mirror of
https://github.com/torvalds/linux.git
synced 2025-04-09 14:45:27 +00:00
15383a0d63
Some fixes may require user space to check if they are applied on the
running kernel before using a specific feature. For instance, this
applies when a restriction was previously too restrictive and is now
getting relaxed (e.g. for compatibility reasons). However, non-visible
changes for legitimate use (e.g. security fixes) do not require an
erratum.
Because fixes are backported down to a specific Landlock ABI, we need a
way to avoid cherry-pick conflicts. The solution is to only update a
file related to the lower ABI impacted by this issue. All the ABI files
are then used to create a bitmask of fixes.
The new errata interface is similar to the one used to get the supported
Landlock ABI version, but it returns a bitmask instead because the order
of fixes may not match the order of versions, and not all fixes may
apply to all versions.
The actual errata will come with dedicated commits. The description is
not actually used in the code but serves as documentation.
Create the landlock_abi_version symbol and use its value to check errata
consistency.
Update test_base's create_ruleset_checks_ordering tests and add errata
tests.
This commit is backportable down to the first version of Landlock.
Fixes: 3532b0b4352c ("landlock: Enable user space to infer supported features")
Cc: Günther Noack <gnoack@google.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20250318161443.279194-3-mic@digikod.net
Signed-off-by: Mickaël Salaün <mic@digikod.net>
23 lines
529 B
C
23 lines
529 B
C
/* SPDX-License-Identifier: GPL-2.0-only */
|
|
/*
|
|
* Landlock LSM - Security framework setup
|
|
*
|
|
* Copyright © 2016-2020 Mickaël Salaün <mic@digikod.net>
|
|
* Copyright © 2018-2020 ANSSI
|
|
*/
|
|
|
|
#ifndef _SECURITY_LANDLOCK_SETUP_H
|
|
#define _SECURITY_LANDLOCK_SETUP_H
|
|
|
|
#include <linux/lsm_hooks.h>
|
|
|
|
extern const int landlock_abi_version;
|
|
|
|
extern bool landlock_initialized;
|
|
extern int landlock_errata;
|
|
|
|
extern struct lsm_blob_sizes landlock_blob_sizes;
|
|
extern const struct lsm_id landlock_lsmid;
|
|
|
|
#endif /* _SECURITY_LANDLOCK_SETUP_H */
|