[PATCH 0/3] Add Landlock UDP support documentation

[PATCH 0/3] Add Landlock UDP support documentation

[Matthieu Buffet]

Hi Alejandro, Mickaël, Günther,

Here is a small update to landlock.7 and landlock_add_rule.2 to add
missing TCP info, and add UDP specifics introduced in kernels 7.2+.
With the benefit of hindsight, re-reading UAPI header changes, I
actually did a bit more than copy-pasting from them (see patch 3/3):
- explicitly state in the access right description that sending
  datagrams without a destination does not require any access right
- more importantly: clarify the description of the most non-trivial
  behaviour (auto-bind denials when emitting, which can occur even if
  CONNECT_SEND_UDP is not handled)
Mickaël, if you are okay with these additions, would you like them in a
UAPI header patch to sync the two?

Have a nice day!

Link: <https://github.com/landlock-lsm/linux/issues/66>

Matthieu Buffet (3):
  man/man2/landlock_add_rule.2: Clarify ephemeral port range
  man/man7/landlock.7: Document AF_UNSPEC behaviour and error codes
  man/man7/landlock.7, man/man2/landlock_add_rule.2: Document UDP
    support

 man/man2/landlock_add_rule.2 | 23 +++++++---
 man/man7/landlock.7          | 88 ++++++++++++++++++++++++++++++++++--
 2 files changed, 102 insertions(+), 9 deletions(-)


base-commit: dbc7211e1e52dcd485bd3e081cfa761506edc4e9
-- 
2.47.3

[PATCH 1/3] man/man2/landlock_add_rule.2: Clarify ephemeral port range

[Matthieu Buffet]

Clarify that ephemeral port range can differ from system to system, and
that a compromised application can choose (without any randomness)
exactly which ephemeral port will be chosen next (as long as it is
within the kernel-wide ip_local_port_range)

Signed-off-by: Matthieu Buffet <matthieu@buffet.re>
---
 man/man2/landlock_add_rule.2 | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/man/man2/landlock_add_rule.2 b/man/man2/landlock_add_rule.2
index fe01a98d99ea..633d89824373 100644
--- a/man/man2/landlock_add_rule.2
+++ b/man/man2/landlock_add_rule.2
@@ -109,9 +109,13 @@ is the network port in host endianness.
 It should be noted that port 0 passed to
 .BR bind (2)
 will bind to an available port from the ephemeral port range.
-This can be configured in the
+The range is configured globally in the
 .I /proc/sys/net/ipv4/ip_local_port_range
-sysctl (also used for IPv6).
+sysctl (also used for IPv6),
+and can be further restricted per-socket using
+.BR setsockopt (2)
+with
+.BR IP_LOCAL_PORT_RANGE (2const).
 .IP
 A Landlock rule with port 0
 and the
-- 
2.47.3

[PATCH 2/3] man/man7/landlock.7: Document AF_UNSPEC behaviour and error codes

[Matthieu Buffet]

Current TCP documentation is missing a description of how AF_UNSPEC is
mapped (depending on operation and address contents) to AF_INET, and the
error codes synthesized by Landlock.

Signed-off-by: Matthieu Buffet <matthieu@buffet.re>
---
 man/man7/landlock.7 | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/man/man7/landlock.7 b/man/man7/landlock.7
index 880dd50582f3..51e63f40052c 100644
--- a/man/man7/landlock.7
+++ b/man/man7/landlock.7
@@ -276,6 +276,24 @@ Bind a TCP socket to a local port.
 .TP
 .BR LANDLOCK_ACCESS_NET_CONNECT_TCP "  (since Landlock ABI version 4)"
 Connect an active TCP socket to a remote port.
+.P
+Note on
+.BR AF_UNSPEC :
+Calling
+.BR connect (2)
+with that address family
+can only dissolve existing associations,
+and as such is always allowed.
+Calling
+.BR bind (2)
+with that address family
+is treated the same way the network stack treats it:
+for IPv4 and
+.B INADDR_ANY
+it is treated as
+.BR AF_INET .
+All other uses of that address family result in the same error codes
+as when Landlock is not in use.
 .\"
 .SS Scope flags
 These flags enable isolating a sandboxed process from a set of IPC actions.
-- 
2.47.3

[PATCH 3/3] man/man7/landlock.7, man/man2/landlock_add_rule.2: Document UDP support

[Matthieu Buffet]

Landlock support for UDP-specific policy was merged in 7.2 in
linux.git 9a8ed15ce224 ("landlock: Add UDP bind() access control")
and
linux.git e61247a2e694 ("landlock: Add UDP send+connect access control")

Update the example to account for ABI v10, and add documentation for new
access rights taken from the UAPI header, plus:
- explicitly state in the access right description that sending
  datagrams without a destination does not require any access right
- more importantly: clarify the description of the most non-trivial
  behaviour (auto-bind denials when emitting, which can occur even if
  CONNECT_SEND_UDP is not handled)

Link: <https://github.com/landlock-lsm/linux/issues/66>
Signed-off-by: Matthieu Buffet <matthieu@buffet.re>
---
 man/man2/landlock_add_rule.2 | 15 +++++---
 man/man7/landlock.7          | 70 ++++++++++++++++++++++++++++++++++--
 2 files changed, 78 insertions(+), 7 deletions(-)

diff --git a/man/man2/landlock_add_rule.2 b/man/man2/landlock_add_rule.2
index 633d89824373..2b2b28147de0 100644
--- a/man/man2/landlock_add_rule.2
+++ b/man/man2/landlock_add_rule.2
@@ -82,7 +82,7 @@ just a file.
 .TP
 .BR LANDLOCK_RULE_NET_PORT "  (since Landlock ABI version 4)"
 For these rules,
-the object is a TCP port,
+the object is a TCP or UDP port,
 and the related actions are defined with
 .IR "network access rights" .
 .IP
@@ -120,8 +120,14 @@ with
 A Landlock rule with port 0
 and the
 .B LANDLOCK_ACCESS_NET_BIND_TCP
-right means that requesting to bind on port 0 is allowed
-and it will automatically translate to binding on the related port range.
+or
+.B LANDLOCK_ACCESS_NET_BIND_UDP
+right means that requesting to bind on port 0
+(explicitly, or implicitly
+by e.g.\& sending a datagram on an unbound UDP socket)
+is allowed
+and it will automatically translate to
+binding on a kernel-assigned ephemeral port.
 .P
 .I flags
 must be 0.
@@ -141,7 +147,8 @@ can fail for the following reasons:
 .I rule_type
 is
 .BR LANDLOCK_RULE_NET_PORT ,
-but TCP is not supported by the running kernel.
+but the kernel was built without
+.BR CONFIG_INET .
 .TP
 .B EBADF
 .I ruleset_fd
diff --git a/man/man7/landlock.7 b/man/man7/landlock.7
index 51e63f40052c..884e1d49feb0 100644
--- a/man/man7/landlock.7
+++ b/man/man7/landlock.7
@@ -53,8 +53,8 @@ For these rules, the object is a file hierarchy,
 and the related filesystem actions are defined with
 .IR "filesystem access rights" .
 .TP
-.BR "Network rules" " (since ABI v4)"
-For these rules, the object is a TCP port,
+.BR "Network rules" " (since ABI v4 for TCP, v10 for UDP)"
+For these rules, the object is a TCP or UDP port,
 and the related actions are defined with
 .IR "network access rights" .
 .\"
@@ -277,6 +277,55 @@ Bind a TCP socket to a local port.
 .BR LANDLOCK_ACCESS_NET_CONNECT_TCP "  (since Landlock ABI version 4)"
 Connect an active TCP socket to a remote port.
 .P
+And similarly for UDP port numbers:
+.TP
+.BR LANDLOCK_ACCESS_NET_BIND_UDP "  (since Landlock ABI version 10)"
+Bind a UDP socket to the given local port.
+.TP
+.BR LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP "  (since Landlock ABI version 10)"
+Set the remote port of a UDP socket to the given port,
+or send datagrams to the given remote port
+taking precedence over any destination pre-set on a socket.
+Sending without an explicit destination
+(i.e.\& on a socket already connected)
+is never restricted.
+.P
+Note on auto-binding:
+Setting a remote address
+or sending a first datagram
+on UDP sockets
+performs an implicit
+.BR bind (2)
+to an ephemeral local source port
+if not already bound.
+If
+.B LANDLOCK_ACCESS_NET_BIND_UDP
+is handled,
+to avoid an
+.B EACCES
+error when sending outbound datagrams
+(even if
+.B LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP
+is not handled),
+either:
+.IP \[bu] 3
+use a socket already bound to a port
+before the ruleset started being enforced;
+.IP \[bu] 3
+grant
+.B LANDLOCK_ACCESS_NET_BIND_UDP
+on port 0, meaning
+\[lq]any port in the ephemeral port range\[rq];
+.IP \[bu] 3
+grant
+.B LANDLOCK_ACCESS_NET_BIND_UDP
+on a specific port,
+and call
+.BR bind (2)
+on that port before trying to
+.BR connect (2)
+or send datagrams.
+.P
 Note on
 .BR AF_UNSPEC :
 Calling
@@ -292,6 +341,17 @@ for IPv4 and
 .B INADDR_ANY
 it is treated as
 .BR AF_INET .
+Sending datagrams to that address family
+on IPv4 UDP sockets
+will similarly be treated as
+.BR AF_INET .
+On IPv6 UDP sockets,
+such use is not supported
+and will always result in a denial as if the policy rejected it:
+use a
+.I NULL
+address instead to get the same semantics
+inside and outside a Landlock domain.
 All other uses of that address family result in the same error codes
 as when Landlock is not in use.
 .\"
@@ -518,6 +578,9 @@ _	_	_
 8	7.0	LANDLOCK_RESTRICT_SELF_TSYNC
 _	_	_
 9	7.1	LANDLOCK_ACCESS_FS_RESOLVE_UNIX
+_	_	_
+10	7.2	LANDLOCK_ACCESS_NET_BIND_UDP
+\^	\^	LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP
 .TE
 .P
 Users should use the Landlock ABI version rather than the kernel version
@@ -628,6 +691,7 @@ __u64 landlock_fs_access_rights[] = {
     (LANDLOCK_ACCESS_FS_IOCTL_DEV    << 1) \- 1,  // v7: same
     (LANDLOCK_ACCESS_FS_IOCTL_DEV    << 1) \- 1,  // v8: same
     (LANDLOCK_ACCESS_FS_RESOLVE_UNIX << 1) \- 1,  // v9: add "resolve_unix"
+    (LANDLOCK_ACCESS_FS_RESOLVE_UNIX << 1) \- 1,  // v10: UDP support
 };
 \&
 int abi = landlock_create_ruleset(NULL, 0,
@@ -640,7 +704,7 @@ if (abi == \-1) {
     perror("Unable to use Landlock");
     return;  /* Graceful fallback: Do nothing.  */
 }
-abi = MIN(abi, 9);
+abi = MIN(abi, 10);
 \&
 /* Only use the available rights in the ruleset.  */
 attr.handled_access_fs &= landlock_fs_access_rights[abi \- 1];
-- 
2.47.3

Re: [PATCH 1/3] man/man2/landlock_add_rule.2: Clarify ephemeral port range

[Günther Noack]

On Thu, Sep 17, 2026 at 09:58:50AM +0200, Matthieu Buffet wrote:
> Clarify that ephemeral port range can differ from system to system, and
> that a compromised application can choose (without any randomness)
> exactly which ephemeral port will be chosen next (as long as it is
> within the kernel-wide ip_local_port_range)
> 
> Signed-off-by: Matthieu Buffet <matthieu@buffet.re>
> ---
>  man/man2/landlock_add_rule.2 | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/man/man2/landlock_add_rule.2 b/man/man2/landlock_add_rule.2
> index fe01a98d99ea..633d89824373 100644
> --- a/man/man2/landlock_add_rule.2
> +++ b/man/man2/landlock_add_rule.2
> @@ -109,9 +109,13 @@ is the network port in host endianness.
>  It should be noted that port 0 passed to
>  .BR bind (2)
>  will bind to an available port from the ephemeral port range.
> -This can be configured in the
> +The range is configured globally in the
>  .I /proc/sys/net/ipv4/ip_local_port_range
> -sysctl (also used for IPv6).
> +sysctl (also used for IPv6),
> +and can be further restricted per-socket using

Grammar nit: I believe this should be "per socket".

> +.BR setsockopt (2)
> +with
> +.BR IP_LOCAL_PORT_RANGE (2const).
>  .IP
>  A Landlock rule with port 0
>  and the
> -- 
> 2.47.3
> 

High level remark: The kernel-side documentation has slightly
different phrasing, saying:

  It should be noted that port 0 passed to bind(2) will bind to an
  available port from the ephemeral port range. This can be configured
  with the /proc/sys/net/ipv4/ip_local_port_range sysctl (also used
  for IPv6), and within that range, on a per-socket basis with
  setsockopt(IP_LOCAL_PORT_RANGE).

But I think your variant is slightly clearer.  Do you plan to update
the kernel-side documentation as well?

Thanks,
–Günther

Re: [PATCH 2/3] man/man7/landlock.7: Document AF_UNSPEC behaviour and error codes

[Günther Noack]

Nit in patch subject: "behavior" (man pages use US English)

On Thu, Sep 17, 2026 at 09:58:51AM +0200, Matthieu Buffet wrote:
> Current TCP documentation is missing a description of how AF_UNSPEC is
> mapped (depending on operation and address contents) to AF_INET, and the
> error codes synthesized by Landlock.
> 
> Signed-off-by: Matthieu Buffet <matthieu@buffet.re>
> ---
>  man/man7/landlock.7 | 18 ++++++++++++++++++
>  1 file changed, 18 insertions(+)
> 
> diff --git a/man/man7/landlock.7 b/man/man7/landlock.7
> index 880dd50582f3..51e63f40052c 100644
> --- a/man/man7/landlock.7
> +++ b/man/man7/landlock.7
> @@ -276,6 +276,24 @@ Bind a TCP socket to a local port.
>  .TP
>  .BR LANDLOCK_ACCESS_NET_CONNECT_TCP "  (since Landlock ABI version 4)"
>  Connect an active TCP socket to a remote port.
> +.P
> +Note on
> +.BR AF_UNSPEC :
> +Calling
> +.BR connect (2)
> +with that address family

