* [PR PATCH] linux5.15+: Add landlock to CONFIG_LSM
@ 2022-12-28 23:09 crtxcr
2022-12-28 23:14 ` paper42
` (5 more replies)
0 siblings, 6 replies; 7+ messages in thread
From: crtxcr @ 2022-12-28 23:09 UTC (permalink / raw)
To: ml
[-- Attachment #1: Type: text/plain, Size: 696 bytes --]
There is a new pull request by crtxcr against master on the void-packages repository
https://github.com/crtxcr/void-packages linux_enable_landlock
https://github.com/void-linux/void-packages/pull/41337
linux5.15+: Add landlock to CONFIG_LSM
#### Testing the changes
- I tested the changes in this PR: **NO**
I answered NO here since I don't run voids kernel config (but have my own with it enabled)
For landlock to be available CONFIG_SECURITY_LANDLOCK=y is not enough, it should also be added to CONFIG_LSM: https://docs.kernel.org/userspace-api/landlock.html#kernel-support
CC @sgn
A patch file from https://github.com/void-linux/void-packages/pull/41337.patch is attached
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: github-pr-linux_enable_landlock-41337.patch --]
[-- Type: text/x-diff, Size: 10813 bytes --]
From c7a9540906c9efe69277ade7e3f3fcd3c23192cf Mon Sep 17 00:00:00 2001
From: Albert Schwarzkopf <dev-voidlinux@quitesimple.org>
Date: Thu, 29 Dec 2022 00:01:04 +0100
Subject: [PATCH] linux5.15+: Add landlock to CONFIG_LSM
---
srcpkgs/linux5.15/files/arm64-dotconfig | 2 +-
srcpkgs/linux5.15/files/i386-dotconfig | 2 +-
srcpkgs/linux5.15/files/ppc-dotconfig | 2 +-
srcpkgs/linux5.15/files/ppc64-dotconfig | 2 +-
srcpkgs/linux5.15/files/ppc64le-dotconfig | 2 +-
srcpkgs/linux5.15/files/x86_64-dotconfig | 2 +-
srcpkgs/linux6.0/files/arm64-dotconfig | 2 +-
srcpkgs/linux6.0/files/i386-dotconfig | 2 +-
srcpkgs/linux6.0/files/ppc-dotconfig | 2 +-
srcpkgs/linux6.0/files/ppc64-dotconfig | 2 +-
srcpkgs/linux6.0/files/ppc64le-dotconfig | 2 +-
srcpkgs/linux6.0/files/x86_64-dotconfig | 2 +-
srcpkgs/linux6.1/files/arm64-dotconfig | 2 +-
srcpkgs/linux6.1/files/i386-dotconfig | 2 +-
srcpkgs/linux6.1/files/ppc-dotconfig | 2 +-
srcpkgs/linux6.1/files/ppc64-dotconfig | 2 +-
srcpkgs/linux6.1/files/ppc64le-dotconfig | 2 +-
srcpkgs/linux6.1/files/x86_64-dotconfig | 2 +-
18 files changed, 18 insertions(+), 18 deletions(-)
diff --git a/srcpkgs/linux5.15/files/arm64-dotconfig b/srcpkgs/linux5.15/files/arm64-dotconfig
index 40c18915d3bc..c3d64f6203ad 100644
--- a/srcpkgs/linux5.15/files/arm64-dotconfig
+++ b/srcpkgs/linux5.15/files/arm64-dotconfig
@@ -11226,7 +11226,7 @@ CONFIG_INTEGRITY_AUDIT=y
# CONFIG_EVM is not set
CONFIG_DEFAULT_SECURITY_APPARMOR=y
# CONFIG_DEFAULT_SECURITY_DAC is not set
-CONFIG_LSM="yama,loadpin,safesetid,integrity"
+CONFIG_LSM="landlock,yama,loadpin,safesetid,integrity"
#
# Kernel hardening options
diff --git a/srcpkgs/linux5.15/files/i386-dotconfig b/srcpkgs/linux5.15/files/i386-dotconfig
index 1f90e83f094c..a76b25edb7d3 100644
--- a/srcpkgs/linux5.15/files/i386-dotconfig
+++ b/srcpkgs/linux5.15/files/i386-dotconfig
@@ -9544,7 +9544,7 @@ CONFIG_INTEGRITY_AUDIT=y
# CONFIG_DEFAULT_SECURITY_SELINUX is not set
# CONFIG_DEFAULT_SECURITY_APPARMOR is not set
CONFIG_DEFAULT_SECURITY_DAC=y
-CONFIG_LSM="yama,loadpin,safesetid,integrity"
+CONFIG_LSM="landlock,yama,loadpin,safesetid,integrity"
#
# Kernel hardening options
diff --git a/srcpkgs/linux5.15/files/ppc-dotconfig b/srcpkgs/linux5.15/files/ppc-dotconfig
index 56421d1745f2..891c36f5e592 100644
--- a/srcpkgs/linux5.15/files/ppc-dotconfig
+++ b/srcpkgs/linux5.15/files/ppc-dotconfig
@@ -7674,7 +7674,7 @@ CONFIG_INTEGRITY_AUDIT=y
# CONFIG_DEFAULT_SECURITY_SELINUX is not set
CONFIG_DEFAULT_SECURITY_APPARMOR=y
# CONFIG_DEFAULT_SECURITY_DAC is not set
-CONFIG_LSM="yama,loadpin,safesetid,integrity,apparmor,selinux,smack,tomoyo"
+CONFIG_LSM="landlock,yama,loadpin,safesetid,integrity,apparmor,selinux,smack,tomoyo"
#
# Kernel hardening options
diff --git a/srcpkgs/linux5.15/files/ppc64-dotconfig b/srcpkgs/linux5.15/files/ppc64-dotconfig
index 601f1d55d2ee..4cbbc7be7c99 100644
--- a/srcpkgs/linux5.15/files/ppc64-dotconfig
+++ b/srcpkgs/linux5.15/files/ppc64-dotconfig
@@ -9658,7 +9658,7 @@ CONFIG_INTEGRITY_AUDIT=y
# CONFIG_DEFAULT_SECURITY_SELINUX is not set
# CONFIG_DEFAULT_SECURITY_APPARMOR is not set
CONFIG_DEFAULT_SECURITY_DAC=y
-CONFIG_LSM="yama,loadpin,safesetid,integrity"
+CONFIG_LSM="landlock,yama,loadpin,safesetid,integrity"
#
# Kernel hardening options
diff --git a/srcpkgs/linux5.15/files/ppc64le-dotconfig b/srcpkgs/linux5.15/files/ppc64le-dotconfig
index 5fafdb797f0b..c4220b08d1c9 100644
--- a/srcpkgs/linux5.15/files/ppc64le-dotconfig
+++ b/srcpkgs/linux5.15/files/ppc64le-dotconfig
@@ -9380,7 +9380,7 @@ CONFIG_INTEGRITY_AUDIT=y
# CONFIG_DEFAULT_SECURITY_SELINUX is not set
# CONFIG_DEFAULT_SECURITY_APPARMOR is not set
CONFIG_DEFAULT_SECURITY_DAC=y
-CONFIG_LSM="yama,loadpin,safesetid,integrity"
+CONFIG_LSM="landlock,yama,loadpin,safesetid,integrity"
#
# Kernel hardening options
diff --git a/srcpkgs/linux5.15/files/x86_64-dotconfig b/srcpkgs/linux5.15/files/x86_64-dotconfig
index 7c711c66f9da..e452c0f08396 100644
--- a/srcpkgs/linux5.15/files/x86_64-dotconfig
+++ b/srcpkgs/linux5.15/files/x86_64-dotconfig
@@ -9728,7 +9728,7 @@ CONFIG_INTEGRITY_AUDIT=y
# CONFIG_EVM is not set
# CONFIG_DEFAULT_SECURITY_APPARMOR is not set
CONFIG_DEFAULT_SECURITY_DAC=y
-CONFIG_LSM="yama,loadpin,safesetid,integrity"
+CONFIG_LSM="landlock,yama,loadpin,safesetid,integrity"
#
# Kernel hardening options
diff --git a/srcpkgs/linux6.0/files/arm64-dotconfig b/srcpkgs/linux6.0/files/arm64-dotconfig
index c708bc401cb3..60a19732fb42 100644
--- a/srcpkgs/linux6.0/files/arm64-dotconfig
+++ b/srcpkgs/linux6.0/files/arm64-dotconfig
@@ -11759,7 +11759,7 @@ CONFIG_INTEGRITY_AUDIT=y
# CONFIG_EVM is not set
CONFIG_DEFAULT_SECURITY_APPARMOR=y
# CONFIG_DEFAULT_SECURITY_DAC is not set
-CONFIG_LSM="yama,loadpin,safesetid,integrity"
+CONFIG_LSM="landlock,yama,loadpin,safesetid,integrity"
#
# Kernel hardening options
diff --git a/srcpkgs/linux6.0/files/i386-dotconfig b/srcpkgs/linux6.0/files/i386-dotconfig
index eb5ad6fce09a..ea5bddf4685d 100644
--- a/srcpkgs/linux6.0/files/i386-dotconfig
+++ b/srcpkgs/linux6.0/files/i386-dotconfig
@@ -9964,7 +9964,7 @@ CONFIG_INTEGRITY_AUDIT=y
# CONFIG_DEFAULT_SECURITY_SELINUX is not set
# CONFIG_DEFAULT_SECURITY_APPARMOR is not set
CONFIG_DEFAULT_SECURITY_DAC=y
-CONFIG_LSM="yama,loadpin,safesetid,integrity"
+CONFIG_LSM="landlock,yama,loadpin,safesetid,integrity"
#
# Kernel hardening options
diff --git a/srcpkgs/linux6.0/files/ppc-dotconfig b/srcpkgs/linux6.0/files/ppc-dotconfig
index 62a721ff52cb..2bf2cb2411a6 100644
--- a/srcpkgs/linux6.0/files/ppc-dotconfig
+++ b/srcpkgs/linux6.0/files/ppc-dotconfig
@@ -8005,7 +8005,7 @@ CONFIG_INTEGRITY_AUDIT=y
# CONFIG_DEFAULT_SECURITY_SELINUX is not set
CONFIG_DEFAULT_SECURITY_APPARMOR=y
# CONFIG_DEFAULT_SECURITY_DAC is not set
-CONFIG_LSM="yama,loadpin,safesetid,integrity,apparmor,selinux,smack,tomoyo"
+CONFIG_LSM="landlock,yama,loadpin,safesetid,integrity,apparmor,selinux,smack,tomoyo"
#
# Kernel hardening options
diff --git a/srcpkgs/linux6.0/files/ppc64-dotconfig b/srcpkgs/linux6.0/files/ppc64-dotconfig
index 841ae1a350d3..d8c80c856e9f 100644
--- a/srcpkgs/linux6.0/files/ppc64-dotconfig
+++ b/srcpkgs/linux6.0/files/ppc64-dotconfig
@@ -10030,7 +10030,7 @@ CONFIG_INTEGRITY_AUDIT=y
# CONFIG_DEFAULT_SECURITY_SELINUX is not set
# CONFIG_DEFAULT_SECURITY_APPARMOR is not set
CONFIG_DEFAULT_SECURITY_DAC=y
-CONFIG_LSM="yama,loadpin,safesetid,integrity"
+CONFIG_LSM="landlock,yama,loadpin,safesetid,integrity"
#
# Kernel hardening options
diff --git a/srcpkgs/linux6.0/files/ppc64le-dotconfig b/srcpkgs/linux6.0/files/ppc64le-dotconfig
index a32850c87f39..f263d08b03ef 100644
--- a/srcpkgs/linux6.0/files/ppc64le-dotconfig
+++ b/srcpkgs/linux6.0/files/ppc64le-dotconfig
@@ -9750,7 +9750,7 @@ CONFIG_INTEGRITY_AUDIT=y
# CONFIG_DEFAULT_SECURITY_SELINUX is not set
# CONFIG_DEFAULT_SECURITY_APPARMOR is not set
CONFIG_DEFAULT_SECURITY_DAC=y
-CONFIG_LSM="yama,loadpin,safesetid,integrity"
+CONFIG_LSM="landlock,yama,loadpin,safesetid,integrity"
#
# Kernel hardening options
diff --git a/srcpkgs/linux6.0/files/x86_64-dotconfig b/srcpkgs/linux6.0/files/x86_64-dotconfig
index fc67dc699926..b592092a4bf7 100644
--- a/srcpkgs/linux6.0/files/x86_64-dotconfig
+++ b/srcpkgs/linux6.0/files/x86_64-dotconfig
@@ -10188,7 +10188,7 @@ CONFIG_INTEGRITY_AUDIT=y
# CONFIG_EVM is not set
# CONFIG_DEFAULT_SECURITY_APPARMOR is not set
CONFIG_DEFAULT_SECURITY_DAC=y
-CONFIG_LSM="yama,loadpin,safesetid,integrity"
+CONFIG_LSM="landlock,yama,loadpin,safesetid,integrity"
#
# Kernel hardening options
diff --git a/srcpkgs/linux6.1/files/arm64-dotconfig b/srcpkgs/linux6.1/files/arm64-dotconfig
index c244e5af74ee..138dfb47a123 100644
--- a/srcpkgs/linux6.1/files/arm64-dotconfig
+++ b/srcpkgs/linux6.1/files/arm64-dotconfig
@@ -11785,7 +11785,7 @@ CONFIG_INTEGRITY_AUDIT=y
# CONFIG_EVM is not set
CONFIG_DEFAULT_SECURITY_APPARMOR=y
# CONFIG_DEFAULT_SECURITY_DAC is not set
-CONFIG_LSM="yama,loadpin,safesetid,integrity"
+CONFIG_LSM="landlock,yama,loadpin,safesetid,integrity"
#
# Kernel hardening options
diff --git a/srcpkgs/linux6.1/files/i386-dotconfig b/srcpkgs/linux6.1/files/i386-dotconfig
index d549a8932534..f484941f12e5 100644
--- a/srcpkgs/linux6.1/files/i386-dotconfig
+++ b/srcpkgs/linux6.1/files/i386-dotconfig
@@ -9981,7 +9981,7 @@ CONFIG_INTEGRITY_AUDIT=y
# CONFIG_DEFAULT_SECURITY_SELINUX is not set
# CONFIG_DEFAULT_SECURITY_APPARMOR is not set
CONFIG_DEFAULT_SECURITY_DAC=y
-CONFIG_LSM="yama,loadpin,safesetid,integrity"
+CONFIG_LSM="landlock,yama,loadpin,safesetid,integrity"
#
# Kernel hardening options
diff --git a/srcpkgs/linux6.1/files/ppc-dotconfig b/srcpkgs/linux6.1/files/ppc-dotconfig
index 1aa3fc01e3cb..42533d89a6e6 100644
--- a/srcpkgs/linux6.1/files/ppc-dotconfig
+++ b/srcpkgs/linux6.1/files/ppc-dotconfig
@@ -8009,7 +8009,7 @@ CONFIG_INTEGRITY_AUDIT=y
# CONFIG_DEFAULT_SECURITY_SELINUX is not set
CONFIG_DEFAULT_SECURITY_APPARMOR=y
# CONFIG_DEFAULT_SECURITY_DAC is not set
-CONFIG_LSM="yama,loadpin,safesetid,integrity,apparmor,selinux,smack,tomoyo"
+CONFIG_LSM="landlock,yama,loadpin,safesetid,integrity,apparmor,selinux,smack,tomoyo"
#
# Kernel hardening options
diff --git a/srcpkgs/linux6.1/files/ppc64-dotconfig b/srcpkgs/linux6.1/files/ppc64-dotconfig
index 82058e328ec9..cb41cf4b037f 100644
--- a/srcpkgs/linux6.1/files/ppc64-dotconfig
+++ b/srcpkgs/linux6.1/files/ppc64-dotconfig
@@ -10050,7 +10050,7 @@ CONFIG_INTEGRITY_AUDIT=y
# CONFIG_DEFAULT_SECURITY_SELINUX is not set
# CONFIG_DEFAULT_SECURITY_APPARMOR is not set
CONFIG_DEFAULT_SECURITY_DAC=y
-CONFIG_LSM="yama,loadpin,safesetid,integrity"
+CONFIG_LSM="landlock,yama,loadpin,safesetid,integrity"
#
# Kernel hardening options
diff --git a/srcpkgs/linux6.1/files/ppc64le-dotconfig b/srcpkgs/linux6.1/files/ppc64le-dotconfig
index 1881ce75cecf..2d85dcc227c1 100644
--- a/srcpkgs/linux6.1/files/ppc64le-dotconfig
+++ b/srcpkgs/linux6.1/files/ppc64le-dotconfig
@@ -9771,7 +9771,7 @@ CONFIG_INTEGRITY_AUDIT=y
# CONFIG_DEFAULT_SECURITY_SELINUX is not set
# CONFIG_DEFAULT_SECURITY_APPARMOR is not set
CONFIG_DEFAULT_SECURITY_DAC=y
-CONFIG_LSM="yama,loadpin,safesetid,integrity"
+CONFIG_LSM="landlock,yama,loadpin,safesetid,integrity"
#
# Kernel hardening options
diff --git a/srcpkgs/linux6.1/files/x86_64-dotconfig b/srcpkgs/linux6.1/files/x86_64-dotconfig
index d6ed831e1921..20579c094dee 100644
--- a/srcpkgs/linux6.1/files/x86_64-dotconfig
+++ b/srcpkgs/linux6.1/files/x86_64-dotconfig
@@ -10219,7 +10219,7 @@ CONFIG_INTEGRITY_AUDIT=y
# CONFIG_EVM is not set
# CONFIG_DEFAULT_SECURITY_APPARMOR is not set
CONFIG_DEFAULT_SECURITY_DAC=y
-CONFIG_LSM="yama,loadpin,safesetid,integrity"
+CONFIG_LSM="landlock,yama,loadpin,safesetid,integrity"
#
# Kernel hardening options
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: linux5.15+: Add landlock to CONFIG_LSM
2022-12-28 23:09 [PR PATCH] linux5.15+: Add landlock to CONFIG_LSM crtxcr
@ 2022-12-28 23:14 ` paper42
2022-12-28 23:40 ` crtxcr
` (4 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: paper42 @ 2022-12-28 23:14 UTC (permalink / raw)
To: ml
[-- Attachment #1: Type: text/plain, Size: 301 bytes --]
New comment by paper42 on void-packages repository
https://github.com/void-linux/void-packages/pull/41337#issuecomment-1366975839
Comment:
> If the running kernel does not have landlock in CONFIG_LSM, then we can still enable it by adding lsm=landlock,[...]
So why should it be enabled by default?
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: linux5.15+: Add landlock to CONFIG_LSM
2022-12-28 23:09 [PR PATCH] linux5.15+: Add landlock to CONFIG_LSM crtxcr
2022-12-28 23:14 ` paper42
@ 2022-12-28 23:40 ` crtxcr
2022-12-29 1:42 ` sgn
` (3 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: crtxcr @ 2022-12-28 23:40 UTC (permalink / raw)
To: ml
[-- Attachment #1: Type: text/plain, Size: 464 bytes --]
New comment by crtxcr on void-packages repository
https://github.com/void-linux/void-packages/pull/41337#issuecomment-1366983339
Comment:
>So why should it be enabled by default?
It allows applications to sandbox themselves and does not require privileges to do so. Enabling it by default makes it available to applications without user intervention. Other distros also have it enabled, so having it default enabled wouldn't be unchartered terrirotry either.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: linux5.15+: Add landlock to CONFIG_LSM
2022-12-28 23:09 [PR PATCH] linux5.15+: Add landlock to CONFIG_LSM crtxcr
2022-12-28 23:14 ` paper42
2022-12-28 23:40 ` crtxcr
@ 2022-12-29 1:42 ` sgn
2022-12-29 1:44 ` sgn
` (2 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: sgn @ 2022-12-29 1:42 UTC (permalink / raw)
To: ml
[-- Attachment #1: Type: text/plain, Size: 186 bytes --]
New comment by sgn on void-packages repository
https://github.com/void-linux/void-packages/pull/41337#issuecomment-1367018280
Comment:
> This can be controlled at boot with the "lsm="
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: linux5.15+: Add landlock to CONFIG_LSM
2022-12-28 23:09 [PR PATCH] linux5.15+: Add landlock to CONFIG_LSM crtxcr
` (2 preceding siblings ...)
2022-12-29 1:42 ` sgn
@ 2022-12-29 1:44 ` sgn
2022-12-29 7:34 ` crtxcr
2022-12-29 7:44 ` [PR PATCH] [Merged]: " sgn
5 siblings, 0 replies; 7+ messages in thread
From: sgn @ 2022-12-29 1:44 UTC (permalink / raw)
To: ml
[-- Attachment #1: Type: text/plain, Size: 195 bytes --]
New comment by sgn on void-packages repository
https://github.com/void-linux/void-packages/pull/41337#issuecomment-1367018542
Comment:
This can be controlled at boot with the "lsm=" parameter.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: linux5.15+: Add landlock to CONFIG_LSM
2022-12-28 23:09 [PR PATCH] linux5.15+: Add landlock to CONFIG_LSM crtxcr
` (3 preceding siblings ...)
2022-12-29 1:44 ` sgn
@ 2022-12-29 7:34 ` crtxcr
2022-12-29 7:44 ` [PR PATCH] [Merged]: " sgn
5 siblings, 0 replies; 7+ messages in thread
From: crtxcr @ 2022-12-29 7:34 UTC (permalink / raw)
To: ml
[-- Attachment #1: Type: text/plain, Size: 915 bytes --]
New comment by crtxcr on void-packages repository
https://github.com/void-linux/void-packages/pull/41337#issuecomment-1367126001
Comment:
@sgn Yes, @paper42 said that much already and I replied why I believe it should be enabled.
To expand on that, I really think regarding landlock the better question is why not to enable it, given it operates on a per-process basis. It doesn't do anything if a process doesn't use it. For those who do, it can serve as a useful tool to create sandboxes or mitigate the effects of exploited vulnerabilities. If, like currently, it simply off a process that would otherwise utilize it might not benefit from it.
It can be assumed most users will not add it to lsm= boot parameters, so they won't benefit from it.
It's also on in Arch, Gentoo, Fedora and Ubuntu. If it was a problematic module it would have been noticed by now. So why shouldn't void enable it too?
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PR PATCH] [Merged]: linux5.15+: Add landlock to CONFIG_LSM
2022-12-28 23:09 [PR PATCH] linux5.15+: Add landlock to CONFIG_LSM crtxcr
` (4 preceding siblings ...)
2022-12-29 7:34 ` crtxcr
@ 2022-12-29 7:44 ` sgn
5 siblings, 0 replies; 7+ messages in thread
From: sgn @ 2022-12-29 7:44 UTC (permalink / raw)
To: ml
[-- Attachment #1: Type: text/plain, Size: 533 bytes --]
There's a merged pull request on the void-packages repository
linux5.15+: Add landlock to CONFIG_LSM
https://github.com/void-linux/void-packages/pull/41337
Description:
#### Testing the changes
- I tested the changes in this PR: **NO**
I answered NO here since I don't run voids kernel config (but have my own with it enabled)
For landlock to be available CONFIG_SECURITY_LANDLOCK=y is not enough, it should also be added to CONFIG_LSM: https://docs.kernel.org/userspace-api/landlock.html#kernel-support
CC @sgn
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2022-12-29 7:44 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-12-28 23:09 [PR PATCH] linux5.15+: Add landlock to CONFIG_LSM crtxcr
2022-12-28 23:14 ` paper42
2022-12-28 23:40 ` crtxcr
2022-12-29 1:42 ` sgn
2022-12-29 1:44 ` sgn
2022-12-29 7:34 ` crtxcr
2022-12-29 7:44 ` [PR PATCH] [Merged]: " sgn
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).