mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs.git
synced 2026-11-01 06:46:35 +01:00
Günther Noack
42fc7e6543
Introduce the LANDLOCK_RESTRICT_SELF_TSYNC flag. With this flag, a given Landlock ruleset is applied to all threads of the calling process, instead of only the current one. Without this flag, multithreaded userspace programs currently resort to using the nptl(7)/libpsx hack for multithreaded policy enforcement, which is also used by libcap and for setuid(2). Using this userspace-based scheme, the threads of a process enforce the same Landlock policy, but the resulting Landlock domains are still separate. The domains being separate causes multiple problems: * When using Landlock's "scoped" access rights, the domain identity is used to determine whether an operation is permitted. As a result, when using LANLDOCK_SCOPE_SIGNAL, signaling between sibling threads stops working. This is a problem for programming languages and frameworks which are inherently multithreaded (e.g. Go). * In audit logging, the domains of separate threads in a process will get logged with different domain IDs, even when they are based on the same ruleset FD, which might confuse users. Cc: Andrew G. Morgan <[email protected]> Cc: John Johansen <[email protected]> Cc: Paul Moore <[email protected]> Suggested-by: Jann Horn <[email protected]> Signed-off-by: Günther Noack <[email protected]> Link: https://lore.kernel.org/r/[email protected] [mic: Fix restrict_self_flags test, clean up Makefile, allign comments, reduce local variable scope, add missing includes] Closes: https://github.com/landlock-lsm/linux/issues/2 Signed-off-by: Mickaël Salaün <[email protected]>
19 lines
244 B
Makefile
19 lines
244 B
Makefile
obj-$(CONFIG_SECURITY_LANDLOCK) := landlock.o
|
|
|
|
landlock-y := \
|
|
setup.o \
|
|
syscalls.o \
|
|
object.o \
|
|
ruleset.o \
|
|
cred.o \
|
|
task.o \
|
|
fs.o \
|
|
tsync.o
|
|
|
|
landlock-$(CONFIG_INET) += net.o
|
|
|
|
landlock-$(CONFIG_AUDIT) += \
|
|
id.o \
|
|
audit.o \
|
|
domain.o
|