I realize this is technically correct, but to a reader who does not
remember the nomenclature of the socket() call in detail, it is
possible to misinterpret "that address family" as referring to TCP,
rather than to "AF_UNSPEC".

connect(AF_UNSPEC) also does not work universally on all socket
families and types (see connect(2)), so the socket that it's being
used with also has an address family that plays a role here.

Maybe simpler to just say "AF_UNSPEC" instead of "that address
family"?

> +can only dissolve existing associations,
> +and as such is always allowed.


> +Calling
> +.BR bind (2)
> +with that address family
> +is treated the same way the network stack treats it:
> +for IPv4 and
> +.B INADDR_ANY
> +it is treated as
> +.BR AF_INET .
> +All other uses of that address family result in the same error codes
> +as when Landlock is not in use.

It's unclear to me how bind() with an AF_UNSPEC family address is
relevant to Landlock sandboxing?  Is this relevant to include?

>  .\"
>  .SS Scope flags
>  These flags enable isolating a sandboxed process from a set of IPC actions.
> -- 
> 2.47.3
> 

I also could not find this change in the kernel documentation, I
assume you plan to copy it there as well?

–Günther

Re: [PATCH 3/3] man/man7/landlock.7, man/man2/landlock_add_rule.2: Document UDP support

[Günther Noack]

Nit: On subject line: You can use "man/man?/landlock*.?", similar to
Tingmao's commit bd51589f (2026-09-11; "man/man?/landlock*.?: Document
LANDLOCK_ADD_RULE_QUIET")

High level remark: This patch does not apply cleanly, can you please
rebase?  I think it might be conflicting with Tingmao's recent "quiet
flag" changes.

On Thu, Sep 17, 2026 at 09:58:52AM +0200, Matthieu Buffet wrote:
> Landlock support for UDP-specific policy was merged in 7.2 in
> linux.git 9a8ed15ce224 ("landlock: Add UDP bind() access control")
> and
> linux.git e61247a2e694 ("landlock: Add UDP send+connect access control")
> 
> Update the example to account for ABI v10, and add documentation for new
> access rights taken from the UAPI header, plus:
> - explicitly state in the access right description that sending
>   datagrams without a destination does not require any access right
> - more importantly: clarify the description of the most non-trivial
>   behaviour (auto-bind denials when emitting, which can occur even if
>   CONNECT_SEND_UDP is not handled)
> 
> Link: <https://github.com/landlock-lsm/linux/issues/66>
> Signed-off-by: Matthieu Buffet <matthieu@buffet.re>
> ---
>  man/man2/landlock_add_rule.2 | 15 +++++---
>  man/man7/landlock.7          | 70 ++++++++++++++++++++++++++++++++++--
>  2 files changed, 78 insertions(+), 7 deletions(-)
> 
> diff --git a/man/man2/landlock_add_rule.2 b/man/man2/landlock_add_rule.2
> index 633d89824373..2b2b28147de0 100644
> --- a/man/man2/landlock_add_rule.2
> +++ b/man/man2/landlock_add_rule.2
> @@ -82,7 +82,7 @@ just a file.
>  .TP
>  .BR LANDLOCK_RULE_NET_PORT "  (since Landlock ABI version 4)"
>  For these rules,
> -the object is a TCP port,
> +the object is a TCP or UDP port,
>  and the related actions are defined with
>  .IR "network access rights" .
>  .IP
> @@ -120,8 +120,14 @@ with
>  A Landlock rule with port 0
>  and the
>  .B LANDLOCK_ACCESS_NET_BIND_TCP
> -right means that requesting to bind on port 0 is allowed
> -and it will automatically translate to binding on the related port range.
> +or
> +.B LANDLOCK_ACCESS_NET_BIND_UDP
> +right means that requesting to bind on port 0
> +(explicitly, or implicitly
> +by e.g.\& sending a datagram on an unbound UDP socket)
      ^^^^^^

Per man-pages(7) style guide, "e.g." is followed by a comma and should
be avoided except in short parenthetical asides (e.g., like this one).


