| Message ID | 20250226212911.34502-2-gnoack@google.com (mailing list archive) |
|---|---|
| State | Handled Elsewhere |
| Headers | show |
| Series | [v2,1/3] landlock.7: Update description of Landlock rules | expand |
On Wed, Feb 26, 2025 at 10:29:10PM +0100, Günther Noack wrote: > This brings it up to date with the wording in the kernel documentation. > > Signed-off-by: Günther Noack <gnoack@google.com> Apologies, I missed to add a "man" tag to the last three subject lines. The last three commits in the overall patch set belong to the man-pages repo. (See threaded view at https://lore.kernel.org/all/20250226211814.31420-2-gnoack@google.com/ for the full overview) —Günther
Hi, On Wed, Feb 26, 2025 at 10:29:10PM +0100, Günther Noack wrote: > This brings it up to date with the wording in the kernel documentation. > > Signed-off-by: Günther Noack <gnoack@google.com> I'd like some more justification in the commit message. > --- > man/man7/landlock.7 | 20 ++++++++++++++++---- > 1 file changed, 16 insertions(+), 4 deletions(-) > > diff --git a/man/man7/landlock.7 b/man/man7/landlock.7 > index c6b7272ea..11f76b072 100644 > --- a/man/man7/landlock.7 > +++ b/man/man7/landlock.7 > @@ -39,13 +39,25 @@ the running kernel must support Landlock and > it must be enabled at boot time. > .\" > .SS Landlock rules > -A Landlock rule describes an action on an object. > -An object is currently a file hierarchy, > -and the related filesystem actions are defined with access rights (see > -.BR landlock_add_rule (2)). > +A Landlock rule describes an action on an object > +which the process intends to perform. > A set of rules is aggregated in a ruleset, > which can then restrict the thread enforcing it, > and its future children. > +.P > +The two existing types of rules are: > +.P This will trigger a diagnostic due to being redundant before TP. (Both P and TP are paragraphing macros, so you're theoretically creating an empty paragraph, which is just ignored by groff(1).) > +.TP > +.B Filesystem rules > +For these rules, the object is a file hierarchy, > +and the related filesystem actions are defined with > +.IR "filesystem access rights" . > +.TP > +.B Network rules (since ABI v4) Most of the pages use Roman for the parenthetical: $ grep -rn 'BR.*(since' | sort -R | head man7/ip.7:782:.BR IP_PKTINFO " (since Linux 2.2)" man2/set_mempolicy.2:109:.BR MPOL_F_STATIC_NODES " (since Linux 2.6.26)" man2/kexec_load.2:60:.BR KEXEC_PRESERVE_CONTEXT " (since Linux 2.6.27)" man2/perf_event_open.2:823:.BR PERF_SAMPLE_REGS_USER " (since Linux 3.7)" man2/perf_event_open.2:1522:.BR PERF_SAMPLE_BRANCH_COND " (since Linux 3.16)" man7/socket.7:998:.BR SO_TIMESTAMPNS " (since Linux 2.6.22)" man2/perf_event_open.2:1537:.BR PERF_SAMPLE_BRANCH_CALL_STACK " (since Linux 4.1)" man2/clone.2:1303:.BR EINVAL " (since Linux 3.9)" man2/eventfd.2:52:.BR EFD_NONBLOCK " (since Linux 2.6.27)" man2/perf_event_open.2:912:.BR PERF_SAMPLE_CGROUP " (since Linux 5.7)" > +For these rules, the object is a TCP port, > +and the related actions are defined with > +.IR "network access rights" . > +.BR landlock_add_rule (2)). Cheers, Alex
