Unverified Commit 192b7ff2 authored by Günther Noack's avatar Günther Noack Committed by Mickaël Salaün
Browse files

landlock: Minor typo and grammar fixes in IPC scoping documentation 



* Fix some whitespace, punctuation and minor grammar.
* Add a missing sentence about the minimum ABI version,
  to stay in line with the section next to it.

Cc: Tahera Fahimi <fahimitahera@gmail.com>
Cc: Tanya Agarwal <tanyaagarwal25699@gmail.com>
Signed-off-by: default avatarGünther Noack <gnoack@google.com>
Link: https://lore.kernel.org/r/20250124154445.162841-1-gnoack@google.com


[mic: Add newlines, update doc date]
Signed-off-by: default avatarMickaël Salaün <mic@digikod.net>
parent 143c9aae

Documentation/userspace-api/landlock.rst

+3 −3
Original line number Diff line number Diff line
@@ -8,7 +8,7 @@ Landlock: unprivileged access control 
=====================================



:Author: Mickaël Salaün

:Date: October 2024

:Date: January 2025



The goal of Landlock is to enable restriction of ambient rights (e.g. global

filesystem or network access) for a set of processes.  Because Landlock
@@ -329,7 +329,7 @@ non-sandboxed process, we can specify this restriction with 
A sandboxed process can connect to a non-sandboxed process when its domain is

not scoped. If a process's domain is scoped, it can only connect to sockets

created by processes in the same scope.

Moreover, If a process is scoped to send signal to a non-scoped process, it can

Moreover, if a process is scoped to send signal to a non-scoped process, it can

only send signals to processes in the same scope.



A connected datagram socket behaves like a stream socket when its domain is

include/uapi/linux/landlock.h

+6 −2
Original line number Diff line number Diff line
@@ -268,7 +268,9 @@ struct landlock_net_port_attr { 
 * ~~~~~~~~~~~~~~~~

 *

 * These flags enable to restrict a sandboxed process to a set of network

 * actions. This is supported since the Landlock ABI version 4.

 * actions.

 *

 * This is supported since Landlock ABI version 4.

 *

 * The following access rights apply to TCP port numbers:

 *
@@ -291,11 +293,13 @@ struct landlock_net_port_attr { 
 * Setting a flag for a ruleset will isolate the Landlock domain to forbid

 * connections to resources outside the domain.

 *

 * This is supported since Landlock ABI version 6.

 *

 * Scopes:

 *

 * - %LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET: Restrict a sandboxed process from

 *   connecting to an abstract UNIX socket created by a process outside the

 *   related Landlock domain (e.g. a parent domain or a non-sandboxed process).

 *   related Landlock domain (e.g., a parent domain or a non-sandboxed process).

 * - %LANDLOCK_SCOPE_SIGNAL: Restrict a sandboxed process from sending a signal

 *   to another process outside the domain.

 */