> +is allowed
> +and it will automatically translate to
> +binding on a kernel-assigned ephemeral port.
>  .P
>  .I flags
>  must be 0.
> @@ -141,7 +147,8 @@ can fail for the following reasons:
>  .I rule_type
>  is
>  .BR LANDLOCK_RULE_NET_PORT ,
> -but TCP is not supported by the running kernel.
> +but the kernel was built without
> +.BR CONFIG_INET .

Good catch, this should be adapted in the kernel documentation as
well.

>  .TP
>  .B EBADF
>  .I ruleset_fd
> diff --git a/man/man7/landlock.7 b/man/man7/landlock.7
> index 51e63f40052c..884e1d49feb0 100644
> --- a/man/man7/landlock.7
> +++ b/man/man7/landlock.7
> @@ -53,8 +53,8 @@ For these rules, the object is a file hierarchy,
>  and the related filesystem actions are defined with
>  .IR "filesystem access rights" .
>  .TP
> -.BR "Network rules" " (since ABI v4)"
> -For these rules, the object is a TCP port,
> +.BR "Network rules" " (since ABI v4 for TCP, v10 for UDP)"
> +For these rules, the object is a TCP or UDP port,
>  and the related actions are defined with
>  .IR "network access rights" .
>  .\"
> @@ -277,6 +277,55 @@ Bind a TCP socket to a local port.
>  .BR LANDLOCK_ACCESS_NET_CONNECT_TCP "  (since Landlock ABI version 4)"
>  Connect an active TCP socket to a remote port.
>  .P
> +And similarly for UDP port numbers:
> +.TP
> +.BR LANDLOCK_ACCESS_NET_BIND_UDP "  (since Landlock ABI version 10)"
> +Bind a UDP socket to the given local port.
> +.TP
> +.BR LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP "  (since Landlock ABI version 10)"
> +Set the remote port of a UDP socket to the given port,
> +or send datagrams to the given remote port
> +taking precedence over any destination pre-set on a socket.
> +Sending without an explicit destination
> +(i.e.\& on a socket already connected)

Same for "i.e." as for "e.g.".

> +is never restricted.
> +.P
> +Note on auto-binding:
> +Setting a remote address
> +or sending a first datagram
> +on UDP sockets
> +performs an implicit
> +.BR bind (2)
> +to an ephemeral local source port
> +if not already bound.
> +If
> +.B LANDLOCK_ACCESS_NET_BIND_UDP
> +is handled,
> +to avoid an
> +.B EACCES
> +error when sending outbound datagrams
> +(even if
> +.B LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP
> +is not handled),
> +either:
> +.IP \[bu] 3
> +use a socket already bound to a port
> +before the ruleset started being enforced;
> +.IP \[bu] 3
> +grant
> +.B LANDLOCK_ACCESS_NET_BIND_UDP
> +on port 0, meaning
> +\[lq]any port in the ephemeral port range\[rq];
> +.IP \[bu] 3
> +grant
> +.B LANDLOCK_ACCESS_NET_BIND_UDP
> +on a specific port,
> +and call
> +.BR bind (2)
> +on that port before trying to
> +.BR connect (2)
> +or send datagrams.
> +.P
>  Note on
>  .BR AF_UNSPEC :
>  Calling
> @@ -292,6 +341,17 @@ for IPv4 and
>  .B INADDR_ANY
>  it is treated as
>  .BR AF_INET .
> +Sending datagrams to that address family
> +on IPv4 UDP sockets
> +will similarly be treated as
> +.BR AF_INET .
> +On IPv6 UDP sockets,
> +such use is not supported
> +and will always result in a denial as if the policy rejected it:
> +use a
> +.I NULL
> +address instead to get the same semantics
> +inside and outside a Landlock domain.
>  All other uses of that address family result in the same error codes
>  as when Landlock is not in use.
>  .\"
> @@ -518,6 +578,9 @@ _	_	_
>  8	7.0	LANDLOCK_RESTRICT_SELF_TSYNC
>  _	_	_
>  9	7.1	LANDLOCK_ACCESS_FS_RESOLVE_UNIX
> +_	_	_
> +10	7.2	LANDLOCK_ACCESS_NET_BIND_UDP
> +\^	\^	LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP
>  .TE
>  .P
>  Users should use the Landlock ABI version rather than the kernel version
> @@ -628,6 +691,7 @@ __u64 landlock_fs_access_rights[] = {
>      (LANDLOCK_ACCESS_FS_IOCTL_DEV    << 1) \- 1,  // v7: same
>      (LANDLOCK_ACCESS_FS_IOCTL_DEV    << 1) \- 1,  // v8: same
>      (LANDLOCK_ACCESS_FS_RESOLVE_UNIX << 1) \- 1,  // v9: add "resolve_unix"
> +    (LANDLOCK_ACCESS_FS_RESOLVE_UNIX << 1) \- 1,  // v10: UDP support
>  };
>  \&
>  int abi = landlock_create_ruleset(NULL, 0,
> @@ -640,7 +704,7 @@ if (abi == \-1) {
>      perror("Unable to use Landlock");
>      return;  /* Graceful fallback: Do nothing.  */
>  }
> -abi = MIN(abi, 9);
> +abi = MIN(abi, 10);
>  \&
>  /* Only use the available rights in the ruleset.  */
>  attr.handled_access_fs &= landlock_fs_access_rights[abi \- 1];
> -- 
> 2.47.3
> 

Documentation seems correct.

