Mickaël Salaün
76b902f874
samples/landlock: Add support for file reparenting
...
Add LANDLOCK_ACCESS_FS_REFER to the "roughly write" access rights and
leverage the Landlock ABI version to only try to enforce it if it is
supported by the running kernel.
Reviewed-by: Paul Moore <paul@paul-moore.com >
Signed-off-by: Mickaël Salaün <mic@digikod.net >
Link: https://lore.kernel.org/r/20220506161102.525323-10-mic@digikod.net
2022-05-23 13:28:00 +02:00
Mickaël Salaün
81709f3dcc
samples/landlock: Format with clang-format
...
Let's follow a consistent and documented coding style. Everything may
not be to our liking but it is better than tacit knowledge. Moreover,
this will help maintain style consistency between different developers.
This contains only whitespace changes.
Automatically formatted with:
clang-format-14 -i samples/landlock/*.[ch]
Link: https://lore.kernel.org/r/20220506160513.523257-8-mic@digikod.net
Cc: stable@vger.kernel.org
Signed-off-by: Mickaël Salaün <mic@digikod.net >
2022-05-23 13:27:46 +02:00
Mickaël Salaün
9805a722db
samples/landlock: Add clang-format exceptions
...
In preparation to a following commit, add clang-format on and
clang-format off stanzas around constant definitions. This enables to
keep aligned values, which is much more readable than packed
definitions.
Link: https://lore.kernel.org/r/20220506160513.523257-7-mic@digikod.net
Cc: stable@vger.kernel.org
Signed-off-by: Mickaël Salaün <mic@digikod.net >
2022-05-23 13:27:46 +02:00
Tom Rix
66b513b7c6
samples/landlock: Fix path_list memory leak
...
Clang static analysis reports this error
sandboxer.c:134:8: warning: Potential leak of memory
pointed to by 'path_list'
ret = 0;
^
path_list is allocated in parse_path() but never freed.
Signed-off-by: Tom Rix <trix@redhat.com >
Link: https://lore.kernel.org/r/20210428213852.2874324-1-trix@redhat.com
Cc: stable@vger.kernel.org
Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com >
2022-02-04 14:07:39 +01:00
Mickaël Salaün
ba84b0bf5a
samples/landlock: Add a sandbox manager example
...
Add a basic sandbox tool to launch a command which can only access a
list of file hierarchies in a read-only or read-write way.
Cc: James Morris <jmorris@namei.org >
Cc: Serge E. Hallyn <serge@hallyn.com >
Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com >
Reviewed-by: Jann Horn <jannh@google.com >
Reviewed-by: Kees Cook <keescook@chromium.org >
Link: https://lore.kernel.org/r/20210422154123.13086-12-mic@digikod.net
Signed-off-by: James Morris <jamorris@linux.microsoft.com >
2021-04-22 12:22:11 -07:00
