Re: [PATCH 0/6] landlock: Add POSIX message queue scoping

["Mickaël Salaün" <mic@digikod.net>]

Hi Oxana,

Thanks for this patch series.  Overall it looks good but you'll find
some feedback to improve and send a v2, following Günther's and Justin's
ones.

You should also Cc Christian and Al and ask for a review of the
mqueue-specific patches (e.g. patch 1) for v2.

You'll find AI reviews here:
https://sashiko.dev/#/patchset/20260722122952.42149-1-oxana%40cloudflare.com

A test should create a domain that denies LANDLOCK_ACCESS_FS_READ_FILE
and make sure the msgqueue scoping control stays the same.

The question about unlinking mqueue is a bit tricky.  I don't think this
should be restricted by an mqueue scope because that would mean that a
sandboxed process creating an mqueue would not be able to remove the
next time the same sandboxed program tries to clean up its files.  So,
we should check if such file are automatically removed if its creator
exits.  In any case, this should at least be documented in the user
documentation.

The user doc should explain this new scope (see previous scope addition
for examples).

tools/testing/selftests/landlock/config must be updated with
CONFIG_POSIX_MQUEUE=y

Other questions/comments should either be answered to explain why they
don't make sense or otherwise be implemented with v2.


On Wed, Jul 22, 2026 at 01:29:36PM +0100, Oxana Kharitonova wrote:
> Hi,
> 
> This series adds landlock support for scoping POSIX message queuesi [1].

Nit: Landlock (in all docs, comments, and messages).

>  
> Landlock already supports scoped IPC restrictions for signals and abstract
> UNIX sockets. These restrictions make it possible to prevent a sandboxed
> task from interacting with IPC objects outside of its Landlock domain,
> while still allowing communication within the same domain or with nested
> domains.
>  
> This series extends the same model to POSIX message queues with a new
> LANDLOCK_SCOPE_POSIX_MSG_QUEUE scope. When this scope is enforced, a task
> can only open POSIX message queues that were created by a task in the same
> landlock domain or in a nested domain.
>  
> The implementation tags mqueuefs inodes at creation time with the creator's
> landlock domain. This domain is kept alive for the lifetime of the inode
> and is checked when the queue is opened.
>  
> The series also exposes the mqueuefs magic number through the shared UAPI
> magic header, bumps the Landlock ABI, updates documentation, adds sandboxer
> support, and adds selftests.
>  
> The new behavior is:
>  
> - a task restricted with LANDLOCK_SCOPE_POSIX_MSG_QUEUE cannot open a queue
>   created outside of its Landlock scope;
> - a task can still open a queue created within its own Landlock domain;
> - queues created outside of any Landlock domain are treated as outside the
>   scope for a scoped opener.
> 
> [1] https://man7.org/linux/man-pages/man7/mq_overview.7.html
> 
> Oxana Kharitonova (6):
>   ipc: Move mqueue fs magic to uapi magic header
>   landlock: Scope POSIX message queue opens
>   landlock: Bump ABI for LANDLOCK_SCOPE_POSIX_MSG_QUEUE
>   selftests/landlock: Test POSIX message queue scoping
>   samples/landlock: Support POSIX message queue scoping
>   landlock: Document POSIX message queue scoping
> 
>  Documentation/admin-guide/LSM/landlock.rst    |   6 +-
>  Documentation/userspace-api/landlock.rst      |  11 +-
>  include/uapi/linux/landlock.h                 |   7 +-
>  include/uapi/linux/magic.h                    |   2 +
>  ipc/mqueue.c                                  |   2 +-
>  samples/landlock/sandboxer.c                  |  16 +-
>  security/landlock/audit.c                     |   9 +
>  security/landlock/audit.h                     |   1 +
>  security/landlock/fs.c                        |  35 +++
>  security/landlock/fs.h                        |  15 ++
>  security/landlock/limits.h                    |   2 +-
>  security/landlock/ruleset.c                   |   1 -
>  security/landlock/syscalls.c                  |   2 +-
>  security/landlock/task.c                      |  43 ++++
>  security/landlock/task.h                      |   4 +
>  tools/testing/selftests/landlock/base_test.c  |   2 +-
>  .../landlock/scoped_posix_msg_queue_test.c    | 223 ++++++++++++++++++
>  .../testing/selftests/landlock/scoped_test.c  |   2 +-
>  18 files changed, 371 insertions(+), 12 deletions(-)
>  create mode 100644 tools/testing/selftests/landlock/scoped_posix_msg_queue_test.c
> 
> -- 
> 2.50.1 (Apple Git-155)
> 
>