[PATCH] landlock_restrict_self.2, landlock.7: Document LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS

[Pedro Holanda <pedroholanda122205@gmail.com>]

Add the LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS flag (Landlock ABI
version 11), which sets the no_new_privs attribute of the calling
thread atomically with successful ruleset enforcement, removing the
need for a prior prctl(PR_SET_NO_NEW_PRIVS) call. Document the flag in
landlock_restrict_self(2) alongside LANDLOCK_RESTRICT_SELF_TSYNC, and
add the ABI 11 row to the VERSIONS table in landlock(7).

Transcribes the kernel documentation added in Justin Suess's ABI 11
series.

Signed-off-by: Pedro Holanda <pedroholanda122205@gmail.com>
Link: https://lore.kernel.org/linux-security-module/20260809154544.1253100-5-utilityemal77@gmail.com/
Link: https://github.com/landlock-lsm/linux/issues/66
---
 man/man2/landlock_restrict_self.2 | 29 +++++++++++++++++++++++++++++
 man/man7/landlock.7               |  2 ++
 2 files changed, 31 insertions(+)

Note: following up on the man-pages transcription from issue #66, at
Günther's suggestion. I've left the DESCRIPTION no_new_privs
precondition and the EPERM entry unchanged; both now have an exception
via this flag. Happy to refine them here or in a follow-up.

diff --git a/man/man2/landlock_restrict_self.2 b/man/man2/landlock_restrict_self.2
index 3b8f897cf..4cfbd1e6a 100644
--- a/man/man2/landlock_restrict_self.2
+++ b/man/man2/landlock_restrict_self.2
@@ -150,6 +150,35 @@ If the calling thread is running with
 this operation enables
 .I no_new_privs
 on the sibling threads as well.
+.TP
+.BR LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS "  (since Landlock ABI version 11)"
+Sets the
+.I no_new_privs
+attribute of the calling thread atomically with enforcement of the
+ruleset.
+.I no_new_privs
+is set if and only if the call succeeds;
+a failed enforcement leaves it unchanged.
+Because the call sets
+.I no_new_privs
+itself,
+it removes the need for a prior
+.BR prctl (2)
+.B PR_SET_NO_NEW_PRIVS
+call (or
+.B CAP_SYS_ADMIN
+use).
+.IP
+When combined with
+.BR LANDLOCK_RESTRICT_SELF_TSYNC ,
+.I no_new_privs
+is set on all threads of the process with the same guarantee.
+.IP
+Leaving
--- a/man/man2/landlock_restrict_self.2
+++ b/man/man2/landlock_restrict_self.2
@@ -150,6 +150,35 @@ If the calling thread is running with
 this operation enables
 .I no_new_privs
 on the sibling threads as well.
+.TP
+.BR LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS "  (since Landlock ABI version 11)"
+Sets the
+.I no_new_privs
+attribute of the calling thread atomically with enforcement of the
+ruleset.
+.I no_new_privs
+is set if and only if the call succeeds;
+a failed enforcement leaves it unchanged.
+Because the call sets
+.I no_new_privs
+itself,
+it removes the need for a prior
+.BR prctl (2)
+.B PR_SET_NO_NEW_PRIVS
+call (or
+.B CAP_SYS_ADMIN
+use).
+.IP
+When combined with
+.BR LANDLOCK_RESTRICT_SELF_TSYNC ,
+.I no_new_privs
+is set on all threads of the process with the same guarantee.
+.IP
+Leaving
+.I no_new_privs
+unset is risky even when Landlock does not require it,
+as it can allow a sandboxed process to regain privileges;
+this flag is the recommended way to avoid that.
 .SH RETURN VALUE
 On success,
 .BR landlock_restrict_self ()
diff --git a/man/man7/landlock.7 b/man/man7/landlock.7
index 006482c94..e8639dcd4 100644
--- a/man/man7/landlock.7
+++ b/man/man7/landlock.7
@@ -534,6 +534,8 @@ _   _       _
 9      7.1     LANDLOCK_ACCESS_FS_RESOLVE_UNIX
 _      _       _
 10     7.2     LANDLOCK_ADD_RULE_QUIET
+_      _       _
+11     7.3     LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS
 .TE
 .P
 Users should use the Landlock ABI version rather than the kernel version
-- 
2.53.0

+.I no_new_privs
+unset is risky even when Landlock does not require it,
+as it can allow a sandboxed process to regain privileges;
+this flag is the recommended way to avoid that.
 .SH RETURN VALUE
 On success,
 .BR landlock_restrict_self ()
diff --git a/man/man7/landlock.7 b/man/man7/landlock.7
index 006482c94..e8639dcd4 100644
--- a/man/man7/landlock.7
+++ b/man/man7/landlock.7
@@ -534,6 +534,8 @@ _	_	_
 9	7.1	LANDLOCK_ACCESS_FS_RESOLVE_UNIX
 _	_	_
 10	7.2	LANDLOCK_ADD_RULE_QUIET
+_	_	_
+11	7.3	LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS
 .TE
 .P
 Users should use the Landlock ABI version rather than the kernel version
-- 
2.53.0