Support LANDLOCK_ACCESS_FS_IOCTL_DEV access right #29
Comments
gnoack
added a commit
that referenced
this issue
Jun 2, 2024
gnoack
added a commit
that referenced
this issue
Jul 4, 2024
gnoack
added a commit
that referenced
this issue
Jul 5, 2024
gnoack
added a commit
that referenced
this issue
Jul 5, 2024
gnoack
added a commit
that referenced
this issue
Jul 5, 2024
gnoack
added a commit
that referenced
this issue
Jul 15, 2024
Make ioctl(2) requests for device files restrictable with Landlock. In the Go library, the LANDLOCK_ACCESS_FS_IOCTL_DEV right is *not* part of the RWFiles and ROFiles convenience functions. When you upgrade from an earlier ABI version to [landlock.V5], and when you are restricting all access rights available at this version, please double check whether your program uses any IOCTLs on device files. Some of the simpler IOCTL commands are exempt and are unconditionally permitted by Landlock. Fixes: #29 Link: https://lore.kernel.org/linux-security-module/[email protected]/
gnoack
added a commit
that referenced
this issue
Jul 15, 2024
Make ioctl(2) requests for device files restrictable with Landlock. In the Go library, the LANDLOCK_ACCESS_FS_IOCTL_DEV right is *not* part of the RWFiles and ROFiles convenience functions. When you upgrade from an earlier ABI version to `landlock.V5`, and when you are restricting all access rights available at this version, please double check whether your program uses any IOCTLs on device files. Some of the simpler IOCTL commands are exempt and are unconditionally permitted by Landlock. Fixes: #29 Link: https://lore.kernel.org/linux-security-module/[email protected]/
gnoack
added a commit
that referenced
this issue
Oct 13, 2024
Make ioctl(2) requests for device files restrictable with Landlock. In the Go library, the LANDLOCK_ACCESS_FS_IOCTL_DEV right is *not* part of the RWFiles and ROFiles convenience functions. When you upgrade from an earlier ABI version to `landlock.V5`, and when you are restricting all access rights available at this version, please double check whether your program uses any IOCTLs on device files. Some of the simpler IOCTL commands are exempt and are unconditionally permitted by Landlock. (See the link below.) Fixes: #29 Link: https://lore.kernel.org/linux-security-module/[email protected]/
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Compare https://wiki.gnoack.org/LandlockIoctlSupport
Work underway on the "ioctl" branch.
The text was updated successfully, but these errors were encountered: