| From: |
| Mickaël Salaün <mic-AT-digikod.net> |
| To: |
| Anton Ivanov <anton.ivanov-AT-cambridgegreys.com>, Johannes Berg <johannes-AT-sipsolutions.net>, Richard Weinberger <richard-AT-nod.at> |
| Subject: |
| [PATCH v1 0/5] Landlock support for UML |
| Date: |
| Thu, 09 Mar 2023 17:54:50 +0100 |
| Message-ID: |
| <20230309165455.175131-1-mic@digikod.net> |
| Cc: |
| Mickaël Salaün <mic-AT-digikod.net>, Christopher Obbard <chris.obbard-AT-collabora.com>, Guenter Roeck <groeck-AT-chromium.org>, Günther Noack <gnoack3000-AT-gmail.com>, Jakub Kicinski <kuba-AT-kernel.org>, James Morris <jmorris-AT-namei.org>, Jeff Xu <jeffxu-AT-google.com>, Kees Cook <keescook-AT-chromium.org>, Paul Moore <paul-AT-paul-moore.com>, Ritesh Raj Sarraf <ritesh-AT-collabora.com>, "Serge E . Hallyn" <serge-AT-hallyn.com>, Shuah Khan <skhan-AT-linuxfoundation.org>, Sjoerd Simons <sjoerd-AT-collabora.com>, Willem de Bruijn <willemb-AT-google.com>, linux-fsdevel-AT-vger.kernel.org, linux-kernel-AT-vger.kernel.org, linux-kselftest-AT-vger.kernel.org, linux-security-module-AT-vger.kernel.org |
| Archive-link: |
| Article |
Hi,
Commit cb2c7d1a1776 ("landlock: Support filesystem access-control")
introduced a new ARCH_EPHEMERAL_INODES configuration, only enabled for
User-Mode Linux. The reason was that UML's hostfs managed inodes in an
ephemeral way: from the kernel point of view, the same inode struct
could be created several times while being used by user space because
the kernel didn't hold references to inodes. Because Landlock (and
probably other subsystems) ties properties (i.e. access rights) to inode
objects, it wasn't possible to create rules that match inodes and then
allow specific accesses.
This patch series fixes the way UML manages inodes according to the
underlying filesystem. They are now properly handles as for other
filesystems, which enables to support Landlock (and probably other
features).
Backporting these patches requires some selftest harness patches
backports too.
Regards,
Mickaël Salaün (5):
hostfs: Fix ephemeral inodes
selftests/landlock: Don't create useless file layouts
selftests/landlock: Add supports_filesystem() helper
selftests/landlock: Make mounts configurable
selftests/landlock: Add tests for pseudo filesystems
arch/Kconfig | 7 -
arch/um/Kconfig | 1 -
fs/hostfs/hostfs.h | 1 +
fs/hostfs/hostfs_kern.c | 213 ++++++------
fs/hostfs/hostfs_user.c | 1 +
security/landlock/Kconfig | 2 +-
tools/testing/selftests/landlock/config | 8 +-
tools/testing/selftests/landlock/fs_test.c | 381 +++++++++++++++++++--
8 files changed, 472 insertions(+), 142 deletions(-)
base-commit: fe15c26ee26efa11741a7b632e9f23b01aca4cc6
--
2.39.2
