* [PATCH] security: remove BUG_ON in security_skb_classify_flow
From: Jiayuan Chen @ 2026-04-08 11:42 UTC (permalink / raw)
To: linux-security-module, paul
Cc: jmorris, serge, linux-kernel, Jiayuan Chen, Kaiyan Mei, Yinhao Hu,
Dongliang Mu
A BPF program attached to the xfrm_decode_session hook can return a
non-zero value, which causes BUG_ON(rc) in security_skb_classify_flow()
to trigger a kernel panic.
Remove the BUG_ON and change the return type from void to int, so that
callers can optionally handle the error.
Reported-by: Kaiyan Mei <M202472210@hust.edu.cn>
Reported-by: Yinhao Hu <dddddd@hust.edu.cn>
Reported-by: Dongliang Mu <dzm91@hust.edu.cn>
Closes: https://lore.kernel.org/bpf/4c4d04ba.6c12b.19c039b69e6.Coremail.kaiyanm@hust.edu.cn/
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
---
include/linux/security.h | 7 ++++---
security/security.c | 16 +++++++++++-----
2 files changed, 15 insertions(+), 8 deletions(-)
diff --git a/include/linux/security.h b/include/linux/security.h
index ee88dd2d2d1f..6d210dc4c649 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -1975,7 +1975,7 @@ int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
struct xfrm_policy *xp,
const struct flowi_common *flic);
int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid);
-void security_skb_classify_flow(struct sk_buff *skb, struct flowi_common *flic);
+int security_skb_classify_flow(struct sk_buff *skb, struct flowi_common *flic);
#else /* CONFIG_SECURITY_NETWORK_XFRM */
@@ -2038,9 +2038,10 @@ static inline int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid)
return 0;
}
-static inline void security_skb_classify_flow(struct sk_buff *skb,
- struct flowi_common *flic)
+static inline int security_skb_classify_flow(struct sk_buff *skb,
+ struct flowi_common *flic)
{
+ return 0;
}
#endif /* CONFIG_SECURITY_NETWORK_XFRM */
diff --git a/security/security.c b/security/security.c
index a26c1474e2e4..26a34eb363c2 100644
--- a/security/security.c
+++ b/security/security.c
@@ -4990,12 +4990,18 @@ int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid)
return call_int_hook(xfrm_decode_session, skb, secid, 1);
}
-void security_skb_classify_flow(struct sk_buff *skb, struct flowi_common *flic)
+/**
+ * security_skb_classify_flow() - Set the flow's secid from the security label
+ * @skb: packet
+ * @flic: flow common structure to set
+ *
+ * Decode the packet in @skb and set the flow's secid in @flic.
+ *
+ * Return: Return 0 if successful.
+ */
+int security_skb_classify_flow(struct sk_buff *skb, struct flowi_common *flic)
{
- int rc = call_int_hook(xfrm_decode_session, skb, &flic->flowic_secid,
- 0);
-
- BUG_ON(rc);
+ return call_int_hook(xfrm_decode_session, skb, &flic->flowic_secid, 0);
}
EXPORT_SYMBOL(security_skb_classify_flow);
#endif /* CONFIG_SECURITY_NETWORK_XFRM */
--
2.43.0
^ permalink raw reply related
* Re: [RFC PATCH 00/20] BPF interface for applying Landlock rulesets
From: Justin Suess @ 2026-04-08 11:41 UTC (permalink / raw)
To: Ihor Solodrai
Cc: ast, daniel, andrii, kpsingh, paul, mic, viro, brauner, kees,
gnoack, jack, jmorris, serge, song, yonghong.song, martin.lau, m,
eddyz87, john.fastabend, sdf, skhan, bpf, linux-security-module,
linux-kernel, linux-fsdevel
In-Reply-To: <5dfadfd4-ea02-4c3f-8d01-5d979ea06747@linux.dev>
On Tue, Apr 07, 2026 at 09:40:07PM -0700, Ihor Solodrai wrote:
>
>
> On 4/7/26 1:01 PM, Justin Suess wrote:
> > Hello,
> >
> > This series lets sleepable BPF LSM programs apply an existing,
> > userspace-created Landlock ruleset to a program during exec.
> >
> > The goal is not to move Landlock policy definition into BPF, nor to create a
> > second policy engine. Instead, BPF is used only to select when an already
> > valid Landlock ruleset should be applied, based on runtime exec context.
> >
> > Background
> > ===
> >
> > Landlock is primarily a syscall-driven, unprivileged-first LSM. That model
> > works well when the application being sandboxed can create and enforce its own
> > rulesets, or when a trusted launcher can impose restrictions directly before
> > running a trusted target.
> >
> > That becomes harder when the target program is not under first-party control,
> > for example:
> >
> > 1. third-party binaries,
> > 2. unmodified container images,
> > 3. programs reached through shells, wrappers, or service managers, and
> > 4. user-supplied or otherwise untrusted code.
> >
> > In these cases, an external supervisor may want to apply a Landlock ruleset to
> > the final executed program, while leaving unrelated parents or helper
> > processes alone.
> >
> > Why external sandboxing is awkward today
> > ===
> >
> > There are two recurring problems.
> >
> > First, userspace cannot reliably predict every file a target may need across
> > different systems, packaging layouts, and runtime conditions. Shared
> > libraries, configuration files, interpreters, and helper binaries often depend
> > on details that are only known at runtime.
> >
> > Second, Landlock inheritance is intentionally one-way. Once a task is
> > restricted, descendants inherit that domain and may only become more
> > restricted. This is exactly what Landlock should do, but it makes external
> > sandboxing awkward when the program of interest is buried inside a larger exec
> > chain. Applying restrictions too early can affect unrelated intermediates;
> > applying them too late misses the target entirely.
> >
> > This series addresses that target-selection problem.
> >
> > Overview
> > ===
> >
> > This series adds a small BPF-to-Landlock bridge:
> >
> > 1. userspace creates a normal Landlock ruleset through the existing ABI;
> > 2. userspace inserts that ruleset FD into a new
> > BPF_MAP_TYPE_LANDLOCK_RULESET map;
> > 3. a sleepable BPF LSM program attached to an exec-time hook looks up the
> > ruleset; and
> > 4. the program calls a kfunc to apply that ruleset to the new program's
> > credentials before exec completes.
> >
> > The important point is that BPF does not create, inspect, or mutate Landlock
> > policy here. It only decides whether to apply a ruleset that was already
> > created and validated through Landlock's existing userspace API.
> >
> > Interface
> > ===
> >
> > The series adds:
> >
> > 1. bpf_landlock_restrict_binprm(), which applies a referenced ruleset to
> > struct linux_binprm credentials;
> > 2. bpf_landlock_put_ruleset(), which releases a referenced ruleset; and
> > 3. BPF_MAP_TYPE_LANDLOCK_RULESET, a specialized map type for holding
> > references to Landlock rulesets originating from userspace file
> > descriptors.
> > 4. A new field in the linux_binprm struct to enable application of
> > task_set_no_new_privs once execution is beyond the point of no return.
> >
> > The kfuncs are restricted to sleepable BPF LSM programs attached to
> > bprm_creds_for_exec and bprm_creds_from_file, which are the points where the
> > new program's credentials may still be updated safely.
> >
> > This series also adds LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS. On the BPF path,
> > this is staged through the exec context and committed only after exec reaches
> > point-of-no-return. This avoids side effects on failed executions while
> > ensuring that the resulting task cannot gain more privileges through later exec
> > transitions. This is done through the set_nnp_on_point_of_no_return field.
> >
> > This has a little subtlety: LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS in the BPF
> > path will not stop the current execution from escalating at all; only subsequent
> > ones. This is intentional to allow landlock policies to be applied through a
> > setuid transition for instance, without affecting the current escalation.
> >
> > Semantics
> > ===
> >
> > This proposal is intended to preserve Landlock semantics as much as practical
> > for an exec-time BPF attachment model:
> >
> > 1. only pre-existing Landlock rulesets may be applied;
> > 2. BPF cannot construct, inspect, or modify rulesets;
> > 3. enforcement still happens before the new program begins execution;
> > 4. normal Landlock inheritance, layering, and future composition remain
> > unchanged; and
> > 5. this does not bypass Landlock's privilege checks for applying Landlock
> > rulesets.
> >
> > In other words, BPF acts as an external selector for when to apply Landlock,
> > not as a replacement for Landlock's enforcement engine.
> >
> > All behavior, future access rights, and previous access rights are designed
> > to automatically be supported from either BPF or existing syscall contexts.
> >
> > The main semantic difference is LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS on the BPF
> > path: it guarantees that the resulting task is pinned with no_new_privs before
> > it can perform later exec transitions, but it does not retroactively suppress
> > privilege gain for the current exec transition itself.
> >
> > The other exception to semantics is the LANDLOCK_RESTRICT_SELF_TSYNC flag.
> > (see Points of Feedback section)
> >
> > Patch layout
> > ===
> >
> > Patches 1-5 prepare the Landlock side by moving shared ruleset logic out of
> > syscalls.c, adding a no_new_privs flag for non-syscall callers, exposing
> > linux_binprm->set_nnp_on_point_of_no_return as an interface to set no_new_privs
> > on the point of no return, and making deferred ruleset destruction RCU-safe.
> >
> > Patches 6-10 add the BPF-facing pieces: the Landlock kfuncs, the new map type,
> > syscall handling for that map, and verifier support.
> >
> > Patches 11-15 add selftests and the small bpftool update needed for the new
> > map type.
> >
> > Patches 16-20 add docs and bump the ABI version and update MAINTAINERS.
> >
> > Feedback is especially welcome on the overall interface shape, the choice of
> > hooks, and the map semantics.
> >
> > Testing
> > ===
> >
> > This patch series has two portions of tests.
> >
> > One lives in the traditional Landlock selftests, for the new
> > LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS flag.
> >
> > The other suite lives under the BPF selftests, and this tests the Landlock
> > kfuncs and the new BPF_MAP_TYPE_LANDLOCK_RULESET.
> >
> > This patch series was run through BPF CI, the results of which are here. [1]
> >
> > All mentioned tests are passing, as well as the BPF CI.
> >
> > [1] : https://github.com/kernel-patches/bpf/pull/11562
>
> Hello Justin.
>
> I regret to disappoint you with a lame piece of feedback, but the
> series hasn't been picked up by automated BPF CI pipeline properly:
> https://github.com/kernel-patches/bpf/pull/11709
>
Apologies.
> I suggest you rebase on top of bpf-next/master [1], and re-submit to
> the mailing list with a bpf-next tag in subject:
> "[RFC PATCH bpf-next ...] bpf: ..."
>
No problem. Sorry about that I based it off the Landlock-next branch.
My fault, I thought the CI was to be manually initiated... oh well.
I'll resubmit soon. Looks like a perfectly clean rebase luckily.
> I'm pretty sure AI bot will find something annoying to address.
>
> Other than that, please be patient. It'll probably take a while for
> maintainers and reviewers to digest this work before anyone can
> meaningfully comment. Thanks!
>
Thank you for your time and help!
> [1] https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/
>
> >
> > Points of Feedback
> > ===
> >
> > First, the new set_nnp_on_point_of_no_return field in struct linux_binprm.
> > This field was needed to request that task_set_no_new_privs be set during an
> > execution, but only after the execution has proceeded beyond the point of no
> > return. I couldn't find a way to express this semantic without adding a new
> > bitfield to struct linux_binprm and a conditional in fs/exec.c. Please see
> > patch 2.
> >
> > Feedback on the BPF testing harness, which was generated with AI assistance as
> > disclosed in the commit footer, is welcomed. I have only limited familiarity
> > with BPF testing practices. These tests were made with strong human supervision.
> > See patches 14 and 15.
> >
> > Feedback on the NO_NEW_PRIVS situation is also welcomed. Because task_set_no_new_privs()
> > would otherwise leak state on failed executions or AT_EXECVE_CHECK, this series
> > stages no_new_privs through the exec context and only commits it after
> > point-of-no-return. This preserves failure behavior while still ensuring that
> > the resulting task cannot elevate further through later exec transitions.
> > When called from bprm_creds_from_file, this does not retroactively change the
> > privilege outcome of the current exec transition itself.
> >
> > See patch 2 and 3.
> >
> > Next, the RCU in the landlock_ruleset. Existing BPF maps use RCU to make sure maps
> > holding references stay valid. I altered the landlock ruleset to use rcu_work
> > to make sure that the rcu is synchronized before putting on a ruleset, and
> > acquire the rcu in the arraymap implementation. See patches 5-10.
> >
> > Next, the semantics of the map. What operations should be supported from BPF
> > and userspace and what data types should they return? I consider the struct
> > bpf_landlock_ruleset to be opaque. Userspace can add items to the map via the
> > fd, delete items by their index, and BPF can delete and lookup items by their
> > index. Items cannot be updated, only swapped.
> >
> > Finally, the handling of the LANDLOCK_RESTRICT_SELF_TSYNC flag. This flag has
> > no meaning in a pre-execution context, as the credentials during the designated
> > LSM hooks (bprm_creds_for_exec/creds_from_file) still represent the pre-execution
> > task. Therefore, this flag is invalidated and attempting to use it with
> > bpf_landlock_restrict_binprm will return -EINVAL. Otherwise, the flag would
> > result in applying the landlock ruleset to the wrong target in addition to the
> > intended one. (see patch 2). This behavior is validated with selftests.
> >
> > Existing works / Credits
> > ===
> >
> > Mickaël Salaün created patchsets adding BPF tracepoints for landlock in [2] [3].
> >
> > Mickaël also gave feedback on this feature and the idea in this GitHub thread. [4]
> >
> > Günther Noack initially received and provided initial feedback on this idea as
> > an early prototype.
> >
> > Liz Rice, author of "Learning eBPF: Programming the Linux Kernel for Enhanced
> > Observability, Networking, and Security" provided background and inspired me to
> > experiment with BPF and the BPF LSM. [5]
> >
> > [2] : https://lore.kernel.org/all/20250523165741.693976-1-mic@digikod.net/
> > [3] : https://lore.kernel.org/linux-security-module/20260406143717.1815792-1-mic@digikod.net/
> > [4] : https://github.com/landlock-lsm/linux/issues/56
> > [5] : https://wellesleybooks.com/book/9781098135126
> >
> > Kind Regards,
> > Justin Suess
> >
> > Justin Suess (20):
> > landlock: Move operations from syscall into ruleset code
> > execve: Add set_nnp_on_point_of_no_return
> > landlock: Implement LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS
> > selftests/landlock: Cover LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS
> > landlock: Make ruleset deferred free RCU safe
> > bpf: lsm: Add Landlock kfuncs
> > bpf: arraymap: Implement Landlock ruleset map
> > bpf: Add Landlock ruleset map type
> > bpf: syscall: Handle Landlock ruleset maps
> > bpf: verifier: Add Landlock ruleset map support
> > selftests/bpf: Add Landlock kfunc declarations
> > selftests/landlock: Rename gettid wrapper for BPF reuse
> > selftests/bpf: Enable Landlock in selftests kernel.
> > selftests/bpf: Add Landlock kfunc test program
> > selftests/bpf: Add Landlock kfunc test runner
> > landlock: Bump ABI version
> > tools: bpftool: Add documentation for landlock_ruleset
> > landlock: Document LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS
> > bpf: Document BPF_MAP_TYPE_LANDLOCK_RULESET
> > MAINTAINERS: update entry for the Landlock subsystem
> >
> > Documentation/bpf/map_landlock_ruleset.rst | 181 +++++
> > Documentation/userspace-api/landlock.rst | 22 +-
> > MAINTAINERS | 4 +
> > fs/exec.c | 8 +
> > include/linux/binfmts.h | 7 +-
> > include/linux/bpf_lsm.h | 15 +
> > include/linux/bpf_types.h | 1 +
> > include/linux/landlock.h | 92 +++
> > include/uapi/linux/bpf.h | 1 +
> > include/uapi/linux/landlock.h | 14 +
> > kernel/bpf/arraymap.c | 67 ++
> > kernel/bpf/bpf_lsm.c | 145 ++++
> > kernel/bpf/syscall.c | 4 +-
> > kernel/bpf/verifier.c | 15 +-
> > samples/landlock/sandboxer.c | 7 +-
> > security/landlock/limits.h | 2 +-
> > security/landlock/ruleset.c | 198 ++++-
> > security/landlock/ruleset.h | 25 +-
> > security/landlock/syscalls.c | 158 +---
> > .../bpf/bpftool/Documentation/bpftool-map.rst | 2 +-
> > tools/bpf/bpftool/map.c | 2 +-
> > tools/include/uapi/linux/bpf.h | 1 +
> > tools/lib/bpf/libbpf.c | 1 +
> > tools/lib/bpf/libbpf_probes.c | 6 +
> > tools/testing/selftests/bpf/bpf_kfuncs.h | 20 +
> > tools/testing/selftests/bpf/config | 5 +
> > tools/testing/selftests/bpf/config.x86_64 | 1 -
> > .../bpf/prog_tests/landlock_kfuncs.c | 733 ++++++++++++++++++
> > .../selftests/bpf/progs/landlock_kfuncs.c | 92 +++
> > tools/testing/selftests/landlock/base_test.c | 10 +-
> > tools/testing/selftests/landlock/common.h | 28 +-
> > tools/testing/selftests/landlock/fs_test.c | 103 +--
> > tools/testing/selftests/landlock/net_test.c | 55 +-
> > .../testing/selftests/landlock/ptrace_test.c | 14 +-
> > .../landlock/scoped_abstract_unix_test.c | 51 +-
> > .../selftests/landlock/scoped_base_variants.h | 23 +
> > .../selftests/landlock/scoped_common.h | 5 +-
> > .../selftests/landlock/scoped_signal_test.c | 30 +-
> > tools/testing/selftests/landlock/wrappers.h | 2 +-
> > 39 files changed, 1877 insertions(+), 273 deletions(-)
> > create mode 100644 Documentation/bpf/map_landlock_ruleset.rst
> > create mode 100644 include/linux/landlock.h
> > create mode 100644 tools/testing/selftests/bpf/prog_tests/landlock_kfuncs.c
> > create mode 100644 tools/testing/selftests/bpf/progs/landlock_kfuncs.c
> >
> >
> > base-commit: 8c6a27e02bc55ab110d1828610048b19f903aaec
>
^ permalink raw reply
* Re: LSM: Whiteout chardev creation sidesteps mknod hook
From: Mickaël Salaün @ 2026-04-08 11:01 UTC (permalink / raw)
To: Günther Noack
Cc: Christian Brauner, Paul Moore, linux-security-module,
John Johansen, Georgia Garcia, Kentaro Takeda, Tetsuo Handa
In-Reply-To: <adUBCQXrt7kmgqJT@google.com>
On Tue, Apr 07, 2026 at 03:05:13PM +0200, Günther Noack wrote:
> Hello Christian, Paul, Mickaël and LSM maintainers!
>
> I discovered the following bug in Landlock, which potentially also
> affects other LSMs:
>
> With renameat2(2)'s RENAME_WHITEOUT flag, it is possible to create a
> "whiteout object" at the source of the rename. Whiteout objects are
> character devices with major/minor (0, 0) -- these devices are not
> bound to any driver, so they are harmless, but still, the creation of
> these files can sidestep the LANDLOCK_ACCESS_FS_MAKE_CHAR access right
> in Landlock.
Any way to "write" on the filesystem should properly be controlled. The
man page says that RENAME_WHITEOUT requires CAP_MKNOD, however, looking
at vfs_mknod(), there is an explicit exception to not check CAP_MKNOD
for whiteout devices. See commit a3c751a50fe6 ("vfs: allow unprivileged
whiteout creation").
>
>
> I am unconvinced which is the right fix here -- do you have an opinion
> on this from the VFS/LSM side?
>
>
> Option 1: Make filesystems call security_path_mknod() during RENAME_WHITEOUT?
This is the right semantic.
>
> Do it in the VFS rename hook.
>
> * Pro: Fixes it for all LSMs
> * Con: Call would have to be done in multiple filesystems
That would not work.
>
>
> Option 2: Handle it in security_{path,inode}_rename()
>
> Make Landlock handle it in security_inode_rename() by looking for the
> RENAME_WHITEOUT flag.
>
> * Con: Operation should only be denied if the file system even
> implements RENAME_WHITEOUT, and we would have to maintain a list of
> affected filesystems for that. (That feels like solving it at the
> wrong layer of abstraction.)
Why would we need to maintain such list? If it's only about the errno,
well, that would not be perfect be ok with a proper doc.
I'm mostly worried that there might be other (future) call paths to
create whiteout devices.
I think option 2 would be the most practical approach for Landlock, with
a new LANDLOCK_ACCESS_FS_MAKE_WHITEOUT right.
I'm also wondering how are the chances that other kind of special file
type like a whiteout device could come up in the future. Any guess
Christian?
> * Con: Unclear whether other LSMs need a similar fix
I guess at least AppArmor and Tomoyo would consider that an issue.
