File tree Expand file tree Collapse file tree 2 files changed +9
-5
lines changed
Documentation/userspace-api Expand file tree Collapse file tree 2 files changed +9
-5
lines changed Original file line number Diff line number Diff line change @@ -8,7 +8,7 @@ Landlock: unprivileged access control
88=====================================
99
1010:Author: Mickaël Salaün
11- :Date: October 2024
11+ :Date: January 2025
1212
1313The goal of Landlock is to enable restriction of ambient rights (e.g. global
1414filesystem or network access) for a set of processes. Because Landlock
@@ -329,11 +329,11 @@ non-sandboxed process, we can specify this restriction with
329329A sandboxed process can connect to a non-sandboxed process when its domain is
330330not scoped. If a process's domain is scoped, it can only connect to sockets
331331created by processes in the same scope.
332- Moreover, If a process is scoped to send signal to a non-scoped process, it can
332+ Moreover, if a process is scoped to send signal to a non-scoped process, it can
333333only send signals to processes in the same scope.
334334
335335A connected datagram socket behaves like a stream socket when its domain is
336- scoped, meaning if the domain is scoped after the socket is connected , it can
336+ scoped, meaning if the domain is scoped after the socket is connected, it can
337337still :manpage: `send(2)` data just like a stream socket. However, in the same
338338scenario, a non-connected datagram socket cannot send data (with
339339:manpage: `sendto(2)`) outside its scope.
Original file line number Diff line number Diff line change @@ -268,7 +268,9 @@ struct landlock_net_port_attr {
268268 * ~~~~~~~~~~~~~~~~
269269 *
270270 * These flags enable to restrict a sandboxed process to a set of network
271- * actions. This is supported since the Landlock ABI version 4.
271+ * actions.
272+ *
273+ * This is supported since Landlock ABI version 4.
272274 *
273275 * The following access rights apply to TCP port numbers:
274276 *
@@ -291,11 +293,13 @@ struct landlock_net_port_attr {
291293 * Setting a flag for a ruleset will isolate the Landlock domain to forbid
292294 * connections to resources outside the domain.
293295 *
296+ * This is supported since Landlock ABI version 6.
297+ *
294298 * Scopes:
295299 *
296300 * - %LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET: Restrict a sandboxed process from
297301 * connecting to an abstract UNIX socket created by a process outside the
298- * related Landlock domain (e.g. a parent domain or a non-sandboxed process).
302+ * related Landlock domain (e.g., a parent domain or a non-sandboxed process).
299303 * - %LANDLOCK_SCOPE_SIGNAL: Restrict a sandboxed process from sending a signal
300304 * to another process outside the domain.
301305 */
You can’t perform that action at this time.
0 commit comments