summaryrefslogtreecommitdiff
path: root/samples
diff options
context:
space:
mode:
authorGünther Noack <gnoack3000@gmail.com>2022-11-07 19:16:51 +0100
committerMickaël Salaün <mic@digikod.net>2022-11-07 20:49:50 +0100
commitf6e53fb2d7bd70547ba53232415976cb70ad6d97 (patch)
tree2639fa1d60f9b1082e049667f94df71103ee1be2 /samples
parentede2a34363a5dddd5e6b37b8e52c5041d1e78209 (diff)
samples/landlock: Document best-effort approach for LANDLOCK_ACCESS_FS_REFER
Add a comment to clarify how to handle best-effort backwards compatibility for LANDLOCK_ACCESS_FS_REFER. The "refer" access is special because these operations are always forbidden in ABI 1, unlike most other operations, which are permitted when using Landlock ABI levels where they are not supported yet. Signed-off-by: Günther Noack <gnoack3000@gmail.com> Link: https://lore.kernel.org/r/20221107181651.4555-1-gnoack3000@gmail.com Signed-off-by: Mickaël Salaün <mic@digikod.net>
Diffstat (limited to 'samples')
-rw-r--r--samples/landlock/sandboxer.c17
1 files changed, 16 insertions, 1 deletions
diff --git a/samples/landlock/sandboxer.c b/samples/landlock/sandboxer.c
index fd4237c64fb2..e2056c8b902c 100644
--- a/samples/landlock/sandboxer.c
+++ b/samples/landlock/sandboxer.c
@@ -234,7 +234,22 @@ int main(const int argc, char *const argv[], char *const *const envp)
/* Best-effort security. */
switch (abi) {
case 1:
- /* Removes LANDLOCK_ACCESS_FS_REFER for ABI < 2 */
+ /*
+ * Removes LANDLOCK_ACCESS_FS_REFER for ABI < 2
+ *
+ * Note: The "refer" operations (file renaming and linking
+ * across different directories) are always forbidden when using
+ * Landlock with ABI 1.
+ *
+ * If only ABI 1 is available, this sandboxer knowingly forbids
+ * refer operations.
+ *
+ * If a program *needs* to do refer operations after enabling
+ * Landlock, it can not use Landlock at ABI level 1. To be
+ * compatible with different kernel versions, such programs
+ * should then fall back to not restrict themselves at all if
+ * the running kernel only supports ABI 1.
+ */
ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_REFER;
__attribute__((fallthrough));
case 2: