Received-SPF: pass (google.com: domain of linux-kernel+bounces-181112-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
From: =?UTF-8?q?Micka=C3=ABl=20Sala=C3=BCn?= <mic@digikod.net>
To: Linus Torvalds <torvalds@linux-foundation.org>
Cc: =?UTF-8?q?Micka=C3=ABl=20Sala=C3=BCn?= <mic@digikod.net>,
	=?UTF-8?q?G=C3=BCnther=20Noack?= <gnoack@google.com>,
	Ivanov Mikhail <ivanov.mikhail1@huawei-partners.com>,
	Konstantin Meskhidze <konstantin.meskhidze@huawei.com>,
	Paul Moore <paul@paul-moore.com>,
	linux-kernel@vger.kernel.org,
	linux-security-module@vger.kernel.org
Subject: [GIT PULL] Landlock updates for v6.10
Date: Thu, 16 May 2024 15:26:24 +0200
Message-ID: <20240516132624.1536065-1-mic@digikod.net>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Hi Linus,

This PR mainly brings IOCTL control to Landlock, contributed by Günther Noack.
This also adds him as a Landlock reviewer, and fixes an issue in the sample.

Please pull these changes for v6.10-rc1.  This commit merged cleanly with your
master branch.  The kernel code has been tested in the latest linux-next
releases for a few weeks, but I rebased it on v6.9 to avoid a merge conflict
because of the recent Kselftest fixes.

syzkaller has also been patched to know about this new access right.

Regards,
 Mickaël

--
The following changes since commit a38297e3fb012ddfa7ce0321a7e5a8daeb1872b6:

  Linux 6.9 (2024-05-12 14:12:29 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux.git tags/landlock-6.10-rc1

for you to fetch changes up to 5bf9e57e634bd72a97b4b12c87186fc052a6a116:

  MAINTAINERS: Add Günther Noack as Landlock reviewer (2024-05-13 06:58:36 +0200)

----------------------------------------------------------------
Landlock updates for v6.10-rc1

----------------------------------------------------------------
Günther Noack (11):
      landlock: Add IOCTL access right for character and block devices
      selftests/landlock: Test IOCTL support
      selftests/landlock: Test IOCTL with memfds
      selftests/landlock: Test ioctl(2) and ftruncate(2) with open(O_PATH)
      selftests/landlock: Test IOCTLs on named pipes
      selftests/landlock: Check IOCTL restrictions for named UNIX domain sockets
      selftests/landlock: Exhaustive test for the IOCTL allow-list
      samples/landlock: Add support for LANDLOCK_ACCESS_FS_IOCTL_DEV
      landlock: Document IOCTL support
      MAINTAINERS: Notify Landlock maintainers about changes to fs/ioctl.c
      fs/ioctl: Add a comment to keep the logic in sync with LSM policies

Ivanov Mikhail (1):
      samples/landlock: Fix incorrect free in populate_ruleset_net

Mickaël Salaün (1):
      MAINTAINERS: Add Günther Noack as Landlock reviewer

 Documentation/userspace-api/landlock.rst     |  78 ++++-
 MAINTAINERS                                  |   2 +
 fs/ioctl.c                                   |   3 +
 include/uapi/linux/landlock.h                |  38 ++-
 samples/landlock/sandboxer.c                 |  18 +-
 security/landlock/fs.c                       | 225 ++++++++++++-
 security/landlock/limits.h                   |   2 +-
 security/landlock/syscalls.c                 |   2 +-
 tools/testing/selftests/landlock/base_test.c |   2 +-
 tools/testing/selftests/landlock/fs_test.c   | 487 ++++++++++++++++++++++++++-
 10 files changed, 811 insertions(+), 46 deletions(-)