linux/arch/xtensa/kernel
Linus Torvalds 17ae69aba8 Add Landlock, a new LSM from Mickaël Salaün <mic@linux.microsoft.com>
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEgycj0O+d1G2aycA8rZhLv9lQBTwFAmCInP4ACgkQrZhLv9lQ
 BTza0g//dTeb9woC9H7qlEhK4l9yk62lTss60Q8X7m7ZSNfdL4tiEbi64SgK+iOW
 OOegbrOEb8Kzh4KJJYmVlVZ5YUWyH4szgmee1wnylBdsWiWaPLPF3Cflz77apy6T
 TiiBsJd7rRE29FKheaMt34B41BMh8QHESN+DzjzJWsFoi/uNxjgSs2W16XuSupKu
 bpRmB1pYNXMlrkzz7taL05jndZYE5arVriqlxgAsuLOFOp/ER7zecrjImdCM/4kL
 W6ej0R1fz2Geh6CsLBJVE+bKWSQ82q5a4xZEkSYuQHXgZV5eywE5UKu8ssQcRgQA
 VmGUY5k73rfY9Ofupf2gCaf/JSJNXKO/8Xjg0zAdklKtmgFjtna5Tyg9I90j7zn+
 5swSpKuRpilN8MQH+6GWAnfqQlNoviTOpFeq3LwBtNVVOh08cOg6lko/bmebBC+R
 TeQPACKS0Q0gCDPm9RYoU1pMUuYgfOwVfVRZK1prgi2Co7ZBUMOvYbNoKYoPIydr
 ENBYljlU1OYwbzgR2nE+24fvhU8xdNOVG1xXYPAEHShu+p7dLIWRLhl8UCtRQpSR
 1ofeVaJjgjrp29O+1OIQjB2kwCaRdfv/Gq1mztE/VlMU/r++E62OEzcH0aS+mnrg
 yzfyUdI8IFv1q6FGT9yNSifWUWxQPmOKuC8kXsKYfqfJsFwKmHM=
 =uCN4
 -----END PGP SIGNATURE-----

Merge tag 'landlock_v34' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security

Pull Landlock LSM from James Morris:
 "Add Landlock, a new LSM from Mickaël Salaün.

  Briefly, Landlock provides for unprivileged application sandboxing.

  From Mickaël's cover letter:
    "The goal of Landlock is to enable to restrict ambient rights (e.g.
     global filesystem access) for a set of processes. Because Landlock
     is a stackable LSM [1], it makes possible to create safe security
     sandboxes as new security layers in addition to the existing
     system-wide access-controls. This kind of sandbox is expected to
     help mitigate the security impact of bugs or unexpected/malicious
     behaviors in user-space applications. Landlock empowers any
     process, including unprivileged ones, to securely restrict
     themselves.

     Landlock is inspired by seccomp-bpf but instead of filtering
     syscalls and their raw arguments, a Landlock rule can restrict the
     use of kernel objects like file hierarchies, according to the
     kernel semantic. Landlock also takes inspiration from other OS
     sandbox mechanisms: XNU Sandbox, FreeBSD Capsicum or OpenBSD
     Pledge/Unveil.

     In this current form, Landlock misses some access-control features.
     This enables to minimize this patch series and ease review. This
     series still addresses multiple use cases, especially with the
     combined use of seccomp-bpf: applications with built-in sandboxing,
     init systems, security sandbox tools and security-oriented APIs [2]"

  The cover letter and v34 posting is here:

      https://lore.kernel.org/linux-security-module/20210422154123.13086-1-mic@digikod.net/

  See also:

      https://landlock.io/

  This code has had extensive design discussion and review over several
  years"

Link: https://lore.kernel.org/lkml/50db058a-7dde-441b-a7f9-f6837fe8b69f@schaufler-ca.com/ [1]
Link: https://lore.kernel.org/lkml/f646e1c7-33cf-333f-070c-0a40ad0468cd@digikod.net/ [2]

