Dynamic Landlock ABI configuration wrt. runtime kernel #2263
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Referenced issues
resolves #2262
Description of the Change
Dynamically determines the available Landlock flags from the version of the Landlock ABI reverted by this call.
This is necessary since the prior implementation relied solely on the definition of these flags for their inclusion. However, such definition is solely determined by the headers available during compile time and is orthogonal to the feature support of the host's kernel (especially if the compilation host and runtime host are different).
A given Landlock flag is now only included in the
landlock_create_ruleset(...)
call ifAs such, this PR enables hosts with
5.13 <= linux kernel version < 6.7
to be used in Secure Validtor Mode.Possible Drawbacks
The drawbacks are the same as the prior implementation's seeming intent.
As described in #2262:
Checklist Before Opening a PR
Before you open a Pull Request (PR), please make sure you've completed the following steps and confirm by answering 'Yes' to each item: