Skip to content

Commit 192b7ff

Browse files
gnoackl0kod
authored andcommitted
landlock: Minor typo and grammar fixes in IPC scoping documentation
* Fix some whitespace, punctuation and minor grammar. * Add a missing sentence about the minimum ABI version, to stay in line with the section next to it. Cc: Tahera Fahimi <fahimitahera@gmail.com> Cc: Tanya Agarwal <tanyaagarwal25699@gmail.com> Signed-off-by: Günther Noack <gnoack@google.com> Link: https://lore.kernel.org/r/20250124154445.162841-1-gnoack@google.com [mic: Add newlines, update doc date] Signed-off-by: Mickaël Salaün <mic@digikod.net>
1 parent 143c9aa commit 192b7ff

File tree

2 files changed

+9
-5
lines changed

2 files changed

+9
-5
lines changed

Documentation/userspace-api/landlock.rst

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ Landlock: unprivileged access control
88
=====================================
99

1010
:Author: Mickaël Salaün
11-
:Date: October 2024
11+
:Date: January 2025
1212

1313
The goal of Landlock is to enable restriction of ambient rights (e.g. global
1414
filesystem or network access) for a set of processes. Because Landlock
@@ -329,11 +329,11 @@ non-sandboxed process, we can specify this restriction with
329329
A sandboxed process can connect to a non-sandboxed process when its domain is
330330
not scoped. If a process's domain is scoped, it can only connect to sockets
331331
created by processes in the same scope.
332-
Moreover, If a process is scoped to send signal to a non-scoped process, it can
332+
Moreover, if a process is scoped to send signal to a non-scoped process, it can
333333
only send signals to processes in the same scope.
334334

335335
A connected datagram socket behaves like a stream socket when its domain is
336-
scoped, meaning if the domain is scoped after the socket is connected , it can
336+
scoped, meaning if the domain is scoped after the socket is connected, it can
337337
still :manpage:`send(2)` data just like a stream socket. However, in the same
338338
scenario, a non-connected datagram socket cannot send data (with
339339
:manpage:`sendto(2)`) outside its scope.

include/uapi/linux/landlock.h

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -268,7 +268,9 @@ struct landlock_net_port_attr {
268268
* ~~~~~~~~~~~~~~~~
269269
*
270270
* These flags enable to restrict a sandboxed process to a set of network
271-
* actions. This is supported since the Landlock ABI version 4.
271+
* actions.
272+
*
273+
* This is supported since Landlock ABI version 4.
272274
*
273275
* The following access rights apply to TCP port numbers:
274276
*
@@ -291,11 +293,13 @@ struct landlock_net_port_attr {
291293
* Setting a flag for a ruleset will isolate the Landlock domain to forbid
292294
* connections to resources outside the domain.
293295
*
296+
* This is supported since Landlock ABI version 6.
297+
*
294298
* Scopes:
295299
*
296300
* - %LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET: Restrict a sandboxed process from
297301
* connecting to an abstract UNIX socket created by a process outside the
298-
* related Landlock domain (e.g. a parent domain or a non-sandboxed process).
302+
* related Landlock domain (e.g., a parent domain or a non-sandboxed process).
299303
* - %LANDLOCK_SCOPE_SIGNAL: Restrict a sandboxed process from sending a signal
300304
* to another process outside the domain.
301305
*/

0 commit comments

Comments
 (0)