxxxxx/ v9: https://lore.kernel.org/linux-security-module/20230116085818.165539-1-konstantin.meskhidze@xxxxxxxxxx/ v8: https://lore.kernel.org/linux-security-module/20221021152644.155136-1-konstantin.meskhidze@xxxxxxxxxx/ v7: https://lore.kernel.org/linux-security-module/20220829170401.834298-1-konstantin.meskhidze@xxxxxxxxxx/ v6: https://lore.kernel.org/linux-security-module/20220621082313.3330667-1-konstantin.meskhidze@xxxxxxxxxx/ v5: https://lore.kernel.org/linux-security-module/20220516152038.39594-1-konstantin.meskhidze@xxxxxxxxxx v4: https://lore.kernel.org/linux-security-module/20220309134459.6448-1-konstantin.meskhidze@xxxxxxxxxx/ v3: https://lore.kernel.org/linux-security-module/20220124080215.265538-1-konstantin.meskhidze@xxxxxxxxxx/ v2: https://lore.kernel.org/linux-security-module/20211228115212.703084-1-konstantin.meskhidze@xxxxxxxxxx/ v1: https://lore.kernel.org/linux-security-module/20211210072123.386713-1-konstantin.meskhidze@xxxxxxxxxx/ Konstantin Meskhidze (11): landlock: Make ruleset's access masks more generic landlock: Refactor landlock_find_rule/insert_rule landlock: Refactor merge/inherit_ruleset functions landlock: Move and rename layer helpers landlock: Refactor layer helpers landlock: Refactor landlock_add_rule() syscall landlock: Add network rules and TCP hooks support selftests/landlock: Share enforce_ruleset() selftests/landlock: Add network tests samples/landlock: Support TCP restrictions landlock: Document network support Mickaël Salaün (1): landlock: Allow FS topology changes for domains without such rule type Documentation/userspace-api/landlock.rst | 96 +- include/uapi/linux/landlock.h | 55 + samples/landlock/sandboxer.c | 115 +- security/landlock/Kconfig | 1 + security/landlock/Makefile | 2 + security/landlock/fs.c | 232 +-- security/landlock/limits.h | 6 + security/landlock/net.c | 198 ++ security/landlock/net.h | 33 + security/landlock/ruleset.c | 405 +++- security/landlock/ruleset.h | 183 +- security/landlock/setup.c | 2 + security/landlock/syscalls.c | 158 +- tools/testing/selftests/landlock/base_test.c | 2 +- tools/testing/selftests/landlock/common.h | 13 + tools/testing/selftests/landlock/config | 4 + tools/testing/selftests/landlock/fs_test.c | 10 - tools/testing/selftests/landlock/net_test.c | 1744 ++++++++++++++++++ 18 files changed, 2908 insertions(+), 351 deletions(-) create mode 100644 security/landlock/net.c create mode 100644 security/landlock/net.h create mode 100644 tools/testing/selftests/landlock/net_test.c -- 2.25.1