I notcied that the original kernel documentation was rephrased in
multiple places.  I think these rephrases are largely good and help to
explain the subject, but I'm a bit worried that the two documentation
places might drift apart.  Are you planning on sending a follow-up on
the kernel side to keep both sides in sync?

In some cases, we might need to balance conciseness and detail (e.g.,
you might want to see how this looks rendered (man -l) to see that the
descriptions of the UDP rights are not significantly longer than the
ones for TCP.)

Reviewed-by: Günther Noack <gnoack3000@gmail.com>

Thanks,
-Günther

Re: [PATCH 0/3] Add Landlock UDP support documentation

[Mickaël Salaün]

On Thu, Sep 17, 2026 at 09:58:49AM +0200, Matthieu Buffet wrote:
> Hi Alejandro, Mickaël, Günther,
> 
> Here is a small update to landlock.7 and landlock_add_rule.2 to add
> missing TCP info, and add UDP specifics introduced in kernels 7.2+.
> With the benefit of hindsight, re-reading UAPI header changes, I
> actually did a bit more than copy-pasting from them (see patch 3/3):
> - explicitly state in the access right description that sending
>   datagrams without a destination does not require any access right
> - more importantly: clarify the description of the most non-trivial
>   behaviour (auto-bind denials when emitting, which can occur even if
>   CONNECT_SEND_UDP is not handled)

Thanks for the patches!

> Mickaël, if you are okay with these additions, would you like them in a
> UAPI header patch to sync the two?

Yes please.

> 
> Have a nice day!
> 
> Link: <https://github.com/landlock-lsm/linux/issues/66>
> 
> Matthieu Buffet (3):
>   man/man2/landlock_add_rule.2: Clarify ephemeral port range
>   man/man7/landlock.7: Document AF_UNSPEC behaviour and error codes
>   man/man7/landlock.7, man/man2/landlock_add_rule.2: Document UDP
>     support
> 
>  man/man2/landlock_add_rule.2 | 23 +++++++---
>  man/man7/landlock.7          | 88 ++++++++++++++++++++++++++++++++++--
>  2 files changed, 102 insertions(+), 9 deletions(-)
> 
> 
> base-commit: dbc7211e1e52dcd485bd3e081cfa761506edc4e9
> -- 
> 2.47.3
> 

Re: [PATCH 1/3] man/man2/landlock_add_rule.2: Clarify ephemeral port range

[Mickaël Salaün]

On Thu, Sep 17, 2026 at 09:58:50AM +0200, Matthieu Buffet wrote:
> Clarify that ephemeral port range can differ from system to system, and
> that a compromised application can choose (without any randomness)
> exactly which ephemeral port will be chosen next (as long as it is
> within the kernel-wide ip_local_port_range)
> 
> Signed-off-by: Matthieu Buffet <matthieu@buffet.re>

With Günther's nits:

Reviewed-by: Mickaël Salaün <mic@digikod.net>

> ---
>  man/man2/landlock_add_rule.2 | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/man/man2/landlock_add_rule.2 b/man/man2/landlock_add_rule.2
> index fe01a98d99ea..633d89824373 100644
> --- a/man/man2/landlock_add_rule.2
> +++ b/man/man2/landlock_add_rule.2
> @@ -109,9 +109,13 @@ is the network port in host endianness.
>  It should be noted that port 0 passed to
>  .BR bind (2)
>  will bind to an available port from the ephemeral port range.
> -This can be configured in the
> +The range is configured globally in the
>  .I /proc/sys/net/ipv4/ip_local_port_range
> -sysctl (also used for IPv6).
> +sysctl (also used for IPv6),
> +and can be further restricted per-socket using
> +.BR setsockopt (2)
> +with
> +.BR IP_LOCAL_PORT_RANGE (2const).
>  .IP
>  A Landlock rule with port 0
>  and the
> -- 
> 2.47.3
> 

Re: [PATCH 3/3] man/man7/landlock.7, man/man2/landlock_add_rule.2: Document UDP support

[Mickaël Salaün]

On Sat, Sep 26, 2026 at 04:01:55PM +0200, Günther Noack wrote:
> Nit: On subject line: You can use "man/man?/landlock*.?", similar to
> Tingmao's commit bd51589f (2026-09-11; "man/man?/landlock*.?: Document
> LANDLOCK_ADD_RULE_QUIET")
> 
> High level remark: This patch does not apply cleanly, can you please
> rebase?  I think it might be conflicting with Tingmao's recent "quiet
> flag" changes.
> 
> On Thu, Sep 17, 2026 at 09:58:52AM +0200, Matthieu Buffet wrote:
> > Landlock support for UDP-specific policy was merged in 7.2 in
> > linux.git 9a8ed15ce224 ("landlock: Add UDP bind() access control")
> > and
> > linux.git e61247a2e694 ("landlock: Add UDP send+connect access control")
> > 
> > Update the example to account for ABI v10, and add documentation for new
> > access rights taken from the UAPI header, plus:
> > - explicitly state in the access right description that sending
> >   datagrams without a destination does not require any access right
> > - more importantly: clarify the description of the most non-trivial
> >   behaviour (auto-bind denials when emitting, which can occur even if
> >   CONNECT_SEND_UDP is not handled)
> > 
> > Link: <https://github.com/landlock-lsm/linux/issues/66>
> > Signed-off-by: Matthieu Buffet <matthieu@buffet.re>
> > ---
> >  man/man2/landlock_add_rule.2 | 15 +++++---
> >  man/man7/landlock.7          | 70 ++++++++++++++++++++++++++++++++++--
> >  2 files changed, 78 insertions(+), 7 deletions(-)
> > 
> > diff --git a/man/man2/landlock_add_rule.2 b/man/man2/landlock_add_rule.2
> > index 633d89824373..2b2b28147de0 100644
> > --- a/man/man2/landlock_add_rule.2
> > +++ b/man/man2/landlock_add_rule.2
> > @@ -82,7 +82,7 @@ just a file.
> >  .TP
> >  .BR LANDLOCK_RULE_NET_PORT "  (since Landlock ABI version 4)"
> >  For these rules,
> > -the object is a TCP port,
> > +the object is a TCP or UDP port,
> >  and the related actions are defined with
> >  .IR "network access rights" .
> >  .IP
> > @@ -120,8 +120,14 @@ with
> >  A Landlock rule with port 0
> >  and the
> >  .B LANDLOCK_ACCESS_NET_BIND_TCP
> > -right means that requesting to bind on port 0 is allowed
> > -and it will automatically translate to binding on the related port range.
> > +or
> > +.B LANDLOCK_ACCESS_NET_BIND_UDP
> > +right means that requesting to bind on port 0
> > +(explicitly, or implicitly
> > +by e.g.\& sending a datagram on an unbound UDP socket)
>       ^^^^^^
> 
> Per man-pages(7) style guide, "e.g." is followed by a comma and should
> be avoided except in short parenthetical asides (e.g., like this one).
> 
> 
> > +is allowed
> > +and it will automatically translate to
> > +binding on a kernel-assigned ephemeral port.
> >  .P
> >  .I flags
> >  must be 0.
> > @@ -141,7 +147,8 @@ can fail for the following reasons:
> >  .I rule_type
> >  is
> >  .BR LANDLOCK_RULE_NET_PORT ,
> > -but TCP is not supported by the running kernel.
> > +but the kernel was built without
> > +.BR CONFIG_INET .
> 
> Good catch, this should be adapted in the kernel documentation as
> well.
> 
> >  .TP
> >  .B EBADF
> >  .I ruleset_fd
> > diff --git a/man/man7/landlock.7 b/man/man7/landlock.7
> > index 51e63f40052c..884e1d49feb0 100644
> > --- a/man/man7/landlock.7
> > +++ b/man/man7/landlock.7
> > @@ -53,8 +53,8 @@ For these rules, the object is a file hierarchy,
> >  and the related filesystem actions are defined with
> >  .IR "filesystem access rights" .
> >  .TP
> > -.BR "Network rules" " (since ABI v4)"
> > -For these rules, the object is a TCP port,
> > +.BR "Network rules" " (since ABI v4 for TCP, v10 for UDP)"
> > +For these rules, the object is a TCP or UDP port,
> >  and the related actions are defined with
> >  .IR "network access rights" .
> >  .\"
> > @@ -277,6 +277,55 @@ Bind a TCP socket to a local port.
> >  .BR LANDLOCK_ACCESS_NET_CONNECT_TCP "  (since Landlock ABI version 4)"
> >  Connect an active TCP socket to a remote port.
> >  .P
> > +And similarly for UDP port numbers:
> > +.TP
> > +.BR LANDLOCK_ACCESS_NET_BIND_UDP "  (since Landlock ABI version 10)"
