Re: Landlock and O_PATH

On 22/02/2022 22:28, S.M Mukarram Nainar wrote:
>> Landlock is designed to be backward and forward compatible just to avoid
>> this kind of issue. An application being restricted with a set of access
>> right will not automatically get new ones with a newer kernel: action
>> handling is explicit (see ruleset's handled_access_fs). I'm extending
>> the documentation with this specific subject:
>> https://lore.kernel.org/r/[email protected]
> 
> Yeah, I understand that. Thanks for clarifying the documentation. But I
> guess my question is then: Can it be assumed that the behavior of any
> given flag will never change? I think that earlier I was assuming that
> O_PATH would go under FS_READ_DIR in the future, but I guess that is not
> the case?

Correct, a given Landlock flag/command/attribute will not change 
behavior over time, as (in theory) all Linux interfaces. If a flag is 
not enough, extensible structs used by the Landlock syscalls can be 
used: 
https://lpc.events/event/7/contributions/657/attachments/639/1159/extensible_syscalls.pdf

For instance, I'm adding a LANDLOCK_ACCESS_FS_REFER to get rid of the 
rename and link limitations. The current behavior (i.e. a ruleset not 
handling this new access right) doesn't change. Taking the O_PATH 
example, I think a new access right like LANDLOCK_ACCESS_FS_WALK could 
be created to cover O_PATH, chdir and other ways to do path traversals.