>
>
> Option 3: Declare that this is working as intended?
We need to be able to controle any file creation, which is not currently
the case because of this whiteout exception.
>
> * Pro: (0, 0) is not a "real" character device
>
>
> In cases 1 and 2, we'd likely need to double check that we are not
> breaking existing scenarios involving OverlayFS, by suddenly requiring
> a more lax policy for creating character devices on these directories.
>
> Please let me know what you think. I'm specifically interested in:
>
> 1. Christian: What is the appropriate way to do this VFS wise?
> 2. LSM maintainers: Is this a bug that affects other LSMs as well?
>
> Thanks,
> —Günther
>
> P.S.: For full transparency, I found this bug by pointing Google
> Gemini at the Landlock codebase.
>
^ permalink raw reply
* Re: [RFC PATCH v4 00/19] Support socket access-control
From: Mickaël Salaün @ 2026-04-08 10:26 UTC (permalink / raw)
To: Mikhail Ivanov
Cc: gnoack, willemdebruijn.kernel, matthieu, linux-security-module,
netdev, netfilter-devel, yusongping, artem.kuzin,
konstantin.meskhidze
In-Reply-To: <20251118134639.3314803-1-ivanov.mikhail1@huawei-partners.com>
Hi Mikhail,
On Tue, Nov 18, 2025 at 09:46:20PM +0800, Mikhail Ivanov wrote:
> Hello! This is v4 RFC patch dedicated to socket protocols restriction.
>
> It is based on the landlock's mic-next branch on top of Linux 6.16-rc2
> kernel version.
>
> Objective
> =========
> Extend Landlock with a mechanism to restrict any set of protocols in
> a sandboxed process.
>
> Closes: https://github.com/landlock-lsm/linux/issues/6
>
> Motivation
> ==========
> Landlock implements the `LANDLOCK_RULE_NET_PORT` rule type, which provides
> fine-grained control of actions for a specific protocol. Any action or
> protocol that is not supported by this rule can not be controlled. As a
> result, protocols for which fine-grained control is not supported can be
> used in a sandboxed system and lead to vulnerabilities or unexpected
> behavior.
>
> Controlling the protocols used will allow to use only those that are
> necessary for the system and/or which have fine-grained Landlock control
> through others types of rules (e.g. TCP bind/connect control with
> `LANDLOCK_RULE_NET_PORT`, UNIX bind control with
> `LANDLOCK_RULE_PATH_BENEATH`).
>
> Consider following examples:
> * Server may want to use only TCP sockets for which there is fine-grained
> control of bind(2) and connect(2) actions [1].
> * System that does not need a network or that may want to disable network
> for security reasons (e.g. [2]) can achieve this by restricting the use
> of all possible protocols.
>
> [1] https://lore.kernel.org/all/ZJvy2SViorgc+cZI@google.com/
> [2] https://cr.yp.to/unix/disablenetwork.html
>
> Implementation
> ==============
> This patchset adds control over the protocols used by implementing a
> restriction of socket creation. This is possible thanks to the new type
> of rule - `LANDLOCK_RULE_SOCKET`, that allows to restrict actions on
> sockets, and a new access right - `LANDLOCK_ACCESS_SOCKET_CREATE`, that
> corresponds to user space sockets creation. The key in this rule
> corresponds to communication protocol signature from socket(2) syscall.
FYI, I sent a new patch series that adds a handled_perm field to
rulesets:
https://lore.kernel.org/all/20260312100444.2609563-6-mic@digikod.net/
See also the rationale:
https://lore.kernel.org/all/20260312100444.2609563-12-mic@digikod.net/
I think that would work well with the socket creation permission. WDYT?
Do you think you'll be able to continue this work or would you like me
or Günther to complete the remaining last bits (while of course keeping
you as the main author)?
>
> The right to create a socket is checked in the LSM hook which is called
> in the __sock_create method. The following user space operations are
> subject to this check: socket(2), socketpair(2), io_uring(7).
>
> `LANDLOCK_ACCESS_SOCKET_CREATE` does not restrict socket creation
> performed by accept(2), because created socket is used for messaging
> between already existing endpoints.
>
> Design discussion
> ===================
> 1. Should `SCTP_SOCKOPT_PEELOFF` and socketpair(2) be restricted?
>
> SCTP socket can be connected to a multiple endpoints (one-to-many
> relation). Calling setsockopt(2) on such socket with option
> `SCTP_SOCKOPT_PEELOFF` detaches one of existing connections to a separate
> UDP socket. This detach is currently restrictable.
>
> Same applies for the socketpair(2) syscall. It was noted that denying
> usage of socketpair(2) in sandboxed environment may be not meaninful [1].
>
> Currently both operations use general socket interface to create sockets.
> Therefore it's not possible to distinguish between socket(2) and those
> operations inside security_socket_create LSM hook which is currently
> used for protocols restriction. Providing such separation may require
> changes in socket layer (eg. in __sock_create) interface which may not be
> acceptable.
>
> [1] https://lore.kernel.org/all/ZurZ7nuRRl0Zf2iM@google.com/
>
> Code coverage
> =============
> Code coverage(gcov) report with the launch of all the landlock selftests:
> * security/landlock:
> lines......: 94.0% (1200 of 1276 lines)
> functions..: 95.0% (134 of 141 functions)
>
> * security/landlock/socket.c:
> lines......: 100.0% (56 of 56 lines)
> functions..: 100.0% (5 of 5 functions)
>
> Currently landlock-test-tools fails on mini.kernel_socket test due to lack
> of SMC protocol support.
>
> General changes v3->v4
> ======================
> * Implementation
> * Adds protocol field to landlock_socket_attr.
> * Adds protocol masks support via wildcards values in
> landlock_socket_attr.
> * Changes LSM hook used from socket_post_create to socket_create.
> * Changes protocol ranges acceptable by socket rules.
> * Adds audit support.
> * Changes ABI version to 8.
> * Tests
> * Adds 5 new tests:
> * mini.rule_with_wildcard, protocol_wildcard.access,
> mini.ruleset_with_wildcards_overlap:
> verify rulesets containing rules with wildcard values.
> * tcp_protocol.alias_restriction: verify that Landlock doesn't
> perform protocol mappings.
> * audit.socket_create: tests audit denial logging.
> * Squashes tests corresponding to Landlock rule adding to a single commit.
> * Documentation
> * Refactors Documentation/userspace-api/landlock.rst.
> * Commits
> * Rebases on mic-next.
> * Refactors commits.
>
> Previous versions
> =================
> v3: https://lore.kernel.org/all/20240904104824.1844082-1-ivanov.mikhail1@huawei-partners.com/
> v2: https://lore.kernel.org/all/20240524093015.2402952-1-ivanov.mikhail1@huawei-partners.com/
> v1: https://lore.kernel.org/all/20240408093927.1759381-1-ivanov.mikhail1@huawei-partners.com/
>
> Mikhail Ivanov (19):
> landlock: Support socket access-control
> selftests/landlock: Test creating a ruleset with unknown access
> selftests/landlock: Test adding a socket rule
> selftests/landlock: Testing adding rule with wildcard value
> selftests/landlock: Test acceptable ranges of socket rule key
> landlock: Add hook on socket creation
> selftests/landlock: Test basic socket restriction
> selftests/landlock: Test network stack error code consistency
> selftests/landlock: Test overlapped rulesets with rules of protocol
> ranges
> selftests/landlock: Test that kernel space sockets are not restricted
> selftests/landlock: Test protocol mappings
> selftests/landlock: Test socketpair(2) restriction
> selftests/landlock: Test SCTP peeloff restriction
> selftests/landlock: Test that accept(2) is not restricted
> lsm: Support logging socket common data
> landlock: Log socket creation denials
> selftests/landlock: Test socket creation denial log for audit
> samples/landlock: Support socket protocol restrictions
> landlock: Document socket rule type support
>
> Documentation/userspace-api/landlock.rst | 48 +-
> include/linux/lsm_audit.h | 8 +
> include/uapi/linux/landlock.h | 60 +-
> samples/landlock/sandboxer.c | 118 +-
> security/landlock/Makefile | 2 +-
> security/landlock/access.h | 3 +
> security/landlock/audit.c | 12 +
> security/landlock/audit.h | 1 +
> security/landlock/limits.h | 4 +
> security/landlock/ruleset.c | 37 +-
> security/landlock/ruleset.h | 46 +-
> security/landlock/setup.c | 2 +
> security/landlock/socket.c | 198 +++
> security/landlock/socket.h | 20 +
> security/landlock/syscalls.c | 61 +-
> security/lsm_audit.c | 4 +
> tools/testing/selftests/landlock/base_test.c | 2 +-
> tools/testing/selftests/landlock/common.h | 14 +
> tools/testing/selftests/landlock/config | 47 +
> tools/testing/selftests/landlock/net_test.c | 11 -
> .../selftests/landlock/protocols_define.h | 169 +++
> .../testing/selftests/landlock/socket_test.c | 1169 +++++++++++++++++
> 22 files changed, 1990 insertions(+), 46 deletions(-)
> create mode 100644 security/landlock/socket.c
> create mode 100644 security/landlock/socket.h
> create mode 100644 tools/testing/selftests/landlock/protocols_define.h
> create mode 100644 tools/testing/selftests/landlock/socket_test.c
>
>
> base-commit: 6dde339a3df80a57ac3d780d8cfc14d9262e2acd
> --
> 2.34.1
>
>
^ permalink raw reply
* Re: [PATCH v2] KEYS: trusted: Debugging as a feature
From: Jarkko Sakkinen @ 2026-04-08 8:29 UTC (permalink / raw)
To: Nayna Jain
Cc: linux-integrity, keyrings, Srish Srinivasan, James Bottomley,
Mimi Zohar, David Howells, Paul Moore, James Morris,
Serge E. Hallyn, Ahmad Fatoum, Pengutronix Kernel Team, open list,
open list:SECURITY SUBSYSTEM
In-Reply-To: <adYRURAJfNCu0FYB@kernel.org>
On Wed, Apr 08, 2026 at 11:27:01AM +0300, Jarkko Sakkinen wrote:
> On Mon, Apr 06, 2026 at 10:42:00PM -0400, Nayna Jain wrote:
> >
> > On 3/24/26 7:00 AM, Jarkko Sakkinen wrote:
> > > TPM_DEBUG, and other similar flags, are a non-standard way to specify a
> > > feature in Linux kernel. Introduce CONFIG_TRUSTED_KEYS_DEBUG for
> > > trusted keys, and use it to replace these ad-hoc feature flags.
