path: root/security/landlock
diff options
authorMickaël Salaün <>2021-04-22 17:41:23 +0200
committerJames Morris <>2021-04-22 12:22:11 -0700
commit3532b0b4352ce79400b0aa68414f1a0fc422b920 (patch)
tree94f98b433fe0a2ba8a8cfb8b752491dfefce0577 /security/landlock
parent5526b450834331d9196cae26acef0bfd5afd9fc4 (diff)
landlock: Enable user space to infer supported features
Add a new flag LANDLOCK_CREATE_RULESET_VERSION to landlock_create_ruleset(2). This enables to retreive a Landlock ABI version that is useful to efficiently follow a best-effort security approach. Indeed, it would be a missed opportunity to abort the whole sandbox building, because some features are unavailable, instead of protecting users as much as possible with the subset of features provided by the running kernel. This new flag enables user space to identify the minimum set of Landlock features supported by the running kernel without relying on a filesystem interface (e.g. /proc/version, which might be inaccessible) nor testing multiple syscall argument combinations (i.e. syscall bisection). New Landlock features will be documented and tied to a minimum version number (greater than 1). The current version will be incremented for each new kernel release supporting new Landlock features. User space libraries can leverage this information to seamlessly restrict processes as much as possible while being compatible with newer APIs. This is a much more lighter approach than the previous landlock_get_features(2): the complexity is pushed to user space libraries. This flag meets similar needs as securityfs versions: selinux/policyvers, apparmor/features/*/version* and tomoyo/version. Supporting this flag now will be convenient for backward compatibility. Cc: Arnd Bergmann <> Cc: James Morris <> Cc: Jann Horn <> Cc: Kees Cook <> Cc: Serge E. Hallyn <> Signed-off-by: Mickaël Salaün <> Link: Signed-off-by: James Morris <>
Diffstat (limited to 'security/landlock')
1 files changed, 13 insertions, 4 deletions
diff --git a/security/landlock/syscalls.c b/security/landlock/syscalls.c
index 93620ad7593b..32396962f04d 100644
--- a/security/landlock/syscalls.c
+++ b/security/landlock/syscalls.c
@@ -128,6 +128,8 @@ static const struct file_operations ruleset_fops = {
.write = fop_dummy_write,
* sys_landlock_create_ruleset - Create a new ruleset
@@ -135,15 +137,19 @@ static const struct file_operations ruleset_fops = {
* the new ruleset.
* @size: Size of the pointed &struct landlock_ruleset_attr (needed for
* backward and forward compatibility).
- * @flags: Must be 0.
+ * @flags: Supported value: %LANDLOCK_CREATE_RULESET_VERSION.
* This system call enables to create a new Landlock ruleset, and returns the
* related file descriptor on success.
+ * If @flags is %LANDLOCK_CREATE_RULESET_VERSION and @attr is NULL and @size is
+ * 0, then the returned value is the highest supported Landlock ABI version
+ * (starting at 1).
+ *
* Possible returned errors are:
* - EOPNOTSUPP: Landlock is supported by the kernel but disabled at boot time;
- * - EINVAL: @flags is not 0, or unknown access, or too small @size;
+ * - EINVAL: unknown @flags, or unknown access, or too small @size;
* - E2BIG or EFAULT: @attr or @size inconsistencies;
* - ENOMSG: empty &landlock_ruleset_attr.handled_access_fs.
@@ -161,9 +167,12 @@ SYSCALL_DEFINE3(landlock_create_ruleset,
if (!landlock_initialized)
- /* No flag for now. */
- if (flags)
+ if (flags) {
+ && !attr && !size)
return -EINVAL;
+ }
/* Copies raw user space buffer. */
err = copy_min_struct_from_user(&ruleset_attr, sizeof(ruleset_attr),