Skip to content

Commit af20627

Browse files
ZheaoliZheaoli
committed
fix review idea
Signed-off-by: Manjusaka <me@manjusaka.me>
1 parent 6bf39f4 commit af20627

File tree

4 files changed

+89
-87
lines changed

4 files changed

+89
-87
lines changed

‎config.md

+49-49
Original file line numberDiff line numberDiff line change
@@ -353,51 +353,51 @@ For Linux-based systems, the `process` object supports the following process-spe
353353
CPU affinity after the process is moved to container's cgroup, and the
354354
final affinity is determined by the Linux kernel.
355355
* **`landlock`** (object, OPTIONAL) specifies the Landlock unprivileged access control settings for the container process.
356-
Note that `noNewPrivileges` must be set to true to use this feature.
357-
For more information about Landlock, see [Landlock documentation][landlock].
358-
`landlock` contains the following properties:
359-
360-
* **`ruleset`** (object, OPTIONAL) the `ruleset` field identifies a set of rules (i.e., actions on objects) that need to be handled (i.e., restricted).
361-
The `ruleset` currently contains the following types:
362-
* **`handledAccessFS`** (array of strings, OPTIONAL) is an array of FS typed actions that are handled by a ruleset.
363-
If no rule explicitly allow them, they should then be forbidden.
364-
* **`handledAssessNetwork`** (array of strings, OPTIONAL) is an array of NETWORK typed actions that are handled by a ruleset. (The NETWORK typed actions are avaliable when the ABI version >= 4. the behavior of the NETWORK typed actions is not used when the ABI version is less than 4 will depend on the **`disableBestEffort`**)
365-
* **`rules`** (object, OPTIONAL) the `rules` field specifies the security policies (i.e., actions allowed on objects) to be added to an existing ruleset.
366-
The `rules` currently contains the following types:
367-
* **`pathBeneath`** (array of objects, OPTIONAL) is an array of the file-hierarchy typed rules.
368-
Entries in the array contain the following properties:
369-
* **`allowedAccess`** (array of strings, OPTIONAL) is an array of FS typed actions that are allowed by a rule. The actions are grouped by the ABI version in the following description:
370-
1. ABI version >= 1:
371-
1. exectute
372-
2. write_file
373-
3. read_file
374-
4. read_dir
375-
5. remove_dir
376-
6. remove_file
377-
7. make_char
378-
8. make_dir
379-
9. make_reg
380-
10. make_sock
381-
11. make_fifo
382-
12. make_block
383-
13. make_sym
384-
2. ABI version >= 2:
385-
1. refer
386-
3. ABI version >= 3:
387-
1. truncate
388-
* **`paths`** (array of strings, OPTIONAL) is an array of files or parent directories of the file hierarchies to restrict.
389-
* **`portBeneath`** (array of objects, OPTIONAL) is an array of the network-hierarchy typed rules.
390-
Entries in the array contain the following properties:
391-
* **`allowedAccess`** (array of strings, OPTIONAL) is an array of NETWORK typed actions that are allowed by a rule. The actions are grouped by the ABI version in the following description:
392-
1. ABI version >= 4:
393-
1. bind
394-
2. connect
395-
* **`ports`** (array of strings, OPTIONAL) is an array of network ports to restrict.
396-
* **`disableBestEffort`** (bool, OPTIONAL) the `disableBestEffort` field disables the best-effort security approach for Landlock access rights.
397-
This is for conditions when the Landlock access rights explicitly configured by the container are not supported or available in the running kernel.
398-
If the best-effort security approach is enabled (`false`), the runtime SHOULD enforce the strongest rules configured up to the current kernel support, and only be [logged as a warning](runtime.md#warnings) for those not supported.
399-
If disabled (`true`), the runtime MUST [generate an error](runtime.md#errors) if one or more rules specified by the container is not supported.
400-
Default is `false`, i.e., following a best-effort security approach.
356+
Note that `noNewPrivileges` must be set to true to use this feature.
357+
For more information about Landlock, see [Landlock documentation][landlock].
358+
`landlock` contains the following properties:
359+
360+
* **`handledAccess`** (object, OPTIONAL) specifies the access rights that will be restricted by the ruleset.
361+
The `handledAccess` currently contains the following types:
362+
* **`handledAccessFS`** (array of strings, OPTIONAL) is an array of FS typed actions that are handled by a ruleset.
363+
If no rule explicitly allow them, they should then be forbidden.
364+
* **`handledAccessNetwork`** (array of strings, OPTIONAL) is an array of NETWORK typed actions that are handled by a ruleset. (The NETWORK typed actions are available when the ABI version >= 4. The behavior when the ABI version is less than 4 will depend on the **`enableBestEffort`**)
365+
* **`rules`** (object, OPTIONAL) specifies the security policies (i.e., actions allowed on objects) to be enforced.
366+
The `rules` currently contains the following types:
367+
* **`pathBeneath`** (array of objects, OPTIONAL) is an array of the file-hierarchy typed rules.
368+
Entries in the array contain the following properties:
369+
* **`allowedAccess`** (array of strings, OPTIONAL) is an array of FS typed actions that are allowed by a rule. The actions are grouped by the ABI version in the following description:
370+
1. ABI version >= 1:
371+
1. execute
372+
2. write_file
373+
3. read_file
374+
4. read_dir
375+
5. remove_dir
376+
6. remove_file
377+
7. make_char
378+
8. make_dir
379+
9. make_reg
380+
10. make_sock
381+
11. make_fifo
382+
12. make_block
383+
13. make_sym
384+
2. ABI version >= 2:
385+
1. refer
386+
3. ABI version >= 3:
387+
1. truncate
388+
* **`paths`** (array of strings, OPTIONAL) is an array of files or parent directories of the file hierarchies to restrict.
389+
* **`networkPort`** (array of objects, OPTIONAL) is an array of the network socket rules.
390+
Entries in the array contain the following properties:
391+
* **`allowedAccess`** (array of strings, OPTIONAL) is an array of NETWORK typed actions that are allowed by a rule. The actions are grouped by the ABI version in the following description:
392+
1. ABI version >= 4:
393+
1. bind
394+
2. connect
395+
* **`ports`** (array of strings, OPTIONAL) is an array of network ports to restrict.
396+
* **`enableBestEffort`** (bool, OPTIONAL) the `enableBestEffort` field disables the best-effort security approach for Landlock access rights.
397+
This is for conditions when the Landlock access rights explicitly configured by the container are not supported or available in the running kernel.
398+
If the best-effort security approach is enabled (`false`), the runtime SHOULD enforce the strongest rules configured up to the current kernel support, and only be [logged as a warning](runtime.md#warnings) for those not supported.
399+
If disabled (`true`), the runtime MUST [generate an error](runtime.md#errors) if one or more rules specified by the container is not supported.
400+
Default is `true`, i.e., following a best-effort security approach.
401401