> > >
> > > Given that trusted keys debug dumps can contain sensitive data, harden
> > > the feature as follows:
> > >
> > > 1. In the Kconfig description postulate that pr_debug() statements must be
> > > used.
> > > 2. Use pr_debug() statements in TPM 1.x driver to print the protocol dump.
> > >
> > > Traces, when actually needed, can be easily enabled by providing
> > > trusted.dyndbg='+p' in the kernel command-line.
> > >
> > > Cc: Srish Srinivasan <ssrish@linux.ibm.com>
> > > Reported-by: Nayna Jain <nayna@linux.ibm.com>
> > > Closes: https://lore.kernel.org/all/7f8b8478-5cd8-4d97-bfd0-341fd5cf10f9@linux.ibm.com/
> > > Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
> > > ---
> > > v2:
> > > - Implement for all trusted keys backends.
> > > - Add HAVE_TRUSTED_KEYS_DEBUG as it is a good practice despite full
> > > coverage.
> > > ---
> > > include/keys/trusted-type.h | 18 +++++-------
> > > security/keys/trusted-keys/Kconfig | 19 ++++++++++++
> > > security/keys/trusted-keys/trusted_caam.c | 4 +--
> > > security/keys/trusted-keys/trusted_tpm1.c | 36 +++++++++++------------
> > > 4 files changed, 46 insertions(+), 31 deletions(-)
> > >
> > > diff --git a/include/keys/trusted-type.h b/include/keys/trusted-type.h
> > > index 03527162613f..620a1f890b6b 100644
> > > --- a/include/keys/trusted-type.h
> > > +++ b/include/keys/trusted-type.h
> > > @@ -83,18 +83,16 @@ struct trusted_key_source {
> > > extern struct key_type key_type_trusted;
> > > -#define TRUSTED_DEBUG 0
> > > -
> > > -#if TRUSTED_DEBUG
> > > +#ifdef CONFIG_TRUSTED_KEYS_DEBUG
> > > static inline void dump_payload(struct trusted_key_payload *p)
> > > {
> > > - pr_info("key_len %d\n", p->key_len);
> > > - print_hex_dump(KERN_INFO, "key ", DUMP_PREFIX_NONE,
> > > - 16, 1, p->key, p->key_len, 0);
> > > - pr_info("bloblen %d\n", p->blob_len);
> > > - print_hex_dump(KERN_INFO, "blob ", DUMP_PREFIX_NONE,
> > > - 16, 1, p->blob, p->blob_len, 0);
> > > - pr_info("migratable %d\n", p->migratable);
> > > + pr_debug("key_len %d\n", p->key_len);
> > > + print_hex_dump_debug("key ", DUMP_PREFIX_NONE,
> > > + 16, 1, p->key, p->key_len, 0);
> > > + pr_debug("bloblen %d\n", p->blob_len);
> > > + print_hex_dump_debug("blob ", DUMP_PREFIX_NONE,
> > > + 16, 1, p->blob, p->blob_len, 0);
> > > + pr_debug("migratable %d\n", p->migratable);
> > > }
> > > #else
> > > static inline void dump_payload(struct trusted_key_payload *p)
> > > diff --git a/security/keys/trusted-keys/Kconfig b/security/keys/trusted-keys/Kconfig
> > > index 9e00482d886a..2ad9ba0e03f1 100644
> > > --- a/security/keys/trusted-keys/Kconfig
> > > +++ b/security/keys/trusted-keys/Kconfig
> > > @@ -1,10 +1,25 @@
> > > config HAVE_TRUSTED_KEYS
> > > bool
> > > +config HAVE_TRUSTED_KEYS_DEBUG
> > > + bool
> > > +
> > > +config TRUSTED_KEYS_DEBUG
> > > + bool "Debug trusted keys"
> > > + depends on HAVE_TRUSTED_KEYS_DEBUG
> > > + default n
> > > + help
> > > + Trusted keys backends and core code that support debug dumps
> > > + can opt-in that feature here. Dumps must only use DEBUG
> > > + level output, as sensitive data may pass by. In the
> > > + kernel-command line traces can be enabled via
> > > + trusted.dyndbg='+p'.
> >
> > Would it be good idea to add an explicit note/warning:
> >
> >
> > NOTE: This option is intended for debugging purposes only. Do not enable on
> > production systems as debug output may expose sensitive cryptographic
> > material.
> > If you are unsure, say N.
> >
> > Apart from this, looks good to me.
> >
> > Reviewed-by: Nayna Jain <nayna@linux.ibm.com>
>
> Thank, I'll add your tag but would you mind quickly screening v3 again
> where I add "trusted.debug=0|1". And yes, your suggestion about extra
> warning makes sense.
>
> Let's make this safe as possible. Mistakes do happen... and then those
> measures pay off :-)
E.g., in 2026 world perfectly realistic scenario is "agentic devops
team" (unfortunately), which might debug trusted keys issue, and leave
debug flag on. Thus, both warning you suggested and also boot option
for good measure do actually leverage risks involved.
BR, Jarkko
^ permalink raw reply
* Re: [PATCH v2] KEYS: trusted: Debugging as a feature
From: Jarkko Sakkinen @ 2026-04-08 8:26 UTC (permalink / raw)
To: Nayna Jain
Cc: linux-integrity, keyrings, Srish Srinivasan, James Bottomley,
Mimi Zohar, David Howells, Paul Moore, James Morris,
Serge E. Hallyn, Ahmad Fatoum, Pengutronix Kernel Team, open list,
open list:SECURITY SUBSYSTEM
In-Reply-To: <afc489d2-a62f-4604-8e56-219311b46516@linux.ibm.com>
On Mon, Apr 06, 2026 at 10:42:00PM -0400, Nayna Jain wrote:
>
> On 3/24/26 7:00 AM, Jarkko Sakkinen wrote:
> > TPM_DEBUG, and other similar flags, are a non-standard way to specify a
> > feature in Linux kernel. Introduce CONFIG_TRUSTED_KEYS_DEBUG for
> > trusted keys, and use it to replace these ad-hoc feature flags.
> >
> > Given that trusted keys debug dumps can contain sensitive data, harden
> > the feature as follows:
> >
> > 1. In the Kconfig description postulate that pr_debug() statements must be
> > used.
> > 2. Use pr_debug() statements in TPM 1.x driver to print the protocol dump.
> >
> > Traces, when actually needed, can be easily enabled by providing
> > trusted.dyndbg='+p' in the kernel command-line.
> >
> > Cc: Srish Srinivasan <ssrish@linux.ibm.com>
> > Reported-by: Nayna Jain <nayna@linux.ibm.com>
> > Closes: https://lore.kernel.org/all/7f8b8478-5cd8-4d97-bfd0-341fd5cf10f9@linux.ibm.com/
> > Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
> > ---
> > v2:
> > - Implement for all trusted keys backends.
> > - Add HAVE_TRUSTED_KEYS_DEBUG as it is a good practice despite full
> > coverage.
> > ---
> > include/keys/trusted-type.h | 18 +++++-------
> > security/keys/trusted-keys/Kconfig | 19 ++++++++++++
> > security/keys/trusted-keys/trusted_caam.c | 4 +--
> > security/keys/trusted-keys/trusted_tpm1.c | 36 +++++++++++------------
> > 4 files changed, 46 insertions(+), 31 deletions(-)
> >
> > diff --git a/include/keys/trusted-type.h b/include/keys/trusted-type.h
> > index 03527162613f..620a1f890b6b 100644
> > --- a/include/keys/trusted-type.h
> > +++ b/include/keys/trusted-type.h
> > @@ -83,18 +83,16 @@ struct trusted_key_source {
> > extern struct key_type key_type_trusted;
> > -#define TRUSTED_DEBUG 0
> > -
> > -#if TRUSTED_DEBUG
> > +#ifdef CONFIG_TRUSTED_KEYS_DEBUG
> > static inline void dump_payload(struct trusted_key_payload *p)
> > {
> > - pr_info("key_len %d\n", p->key_len);
> > - print_hex_dump(KERN_INFO, "key ", DUMP_PREFIX_NONE,
> > - 16, 1, p->key, p->key_len, 0);
> > - pr_info("bloblen %d\n", p->blob_len);
> > - print_hex_dump(KERN_INFO, "blob ", DUMP_PREFIX_NONE,
> > - 16, 1, p->blob, p->blob_len, 0);
> > - pr_info("migratable %d\n", p->migratable);
> > + pr_debug("key_len %d\n", p->key_len);
> > + print_hex_dump_debug("key ", DUMP_PREFIX_NONE,
> > + 16, 1, p->key, p->key_len, 0);
> > + pr_debug("bloblen %d\n", p->blob_len);
> > + print_hex_dump_debug("blob ", DUMP_PREFIX_NONE,
> > + 16, 1, p->blob, p->blob_len, 0);
> > + pr_debug("migratable %d\n", p->migratable);
> > }
> > #else
> > static inline void dump_payload(struct trusted_key_payload *p)
> > diff --git a/security/keys/trusted-keys/Kconfig b/security/keys/trusted-keys/Kconfig
> > index 9e00482d886a..2ad9ba0e03f1 100644
> > --- a/security/keys/trusted-keys/Kconfig
> > +++ b/security/keys/trusted-keys/Kconfig
> > @@ -1,10 +1,25 @@
> > config HAVE_TRUSTED_KEYS
> > bool
> > +config HAVE_TRUSTED_KEYS_DEBUG
> > + bool
> > +
> > +config TRUSTED_KEYS_DEBUG
> > + bool "Debug trusted keys"
> > + depends on HAVE_TRUSTED_KEYS_DEBUG
> > + default n
> > + help
> > + Trusted keys backends and core code that support debug dumps
> > + can opt-in that feature here. Dumps must only use DEBUG
> > + level output, as sensitive data may pass by. In the
> > + kernel-command line traces can be enabled via
> > + trusted.dyndbg='+p'.
>
> Would it be good idea to add an explicit note/warning:
>
>
> NOTE: This option is intended for debugging purposes only. Do not enable on
> production systems as debug output may expose sensitive cryptographic
> material.
> If you are unsure, say N.
>
> Apart from this, looks good to me.
>
> Reviewed-by: Nayna Jain <nayna@linux.ibm.com>
Thank, I'll add your tag but would you mind quickly screening v3 again
where I add "trusted.debug=0|1". And yes, your suggestion about extra
warning makes sense.
Let's make this safe as possible. Mistakes do happen... and then those
measures pay off :-)
BR, Jarkko
^ permalink raw reply
* Re: [PATCH v2] KEYS: trusted: Debugging as a feature
From: Jarkko Sakkinen @ 2026-04-08 8:24 UTC (permalink / raw)
To: Srish Srinivasan
Cc: linux-integrity, keyrings, Nayna Jain, James Bottomley,
Mimi Zohar, David Howells, Paul Moore, James Morris,
Serge E. Hallyn, Ahmad Fatoum, Pengutronix Kernel Team, open list,
open list:SECURITY SUBSYSTEM
In-Reply-To: <0ce8d850-9ca7-4327-a6be-d1cb84925915@linux.ibm.com>
On Thu, Mar 26, 2026 at 10:34:58PM +0530, Srish Srinivasan wrote:
>
> On 3/24/26 4:30 PM, Jarkko Sakkinen wrote:
> > TPM_DEBUG, and other similar flags, are a non-standard way to specify a
> > feature in Linux kernel. Introduce CONFIG_TRUSTED_KEYS_DEBUG for
> > trusted keys, and use it to replace these ad-hoc feature flags.
> >
> > Given that trusted keys debug dumps can contain sensitive data, harden
> > the feature as follows:
> >
> > 1. In the Kconfig description postulate that pr_debug() statements must be
> > used.
> > 2. Use pr_debug() statements in TPM 1.x driver to print the protocol dump.
> >
> > Traces, when actually needed, can be easily enabled by providing
> > trusted.dyndbg='+p' in the kernel command-line.
> >
> > Cc: Srish Srinivasan <ssrish@linux.ibm.com>
> > Reported-by: Nayna Jain <nayna@linux.ibm.com>
> > Closes: https://lore.kernel.org/all/7f8b8478-5cd8-4d97-bfd0-341fd5cf10f9@linux.ibm.com/
> > Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
>
>
> Tested on PKWM and emulated TPM backends.
>
> Tested-by: Srish Srinivasan <ssrish@linux.ibm.com>
Thank you!
As it is uprised as a feature (like it should as ad-hoc compilation
flags are harmful), this also requires a boot flag so that "I know
what I'm doing" is addressed.
I'll send one more round with a flag 'trusted.debug=0|1'. These extra
steps protect production kernels for reasonable measure.
BR, Jarkko
^ permalink raw reply
* Re: [RFC PATCH 00/20] BPF interface for applying Landlock rulesets
From: Ihor Solodrai @ 2026-04-08 4:40 UTC (permalink / raw)
To: Justin Suess, ast, daniel, andrii, kpsingh, paul, mic, viro,
brauner, kees
Cc: gnoack, jack, jmorris, serge, song, yonghong.song, martin.lau, m,
eddyz87, john.fastabend, sdf, skhan, bpf, linux-security-module,
linux-kernel, linux-fsdevel
In-Reply-To: <20260407200157.3874806-1-utilityemal77@gmail.com>
On 4/7/26 1:01 PM, Justin Suess wrote:
> Hello,
>
> This series lets sleepable BPF LSM programs apply an existing,
> userspace-created Landlock ruleset to a program during exec.
>
> The goal is not to move Landlock policy definition into BPF, nor to create a
> second policy engine. Instead, BPF is used only to select when an already
> valid Landlock ruleset should be applied, based on runtime exec context.
>
> Background
> ===
>
> Landlock is primarily a syscall-driven, unprivileged-first LSM. That model
> works well when the application being sandboxed can create and enforce its own
> rulesets, or when a trusted launcher can impose restrictions directly before
> running a trusted target.
>
> That becomes harder when the target program is not under first-party control,
> for example:
>
> 1. third-party binaries,
> 2. unmodified container images,
> 3. programs reached through shells, wrappers, or service managers, and
> 4. user-supplied or otherwise untrusted code.
>
> In these cases, an external supervisor may want to apply a Landlock ruleset to
> the final executed program, while leaving unrelated parents or helper
> processes alone.
>
> Why external sandboxing is awkward today
> ===
>
> There are two recurring problems.
>
> First, userspace cannot reliably predict every file a target may need across
> different systems, packaging layouts, and runtime conditions. Shared
> libraries, configuration files, interpreters, and helper binaries often depend
> on details that are only known at runtime.
>
> Second, Landlock inheritance is intentionally one-way. Once a task is
> restricted, descendants inherit that domain and may only become more
> restricted. This is exactly what Landlock should do, but it makes external
> sandboxing awkward when the program of interest is buried inside a larger exec
> chain. Applying restrictions too early can affect unrelated intermediates;
> applying them too late misses the target entirely.
>
> This series addresses that target-selection problem.
>
> Overview
> ===
>
> This series adds a small BPF-to-Landlock bridge:
>
> 1. userspace creates a normal Landlock ruleset through the existing ABI;
> 2. userspace inserts that ruleset FD into a new
> BPF_MAP_TYPE_LANDLOCK_RULESET map;
> 3. a sleepable BPF LSM program attached to an exec-time hook looks up the
> ruleset; and
> 4. the program calls a kfunc to apply that ruleset to the new program's
> credentials before exec completes.
>
> The important point is that BPF does not create, inspect, or mutate Landlock
> policy here. It only decides whether to apply a ruleset that was already
> created and validated through Landlock's existing userspace API.
>
> Interface
> ===
>
> The series adds:
>
> 1. bpf_landlock_restrict_binprm(), which applies a referenced ruleset to
> struct linux_binprm credentials;
> 2. bpf_landlock_put_ruleset(), which releases a referenced ruleset; and
> 3. BPF_MAP_TYPE_LANDLOCK_RULESET, a specialized map type for holding
> references to Landlock rulesets originating from userspace file
> descriptors.
> 4. A new field in the linux_binprm struct to enable application of
> task_set_no_new_privs once execution is beyond the point of no return.
>
> The kfuncs are restricted to sleepable BPF LSM programs attached to
> bprm_creds_for_exec and bprm_creds_from_file, which are the points where the
> new program's credentials may still be updated safely.
>
> This series also adds LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS. On the BPF path,
> this is staged through the exec context and committed only after exec reaches
> point-of-no-return. This avoids side effects on failed executions while
> ensuring that the resulting task cannot gain more privileges through later exec
> transitions. This is done through the set_nnp_on_point_of_no_return field.
>
> This has a little subtlety: LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS in the BPF
> path will not stop the current execution from escalating at all; only subsequent
> ones. This is intentional to allow landlock policies to be applied through a
> setuid transition for instance, without affecting the current escalation.
>
> Semantics
> ===
>
> This proposal is intended to preserve Landlock semantics as much as practical
> for an exec-time BPF attachment model:
>
> 1. only pre-existing Landlock rulesets may be applied;
> 2. BPF cannot construct, inspect, or modify rulesets;
> 3. enforcement still happens before the new program begins execution;
> 4. normal Landlock inheritance, layering, and future composition remain
> unchanged; and
> 5. this does not bypass Landlock's privilege checks for applying Landlock
> rulesets.
>
> In other words, BPF acts as an external selector for when to apply Landlock,
> not as a replacement for Landlock's enforcement engine.
>
> All behavior, future access rights, and previous access rights are designed
> to automatically be supported from either BPF or existing syscall contexts.
>
> The main semantic difference is LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS on the BPF
> path: it guarantees that the resulting task is pinned with no_new_privs before
> it can perform later exec transitions, but it does not retroactively suppress
> privilege gain for the current exec transition itself.
>
> The other exception to semantics is the LANDLOCK_RESTRICT_SELF_TSYNC flag.
> (see Points of Feedback section)
>
> Patch layout
> ===
>
> Patches 1-5 prepare the Landlock side by moving shared ruleset logic out of
> syscalls.c, adding a no_new_privs flag for non-syscall callers, exposing
> linux_binprm->set_nnp_on_point_of_no_return as an interface to set no_new_privs
> on the point of no return, and making deferred ruleset destruction RCU-safe.
>
> Patches 6-10 add the BPF-facing pieces: the Landlock kfuncs, the new map type,
> syscall handling for that map, and verifier support.
>
> Patches 11-15 add selftests and the small bpftool update needed for the new
> map type.
>
> Patches 16-20 add docs and bump the ABI version and update MAINTAINERS.
>
> Feedback is especially welcome on the overall interface shape, the choice of
> hooks, and the map semantics.
>
> Testing
> ===
>
> This patch series has two portions of tests.
>
> One lives in the traditional Landlock selftests, for the new
> LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS flag.
>
> The other suite lives under the BPF selftests, and this tests the Landlock
> kfuncs and the new BPF_MAP_TYPE_LANDLOCK_RULESET.
>
> This patch series was run through BPF CI, the results of which are here. [1]
>
> All mentioned tests are passing, as well as the BPF CI.
>
> [1] : https://github.com/kernel-patches/bpf/pull/11562
Hello Justin.
I regret to disappoint you with a lame piece of feedback, but the
series hasn't been picked up by automated BPF CI pipeline properly:
https://github.com/kernel-patches/bpf/pull/11709
I suggest you rebase on top of bpf-next/master [1], and re-submit to
the mailing list with a bpf-next tag in subject:
"[RFC PATCH bpf-next ...] bpf: ..."
I'm pretty sure AI bot will find something annoying to address.
Other than that, please be patient. It'll probably take a while for
maintainers and reviewers to digest this work before anyone can
meaningfully comment. Thanks!
[1] https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/
>
> Points of Feedback
> ===
>
> First, the new set_nnp_on_point_of_no_return field in struct linux_binprm.
> This field was needed to request that task_set_no_new_privs be set during an
> execution, but only after the execution has proceeded beyond the point of no
> return. I couldn't find a way to express this semantic without adding a new
> bitfield to struct linux_binprm and a conditional in fs/exec.c. Please see
> patch 2.
>
> Feedback on the BPF testing harness, which was generated with AI assistance as
> disclosed in the commit footer, is welcomed. I have only limited familiarity
> with BPF testing practices. These tests were made with strong human supervision.
> See patches 14 and 15.
>
> Feedback on the NO_NEW_PRIVS situation is also welcomed. Because task_set_no_new_privs()
> would otherwise leak state on failed executions or AT_EXECVE_CHECK, this series
> stages no_new_privs through the exec context and only commits it after
> point-of-no-return. This preserves failure behavior while still ensuring that
> the resulting task cannot elevate further through later exec transitions.
> When called from bprm_creds_from_file, this does not retroactively change the
> privilege outcome of the current exec transition itself.
>
> See patch 2 and 3.
>
> Next, the RCU in the landlock_ruleset. Existing BPF maps use RCU to make sure maps
> holding references stay valid. I altered the landlock ruleset to use rcu_work
> to make sure that the rcu is synchronized before putting on a ruleset, and
> acquire the rcu in the arraymap implementation. See patches 5-10.
