File tree Expand file tree Collapse file tree 2 files changed +9
-5
lines changed
Documentation/userspace-api Expand file tree Collapse file tree 2 files changed +9
-5
lines changed Original file line number Diff line number Diff line change @@ -8,7 +8,7 @@ Landlock: unprivileged access control
8
8
=====================================
9
9
10
10
:Author: Mickaël Salaün
11
- :Date: October 2024
11
+ :Date: January 2025
12
12
13
13
The goal of Landlock is to enable restriction of ambient rights (e.g. global
14
14
filesystem or network access) for a set of processes. Because Landlock
@@ -329,11 +329,11 @@ non-sandboxed process, we can specify this restriction with
329
329
A sandboxed process can connect to a non-sandboxed process when its domain is
330
330
not scoped. If a process's domain is scoped, it can only connect to sockets
331
331
created by processes in the same scope.
332
- Moreover, If a process is scoped to send signal to a non-scoped process, it can
332
+ Moreover, if a process is scoped to send signal to a non-scoped process, it can
333
333
only send signals to processes in the same scope.
334
334
335
335
A connected datagram socket behaves like a stream socket when its domain is
336
- scoped, meaning if the domain is scoped after the socket is connected , it can
336
+ scoped, meaning if the domain is scoped after the socket is connected, it can
337
337
still :manpage: `send(2)` data just like a stream socket. However, in the same
338
338
scenario, a non-connected datagram socket cannot send data (with
339
339
:manpage: `sendto(2)`) outside its scope.
Original file line number Diff line number Diff line change @@ -268,7 +268,9 @@ struct landlock_net_port_attr {
268
268
* ~~~~~~~~~~~~~~~~
269
269
*
270
270
* These flags enable to restrict a sandboxed process to a set of network
271
- * actions. This is supported since the Landlock ABI version 4.
271
+ * actions.
272
+ *
273
+ * This is supported since Landlock ABI version 4.
272
274
*
273
275
* The following access rights apply to TCP port numbers:
274
276
*
@@ -291,11 +293,13 @@ struct landlock_net_port_attr {
291
293
* Setting a flag for a ruleset will isolate the Landlock domain to forbid
292
294
* connections to resources outside the domain.
293
295
*
296
+ * This is supported since Landlock ABI version 6.
297
+ *
294
298
* Scopes:
295
299
*
296
300
* - %LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET: Restrict a sandboxed process from
297
301
* connecting to an abstract UNIX socket created by a process outside the
298
- * related Landlock domain (e.g. a parent domain or a non-sandboxed process).
302
+ * related Landlock domain (e.g., a parent domain or a non-sandboxed process).
299
303
* - %LANDLOCK_SCOPE_SIGNAL: Restrict a sandboxed process from sending a signal
300
304
* to another process outside the domain.
301
305
*/
You can’t perform that action at this time.
0 commit comments