Re: [PATCH 0/6] Fix Landlock mediation of commoncap's capability checks

["Serge Hallyn (AMD)" <sergeh@kernel.org>]

On Tue, Nov 10, 2026 at 09:24:28PM +0100, Mickaël Salaün wrote:
> Hi,
> 
> This is series 1 of 3:
> 
> * 1. fix Landlock mediation of commoncap's capability checks;
>   2. fix PR_SET_SECUREBITS mediation and add focused Landlock tests;
>   3. fix Landlock mediation of capabilities guarding LSM policies.
> 
> LANDLOCK_PERMISSION_CAPABILITY_USE, merged for v7.4, denies capabilities
> through the LSM capable hook, but commoncap's mmap_addr, capset and
> vm_enough_memory hooks call cap_capable() directly.  A domain that
> denies a capability can therefore still:
> 
> - map memory below vm.mmap_min_addr (CAP_SYS_RAWIO), which defeats a
>   mitigation for kernel NULL pointer dereferences;
> - add inheritable capabilities outside of its permitted set
>   (CAP_SETPCAP), which lets a privileged sandbox without no_new_privs
>   gain capabilities through execve(), although the domain still
>   restricts their use;
> - use the admin memory reserve with vm.overcommit_memory=2
>   (CAP_SYS_ADMIN).
> 
> As SELinux does, patches 2 to 4 add Landlock's own check to these hooks,
> with commoncap's conditions, so they only deny what commoncap granted
> because of the capability.  Patch 1 factors out the shared check.  Patch
> 5 adds tests, including audit tests, that fail without the fixes.  Patch
> 6 fixes the documentation, which overstated what the permission
> restricts and how its denials show.
> 
> Two other direct capability-set checks are fixed separately:
> 
> - PSI triggers (CAP_SYS_RESOURCE):
>   https://patch.msgid.link/20261106120004.90041-1-dennylin0707@gmail.com
> - user namespace uid 0 mapping (CAP_SETFCAP):
>   https://patch.msgid.link/20261110144205.2404088-1-mic@digikod.net
> 
> Regards,

Acked-by: Serge Hallyn (AMD) <sergeh@kernel.org>
> 
> Mickaël Salaün (6):
>   landlock: Factor out capability denial checks
>   landlock: Mediate CAP_SYS_RAWIO for mappings below mmap_min_addr
>   landlock: Mediate CAP_SETPCAP for inheritable capabilities
>   landlock: Mediate CAP_SYS_ADMIN for the admin memory reserve
>   selftests/landlock: Test capability checks outside the capable hook
>   landlock: Fix capability restriction documentation
> 
>  Documentation/security/landlock.rst         |   8 +-
>  Documentation/userspace-api/landlock.rst    |   8 +-
>  include/uapi/linux/landlock.h               |   6 +-
>  security/landlock/cap.c                     | 110 +++-
>  tools/testing/selftests/landlock/cap_test.c | 535 ++++++++++++++++++++
>  tools/testing/selftests/landlock/common.h   |   4 +-
>  6 files changed, 650 insertions(+), 21 deletions(-)
> 
> 
> base-commit: 7475ea8b58616b33c04afb976cf0fbaad9dd63fb
> -- 
> 2.56.0
>