Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1470075

Re: [RFC v2 00/10] Landlock LSM: Unprivileged sandboxing

Show all headers | View raw

On Thu, Aug 25, 2016 at 3:32 AM, Mickaël Salaün <mic@digikod.net> wrote:
> Hi,
>
> This series is a proof of concept to fill some missing part of seccomp as the
> ability to check syscall argument pointers or creating more dynamic security
> policies. The goal of this new stackable Linux Security Module (LSM) called
> Landlock is to allow any process, including unprivileged ones, to create
> powerful security sandboxes comparable to the Seatbelt/XNU Sandbox or the
> OpenBSD Pledge. This kind of sandbox help to mitigate the security impact of
> bugs or unexpected/malicious behaviors in userland applications.
>

Maybe I'm missing an obvious description, but: do you have a
description of the eBPF API to landlock?  What function do you
provide, when is it called, what functions can it call, what does the
fancy new arraymap do, etc?

--Andy

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[RFC v2 00/10] Landlock LSM: Unprivileged sandboxing Mickaël Salaün <mic@digikod.net> - 2016-08-25 12:50 +0200
  [RFC v2 10/10] samples/landlock: Add sandbox example Mickaël Salaün <mic@digikod.net> - 2016-08-25 12:50 +0200
  [RFC v2 05/10] seccomp: Handle Landlock Mickaël Salaün <mic@digikod.net> - 2016-08-25 12:50 +0200
  [RFC v2 02/10] bpf: Move u64_to_ptr() to BPF headers and inline it Mickaël Salaün <mic@digikod.net> - 2016-08-25 12:50 +0200
  [RFC v2 08/10] landlock: Handle file system comparisons Mickaël Salaün <mic@digikod.net> - 2016-08-25 12:50 +0200
    Re: [RFC v2 08/10] landlock: Handle file system comparisons Andy Lutomirski <luto@amacapital.net> - 2016-08-25 13:20 +0200
      Re: [RFC v2 08/10] landlock: Handle file system comparisons Mickaël Salaün <mic@digikod.net> - 2016-08-25 16:20 +0200
        Re: [RFC v2 08/10] landlock: Handle file system comparisons Andy Lutomirski <luto@amacapital.net> - 2016-08-26 17:00 +0200
          Re: [RFC v2 08/10] landlock: Handle file system comparisons Mickaël Salaün <mic@digikod.net> - 2016-08-27 15:50 +0200
  [RFC v2 01/10] landlock: Add Kconfig Mickaël Salaün <mic@digikod.net> - 2016-08-25 12:50 +0200
  [RFC v2 07/10] landlock: Add errno check Mickaël Salaün <mic@digikod.net> - 2016-08-25 12:50 +0200
    Re: [RFC v2 07/10] landlock: Add errno check Andy Lutomirski <luto@amacapital.net> - 2016-08-25 13:20 +0200
  [RFC v2 06/10] landlock: Add LSM hooks Mickaël Salaün <mic@digikod.net> - 2016-08-25 12:50 +0200
    Re: [RFC v2 06/10] landlock: Add LSM hooks Andy Lutomirski <luto@amacapital.net> - 2016-08-30 21:00 +0200
      Re: [RFC v2 06/10] landlock: Add LSM hooks Mickaël Salaün <mic@digikod.net> - 2016-08-30 22:20 +0200
        Re: [RFC v2 06/10] landlock: Add LSM hooks Andy Lutomirski <luto@amacapital.net> - 2016-08-30 22:20 +0200
          Re: [RFC v2 06/10] landlock: Add LSM hooks Mickaël Salaün <mic@digikod.net> - 2016-08-30 22:30 +0200
  Re: [RFC v2 00/10] Landlock LSM: Unprivileged sandboxing Andy Lutomirski <luto@amacapital.net> - 2016-08-25 13:30 +0200
    Re: [RFC v2 00/10] Landlock LSM: Unprivileged sandboxing Mickaël Salaün <mic@digikod.net> - 2016-08-25 16:00 +0200
  Re: [RFC v2 00/10] Landlock LSM: Unprivileged sandboxing Andy Lutomirski <luto@amacapital.net> - 2016-08-27 09:50 +0200
    Re: [RFC v2 00/10] Landlock LSM: Unprivileged sandboxing Mickaël Salaün <mic@digikod.net> - 2016-08-27 17:20 +0200
      Re: [RFC v2 00/10] Landlock LSM: Unprivileged sandboxing (cgroup  delegation) Mickaël Salaün <mic@digikod.net> - 2016-08-27 17:30 +0200
  Re: [RFC v2 00/10] Landlock LSM: Unprivileged sandboxing Andy Lutomirski <luto@amacapital.net> - 2016-08-30 18:10 +0200
    Re: [RFC v2 00/10] Landlock LSM: Unprivileged sandboxing Andy Lutomirski <luto@amacapital.net> - 2016-08-30 22:00 +0200
    Re: [RFC v2 00/10] Landlock LSM: Unprivileged sandboxing Mickaël Salaün <mic@digikod.net> - 2016-08-30 22:00 +0200

csiph-web