* tag 'landlock_v34' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
  landlock: Enable user space to infer supported features
  landlock: Add user and kernel documentation
  samples/landlock: Add a sandbox manager example
  selftests/landlock: Add user space tests
  landlock: Add syscall implementations
  arch: Wire up Landlock syscalls
  fs,security: Add sb_delete hook
  landlock: Support filesystem access-control
  LSM: Infrastructure management of the superblock
  landlock: Add ptrace restrictions
  landlock: Set up the security framework and manage credentials
  landlock: Add ruleset and domain management
  landlock: Add object management
2021-05-01 18:50:44 -07:00
..
syscalls Add Landlock, a new LSM from Mickaël Salaün <mic@linux.microsoft.com> 2021-05-01 18:50:44 -07:00
.gitignore .gitignore: add SPDX License Identifier 2020-03-25 11:50:48 +01:00
align.S xtensa: clean up word alignment macros in assembly code 2017-12-10 14:48:53 -08:00
asm-offsets.c xtensa: add missing exclusive access state management 2020-07-31 14:15:57 -07:00
coprocessor.S xtensa: move coprocessor_flush to the .text section 2021-03-08 20:15:09 -08:00
entry.S xtensa: add support for TIF_NOTIFY_SIGNAL 2020-11-12 08:45:56 -07:00
head.S xtensa: Couple of typo fixes 2021-04-04 15:39:04 -07:00
hw_breakpoint.c xtensa: replace variant/core.h with asm/core.h 2019-05-06 17:48:55 -07:00
irq.c xtensa: drop variant IRQ support 2018-08-20 12:28:05 -07:00
jump_label.c jump_label: move 'asm goto' support test to Kconfig 2019-01-06 09:46:51 +09:00
Makefile xtensa: use the generic uncached segment support 2019-11-11 10:52:18 +01:00
mcount.S xtensa: abstract 'entry' and 'retw' in assembly code 2019-07-08 10:04:48 -07:00
module.c xtensa: clean up custom-controlled debug output 2017-12-16 22:37:08 -08:00
mxhead.S xtensa: drop unused sections and remapped reset handlers 2015-11-03 17:19:39 +03:00
pci-dma.c dma-mapping: merge <linux/dma-noncoherent.h> into <linux/dma-map-ops.h> 2020-10-06 07:07:06 +02:00
pci.c xtensa: fix warning comparing pointer to 0 2021-04-04 15:39:02 -07:00
perf_event.c xtensa: fix xtensa_pmu_setup prototype 2020-07-31 14:09:12 -07:00
platform.c xtensa: drop empty platform_* functions from platforms 2020-01-31 12:17:28 -08:00
process.c arch: setup PF_IO_WORKER threads like PF_KTHREAD 2021-02-21 17:25:22 -07:00
ptrace.c Merge branch 'work.regset' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2020-08-07 09:29:25 -07:00
s32c1i_selftest.c xtensa: move S32C1I self-test to a separate file 2016-11-16 15:08:28 -08:00
setup.c treewide: Convert macro and uses of __section(foo) to __section("foo") 2020-10-25 14:51:49 -07:00
signal.c xtensa: add support for TIF_NOTIFY_SIGNAL 2020-11-12 08:45:56 -07:00
smp.c xtensa: replace setup_irq() by request_irq() 2020-03-03 18:40:26 -08:00
stacktrace.c arch: xtensa: Remove CONFIG_OPROFILE support 2021-01-29 10:05:51 +05:30
syscall.c xtensa: syscalls: switch to generic syscalltbl.sh 2021-04-04 15:39:03 -07:00
time.c xtensa: Replace <linux/clk-provider.h> by <linux/of_clk.h> 2020-12-07 14:01:02 -08:00
traps.c mm: reorder includes after introduction of linux/pgtable.h 2020-06-09 09:39:13 -07:00
vectors.S mm: reorder includes after introduction of linux/pgtable.h 2020-06-09 09:39:13 -07:00
vmlinux.lds.S xtensa: reorganize vectors placement 2020-02-04 21:57:02 -08:00
xtensa_ksyms.c mm: remove unneeded includes of <asm/pgalloc.h> 2020-08-07 11:33:26 -07:00