[GIT PULL] Landlock update for v7.3-rc1

["Mickaël Salaün" <mic@digikod.net>]

Hi,

This PR improves observability with Landlock tracepoints support, which
required some refactoring for dedicated domain types and common helpers shared
with audit code.  A LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS flag is also added to
improve process-wide domain enforcement consistency.  Whiteout files are now
correctly handled and tested, and a few other fixes complete this PR.

Please pull these changes for v7.3-rc1 .  These commits merge cleanly
with your master branch.  Most kernel changes have been tested in the
latest linux-next releases for some weeks, and I recently updated commit
messages to reflect latest reviews.

Test coverage for security/landlock is 91.6% of 2571 lines according to
LLVM 22, and it was 91.8% of 2357 lines before this PR.

Regards,
 Mickaël

--
The following changes since commit 075b74841bd0065a3bda3440873c747938e69b68:

  Linux 7.2-rc6 (2026-08-02 16:24:24 -0700)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/mic/linux.git tags/landlock-7.3-rc1

for you to fetch changes up to 172b6a6d8463562b0cbebfd66f770b078f81966b:

  landlock: Document tracepoints (2026-08-17 10:17:19 +0200)

----------------------------------------------------------------
Landlock update for v7.3-rc1

----------------------------------------------------------------
Doehyun Baek (1):
      landlock: Document fs.resolve_unix audit blocker

Günther Noack (7):
      landlock: Documentation wording cleanups
      selftests/landlock: Use an actual chardev for MAKE_CHAR audit test
      landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation
      selftests/landlock: Add tests for whiteout object creation
      selftests/landlock: Add audit test for whiteout object creation
      selftests/landlock: Test whiteout object behaviour in OverlayFS renames
      landlock: Link the erratum documentation for whiteout objects

Justin Suess (5):
      landlock: Check landlock_restrict_self(2)'s flags before privileges
      landlock: Add LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS
      selftests/landlock: Test LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS
      landlock: Document LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS
      samples/landlock: Add LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS to sampler

Mickaël Salaün (20):
      landlock: Harden sock_is_scoped() against file-less sockets
      landlock: Prepare ruleset and domain type split
      landlock: Move domain query functions to domain.c
      landlock: Split struct landlock_domain from struct landlock_ruleset
      landlock: Split denial logging from audit into common framework
      landlock: Decouple the per-denial logging decision from CONFIG_AUDIT
      landlock: Consolidate access-right and scope names in a shared header
      landlock: Add create_ruleset and free_ruleset tracepoints
      landlock: Add landlock_add_rule_fs and landlock_add_rule_net tracepoints
      landlock: Add create_domain and free_domain tracepoints
      landlock: Add landlock_enforce_domain tracepoint
      landlock: Add tracepoints for rule checking
      landlock: Add landlock_deny_access_fs and landlock_deny_access_net
      landlock: Add tracepoints for ptrace and scope denials
      selftests/landlock: Add trace event test infrastructure and tests
      selftests/landlock: Add filesystem tracepoint tests
      selftests/landlock: Add network tracepoint tests
      selftests/landlock: Add scope and ptrace tracepoint tests
      selftests/landlock: Add landlock_enforce_domain trace tests
      landlock: Document tracepoints

Wang Yan (1):
      selftests/landlock: Fix spelling error in fs_test comment

 Documentation/admin-guide/LSM/landlock.rst         |  106 +-
 Documentation/security/landlock.rst                |   38 +-
 Documentation/trace/events-landlock.rst            |  326 ++++
 Documentation/trace/index.rst                      |    1 +
 Documentation/userspace-api/landlock.rst           |   62 +-
 MAINTAINERS                                        |    3 +
 include/linux/landlock.h                           |   56 +
 include/trace/events/landlock.h                    |  965 ++++++++++++
 include/uapi/linux/landlock.h                      |   22 +-
 samples/landlock/sandboxer.c                       |   16 +-
 security/landlock/Kconfig                          |    5 +
 security/landlock/Makefile                         |   12 +-
 security/landlock/access.h                         |    6 +-
 security/landlock/audit.c                          |  641 +-------
 security/landlock/audit.h                          |   57 +-
 security/landlock/cred.c                           |   14 +-
 security/landlock/cred.h                           |   29 +-
 security/landlock/domain.c                         |  472 +++++-
 security/landlock/domain.h                         |  163 +-
 security/landlock/errata/abi-1.h                   |   23 +
 security/landlock/fs.c                             |  259 +++-
 security/landlock/fs.h                             |   40 +-
 security/landlock/id.h                             |    6 +-
 security/landlock/limits.h                         |    2 +-
 security/landlock/log.c                            |  587 +++++++
 security/landlock/log.h                            |   86 ++
 security/landlock/net.c                            |   38 +-
 security/landlock/ruleset.c                        |  546 +------
 security/landlock/ruleset.h                        |  250 +--
 security/landlock/syscalls.c                       |  125 +-
 security/landlock/task.c                           |   87 +-
 security/landlock/trace.c                          |  185 +++
 security/landlock/trace.h                          |   44 +
 security/landlock/tsync.c                          |   24 +-
 security/landlock/tsync.h                          |    4 +-
 tools/testing/selftests/landlock/audit.h           |   35 -
 tools/testing/selftests/landlock/base_test.c       |  104 +-
 tools/testing/selftests/landlock/common.h          |   47 +
 tools/testing/selftests/landlock/config            |    2 +
 tools/testing/selftests/landlock/fs_test.c         |  738 ++++++++-
 tools/testing/selftests/landlock/net_test.c        |  590 ++++++-
 tools/testing/selftests/landlock/ptrace_test.c     |  402 +++++
 .../selftests/landlock/scoped_abstract_unix_test.c |  264 ++++
 .../selftests/landlock/scoped_signal_test.c        |  404 +++++
 tools/testing/selftests/landlock/trace.h           |  639 ++++++++
 tools/testing/selftests/landlock/trace_fs_test.c   |  496 ++++++
 tools/testing/selftests/landlock/trace_test.c      | 1620 ++++++++++++++++++++
 tools/testing/selftests/landlock/true.c            |   10 +
 tools/testing/selftests/landlock/tsync_test.c      |   96 +-
 49 files changed, 9244 insertions(+), 1503 deletions(-)
 create mode 100644 Documentation/trace/events-landlock.rst
 create mode 100644 include/linux/landlock.h
 create mode 100644 include/trace/events/landlock.h
 create mode 100644 security/landlock/log.c
 create mode 100644 security/landlock/log.h
 create mode 100644 security/landlock/trace.c
 create mode 100644 security/landlock/trace.h
 create mode 100644 tools/testing/selftests/landlock/trace.h
 create mode 100644 tools/testing/selftests/landlock/trace_fs_test.c
 create mode 100644 tools/testing/selftests/landlock/trace_test.c