Add ABI v8: TSYNC#130
Conversation
|
@jarkkojs, it would be useful if you could test it. I still need to do some polishing, but the main code should be OK. |
|
Sure, can you give me day or two so I could do experimental change to Landstrip and get that way a real end-to-end test done? |
Sure, there is no rush. |
Here's what I plan to do. First off, my test suite is not "real" cargo test: https://github.com/landstrip/landstrip/tree/main/tests That is actually by design as it making it "deployable". Secondly, I have somewhat robust kernel testing harness to which I can package Landstrip and test program: https://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd-test.git/ So I'll do that compile in modified Landstrip and can run quite complex set of tests, which should exercise pretty well at least part of the new features and I can add some more to data.txt if I need extra coverage :-) Thus there is a bit of preparation but nice thing is that it will end up to my regular Linux kernel QA cycle (because why I would remove it after all the extra trouble). |
|
Tested-by: Jarkko Sakkinen jarkko.sakkinen@iki.fi With non-production quality changes but it does the job. I'll do a proper integration later. |
Add ABI::V8 for the multithreading support introduced with Linux 7.0. The new LANDLOCK_RESTRICT_SELF_TSYNC flag atomically applies the Landlock configuration (domain and logging) to all threads of the calling process instead of only the calling thread. Append ABI::V8 to every from_all() match arm for AccessFs, AccessNet, and Scope, and to the From<ABI> for BitFlags<Erratum> mapping. ABI v8 introduces no new access rights, scopes, or errata, so these arms only extend the existing sets. Update the From<i32> for ABI catch-all and the errata_up_to_date test accordingly. Expose the flag through a new all_threads() boolean setter on the RestrictSelfAttr trait, shared between RulesetCreated (with a domain) and the domain-less RestrictSelf builder. The kernel accepts LANDLOCK_RESTRICT_SELF_TSYNC either with a ruleset file descriptor or, on the domain-less path, only together with LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF and a ruleset_fd of -1; otherwise it returns an error. The crate does not pre-check this combination so as not to restrict what the kernel allows; any kernel error is surfaced through RestrictSelfError. Add the RestrictSelfFlag::AllThreads variant. Because it breaks the shared Log prefix of the existing variants, remove the now-unnecessary clippy::enum_variant_names allowance. Report the effective state with a new all_threads field on RestrictionStatus and RestrictSelfStatus, alongside the existing log_* fields. Name the setter all_threads() rather than a verb-led form, following the declarative builder convention used for no_new_privs and the log_* setters. The bare name describes the effect (which threads are covered) rather than the kernel TSYNC mechanism, mirroring how log_subdomains hides the kernel LOG_SUBDOMAINS_OFF polarity. A verb form such as synchronize_threads would also read as a thread synchronization primitive, which it is not. On a kernel older than ABI v8 the flag is unsupported. Under the default best-effort level it is silently dropped, in which case only the calling thread and its future children are restricted, not the sibling and parent threads. This is a weaker guarantee than requested for a multithreaded process, so the all_threads() documentation directs callers needing process-wide enforcement to HardRequirement or to the all_threads status field. Because TSYNC applies to every thread of the process, the integration test enforces it in a forked child to avoid restricting the multithreaded test runner; the ruleset is built before the fork so the child only runs the restrict_self syscalls. Add Linux 7.0 to the CI kernel matrix (Landlock ABI v8). Leave the MSRV job's LANDLOCK_CRATE_TEST_ABI at 7 to match its runner kernel, which predates Linux 7.0. Signed-off-by: Mickaël Salaün <mic@digikod.net>
Bump the sandboxer target to Landlock ABI v8, matching the LANDLOCK_ABI_LAST update in the kernel sample for Linux 7.0. The kernel sample does not use LANDLOCK_RESTRICT_SELF_TSYNC (it is single-threaded), so no all_threads() call is added. The existing hint logic already reports an outdated kernel for any effective ABI below the targeted one. Signed-off-by: Mickaël Salaün <mic@digikod.net>
2 participants
Depends on #129