>
> Next, the semantics of the map. What operations should be supported from BPF
> and userspace and what data types should they return? I consider the struct
> bpf_landlock_ruleset to be opaque. Userspace can add items to the map via the
> fd, delete items by their index, and BPF can delete and lookup items by their
> index. Items cannot be updated, only swapped.
>
> Finally, the handling of the LANDLOCK_RESTRICT_SELF_TSYNC flag. This flag has
> no meaning in a pre-execution context, as the credentials during the designated
> LSM hooks (bprm_creds_for_exec/creds_from_file) still represent the pre-execution
> task. Therefore, this flag is invalidated and attempting to use it with
> bpf_landlock_restrict_binprm will return -EINVAL. Otherwise, the flag would
> result in applying the landlock ruleset to the wrong target in addition to the
> intended one. (see patch 2). This behavior is validated with selftests.
>
> Existing works / Credits
> ===
>
> Mickaël Salaün created patchsets adding BPF tracepoints for landlock in [2] [3].
>
> Mickaël also gave feedback on this feature and the idea in this GitHub thread. [4]
>
> Günther Noack initially received and provided initial feedback on this idea as
> an early prototype.
>
> Liz Rice, author of "Learning eBPF: Programming the Linux Kernel for Enhanced
> Observability, Networking, and Security" provided background and inspired me to
> experiment with BPF and the BPF LSM. [5]
>
> [2] : https://lore.kernel.org/all/20250523165741.693976-1-mic@digikod.net/
> [3] : https://lore.kernel.org/linux-security-module/20260406143717.1815792-1-mic@digikod.net/
> [4] : https://github.com/landlock-lsm/linux/issues/56
> [5] : https://wellesleybooks.com/book/9781098135126
>
> Kind Regards,
> Justin Suess
>
> Justin Suess (20):
> landlock: Move operations from syscall into ruleset code
> execve: Add set_nnp_on_point_of_no_return
> landlock: Implement LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS
> selftests/landlock: Cover LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS
> landlock: Make ruleset deferred free RCU safe
> bpf: lsm: Add Landlock kfuncs
> bpf: arraymap: Implement Landlock ruleset map
> bpf: Add Landlock ruleset map type
> bpf: syscall: Handle Landlock ruleset maps
> bpf: verifier: Add Landlock ruleset map support
> selftests/bpf: Add Landlock kfunc declarations
> selftests/landlock: Rename gettid wrapper for BPF reuse
> selftests/bpf: Enable Landlock in selftests kernel.
> selftests/bpf: Add Landlock kfunc test program
> selftests/bpf: Add Landlock kfunc test runner
> landlock: Bump ABI version
> tools: bpftool: Add documentation for landlock_ruleset
> landlock: Document LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS
> bpf: Document BPF_MAP_TYPE_LANDLOCK_RULESET
> MAINTAINERS: update entry for the Landlock subsystem
>
> Documentation/bpf/map_landlock_ruleset.rst | 181 +++++
> Documentation/userspace-api/landlock.rst | 22 +-
> MAINTAINERS | 4 +
> fs/exec.c | 8 +
> include/linux/binfmts.h | 7 +-
> include/linux/bpf_lsm.h | 15 +
> include/linux/bpf_types.h | 1 +
> include/linux/landlock.h | 92 +++
> include/uapi/linux/bpf.h | 1 +
> include/uapi/linux/landlock.h | 14 +
> kernel/bpf/arraymap.c | 67 ++
> kernel/bpf/bpf_lsm.c | 145 ++++
> kernel/bpf/syscall.c | 4 +-
> kernel/bpf/verifier.c | 15 +-
> samples/landlock/sandboxer.c | 7 +-
> security/landlock/limits.h | 2 +-
> security/landlock/ruleset.c | 198 ++++-
> security/landlock/ruleset.h | 25 +-
> security/landlock/syscalls.c | 158 +---
> .../bpf/bpftool/Documentation/bpftool-map.rst | 2 +-
> tools/bpf/bpftool/map.c | 2 +-
> tools/include/uapi/linux/bpf.h | 1 +
> tools/lib/bpf/libbpf.c | 1 +
> tools/lib/bpf/libbpf_probes.c | 6 +
> tools/testing/selftests/bpf/bpf_kfuncs.h | 20 +
> tools/testing/selftests/bpf/config | 5 +
> tools/testing/selftests/bpf/config.x86_64 | 1 -
> .../bpf/prog_tests/landlock_kfuncs.c | 733 ++++++++++++++++++
> .../selftests/bpf/progs/landlock_kfuncs.c | 92 +++
> tools/testing/selftests/landlock/base_test.c | 10 +-
> tools/testing/selftests/landlock/common.h | 28 +-
> tools/testing/selftests/landlock/fs_test.c | 103 +--
> tools/testing/selftests/landlock/net_test.c | 55 +-
> .../testing/selftests/landlock/ptrace_test.c | 14 +-
> .../landlock/scoped_abstract_unix_test.c | 51 +-
> .../selftests/landlock/scoped_base_variants.h | 23 +
> .../selftests/landlock/scoped_common.h | 5 +-
> .../selftests/landlock/scoped_signal_test.c | 30 +-
> tools/testing/selftests/landlock/wrappers.h | 2 +-
> 39 files changed, 1877 insertions(+), 273 deletions(-)
> create mode 100644 Documentation/bpf/map_landlock_ruleset.rst
> create mode 100644 include/linux/landlock.h
> create mode 100644 tools/testing/selftests/bpf/prog_tests/landlock_kfuncs.c
> create mode 100644 tools/testing/selftests/bpf/progs/landlock_kfuncs.c
>
>
> base-commit: 8c6a27e02bc55ab110d1828610048b19f903aaec
^ permalink raw reply
* Re: [PATCH v4 3/3] selinux: fix overlayfs mmap() and mprotect() access checks
From: Paul Moore @ 2026-04-07 20:21 UTC (permalink / raw)
To: Stephen Smalley
Cc: Ondrej Mosnacek, linux-security-module, selinux, linux-fsdevel,
linux-unionfs, linux-erofs, Amir Goldstein, Gao Xiang,
Christian Brauner
In-Reply-To: <CAEjxPJ62=0v9QYJ6s0DrwRp4WZna8f9wnuM_DUUNrcz2dd_kog@mail.gmail.com>
On Tue, Apr 7, 2026 at 3:20 PM Stephen Smalley
<stephen.smalley.work@gmail.com> wrote:
> On Tue, Apr 7, 2026 at 10:35 AM Paul Moore <paul@paul-moore.com> wrote:
> > On Tue, Apr 7, 2026 at 8:14 AM Stephen Smalley
> > <stephen.smalley.work@gmail.com> wrote:
> > > On Thu, Apr 2, 2026 at 11:09 PM Paul Moore <paul@paul-moore.com> wrote:
> > > >
> > > > The existing SELinux security model for overlayfs is to allow access if
> > > > the current task is able to access the top level file (the "user" file)
> > > > and the mounter's credentials are sufficient to access the lower
> > > > level file (the "backing" file). Unfortunately, the current code does
> > > > not properly enforce these access controls for both mmap() and mprotect()
> > > > operations on overlayfs filesystems.
> > > >
> > > > This patch makes use of the newly created security_mmap_backing_file()
> > > > LSM hook to provide the missing backing file enforcement for mmap()
> > > > operations, and leverages the backing file API and new LSM blob to
> > > > provide the necessary information to properly enforce the mprotect()
> > > > access controls.
> > > >
> > > > Cc: stable@vger.kernel.org
> > > > Signed-off-by: Paul Moore <paul@paul-moore.com>
> > >
> > > Do you have tests for these changes showing the before and after (i.e.
> > > failing without your patches, passing with them)? I tried running an
> > > earlier set from Ondrej but they failed.
> >
> > A few months ago I sent you and Ondrej some feedback on those early
> > tests from Ondrej, but yes, I also had problems with Ondrej's tests.
> > I've been using a hacked up combination of the existing tests, some of
> > Ondrej's additions, and an additional debug/test patch to ensure the
> > labeling is correct. It's far from ideal, but I didn't invest time in
> > test development as I assumed Ondrej would continue his efforts there
> > (unfortunately it doesn't appear that he has?), and I wanted to focus
> > on getting a solution as soon as possible for obvious reasons.
>
> Ok, I'm happy to look at even unpolished tests - just want something I
> can use to exercise the before and after states.
Hopefully Ondrej can provide an updated patch.
--
paul-moore.com
^ permalink raw reply
* [RFC PATCH 20/20] MAINTAINERS: update entry for the Landlock subsystem
From: Justin Suess @ 2026-04-07 20:01 UTC (permalink / raw)
To: ast, daniel, andrii, kpsingh, paul, mic, viro, brauner, kees
Cc: gnoack, jack, jmorris, serge, song, yonghong.song, martin.lau, m,
eddyz87, john.fastabend, sdf, skhan, bpf, linux-security-module,
linux-kernel, linux-fsdevel, Justin Suess
In-Reply-To: <20260407200157.3874806-1-utilityemal77@gmail.com>
Update the maintainers file to reflect the new selftest files,
cross-subsystem, documentation, and kernel-internal Landlock headers.
Signed-off-by: Justin Suess <utilityemal77@gmail.com>
---
MAINTAINERS | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/MAINTAINERS b/MAINTAINERS
index c3fe46d7c4bc..e9ad2ed1237a 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -14386,12 +14386,16 @@ S: Supported
W: https://landlock.io
T: git https://git.kernel.org/pub/scm/linux/kernel/git/mic/linux.git
F: Documentation/admin-guide/LSM/landlock.rst
+F: Documentation/bpf/map_landlock_ruleset.rst
F: Documentation/security/landlock.rst
F: Documentation/userspace-api/landlock.rst
F: fs/ioctl.c
+F: include/linux/landlock.h
F: include/uapi/linux/landlock.h
F: samples/landlock/
F: security/landlock/
+F: tools/testing/selftests/bpf/prog_tests/landlock_kfuncs.c
+F: tools/testing/selftests/bpf/progs/landlock_kfuncs.c
F: tools/testing/selftests/landlock/
K: landlock
K: LANDLOCK
--
2.53.0
^ permalink raw reply related
* [RFC PATCH 19/20] bpf: Document BPF_MAP_TYPE_LANDLOCK_RULESET
From: Justin Suess @ 2026-04-07 20:01 UTC (permalink / raw)
To: ast, daniel, andrii, kpsingh, paul, mic, viro, brauner, kees
Cc: gnoack, jack, jmorris, serge, song, yonghong.song, martin.lau, m,
eddyz87, john.fastabend, sdf, skhan, bpf, linux-security-module,
linux-kernel, linux-fsdevel, Justin Suess
In-Reply-To: <20260407200157.3874806-1-utilityemal77@gmail.com>
Document the BPF_MAP_TYPE_LANDLOCK_RULESET map type and explain the
kfuncs it is associated with.
