| Message ID | 20220827111215.131442-7-xiujianfeng@huawei.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | landlock: add chmod and chown support | expand |
On Sat, Aug 27, 2022 at 07:12:15PM +0800, Xiu Jianfeng wrote: > update LANDLOCK_ACCESS_FS_{CHMOD, CHGRP} support and add abi change > in the document. > > Signed-off-by: Xiu Jianfeng <xiujianfeng@huawei.com> > --- > Documentation/userspace-api/landlock.rst | 9 ++++++++- > 1 file changed, 8 insertions(+), 1 deletion(-) > > diff --git a/Documentation/userspace-api/landlock.rst b/Documentation/userspace-api/landlock.rst > index 2509c2fbf98f..0e97a7998fa1 100644 > --- a/Documentation/userspace-api/landlock.rst > +++ b/Documentation/userspace-api/landlock.rst > @@ -61,7 +61,9 @@ the need to be explicit about the denied-by-default access rights. > LANDLOCK_ACCESS_FS_MAKE_BLOCK | > LANDLOCK_ACCESS_FS_MAKE_SYM | > LANDLOCK_ACCESS_FS_REFER | > - LANDLOCK_ACCESS_FS_TRUNCATE, > + LANDLOCK_ACCESS_FS_TRUNCATE | > + LANDLOCK_ACCESS_FS_CHMOD | > + LANDLOCK_ACCESS_FS_CHGRP > }; > > Because we may not know on which kernel version an application will be > @@ -90,6 +92,11 @@ the ABI. > case 2: > /* Removes LANDLOCK_ACCESS_FS_TRUNCATE for ABI < 3 */ > ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_TRUNCATE; > + __attribute__((fallthrough)); > + case 3: > + /* Removes LANDLOCK_ACCESS_FS_{CHMOD, CHGRP} for ABI < 4 */ > + ruleset_attr.handled_access_fs &= ~(LANDLOCK_ACCESS_FS_CHMOD | > + LANDLOCK_ACCESS_FS_CHGRP); > } > > This enables to create an inclusive ruleset that will contain our rules. There is a sentence just above this code example that neesd updating as well. --
Hi, 在 2022/8/28 1:28, Günther Noack 写道: > On Sat, Aug 27, 2022 at 07:12:15PM +0800, Xiu Jianfeng wrote: >> update LANDLOCK_ACCESS_FS_{CHMOD, CHGRP} support and add abi change >> in the document. >> >> Signed-off-by: Xiu Jianfeng <xiujianfeng@huawei.com> >> --- >> Documentation/userspace-api/landlock.rst | 9 ++++++++- >> 1 file changed, 8 insertions(+), 1 deletion(-) >> >> diff --git a/Documentation/userspace-api/landlock.rst b/Documentation/userspace-api/landlock.rst >> index 2509c2fbf98f..0e97a7998fa1 100644 >> --- a/Documentation/userspace-api/landlock.rst >> +++ b/Documentation/userspace-api/landlock.rst >> @@ -61,7 +61,9 @@ the need to be explicit about the denied-by-default access rights. >> LANDLOCK_ACCESS_FS_MAKE_BLOCK | >> LANDLOCK_ACCESS_FS_MAKE_SYM | >> LANDLOCK_ACCESS_FS_REFER | >> - LANDLOCK_ACCESS_FS_TRUNCATE, >> + LANDLOCK_ACCESS_FS_TRUNCATE | >> + LANDLOCK_ACCESS_FS_CHMOD | >> + LANDLOCK_ACCESS_FS_CHGRP >> }; >> >> Because we may not know on which kernel version an application will be >> @@ -90,6 +92,11 @@ the ABI. >> case 2: >> /* Removes LANDLOCK_ACCESS_FS_TRUNCATE for ABI < 3 */ >> ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_TRUNCATE; >> + __attribute__((fallthrough)); >> + case 3: >> + /* Removes LANDLOCK_ACCESS_FS_{CHMOD, CHGRP} for ABI < 4 */ >> + ruleset_attr.handled_access_fs &= ~(LANDLOCK_ACCESS_FS_CHMOD | >> + LANDLOCK_ACCESS_FS_CHGRP); >> } >> >> This enables to create an inclusive ruleset that will contain our rules. > > There is a sentence just above this code example that neesd updating as well. > Get it, it's the follwing sentence, thanks. ... Let's check if we should remove the `LANDLOCK_ACCESS_FS_REFER` or `LANDLOCK_ACCESS_FS_TRUNCATE` access rights, which are only supported starting with the second and third version of the ABI. ... > -- > . >
diff --git a/Documentation/userspace-api/landlock.rst b/Documentation/userspace-api/landlock.rst index 2509c2fbf98f..0e97a7998fa1 100644 --- a/Documentation/userspace-api/landlock.rst +++ b/Documentation/userspace-api/landlock.rst @@ -61,7 +61,9 @@ the need to be explicit about the denied-by-default access rights. LANDLOCK_ACCESS_FS_MAKE_BLOCK | LANDLOCK_ACCESS_FS_MAKE_SYM | LANDLOCK_ACCESS_FS_REFER | - LANDLOCK_ACCESS_FS_TRUNCATE, + LANDLOCK_ACCESS_FS_TRUNCATE | + LANDLOCK_ACCESS_FS_CHMOD | + LANDLOCK_ACCESS_FS_CHGRP }; Because we may not know on which kernel version an application will be @@ -90,6 +92,11 @@ the ABI. case 2: /* Removes LANDLOCK_ACCESS_FS_TRUNCATE for ABI < 3 */ ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_TRUNCATE; + __attribute__((fallthrough)); + case 3: + /* Removes LANDLOCK_ACCESS_FS_{CHMOD, CHGRP} for ABI < 4 */ + ruleset_attr.handled_access_fs &= ~(LANDLOCK_ACCESS_FS_CHMOD | + LANDLOCK_ACCESS_FS_CHGRP); } This enables to create an inclusive ruleset that will contain our rules.
update LANDLOCK_ACCESS_FS_{CHMOD, CHGRP} support and add abi change in the document. Signed-off-by: Xiu Jianfeng <xiujianfeng@huawei.com> --- Documentation/userspace-api/landlock.rst | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)