-
Notifications
You must be signed in to change notification settings - Fork 42
Dynamic Landlock ABI configuration wrt. runtime kernel #2263
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Prior implementation assumed landlock version from flag declarations in headers on compilation host, which do not necessarily match flags available at runtime, in particular on a different runtime target. To include a Landlock flag, now need both availability of flag on compilation host and runtime target.
1b1183c
to
d2071b4
Compare
Itzyboo1
approved these changes
Dec 4, 2024
@Harrm checking in whether you have time to review this? I have merged latest |
Harrm
approved these changes
Feb 12, 2025
Let me run it for a day or two on our stand. If all good, we will merge |
kamilsa
approved these changes
Feb 13, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Referenced issues
resolves #2262
Description of the Change
Dynamically determines the available Landlock flags from the version of the Landlock ABI reverted by this call.
This is necessary since the prior implementation relied solely on the definition of these flags for their inclusion. However, such definition is solely determined by the headers available during compile time and is orthogonal to the feature support of the host's kernel (especially if the compilation host and runtime host are different).
A given Landlock flag is now only included in the
landlock_create_ruleset(...)
call ifAs such, this PR enables hosts with
5.13 <= linux kernel version < 6.7
to be used in Secure Validator Mode.Possible Drawbacks
The drawbacks are the same as the prior implementation's seeming intent.
As described in #2262:
Checklist Before Opening a PR
Before you open a Pull Request (PR), please make sure you've completed the following steps and confirm by answering 'Yes' to each item: