From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-yw1-f172.google.com (mail-yw1-f172.google.com [209.85.128.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B59C435C6B1 for ; Fri, 31 Jul 2026 22:43:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.172 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785537786; cv=none; b=Gp1euejB9W2C4LF1TT8t8MuT5zI9zJ8OPKxwigbe4+GdjSqS2lsA9FNqIq3dB3eMZ+l9BfYWAcn9nLrm/eAr8J1PbLgtWZMRDAvfNtIU/gVcZc8597xxKy1doAHlnmPxXyAy5KCFu4I1790uxR6hV6mzjA7ZayT9eOPXPU9vleY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785537786; c=relaxed/simple; bh=C03woqvIExHV5h/UIaI3n1K1sZHQlqLq5pH70aDBmGQ=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=j54Kh0O2ee1UxvwMeiy/zcRzQVyKfhJcetzhBBJEgBaTZoCrM6BsZnUwVkAi24FJYlyVp1hCNES6AlvSjbYrb9ucA1wrEqpSBlvpfY5kE9LJ3wzHBP3T1xWYTN6Ux64JuqMRBYW/j4+DNgnu/OfvmnYY/JQHD9Ch5CrmjRpZIoY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Rg/40GrO; arc=none smtp.client-ip=209.85.128.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Rg/40GrO" Received: by mail-yw1-f172.google.com with SMTP id 00721157ae682-80e2cfe6918so16184977b3.0 for ; Fri, 31 Jul 2026 15:43:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785537783; x=1786142583; darn=vger.kernel.org; h=in-reply-to:content-transfer-encoding:content-disposition :content-type:mime-version:references:message-id:subject:cc:to:from :date:from:to:cc:subject:date:message-id:reply-to:content-type; bh=1v4UKn/6uG59l71+23NwGAdv04bQ2TdT7TPbWb2jEQo=; b=Rg/40GrOvySDSLPMZ/bD1FFsrR/RPcShXa9jNGCBO62IEpO42chXH1A8AJYqq/ntUk aZpAkbq2JXowSuYb1riL+k9Ho/chX/aqa+vUmBfshV5W7MamK2YsT5sMMMH41fll2UA3 QqD06fvTPX2g66mygtwGVv4FWE8XFdyuo6IbbiEbCzynI1duduW5V0mQPJMqgsnUu57S 2Je/4yMsir6xAYF+7VmsEMXhmcynF9ks4vDDi+0h0gOQKv2pC01VekBXo4gE+fQJY7Hu t1scUOJUU1psDl0uBieYP8YsT/iMQPAhGD/D4ZwWaHlbUzoeMsPH5a6rigszHa43QIFh 4HRw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785537783; x=1786142583; h=in-reply-to:content-transfer-encoding:content-disposition :content-type:mime-version:references:message-id:subject:cc:to:from :date:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to:content-type; bh=1v4UKn/6uG59l71+23NwGAdv04bQ2TdT7TPbWb2jEQo=; b=VKxofaEYDMFF6zi/9fRFS8nOcHMbtaDXR5Dch0FjyjwC5mrbxD4b66eJJFYLenmXIT G6wb3Uga0aSey5o+AorYMbQlOTorzmeHsPkAKMuDVPo8kWirYyGxY8E3yZz7cr2uTM7e L++cWVy9P28tXdGCioSf4L51A+265iY4ArNaHT9c6h/5EGTqZMqzRtGBEx6yNF7ksCaz tKE1P1YUUegjmC1T7oSpxCyzhw6d4AGzvHHzV7RwrDkzQ0xih+GpcpW066PWlH5sBvDA KcDlC/EwzP07gtng+nXQjQ+Uh2uHQd+Pc02jL9XrU52iXPQRXP+eW6YvI5yG43rH45rQ Xz1w== X-Forwarded-Encrypted: i=1; AHgh+Rpc9ag9J66fw1veaXax4xH1lWI/9SsppIE6+oED6+KomjYdMaTqA1xEdKxW6zILlNCvkVTA2AXl51WB+rA=@vger.kernel.org X-Gm-Message-State: AOJu0Yzt+qU9+jkfVWqzKt8xulGOULYV5+9l/66FgUhrs9YFt9iDaN+w vXhEYATnHA67msPluGY9jWcQ+tf/1FEpSg3M2oQolGSxGJRfaNyLmTTo X-Gm-Gg: AR+sD13a9GavpA8SL8kTadu1nITexQpWJBGt6vfA9UrF+3js79DVz42mnPwfYVX00nV r0wOAOgLUW5b5rWEeVVqN+AqaeieEXEC7bTJDDO410Mz6bWi6V1fQ3A8cBSDrVM3BZ9oIb7uUDE EEIswQi6mpCX6MxqW4SEx0qPGfV9kziYaA6qdqQfc5l2TijHtSzafW2LlI+AgzY94B3p3zZFMZx neDVIag5T+9b+TIkcRqE/TgNW00IUYWcubzSQPjRFyBz8jRVc6XsZSHEjWDZKp+A2scVyMAuUCq jGNN1XTU9KJhlMKOfD3dnAFrJOwBeUJ2LFAM8422JpC1U1OOD6YO3ba9PikZNLuLDQeShPSnPG4 J4AG6tMaFGYNXFLm5afEHdfHxNjJofJ6d95J9qgEXSPeOJwlavJJ4wLLoZUuZ7HjcuGg/tEYwik tadNLxVGVCUPhrjpVXxrkFEtFZgMK5eztw0NCVW+l3HjNzCt2rZ51bmHO/TuCEuABVsBqN7iG+r UftOWB6iL7jrbUQhPoeXw== X-Received: by 2002:a05:690c:38b:b0:81e:bd02:b02c with SMTP id 00721157ae682-81fd49c6f67mr22166977b3.1.1785537783524; Fri, 31 Jul 2026 15:43:03 -0700 (PDT) Received: from zenbox ([2600:1700:18fb:6011:d52:64e9:32ac:b832]) by smtp.gmail.com with ESMTPSA id 00721157ae682-81fccf2cae7sm15549597b3.2.2026.07.31.15.43.02 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 31 Jul 2026 15:43:03 -0700 (PDT) Date: Fri, 31 Jul 2026 18:43:02 -0400 From: Justin Suess To: =?utf-8?Q?Micka=C3=ABl_Sala=C3=BCn?= Cc: gnoack3000@gmail.com, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org Subject: Re: [PATCH v2 1/3] landlock: Add LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS Message-ID: References: <20260717220320.1030123-1-utilityemal77@gmail.com> <20260717220320.1030123-2-utilityemal77@gmail.com> <20260731.gagai6she3So@digikod.net> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <20260731.gagai6she3So@digikod.net> On Fri, Jul 31, 2026 at 11:29:28PM +0200, Mickaël Salaün wrote: > I like this series. > Thanks! > On Fri, Jul 17, 2026 at 06:03:17PM -0400, Justin Suess wrote: > > Add a landlock_restrict_self(2) flag to set the no_new_privs attribute > > of the calling thread atomically with the enforcement of the ruleset: > > It looks atomic from the caller, but really this bit is set iff the > ruleset enforcement succeed and before the call returns. Even for user > space, when we'll have an introspection interface (e.g. tracepoints), > user space could see inconsistencies wrt /proc/pid/status showing NNP > because both operations are not atomic. > True, I did not consider the tracepoint perspective. Words mean things, so "atomic" isn't the best choice of words when it's really an ordering guarantee. (nnp set if and only if enforcement already succeeded). I'll send a revised version next week (I don't have any objections to any of your proposed changes) Justin > > no_new_privs is set if and only if the call succeeds. This removes the > > need for a prior prctl(2) PR_SET_NO_NEW_PRIVS call and guarantees that a > > failed enforcement leaves the attribute unchanged. > > > > Because no_new_privs is set by the call itself, the no_new_privs / > > CAP_SYS_ADMIN requirement of landlock_restrict_self(2) is fulfilled by > > construction, and the related EPERM check is skipped. As a consequence, > > an unprivileged caller passing unknown flags along with this flag gets > > EINVAL instead of EPERM. > > > > The attribute is only set past the last point of failure, just before > > committing the new credentials. When combined with > > LANDLOCK_RESTRICT_SELF_TSYNC, no_new_privs is set on the sibling threads > > as well, in their commit phase, with the same atomicity. > > > > Bump the Landlock ABI version to 11. > > > > Cc: Mickaël Salaün > > Signed-off-by: Justin Suess > > --- > > include/uapi/linux/landlock.h | 13 +++++++++++++ > > security/landlock/limits.h | 2 +- > > security/landlock/syscalls.c | 28 +++++++++++++++++++++------- > > security/landlock/tsync.c | 8 ++++++-- > > security/landlock/tsync.h | 4 +++- > > 5 files changed, 44 insertions(+), 11 deletions(-)