Re: [PATCH v2 3/3] landlock: Document LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS

["Mickaël Salaün" <mic@digikod.net>]

On Fri, Jul 17, 2026 at 06:03:19PM -0400, Justin Suess wrote:
> Document atomically setting no_new_privs with ruleset enforcement,
> following the same compatibility section style as previous ABI
> additions.
> 
> Signed-off-by: Justin Suess <utilityemal77@gmail.com>
> ---
>  Documentation/userspace-api/landlock.rst | 14 +++++++++++++-
>  1 file changed, 13 insertions(+), 1 deletion(-)
> 
> diff --git a/Documentation/userspace-api/landlock.rst b/Documentation/userspace-api/landlock.rst
> index 5a63d4476c1c..ec87d35f4715 100644
> --- a/Documentation/userspace-api/landlock.rst
> +++ b/Documentation/userspace-api/landlock.rst

The tutorial in this doc should also be updated accordingly, taking into
account the best-effort approach and then the fallback to calling prctl.

First by updating the restrict_flags content according to the ABI
version, and then by updating the prctl block with something like this:

  if (!(restrict_flags & LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS) &&
      prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {

The saandboxer sample should also follow the same pattern.

> @@ -8,7 +8,7 @@ Landlock: unprivileged access control
>  =====================================
>  
>  :Author: Mickaël Salaün
> -:Date: June 2026
> +:Date: July 2026
>  
>  The goal of Landlock is to enable restriction of ambient rights (e.g. global
>  filesystem or network access) for a set of processes.  Because Landlock
> @@ -789,6 +789,18 @@ when at least one sys_landlock_add_rule() call is made for it with the
>  ``LANDLOCK_ADD_RULE_QUIET`` flag, additional add-rule calls for the same
>  object without this flag do not clear it.
>  
> +Atomic no_new_privs (ABI < 11)
> +------------------------------

You can just drop the "Atomic" in this title.

> +
> +Starting with the Landlock ABI version 11, sys_landlock_restrict_self()
> +accepts the ``LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS`` flag, which sets the
> +no_new_privs attribute of the calling thread atomically with the enforcement

It should be something like "all-or-nothing" instead of atomically, or
just describe the proprety.

> +of the ruleset: no_new_privs is set if and only if the call succeeds.  This
> +removes the need for a prior :manpage:`prctl(2)` ``PR_SET_NO_NEW_PRIVS``
> +call, and with it the ``CAP_SYS_ADMIN`` requirement.  When combined with
> +``LANDLOCK_RESTRICT_SELF_TSYNC``, no_new_privs is set on all threads of the
> +process.

One important point of this flag is that the NNP is only set if the
ruleset enforcement succeed (ordering).

Also, as discussed previously, it should be explicit in the doc that not
setting no_new_privs is risky even when it is not required, and this
flag makes it cheap to avoid.

> +
>  .. _kernel_support:
>  
>  Kernel support
> -- 
> 2.54.0
>