diff options
| author | Mickaël Salaün <mic@digikod.net> | 2026-10-14 10:27:14 +0200 |
|---|---|---|
| committer | Mickaël Salaün <mic@digikod.net> | 2026-10-20 16:47:22 +0200 |
| commit | 5d2c5cd87ab806aa1fbf04e8ef46f6db7f252954 (patch) | |
| tree | 6da799f5a8aaeda2752d6df192b1a6791d2c9c95 /include/trace | |
| parent | b3dafbe7ed23c280564e390d9ad3023a46d77f89 (diff) | |
| download | linux-5d2c5cd87ab806aa1fbf04e8ef46f6db7f252954.tar.gz linux-5d2c5cd87ab806aa1fbf04e8ef46f6db7f252954.zip | |
landlock: Add documentation for capability and namespace restrictions
Document the two new Landlock permission categories, introduced with ABI
12, in the userspace API guide, admin guide, trace-event guide, UAPI
comments, and kernel security documentation.
The kernel security documentation generalizes the existing per-object
access-rights framing into three restriction models (handled_access_*,
handled_permissions, scoped) and states criteria for choosing among
them, so future permission or scope additions have a documented place to
land.
Cc: Christian Brauner <brauner@kernel.org>
Cc: Günther Noack <gnoack@google.com>
Cc: Paul Moore <paul@paul-moore.com>
Cc: Serge E. Hallyn <serge@hallyn.com>
Link: https://patch.msgid.link/20261014082718.1435842-9-mic@digikod.net
Signed-off-by: Mickaël Salaün <mic@digikod.net>
Diffstat (limited to 'include/trace')
| -rw-r--r-- | include/trace/events/landlock.h | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/include/trace/events/landlock.h b/include/trace/events/landlock.h index 744ef55ec1de..4f19d1c04d74 100644 --- a/include/trace/events/landlock.h +++ b/include/trace/events/landlock.h @@ -278,11 +278,12 @@ static inline const char *__trace_landlock_print_layers( * Every denial event shares three fields. domain is the ID of the * innermost domain that blocked the access. same_exec tells whether the * current task is the same executable that entered that domain. logged is - * the domain's audit-logging decision for this denial (its log_status is - * enabled and the per-execution flag selected by same_exec is set); a - * stateless ftrace filter can select the denials the domain submits to - * audit with logged==1, without reconstructing it from the per-execution - * log flags. Denial events order their shared fields as domain, same_exec, + * the complete audit-submission selection for this denial: the domain's + * log_status and per-execution flag, per-object or per-member quiet rules, + * and request-specific no-audit options. This excludes global audit state + * and audit-side filters. A stateless ftrace filter can select the denials + * the domain submits to audit with logged==1, without reconstructing those + * inputs. Denial events order their shared fields as domain, same_exec, * and logged. Access and permission denial events follow these with the * blockers verdict input, type-specific fields, and any variable-length field. * |