> > +Bind a UDP socket to the given local port.
> > +.TP
> > +.BR LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP "  (since Landlock ABI version 10)"
> > +Set the remote port of a UDP socket to the given port,
> > +or send datagrams to the given remote port
> > +taking precedence over any destination pre-set on a socket.
> > +Sending without an explicit destination
> > +(i.e.\& on a socket already connected)
> 
> Same for "i.e." as for "e.g.".
> 
> > +is never restricted.
> > +.P
> > +Note on auto-binding:
> > +Setting a remote address
> > +or sending a first datagram
> > +on UDP sockets
> > +performs an implicit
> > +.BR bind (2)
> > +to an ephemeral local source port
> > +if not already bound.
> > +If
> > +.B LANDLOCK_ACCESS_NET_BIND_UDP
> > +is handled,
> > +to avoid an
> > +.B EACCES
> > +error when sending outbound datagrams
> > +(even if
> > +.B LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP
> > +is not handled),
> > +either:
> > +.IP \[bu] 3
> > +use a socket already bound to a port
> > +before the ruleset started being enforced;
> > +.IP \[bu] 3
> > +grant
> > +.B LANDLOCK_ACCESS_NET_BIND_UDP
> > +on port 0, meaning
> > +\[lq]any port in the ephemeral port range\[rq];
> > +.IP \[bu] 3
> > +grant
> > +.B LANDLOCK_ACCESS_NET_BIND_UDP
> > +on a specific port,
> > +and call
> > +.BR bind (2)
> > +on that port before trying to
> > +.BR connect (2)
> > +or send datagrams.
> > +.P
> >  Note on
> >  .BR AF_UNSPEC :
> >  Calling
> > @@ -292,6 +341,17 @@ for IPv4 and
> >  .B INADDR_ANY
> >  it is treated as
> >  .BR AF_INET .
> > +Sending datagrams to that address family
> > +on IPv4 UDP sockets
> > +will similarly be treated as
> > +.BR AF_INET .
> > +On IPv6 UDP sockets,
> > +such use is not supported
> > +and will always result in a denial as if the policy rejected it:
> > +use a
> > +.I NULL
> > +address instead to get the same semantics
> > +inside and outside a Landlock domain.
> >  All other uses of that address family result in the same error codes
> >  as when Landlock is not in use.
> >  .\"
> > @@ -518,6 +578,9 @@ _	_	_
> >  8	7.0	LANDLOCK_RESTRICT_SELF_TSYNC
> >  _	_	_
> >  9	7.1	LANDLOCK_ACCESS_FS_RESOLVE_UNIX
> > +_	_	_
> > +10	7.2	LANDLOCK_ACCESS_NET_BIND_UDP
> > +\^	\^	LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP
> >  .TE
> >  .P
> >  Users should use the Landlock ABI version rather than the kernel version
> > @@ -628,6 +691,7 @@ __u64 landlock_fs_access_rights[] = {
> >      (LANDLOCK_ACCESS_FS_IOCTL_DEV    << 1) \- 1,  // v7: same
> >      (LANDLOCK_ACCESS_FS_IOCTL_DEV    << 1) \- 1,  // v8: same
> >      (LANDLOCK_ACCESS_FS_RESOLVE_UNIX << 1) \- 1,  // v9: add "resolve_unix"
> > +    (LANDLOCK_ACCESS_FS_RESOLVE_UNIX << 1) \- 1,  // v10: UDP support
> >  };
> >  \&
> >  int abi = landlock_create_ruleset(NULL, 0,
> > @@ -640,7 +704,7 @@ if (abi == \-1) {
> >      perror("Unable to use Landlock");
> >      return;  /* Graceful fallback: Do nothing.  */
> >  }
> > -abi = MIN(abi, 9);
> > +abi = MIN(abi, 10);
> >  \&
> >  /* Only use the available rights in the ruleset.  */
> >  attr.handled_access_fs &= landlock_fs_access_rights[abi \- 1];
> > -- 
> > 2.47.3
> > 
> 
> Documentation seems correct.
> 
> I notcied that the original kernel documentation was rephrased in
> multiple places.  I think these rephrases are largely good and help to
> explain the subject, but I'm a bit worried that the two documentation
> places might drift apart.  Are you planning on sending a follow-up on
> the kernel side to keep both sides in sync?

As Matthieu proposed in the cover letter, yes that would definitely be
appreciated.

> 
> In some cases, we might need to balance conciseness and detail (e.g.,
> you might want to see how this looks rendered (man -l) to see that the
> descriptions of the UDP rights are not significantly longer than the
> ones for TCP.)
> 
> Reviewed-by: Günther Noack <gnoack3000@gmail.com>

Reviewed-by: Mickaël Salaün <mic@digikod.net>

> 
> Thanks,
> -Günther