New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Landlock v1.4 #7829
Landlock v1.4 #7829
Conversation
Codecov Report
@@ Coverage Diff @@
## master #7829 +/- ##
==========================================
- Coverage 76.10% 75.99% -0.11%
==========================================
Files 663 664 +1
Lines 185889 185890 +1
==========================================
- Hits 141467 141275 -192
- Misses 44422 44615 +193
Flags with carried forward coverage won't be shown. Click here to find out more. |
This patch is adding support for Landlock, a Linux Security Module available since Linux 5.13. The concept is to prevent any file operation on directories where Suricata is not supposed to access. Landlock support is built by default if the header is present. The feature is disabled by default and need to be activated in the YAML to be active. Landlock documentation: https://docs.kernel.org/userspace-api/landlock.html Feature: OISF#5479
If landlock ABI is inferior to 2 (before Linux 5.19) then the renaming of files is impossible if the protection is enabled. This patch disables landlock if ABI < 2 and file-store is enabled. As file store is initialized in output the call to landlock had to done after the output initialization.
WARNING:
Pipeline 9018 |
Information: QA ran without warnings. Pipeline 9023 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Docs still looking good to me :P
@@ -1097,6 +1097,22 @@ asn1-max-frames: 256 | |||
# user: suri | |||
# group: suri | |||
|
|||
security: | |||
# Limit processus creation by Suricata (default: yes) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
#7458 isn't merged yet.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
fixed up in #7853
Merged in #7853, thanks a lot for this work Eric! |
Replace #7697
Link to redmine ticket: https://redmine.openinfosecfoundation.org/issues/5479
Describe changes: