Re: [PATCH v5 06/10] seccomp,landlock: Handle Landlock events per process hierarchy

2017-03-02 Thread Andy Lutomirski
On Thu, Mar 2, 2017 at 4:48 PM, Mickaël Salaün wrote: > > On 02/03/2017 17:36, Andy Lutomirski wrote: >> On Wed, Mar 1, 2017 at 3:28 PM, Mickaël Salaün wrote: >>> >>> >>> On 01/03/2017 23:20, Andy Lutomirski wrote: On Wed, Mar 1, 2017 at 2:14 PM, Mickaël Salaün wrote: > > On 28/02/2

Re: [kernel-hardening] [PATCH v5 06/10] seccomp,landlock: Handle Landlock events per process hierarchy

2017-03-02 Thread Mickaël Salaün
On 02/03/2017 11:22, Djalal Harouni wrote: > On Wed, Feb 22, 2017 at 2:26 AM, Mickaël Salaün wrote: >> The seccomp(2) syscall can be use to apply a Landlock rule to the >> current process. As with a seccomp filter, the Landlock rule is enforced >> for all its future children. An inherited rule t

Re: [PATCH v5 06/10] seccomp,landlock: Handle Landlock events per process hierarchy

2017-03-02 Thread Mickaël Salaün
On 03/03/2017 01:55, Andy Lutomirski wrote: > On Thu, Mar 2, 2017 at 4:48 PM, Mickaël Salaün wrote: >> >> On 02/03/2017 17:36, Andy Lutomirski wrote: >>> On Wed, Mar 1, 2017 at 3:28 PM, Mickaël Salaün wrote: On 01/03/2017 23:20, Andy Lutomirski wrote: > On Wed, Mar 1, 2017 at

Re: [PATCH v5 06/10] seccomp,landlock: Handle Landlock events per process hierarchy

2017-03-02 Thread Mickaël Salaün
On 02/03/2017 17:36, Andy Lutomirski wrote: > On Wed, Mar 1, 2017 at 3:28 PM, Mickaël Salaün wrote: >> >> >> On 01/03/2017 23:20, Andy Lutomirski wrote: >>> On Wed, Mar 1, 2017 at 2:14 PM, Mickaël Salaün wrote: On 28/02/2017 21:01, Andy Lutomirski wrote: > On Tue, Feb 21, 2017 at 5

Re: [PATCH v5 06/10] seccomp,landlock: Handle Landlock events per process hierarchy

2017-03-02 Thread Andy Lutomirski
On Wed, Mar 1, 2017 at 3:28 PM, Mickaël Salaün wrote: > > > On 01/03/2017 23:20, Andy Lutomirski wrote: >> On Wed, Mar 1, 2017 at 2:14 PM, Mickaël Salaün wrote: >>> >>> On 28/02/2017 21:01, Andy Lutomirski wrote: On Tue, Feb 21, 2017 at 5:26 PM, Mickaël Salaün wrote: >>> This design makes i

Re: [kernel-hardening] [PATCH v5 06/10] seccomp,landlock: Handle Landlock events per process hierarchy

2017-03-02 Thread Djalal Harouni
On Wed, Feb 22, 2017 at 2:26 AM, Mickaël Salaün wrote: > The seccomp(2) syscall can be use to apply a Landlock rule to the > current process. As with a seccomp filter, the Landlock rule is enforced > for all its future children. An inherited rule tree can be updated > (append-only) by the owner of

Re: [PATCH v5 06/10] seccomp,landlock: Handle Landlock events per process hierarchy

2017-03-01 Thread Andy Lutomirski
On Wed, Mar 1, 2017 at 2:14 PM, Mickaël Salaün wrote: > > On 28/02/2017 21:01, Andy Lutomirski wrote: >> On Tue, Feb 21, 2017 at 5:26 PM, Mickaël Salaün wrote: >>> The seccomp(2) syscall can be use to apply a Landlock rule to the >>> current process. As with a seccomp filter, the Landlock rule is

Re: [PATCH v5 06/10] seccomp,landlock: Handle Landlock events per process hierarchy

2017-03-01 Thread Mickaël Salaün
On 01/03/2017 23:20, Andy Lutomirski wrote: > On Wed, Mar 1, 2017 at 2:14 PM, Mickaël Salaün wrote: >> >> On 28/02/2017 21:01, Andy Lutomirski wrote: >>> On Tue, Feb 21, 2017 at 5:26 PM, Mickaël Salaün wrote: The seccomp(2) syscall can be use to apply a Landlock rule to the current pr

Re: [PATCH v5 06/10] seccomp,landlock: Handle Landlock events per process hierarchy

2017-03-01 Thread Mickaël Salaün
On 28/02/2017 21:01, Andy Lutomirski wrote: > On Tue, Feb 21, 2017 at 5:26 PM, Mickaël Salaün wrote: >> The seccomp(2) syscall can be use to apply a Landlock rule to the >> current process. As with a seccomp filter, the Landlock rule is enforced >> for all its future children. An inherited rule t

Re: [PATCH v5 06/10] seccomp,landlock: Handle Landlock events per process hierarchy

2017-02-28 Thread Andy Lutomirski
On Tue, Feb 21, 2017 at 5:26 PM, Mickaël Salaün wrote: > The seccomp(2) syscall can be use to apply a Landlock rule to the > current process. As with a seccomp filter, the Landlock rule is enforced > for all its future children. An inherited rule tree can be updated > (append-only) by the owner of

[PATCH v5 06/10] seccomp,landlock: Handle Landlock events per process hierarchy

2017-02-21 Thread Mickaël Salaün
The seccomp(2) syscall can be use to apply a Landlock rule to the current process. As with a seccomp filter, the Landlock rule is enforced for all its future children. An inherited rule tree can be updated (append-only) by the owner of inherited Landlock nodes (e.g. a parent process that create a n