diff options
Diffstat (limited to 'include/uapi')
| -rw-r--r-- | include/uapi/linux/landlock.h | 22 |
1 files changed, 18 insertions, 4 deletions
diff --git a/include/uapi/linux/landlock.h b/include/uapi/linux/landlock.h index 7ffe2ef127ee..cceda3b3b961 100644 --- a/include/uapi/linux/landlock.h +++ b/include/uapi/linux/landlock.h @@ -191,12 +191,25 @@ struct landlock_ruleset_attr { * * If the calling thread is running with no_new_privs, this operation * enables no_new_privs on the sibling threads as well. + * + * The following flag ties the no_new_privs attribute to the ruleset + * enforcement: + * + * %LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS + * Sets the no_new_privs attribute of the calling thread only once the + * enforcement of the ruleset succeeded: no_new_privs is set if and only + * if sys_landlock_restrict_self() succeeds. This removes the need for a + * prior :manpage:`prctl(2)` ``PR_SET_NO_NEW_PRIVS`` call (or + * %CAP_SYS_ADMIN use). This flag requires a ruleset. When + * combined with %LANDLOCK_RESTRICT_SELF_TSYNC, no_new_privs is set on the + * sibling threads as well. */ /* clang-format off */ #define LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF (1U << 0) #define LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON (1U << 1) #define LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF (1U << 2) #define LANDLOCK_RESTRICT_SELF_TSYNC (1U << 3) +#define LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS (1U << 4) /* clang-format on */ /** @@ -315,16 +328,16 @@ struct landlock_net_port_attr { * :manpage:`connect(2)` as well as calls to :manpage:`sendmsg(2)` with an * explicit recipient address. * - * This access right only applies to connections to UNIX server sockets which + * This access right applies only to connections to UNIX server sockets which * were created outside of the newly created Landlock domain (e.g. from within * a parent domain or from an unrestricted process). Newly created UNIX * servers within the same Landlock domain continue to be accessible. In this * regard, %LANDLOCK_ACCESS_FS_RESOLVE_UNIX has the same semantics as the * ``LANDLOCK_SCOPE_*`` flags. * - * If a resolve attempt is denied, the operation returns an ``EACCES`` error, - * in line with other filesystem access rights (but different to denials for - * abstract UNIX domain sockets). + * If a resolution attempt is denied, the operation returns an ``EACCES`` + * error, in line with other filesystem access rights (but different to + * denials for abstract UNIX domain sockets). * * This access right is available since the ninth version of the Landlock ABI. * @@ -351,6 +364,7 @@ struct landlock_net_port_attr { * device. * - %LANDLOCK_ACCESS_FS_MAKE_DIR: Create (or rename) a directory. * - %LANDLOCK_ACCESS_FS_MAKE_REG: Create (or rename or link) a regular file. + * This also guards the creation of whiteout objects as used in OverlayFS. * - %LANDLOCK_ACCESS_FS_MAKE_SOCK: Create (or rename or link) a UNIX domain * socket. * - %LANDLOCK_ACCESS_FS_MAKE_FIFO: Create (or rename or link) a named pipe. |