Re: [PATCH v3 1/2] docs: landlock: clarify TTY signal scoping

["Günther Noack" <gnoack3000@gmail.com>]

On Wed, Sep 23, 2026 at 12:33:20PM -0400, Christopher Lusk wrote:
> LANDLOCK_SCOPE_SIGNAL limits signals sent to arbitrary processes outside
> a domain.  A PTY master differs because its holder controls attached
> processes through input and signal injection.
> 
> Clarify this boundary in the userspace guide and narrow the UAPI
> description to arbitrary target processes.
> 
> Built the userspace-api docs; no new warnings.
> 
> Link: https://lore.kernel.org/r/20260916152336.1589383-1-clusk@northecho.dev
> Suggested-by: Günther Noack <gnoack@google.com>
> Suggested-by: Mickaël Salaün <mic@digikod.net>
> Assisted-by: Codex:gpt-5.6-sol
> Signed-off-by: Christopher Lusk <clusk@northecho.dev>
> ---
>  Documentation/userspace-api/landlock.rst | 6 ++++++
>  include/uapi/linux/landlock.h            | 2 +-
>  2 files changed, 7 insertions(+), 1 deletion(-)
> 
> diff --git a/Documentation/userspace-api/landlock.rst b/Documentation/userspace-api/landlock.rst
> index 84cb7bf6b3ed..4d9fb1f1588c 100644
> --- a/Documentation/userspace-api/landlock.rst
> +++ b/Documentation/userspace-api/landlock.rst
> @@ -430,6 +430,12 @@ The operations which can be scoped are:
>      This limits the sending of signals to target processes which run within the
>      same or a nested Landlock domain.
>  
> +    Holding a PTY master FD grants control over the processes running under that
> +    terminal, including the ability to inject input and signals.  A process able
> +    to write to the master should therefore be considered as privileged as those
> +    processes, and this capability is not restricted by
> +    ``LANDLOCK_SCOPE_SIGNAL``.
> +
>  ``LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET``
>      This limits the set of abstract :manpage:`unix(7)` sockets to which we can
>      :manpage:`connect(2)` to socket addresses which were created by a process in
> diff --git a/include/uapi/linux/landlock.h b/include/uapi/linux/landlock.h
> index cceda3b3b961..ad7b1ebd62ed 100644
> --- a/include/uapi/linux/landlock.h
> +++ b/include/uapi/linux/landlock.h
> @@ -500,7 +500,7 @@ struct landlock_net_port_attr {
>   *   connecting to an abstract UNIX socket created by a process outside the
>   *   related Landlock domain (e.g., a parent domain or a non-sandboxed process).
>   * - %LANDLOCK_SCOPE_SIGNAL: Restrict a sandboxed process from sending a signal
> - *   to another process outside the domain.
> + *   to an arbitrary process outside the domain.
>   */
>  /* clang-format off */
>  #define LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET		(1ULL << 0)
> -- 
> 2.55.0
> 

Apologies for dropping the ball on this, I'm only realizing it now.

Reviewed-by: Günther Noack <gnoack3000@gmail.com>

A related documenation patch was brought up in [1] as well.

–Günther

[1] https://lore.kernel.org/all/tencent_1D938EDA50BCDB080CFADC6A@qq.com/