402402
### <a name="configUser" />User
403403

@@ -444,7 +444,7 @@ _Note: symbolic name for uid and gid, such as uname and gname respectively, are
444444
"priority": 4
445445
},
446446
"landlock": {
447-
"ruleset": {
447+
"handledAccess": {
448448
"handledAccessFS": [
449449
"execute",
450450
"write_file",
@@ -462,7 +462,7 @@ _Note: symbolic name for uid and gid, such as uname and gname respectively, are
462462
"refer",
463463
"truncate"
464464
],
465-
"handledAssessNetwork": [
465+
"handledAccessNetwork": [
466466
"bind",
467467
"connect"
468468
]
@@ -501,7 +501,7 @@ _Note: symbolic name for uid and gid, such as uname and gname respectively, are
501501
]
502502
}
503503
],
504-
"portBeneath": [
504+
"networkPort": [
505505
{
506506
"allowedAccess": [
507507
"bind",
@@ -514,7 +514,7 @@ _Note: symbolic name for uid and gid, such as uname and gname respectively, are
514514
}
515515
]
516516
},
517-
"disableBestEffort": false
517+
"enableBestEffort": true
518518
},
519519
"noNewPrivileges": true,
520520
"capabilities": {

‎schema/config-schema.json

+3-3
Original file line numberDiff line numberDiff line change
@@ -166,13 +166,13 @@
166166
"landlock": {
167167
"type": "object",
168168
"properties": {
169-
"ruleset": {
170-
"$ref": "defs.json#/definitions/LandlockRuleset"
169+
"handledAccess": {
170+
"$ref": "defs.json#/definitions/LandlockHandledAccess"
171171
},
172172
"rules": {
173173
"$ref": "defs.json#/definitions/LandlockRules"
174174
},
175-
"disableBestEffort": {
175+
"enableBestEffort": {
176176
"type": "boolean"
177177
}
178178
}

‎schema/defs.json

+17-14
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,7 @@
8080
"type": "string"
8181
}
8282
},
83-
"ArrayOfPorts":{
83+
"ArrayOfPorts": {
8484
"type": "array",
8585
"items": {
8686
"$ref": "#/definitions/port"
@@ -216,16 +216,16 @@
216216
"$ref": "#/definitions/LandlockNetworkAction"
217217
}
218218
},
219-
"LandlockRuleset": {
219+
"LandlockHandledAccess": {
220220
"type": "object",
221-
"properties": {
222-
"handledAccessFS": {
223-
"$ref": "#/definitions/ArrayOfLandlockFSActions"
224-
},
225-
"handledAssessNetwork": {
226-
"$ref": "#/definitions/ArrayOfLandlockNetworkActions"
227-
}
228-
}
221+
"properties": {
222+
"handledAccessFS": {
223+
"$ref": "#/definitions/ArrayOfLandlockFSActions"
224+
},
225+
"handledAccessNetwork": {
226+
"$ref": "#/definitions/ArrayOfLandlockNetworkActions"
227+
}
228+
}
229229
},
230230
"LandlockRulePathBeneath": {
231231
"type": "object",
@@ -238,13 +238,13 @@
238238
}
239239
}
240240
},
241-
"LandlockRulePortBeneath": {
241+
"LandlockRuleNetworkPort": {
242242
"type": "object",
243243
"properties": {
244244
"allowedAccess": {
245245
"$ref": "#/definitions/ArrayOfLandlockNetworkActions"
246246
},
247-
"paths": {
247+
"ports": {
248248
"$ref": "#/definitions/ArrayOfPorts"
249249
}
250250
}
@@ -255,17 +255,20 @@
255255
"$ref": "#/definitions/LandlockRulePathBeneath"
256256
}
257257
},
258-
"ArrayOfLandlockRulePortBeneaths": {
258+
"ArrayOfLandlockRuleNetworkPorts": {
259259
"type": "array",
260260
"items": {
261-
"$ref": "#/definitions/LandlockRulePortBeneath"
261+
"$ref": "#/definitions/LandlockRuleNetworkPort"
262262
}
263263
},
264264
"LandlockRules": {
265265
"type": "object",
266266
"properties": {
267267
"pathBeneath": {
268268
"$ref": "#/definitions/ArrayOfLandlockRulePathBeneaths"
269+
},
270+
"networkPort": {
271+
"$ref": "#/definitions/ArrayOfLandlockRuleNetworkPorts"
269272
}
270273
}
271274
}

‎specs-go/config.go

+20-21
Original file line numberDiff line numberDiff line change
@@ -103,55 +103,53 @@ type Process struct {
103103

104104
// Landlock specifies the Landlock unprivileged access control settings for the container process.
105105
type Landlock struct {
106-
// Ruleset identifies a set of rules (i.e., actions on objects) that need to be handled.
107-
Ruleset *LandlockRuleset `json:"ruleset,omitempty" platform:"linux"`
108-
// Rules are the security policies (i.e., actions allowed on objects) to be added to an existing ruleset.
106+
// HandledAccess specifies the access rights that will be restricted by the ruleset.
107+
HandledAccess *LandlockHandledAccess `json:"handledAccess,omitempty" platform:"linux"`
108+
// Rules are the security policies (i.e., actions allowed on objects) to be enforced.
109109
Rules *LandlockRules `json:"rules,omitempty" platform:"linux"`
110-
// DisableBestEffort disables the best-effort security approach for Landlock access rights.
110+
// EnableBestEffort disables the best-effort security approach for Landlock access rights.
111111
// This is for conditions when the Landlock access rights explicitly configured by the container are not
112112
// supported or available in the running kernel.
113113
// Default is false, i.e., following a best-effort security approach.
114-
DisableBestEffort bool `json:"disableBestEffort,omitempty" platform:"linux"`
114+
EnableBestEffort bool `json:"enableBestEffort,omitempty" platform:"linux"`
115115
}
116116

117-
// LandlockRuleset identifies a set of rules (i.e., actions on objects) that need to be handled.
118-
type LandlockRuleset struct {
119-
// HandledAccessFS is a list of actions that is handled by this ruleset and should then be
120-
// forbidden if no rule explicitly allow them.
117+
// LandlockHandledAccess specifies the access rights that will be restricted by the ruleset.
118+
type LandlockHandledAccess struct {
119+
// HandledAccessFS specifies filesystem actions that will be restricted unless explicitly allowed by rules.
121120
HandledAccessFS []LandlockFSAction `json:"handledAccessFS,omitempty" platform:"linux"`
122-
// HandledAccessNetwork is a list of actions that is handled by this ruleset and should then be
123-
// forbidden if no rule explicitly allow them.
121+
// HandledAccessNetwork specifies network actions that will be restricted unless explicitly allowed by rules.
124122
HandledAccessNetwork []LandlockNetworkAction `json:"handledAccessNetwork,omitempty" platform:"linux"`
125123
}
126124

127125
// LandlockRules represents the security policies (i.e., actions allowed on objects).
128126
type LandlockRules struct {
129-
// PathBeneath specifies the file-hierarchy typed rules.
127+
// PathBeneath specifies file-hierarchy access rules.
130128
PathBeneath []LandlockRulePathBeneath `json:"pathBeneath,omitempty" platform:"linux"`
131-
// PortBeneath specifies the network-socket typed rules.
132-
PortBeneath []LandlockRulePortBeneath `json:"portBeneath,omitempty" platform:"linux"`
129+
// NetworkPort specifies network socket access rules.
130+
NetworkPort []LandlockRuleNetworkPort `json:"networkPort,omitempty" platform:"linux"`
133131
}
134132

135-
// LandlockRulePathBeneath defines the file-hierarchy typed rule that grants the access rights specified by
136-
// `AllowedAccess` to the file hierarchies under the given `Paths`.
133+
// LandlockRulePathBeneath grants filesystem access rights to hierarchies under specified paths.
137134
type LandlockRulePathBeneath struct {
138-
// AllowedAccess contains a list of allowed filesystem actions for the file hierarchies.
135+
// AllowedAccess lists allowed filesystem actions for the file hierarchies.
139136
AllowedAccess []LandlockFSAction `json:"allowedAccess,omitempty" platform:"linux"`
140137
// Paths are the files or parent directories of the file hierarchies to restrict.
141138
Paths []string `json:"paths,omitempty" platform:"linux"`
142139
}
143140

144-
type LandlockRulePortBeneath struct {
145-
// AllowedAccess contains a list of allowed network actions for the network sockets.
141+
// LandlockRuleNetworkPort grants network access rights to specified ports.
142+
type LandlockRuleNetworkPort struct {
143+
// AllowedAccess lists allowed network actions for the network sockets.
146144
AllowedAccess []LandlockNetworkAction `json:"allowedAccess,omitempty" platform:"linux"`
147145
// Ports are the network ports to restrict.
148146
Ports []string `json:"ports,omitempty" platform:"linux"`
149147
}
150148

151-
// LandlockFSAction used to specify the FS actions that are handled by a ruleset or allowed by a rule.
149+
// LandlockFSAction specifies filesystem actions that can be restricted by Landlock.
152150
type LandlockFSAction string
153151

154-
// Define actions on files and directories that Landlock can restrict a sandboxed process to.
152+
// Actions on files and directories that Landlock can restrict a sandboxed process to
155153
const (
156154
LLFSActExecute LandlockFSAction = "execute"
157155
LLFSActWriteFile LandlockFSAction = "write_file"
@@ -170,6 +168,7 @@ const (
170168
LLFSActTruncate LandlockFSAction = "truncate"
171169
)
172170

171+
// LandlockNetworkAction specifies network actions that can be restricted by Landlock.
173172
type LandlockNetworkAction string
174173

175174
const (

0 commit comments

Comments
 (0)