linux/samples
Linus Torvalds 136cc1e1f5 Landlock updates for v6.7-rc1
-----BEGIN PGP SIGNATURE-----
 
 iIYEABYIAC4WIQSVyBthFV4iTW/VU1/l49DojIL20gUCZUOZKRAcbWljQGRpZ2lr
 b2QubmV0AAoJEOXj0OiMgvbSoaIBAMHG8wxzRcTMplddgQHXmbWPByFIjhA0hqqp
 +hEgLFfyAQCqLPi4fW49CokrkynATKXTLMIBfZ37EYZ3llJgveHTDw==
 =rPTd
 -----END PGP SIGNATURE-----

Merge tag 'landlock-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux

Pull landlock updates from Mickaël Salaün:
 "A Landlock ruleset can now handle two new access rights:
  LANDLOCK_ACCESS_NET_BIND_TCP and LANDLOCK_ACCESS_NET_CONNECT_TCP. When
  handled, the related actions are denied unless explicitly allowed by a
  Landlock network rule for a specific port.

  The related patch series has been reviewed for almost two years, it
  has evolved a lot and we now have reached a decent design, code and
  testing. The refactored kernel code and the new test helpers also
  bring the foundation to support more network protocols.

  Test coverage for security/landlock is 92.4% of 710 lines according to
  gcc/gcov-13, and it was 93.1% of 597 lines before this series. The
  decrease in coverage is due to code refactoring to make the ruleset
  management more generic (i.e. dealing with inodes and ports) that also
  added new WARN_ON_ONCE() checks not possible to test from user space.

  syzkaller has been updated accordingly [4], and such patched instance
  (tailored to Landlock) has been running for a month, covering all the
  new network-related code [5]"

Link: https://lore.kernel.org/r/20231026014751.414649-1-konstantin.meskhidze@huawei.com [1]
Link: https://lore.kernel.org/r/CAHC9VhS1wwgH6NNd+cJz4MYogPiRV8NyPDd1yj5SpaxeUB4UVg@mail.gmail.com [2]
Link: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next-history.git/commit/?id=c8dc5ee69d3a [3]
Link: https://github.com/google/syzkaller/pull/4266 [4]
Link: https://storage.googleapis.com/syzbot-assets/82e8608dec36/ci-upstream-linux-next-kasan-gce-root-ab577164.html#security%2flandlock%2fnet.c [5]

* tag 'landlock-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux:
  selftests/landlock: Add tests for FS topology changes with network rules
  landlock: Document network support
  samples/landlock: Support TCP restrictions
  selftests/landlock: Add network tests
  selftests/landlock: Share enforce_ruleset() helper
  landlock: Support network rules with TCP bind and connect
  landlock: Refactor landlock_add_rule() syscall
  landlock: Refactor layer helpers
  landlock: Move and rename layer helpers
  landlock: Refactor merge/inherit_ruleset helpers
  landlock: Refactor landlock_find_rule/insert_rule helpers
  landlock: Allow FS topology changes for domains without such rule type
  landlock: Make ruleset's access masks more generic
2023-11-03 09:28:53 -10:00
..
acrn virt: acrn: Replace obsolete memalign() with posix_memalign() 2023-04-20 14:20:51 +02:00
auxdisplay .gitignore: prefix local generated files with a slash 2021-05-02 00:43:35 +09:00
binderfs .gitignore: prefix local generated files with a slash 2021-05-02 00:43:35 +09:00
bpf samples/bpf: Allow building with custom bpftool 2023-10-26 15:32:13 +02:00
configfs treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
connector .gitignore: prefix local generated files with a slash 2021-05-02 00:43:35 +09:00
coresight coresight: syscfg: Example CoreSight configuration loadable module 2021-11-26 11:34:07 -07:00
fanotify Add gitignore file for samples/fanotify/ subdirectory 2021-11-07 11:19:24 -08:00
fprobe fprobe: Pass return address to the handlers 2023-06-06 21:39:55 +09:00
ftrace samples: ftrace: Replace bti assembly with hint for older compiler 2023-08-21 22:03:58 -04:00
hid bpf: Replace deprecated -target with --target= for Clang 2023-06-29 15:46:17 +02:00
hidraw .gitignore: prefix local generated files with a slash 2021-05-02 00:43:35 +09:00
hw_breakpoint samples/hw_breakpoint: mark sample_hbp as static 2023-07-26 11:17:19 -07:00
kdb kdb: Rename members of struct kdbtab_t 2021-07-27 17:05:06 +01:00
kfifo samples/kfifo: Rename read_lock/write_lock 2021-10-13 14:36:48 +02:00
kmemleak kmemleak-test: drop __init to get better backtrace 2023-06-09 16:25:40 -07:00
kobject samples/kobject: make kobj_type structure constant 2023-02-08 13:34:41 +01:00
kprobes samples: kprobes: Fixes a typo 2023-10-10 01:00:50 +09:00
landlock samples/landlock: Support TCP restrictions 2023-10-26 21:07:17 +02:00
livepatch livepatch: Reorder to use before freeing a pointer 2022-03-23 13:51:11 +01:00
mei samples: mei: don't wait on read completion upon write. 2021-08-01 09:54:22 +02:00
nitro_enclaves nitro_enclaves: Add fixes for checkpatch blank line reports 2021-09-14 11:11:20 +02:00
pfsm samples: Add userspace example for TI TPS6594 PFSM 2023-06-15 13:41:53 +02:00
pidfd .gitignore: prefix local generated files with a slash 2021-05-02 00:43:35 +09:00
pktgen samples: pktgen: fix append mode failed issue 2023-07-03 09:15:26 +01:00
qmi soc: qcom: qmi: use const for struct qmi_elem_info 2022-08-29 17:33:01 -05:00
rpmsg
rust samples: rust: print: Add sample code for Arc printing 2023-04-10 05:05:43 +02:00
seccomp samples/seccomp: Adjust sample to also provide kill option 2022-02-10 19:09:12 -08:00
timers .gitignore: prefix local generated files with a slash 2021-05-02 00:43:35 +09:00
trace_events tracing: Fix cpumask() example typo 2022-12-14 11:17:55 -05:00
trace_printk
uhid
user_events tracing/user_events: Use write ABI in example 2023-03-29 06:52:09 -04:00
v4l treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_168.RULE (part 2) 2022-06-10 14:51:36 +02:00
vfio-mdev vfio/mtty: Enable migration support 2023-10-24 15:03:10 -06:00
vfs .gitignore: prefix local generated files with a slash 2021-05-02 00:43:35 +09:00
watch_queue .gitignore: prefix local generated files with a slash 2021-05-02 00:43:35 +09:00
watchdog .gitignore: prefix local generated files with a slash 2021-05-02 00:43:35 +09:00
Kconfig vfio-dev/mdpy-fb: Use fbdev I/O helpers 2023-08-04 15:54:39 +02:00
Makefile samples: Add userspace example for TI TPS6594 PFSM 2023-06-15 13:41:53 +02:00