diff options
Diffstat (limited to 'include/uapi/linux')
| -rw-r--r-- | include/uapi/linux/landlock.h | 49 |
1 files changed, 49 insertions, 0 deletions
diff --git a/include/uapi/linux/landlock.h b/include/uapi/linux/landlock.h index bb8ec589ddac..3128e58d4b78 100644 --- a/include/uapi/linux/landlock.h +++ b/include/uapi/linux/landlock.h @@ -237,6 +237,11 @@ enum landlock_rule_type { * @LANDLOCK_RULE_NAMESPACE: Type of a &struct landlock_namespace_attr . */ LANDLOCK_RULE_NAMESPACE, + /** + * @LANDLOCK_RULE_CAPABILITY: Type of a &struct + * landlock_capability_attr . + */ + LANDLOCK_RULE_CAPABILITY, }; /** @@ -326,6 +331,42 @@ struct landlock_namespace_attr { }; /** + * struct landlock_capability_attr - Capability definition + * + * Argument of sys_landlock_add_rule() with %LANDLOCK_RULE_CAPABILITY. + */ +struct landlock_capability_attr { + /** + * @permissions: Must be set to %LANDLOCK_PERMISSION_CAPABILITY_USE. + */ + __u64 permissions; + /** + * @allowed_capabilities: Bitmask of capabilities (``1ULL << CAP_*``) to + * allow under this rule. Bits above ``CAP_LAST_CAP`` are silently + * ignored for forward compatibility. + */ + __u64 allowed_capabilities; + /** + * @quiet_capabilities: Bitmask of capabilities (``1ULL << CAP_*``) + * whose denial by this layer should not be submitted to audit, even if + * audit logging would normally take place per landlock_restrict_self() + * flags. Only audit records attributed to this layer are suppressed; + * denial tracepoints still fire (see `Permission flags`_). Bits also + * set in @allowed_capabilities have no effect, since an allowed + * capability is never denied. Bits above ``CAP_LAST_CAP`` are silently + * ignored. + * + * At least one of @allowed_capabilities or @quiet_capabilities must be + * non-zero, otherwise the call returns ``-ENOMSG``. The non-zero check + * runs on the raw input before unknown-bit masking, so a rule that sets + * only bits unknown to the running kernel (above ``CAP_LAST_CAP``) + * succeeds but has no runtime effect. Programs should omit this rule + * when they neither allow nor quiet a capability. + */ + __u64 quiet_capabilities; +}; + +/** * DOC: fs_access * * A set of actions on kernel objects may be defined by an attribute (e.g. @@ -577,7 +618,15 @@ struct landlock_namespace_attr { * Landlock domain that handles this permission is denied from using namespace * types that are not explicitly allowed by a %LANDLOCK_RULE_NAMESPACE rule. * Support added in Landlock ABI version 12. + * - %LANDLOCK_PERMISSION_CAPABILITY_USE: Restrict the use of specific Linux + * capabilities. A process in a Landlock domain that handles this permission + * is denied from exercising capabilities that are not explicitly allowed by a + * %LANDLOCK_RULE_CAPABILITY rule. This hook is purely restrictive: it can + * deny capabilities that the kernel would otherwise grant, but it can never + * grant capabilities that the kernel already denied. Support added in + * Landlock ABI version 12. */ #define LANDLOCK_PERMISSION_NAMESPACE_USE (1ULL << 0) +#define LANDLOCK_PERMISSION_CAPABILITY_USE (1ULL << 1) #endif /* _UAPI_LINUX_LANDLOCK_H */ |