Hello! On Fri, Feb 28, 2025 at 10:31:09PM +0100, Alejandro Colomar wrote: > Hi, > > On Wed, Feb 26, 2025 at 10:29:10PM +0100, Günther Noack wrote: > > This brings it up to date with the wording in the kernel documentation. > > > > Signed-off-by: Günther Noack <gnoack@google.com> > > I'd like some more justification in the commit message. Adding that. (linking to matching commit in kernel which introduced this) > > > --- > > man/man7/landlock.7 | 20 ++++++++++++++++---- > > 1 file changed, 16 insertions(+), 4 deletions(-) > > > > diff --git a/man/man7/landlock.7 b/man/man7/landlock.7 > > index c6b7272ea..11f76b072 100644 > > --- a/man/man7/landlock.7 > > +++ b/man/man7/landlock.7 > > @@ -39,13 +39,25 @@ the running kernel must support Landlock and > > it must be enabled at boot time. > > .\" > > .SS Landlock rules > > -A Landlock rule describes an action on an object. > > -An object is currently a file hierarchy, > > -and the related filesystem actions are defined with access rights (see > > -.BR landlock_add_rule (2)). > > +A Landlock rule describes an action on an object > > +which the process intends to perform. > > A set of rules is aggregated in a ruleset, > > which can then restrict the thread enforcing it, > > and its future children. > > +.P > > +The two existing types of rules are: > > +.P > > This will trigger a diagnostic due to being redundant before TP. > > (Both P and TP are paragraphing macros, so you're theoretically creating > an empty paragraph, which is just ignored by groff(1).) Thanks, fixed. > > +.TP > > +.B Filesystem rules > > +For these rules, the object is a file hierarchy, > > +and the related filesystem actions are defined with > > +.IR "filesystem access rights" . > > +.TP > > +.B Network rules (since ABI v4) > > Most of the pages use Roman for the parenthetical: > > $ grep -rn 'BR.*(since' | sort -R | head > man7/ip.7:782:.BR IP_PKTINFO " (since Linux 2.2)" > man2/set_mempolicy.2:109:.BR MPOL_F_STATIC_NODES " (since Linux 2.6.26)" > man2/kexec_load.2:60:.BR KEXEC_PRESERVE_CONTEXT " (since Linux 2.6.27)" > man2/perf_event_open.2:823:.BR PERF_SAMPLE_REGS_USER " (since Linux 3.7)" > man2/perf_event_open.2:1522:.BR PERF_SAMPLE_BRANCH_COND " (since Linux 3.16)" > man7/socket.7:998:.BR SO_TIMESTAMPNS " (since Linux 2.6.22)" > man2/perf_event_open.2:1537:.BR PERF_SAMPLE_BRANCH_CALL_STACK " (since Linux 4.1)" > man2/clone.2:1303:.BR EINVAL " (since Linux 3.9)" > man2/eventfd.2:52:.BR EFD_NONBLOCK " (since Linux 2.6.27)" > man2/perf_event_open.2:912:.BR PERF_SAMPLE_CGROUP " (since Linux 5.7)" > > > +For these rules, the object is a TCP port, > > +and the related actions are defined with > > +.IR "network access rights" . > > +.BR landlock_add_rule (2)). Removing this stray last line as well, which was left over from an earlier version of the text. —Günther
diff --git a/man/man7/landlock.7 b/man/man7/landlock.7 index c6b7272ea..11f76b072 100644 --- a/man/man7/landlock.7 +++ b/man/man7/landlock.7 @@ -39,13 +39,25 @@ the running kernel must support Landlock and it must be enabled at boot time. .\" .SS Landlock rules -A Landlock rule describes an action on an object. -An object is currently a file hierarchy, -and the related filesystem actions are defined with access rights (see -.BR landlock_add_rule (2)). +A Landlock rule describes an action on an object +which the process intends to perform. A set of rules is aggregated in a ruleset, which can then restrict the thread enforcing it, and its future children. +.P +The two existing types of rules are: +.P +.TP +.B Filesystem rules +For these rules, the object is a file hierarchy, +and the related filesystem actions are defined with +.IR "filesystem access rights" . +.TP +.B Network rules (since ABI v4) +For these rules, the object is a TCP port, +and the related actions are defined with +.IR "network access rights" . +.BR landlock_add_rule (2)). .\" .SS Filesystem actions These flags enable to restrict a sandboxed process to a
This brings it up to date with the wording in the kernel documentation. Signed-off-by: Günther Noack <gnoack@google.com> --- man/man7/landlock.7 | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-)