Signed-off-by: Justin Suess <utilityemal77@gmail.com>
---
Documentation/bpf/map_landlock_ruleset.rst | 181 +++++++++++++++++++++
1 file changed, 181 insertions(+)
create mode 100644 Documentation/bpf/map_landlock_ruleset.rst
diff --git a/Documentation/bpf/map_landlock_ruleset.rst b/Documentation/bpf/map_landlock_ruleset.rst
new file mode 100644
index 000000000000..90f3141a829b
--- /dev/null
+++ b/Documentation/bpf/map_landlock_ruleset.rst
@@ -0,0 +1,181 @@
+.. SPDX-License-Identifier: GPL-2.0-only
+
+==============================
+BPF_MAP_TYPE_LANDLOCK_RULESET
+==============================
+
+``BPF_MAP_TYPE_LANDLOCK_RULESET`` is a specialized, array-backed map for
+holding references to Landlock rulesets that were created from userspace.
+It is meant to bridge BPF LSM policy selection with Landlock policy
+enforcement: userspace creates a normal Landlock ruleset, inserts its file
+descriptor into the map, and a BPF LSM program later looks up that ruleset and
+applies it with a Landlock kfunc during ``execve()`` preparation.
+
+BPF programs cannot create, inspect, or modify Landlock policy through this
+map. The looked-up object is exposed only as an opaque
+``struct bpf_landlock_ruleset`` reference.
+
+The map uses ``__u32`` keys as array indexes and stores one ruleset reference
+per slot. Like other array maps, its size is fixed at creation time and its
+elements are preallocated.
+
+Usage
+=====
+
+Kernel BPF
+----------
+
+.. note::
+ This map type is only supported for BPF LSM programs. In practice, it is
+ useful for sleepable BPF LSM programs attached to
+ ``bprm_creds_for_exec`` or ``bprm_creds_from_file``, because those are the
+ hooks where the associated Landlock kfuncs are available.
+
+bpf_map_lookup_elem()
+~~~~~~~~~~~~~~~~~~~~~
+
+.. code-block:: c
+
+ void *bpf_map_lookup_elem(struct bpf_map *map, const void *key)
+
+Lookup returns a trusted pointer to an opaque ``struct bpf_landlock_ruleset``.
+The verifier treats the result as a referenced BTF object, not as a pointer to
+the raw ``__u32`` map value declared in the map definition.
+
+Each successful lookup acquires a ruleset reference. The BPF program must
+release that reference with ``bpf_landlock_put_ruleset()`` on all paths after
+the lookup succeeds.
+
+The returned pointer is intended to be passed to
+``bpf_landlock_restrict_binprm()``. It is opaque and cannot be dereferenced
+or inspected from BPF.
+
+bpf_map_delete_elem()
+~~~~~~~~~~~~~~~~~~~~~
+
+.. code-block:: c
+
+ long bpf_map_delete_elem(struct bpf_map *map, const void *key)
+
+Delete removes the ruleset reference stored in the selected slot and drops the
+map's own reference to that ruleset.
+
+Landlock kfuncs
+---------------
+
+The map contains objects designed to work with the following Landlock kfuncs:
+
+.. code-block:: c
+
+ void bpf_landlock_put_ruleset(const struct bpf_landlock_ruleset *ruleset)
+
+.. code-block:: c
+
+ int bpf_landlock_restrict_binprm(struct linux_binprm *bprm,
+ const struct bpf_landlock_ruleset *ruleset,
+ __u32 flags)
+
+``bpf_landlock_restrict_binprm()`` applies the looked-up ruleset to the new
+program credentials that are being prepared for ``execve()``. The ``flags``
+argument uses the same Landlock restriction flags as
+``landlock_restrict_self()``, including ``LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS``.
+When this flag is used from BPF, ``no_new_privs`` is staged through the exec
+context and committed only after exec reaches point-of-no-return. This avoids
+side effects on failed executions or ``AT_EXECVE_CHECK`` while ensuring that
+the resulting task cannot gain more privileges through later exec transitions.
+
+Userspace
+---------
+
+bpf_map_update_elem()
+~~~~~~~~~~~~~~~~~~~~~
+
+.. code-block:: c
+
+ int bpf_map_update_elem(int fd, const void *key, const void *value, __u64 flags)
+
+Userspace populates the map by writing a Landlock ruleset file descriptor into
+the selected slot. The map uses FD-array update semantics:
+
+- ``key`` points to a ``__u32`` array index.
+- ``value`` points to a ``__u32`` containing the ruleset file descriptor.
+- ``flags`` must be ``BPF_ANY``.
+
+The supplied file descriptor must refer to a valid Landlock ruleset.
+
+Userspace lookup of map contents is not supported for this map type.
+
+Example
+=======
+
+Kernel BPF
+----------
+
+The following snippet shows a sleepable BPF LSM program that looks up a
+ruleset, applies it during exec credential preparation, and releases the
+lookup reference.
+
+.. code-block:: c
+
+ struct {
+ __uint(type, BPF_MAP_TYPE_LANDLOCK_RULESET);
+ __uint(max_entries, 1);
+ __type(key, __u32);
+ __type(value, __u32);
+ } ruleset_map SEC(".maps");
+
+ SEC("lsm.s/bprm_creds_for_exec")
+ int BPF_PROG(apply_ruleset, struct linux_binprm *bprm)
+ {
+ const struct bpf_landlock_ruleset *ruleset;
+ __u32 key = 0;
+
+ ruleset = bpf_map_lookup_elem(&ruleset_map, &key);
+ if (!ruleset)
+ return 0;
+
+ bpf_landlock_restrict_binprm(
+ bprm, ruleset, LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS);
+ bpf_landlock_put_ruleset(ruleset);
+ return 0;
+ }
+
+Userspace
+---------
+
+The following snippet shows how to insert a previously created Landlock
+ruleset into the map.
+
+.. code-block:: c
+
+ int populate_ruleset_map(int map_fd, int ruleset_fd)
+ {
+ __u32 key = 0;
+ __u32 value = ruleset_fd;
+
+ return bpf_map_update_elem(map_fd, &key, &value, BPF_ANY);
+ }
+
+Semantics
+=========
+
+- Map creation requires ``CONFIG_SECURITY_LANDLOCK``. Otherwise,
+ ``BPF_MAP_CREATE`` for this type fails with ``-EOPNOTSUPP``.
+- Map definitions use ``sizeof(__u32)`` for both keys and values because
+ userspace writes ruleset file descriptors into the map.
+- From BPF, only ``bpf_map_lookup_elem()`` and ``bpf_map_delete_elem()`` are
+ supported for this map type.
+- From userspace, insertion is done with ``bpf_map_update_elem()`` using a
+ Landlock ruleset FD.
+- The looked-up value is an opaque, trusted BTF object reference, so BPF must
+ treat it as a handle and release it with ``bpf_landlock_put_ruleset()``.
+- ``LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS`` on the BPF path pins the resulting
+ task with ``no_new_privs`` after exec is committed. When used from
+ ``bprm_creds_from_file``, this does not retroactively suppress privilege gain
+ for the current exec transition itself.
+- If Landlock support is disabled in the running kernel, programs using the
+ associated Landlock kfuncs may still load, but the kfunc call returns
+ ``-EOPNOTSUPP`` at runtime.
+
+See ``tools/testing/selftests/bpf/progs/landlock_kfuncs.c`` for a complete
+example.
--
2.53.0
^ permalink raw reply related
* [RFC PATCH 18/20] landlock: Document LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS
From: Justin Suess @ 2026-04-07 20:01 UTC (permalink / raw)
To: ast, daniel, andrii, kpsingh, paul, mic, viro, brauner, kees
Cc: gnoack, jack, jmorris, serge, song, yonghong.song, martin.lau, m,
eddyz87, john.fastabend, sdf, skhan, bpf, linux-security-module,
linux-kernel, linux-fsdevel, Justin Suess
In-Reply-To: <20260407200157.3874806-1-utilityemal77@gmail.com>
Document the new LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS flag, and explain
how its designed primarily for BPF-side use cases for Landlock.
Signed-off-by: Justin Suess <utilityemal77@gmail.com>
---
Documentation/userspace-api/landlock.rst | 22 ++++++++++++++++++++--
1 file changed, 20 insertions(+), 2 deletions(-)
diff --git a/Documentation/userspace-api/landlock.rst b/Documentation/userspace-api/landlock.rst
index fd8b78c31f2f..82c88d75ef21 100644
--- a/Documentation/userspace-api/landlock.rst
+++ b/Documentation/userspace-api/landlock.rst
@@ -204,7 +204,8 @@ similar backwards compatibility check is needed for the restrict flags
__u32 restrict_flags =
LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON |
- LANDLOCK_RESTRICT_SELF_TSYNC;
+ LANDLOCK_RESTRICT_SELF_TSYNC |
+ LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS;
switch (abi) {
case 1 ... 6:
/* Removes logging flags for ABI < 7 */
@@ -223,10 +224,18 @@ similar backwards compatibility check is needed for the restrict flags
* children (and not for all threads, including parents and siblings).
*/
restrict_flags &= ~LANDLOCK_RESTRICT_SELF_TSYNC;
+ __attribute__((fallthrough));
+ case 8:
+ case 9:
+ /* Removes no_new_privs convenience flag for ABI < 10 */
+ restrict_flags &= ~LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS;
}
The next step is to restrict the current thread from gaining more privileges
-(e.g. through a SUID binary). We now have a ruleset with the first rule
+(e.g. through a SUID binary). When supported, this can be folded into
+``landlock_restrict_self()`` with ``LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS``;
+otherwise, user space must still call :manpage:`prctl(2)` explicitly. We now
+have a ruleset with the first rule
allowing read and execute access to ``/usr`` while denying all other handled
accesses for the filesystem, and a second rule allowing HTTPS connections.
@@ -716,6 +725,15 @@ Starting with the Landlock ABI version 9, it is possible to restrict
connections to pathname UNIX domain sockets (:manpage:`unix(7)`) using
the new ``LANDLOCK_ACCESS_FS_RESOLVE_UNIX`` right.
+No New Privs flag (ABI < 10)
+----------------------------------------
+
+Starting with the Landlock ABI version 10, it is possible to request
+``no_new_privs`` as part of ``landlock_restrict_self()`` by passing the
+``LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS`` flag. This lets user space request
+the prerequisite from the Landlock API itself, which is especially useful when
+the restriction is applied from an external context such as BPF.
+
.. _kernel_support:
Kernel support
--
2.53.0
^ permalink raw reply related
* [RFC PATCH 17/20] tools: bpftool: Add documentation for landlock_ruleset
From: Justin Suess @ 2026-04-07 20:01 UTC (permalink / raw)
To: ast, daniel, andrii, kpsingh, paul, mic, viro, brauner, kees
Cc: gnoack, jack, jmorris, serge, song, yonghong.song, martin.lau, m,
eddyz87, john.fastabend, sdf, skhan, bpf, linux-security-module,
linux-kernel, linux-fsdevel, Justin Suess
In-Reply-To: <20260407200157.3874806-1-utilityemal77@gmail.com>
Add BPF_MAP_TYPE_LANDLOCK_RULESET to bpftool listing.
Signed-off-by: Justin Suess <utilityemal77@gmail.com>
---
tools/bpf/bpftool/Documentation/bpftool-map.rst | 2 +-
tools/bpf/bpftool/map.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/bpf/bpftool/Documentation/bpftool-map.rst b/tools/bpf/bpftool/Documentation/bpftool-map.rst
index 1af3305ea2b2..48bf6ee36fa4 100644
--- a/tools/bpf/bpftool/Documentation/bpftool-map.rst
+++ b/tools/bpf/bpftool/Documentation/bpftool-map.rst
@@ -56,7 +56,7 @@ MAP COMMANDS
| | **cgroup_storage** | **reuseport_sockarray** | **percpu_cgroup_storage**
| | **queue** | **stack** | **sk_storage** | **struct_ops** | **ringbuf** | **inode_storage**
| | **task_storage** | **bloom_filter** | **user_ringbuf** | **cgrp_storage** | **arena**
-| | **insn_array** }
+| | **landlock_ruleset** | **insn_array** }
DESCRIPTION
===========
diff --git a/tools/bpf/bpftool/map.c b/tools/bpf/bpftool/map.c
index 7ebf7dbcfba4..0fe391a3ce73 100644
--- a/tools/bpf/bpftool/map.c
+++ b/tools/bpf/bpftool/map.c
@@ -1478,7 +1478,7 @@ static int do_help(int argc, char **argv)
" cgroup_storage | reuseport_sockarray | percpu_cgroup_storage |\n"
" queue | stack | sk_storage | struct_ops | ringbuf | inode_storage |\n"
" task_storage | bloom_filter | user_ringbuf | cgrp_storage | arena |\n"
- " insn_array }\n"
+ " insn_array | landlock_ruleset }\n"
" " HELP_SPEC_OPTIONS " |\n"
" {-f|--bpffs} | {-n|--nomount} }\n"
"",
--
2.53.0
^ permalink raw reply related
* [RFC PATCH 16/20] landlock: Bump ABI version
From: Justin Suess @ 2026-04-07 20:01 UTC (permalink / raw)
To: ast, daniel, andrii, kpsingh, paul, mic, viro, brauner, kees
Cc: gnoack, jack, jmorris, serge, song, yonghong.song, martin.lau, m,
eddyz87, john.fastabend, sdf, skhan, bpf, linux-security-module,
linux-kernel, linux-fsdevel, Justin Suess
In-Reply-To: <20260407200157.3874806-1-utilityemal77@gmail.com>
Bump the ABI version in the kernel for the new
RESTRICT_SELF_NO_NEW_PRIVS flag.
Signed-off-by: Justin Suess <utilityemal77@gmail.com>
---
samples/landlock/sandboxer.c | 7 ++++++-
security/landlock/syscalls.c | 2 +-
tools/testing/selftests/landlock/base_test.c | 2 +-
3 files changed, 8 insertions(+), 3 deletions(-)
diff --git a/samples/landlock/sandboxer.c b/samples/landlock/sandboxer.c
index 66e56ae275c6..53bd77e55855 100644
--- a/samples/landlock/sandboxer.c
+++ b/samples/landlock/sandboxer.c
@@ -301,7 +301,7 @@ static bool check_ruleset_scope(const char *const env_var,
/* clang-format on */
-#define LANDLOCK_ABI_LAST 9
+#define LANDLOCK_ABI_LAST 10
#define XSTR(s) #s
#define STR(s) XSTR(s)
@@ -444,6 +444,11 @@ int main(const int argc, char *const argv[], char *const *const envp)
/* Removes LANDLOCK_ACCESS_FS_RESOLVE_UNIX for ABI < 9 */
ruleset_attr.handled_access_fs &=
~LANDLOCK_ACCESS_FS_RESOLVE_UNIX;
+ __attribute__((fallthrough));
+ case 9:
+ /* Removes LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS for ABI < 10 */
+ supported_restrict_flags &=
+ ~LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS;
/* Must be printed for any ABI < LANDLOCK_ABI_LAST. */
fprintf(stderr,
"Hint: You should update the running kernel "
diff --git a/security/landlock/syscalls.c b/security/landlock/syscalls.c
index 6723806723d5..790ac046542f 100644
--- a/security/landlock/syscalls.c
+++ b/security/landlock/syscalls.c
@@ -130,7 +130,7 @@ static void build_check_abi(void)
* If the change involves a fix that requires userspace awareness, also update
* the errata documentation in Documentation/userspace-api/landlock.rst .
*/
-const int landlock_abi_version = 9;
+const int landlock_abi_version = 10;
/**
* sys_landlock_create_ruleset - Create a new ruleset
diff --git a/tools/testing/selftests/landlock/base_test.c b/tools/testing/selftests/landlock/base_test.c
index a4c38541de70..51c72064c190 100644
--- a/tools/testing/selftests/landlock/base_test.c
+++ b/tools/testing/selftests/landlock/base_test.c
@@ -76,7 +76,7 @@ TEST(abi_version)
const struct landlock_ruleset_attr ruleset_attr = {
.handled_access_fs = LANDLOCK_ACCESS_FS_READ_FILE,
};
- ASSERT_EQ(9, landlock_create_ruleset(NULL, 0,
+ ASSERT_EQ(10, landlock_create_ruleset(NULL, 0,
LANDLOCK_CREATE_RULESET_VERSION));
ASSERT_EQ(-1, landlock_create_ruleset(&ruleset_attr, 0,
--
2.53.0
^ permalink raw reply related
* [RFC PATCH 15/20] selftests/bpf: Add Landlock kfunc test runner
From: Justin Suess @ 2026-04-07 20:01 UTC (permalink / raw)
To: ast, daniel, andrii, kpsingh, paul, mic, viro, brauner, kees
Cc: gnoack, jack, jmorris, serge, song, yonghong.song, martin.lau, m,
eddyz87, john.fastabend, sdf, skhan, bpf, linux-security-module,
linux-kernel, linux-fsdevel, Justin Suess
In-Reply-To: <20260407200157.3874806-1-utilityemal77@gmail.com>
Add a selftest program that loads the Landlock BPF program. The program
creates Landlock rulesets under two topologies (with and without parent
domain). It tests proper enforcement of Landlock rulesets by forking and
executing a child process while a ruleset is enforced by BPF. The result
of the operation is checked and the BPF program counters are verified to
ensure proper execution.
Assisted-by: OpenAI:GPT-5.4
Signed-off-by: Justin Suess <utilityemal77@gmail.com>
---
.../bpf/prog_tests/landlock_kfuncs.c | 733 ++++++++++++++++++
1 file changed, 733 insertions(+)
create mode 100644 tools/testing/selftests/bpf/prog_tests/landlock_kfuncs.c
diff --git a/tools/testing/selftests/bpf/prog_tests/landlock_kfuncs.c b/tools/testing/selftests/bpf/prog_tests/landlock_kfuncs.c
new file mode 100644
index 000000000000..a2f2a067b911
--- /dev/null
+++ b/tools/testing/selftests/bpf/prog_tests/landlock_kfuncs.c
@@ -0,0 +1,733 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include <errno.h>
+#include <fcntl.h>
+#include <linux/limits.h>
+#include "../../../../../usr/include/linux/landlock.h"
+#include <sched.h>
+#include <stdbool.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/mount.h>
+#include <sys/prctl.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <test_progs.h>
+#include <unistd.h>
+
+#include "landlock_kfuncs.skel.h"
+#include "../../landlock/wrappers.h"
+
+#ifndef BIT
+#define BIT(nr) (1U << (nr))
+#endif
+
+#ifndef LANDLOCK_RESTRICT_SELF_TSYNC
+#define LANDLOCK_RESTRICT_SELF_TSYNC BIT(3)
+#endif
+
+#ifndef LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS
+#define LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS BIT(4)
+#endif
+
+#define LANDLOCK_EXEC_PATH "/bin/sh"
+#define MNT_TMP_DATA "size=4m,mode=700"
+
+enum previous_domain_kind {
+ PREV_DOMAIN_NONE,
+ PREV_DOMAIN_NESTED,
+};
+
+enum operation_kind {
+ OPERATION_READ,
+ OPERATION_WRITE,
+ OPERATION_CREATE,
+};
+
+struct hook_variant {
+ const char *name;
+ bool enable_bprm_creds_for_exec;
+ bool enable_bprm_creds_from_file;
+};
+
+struct restrict_variant {
+ const char *name;
+ enum previous_domain_kind previous_domain;
+ __u32 restrict_flags;
+ int expected_restrict_ret;
+ bool expect_enforced;
+};
+
+struct operation_case {
+ const char *name;
+ enum operation_kind kind;
+ __u64 handled_access_fs;
+ __u64 allowed_access_fs;
+};
+
+struct landlock_test_env {
+ char base_dir[PATH_MAX];
+ char allowed_dir[PATH_MAX];
+ char restricted_dir[PATH_MAX];
+ char allowed_file[PATH_MAX];
+ char restricted_file[PATH_MAX];
+ char created_file[PATH_MAX];
+};
+
+static const struct hook_variant hook_variants[] = {
+ {
+ .name = "bprm_creds_for_exec",
+ .enable_bprm_creds_for_exec = true,
+ },
+ {
+ .name = "bprm_creds_from_file",
+ .enable_bprm_creds_from_file = true,
+ },
+};
+
+static const struct restrict_variant domain_variants[] = {
+ {
+ .name = "no_previous_domain",
+ .previous_domain = PREV_DOMAIN_NONE,
+ .expect_enforced = true,
+ },
+ {
+ .name = "nested_previous_domain",
+ .previous_domain = PREV_DOMAIN_NESTED,
+ .expect_enforced = true,
+ },
+};
+
+static const struct restrict_variant flag_variants[] = {
+ {
+ .name = "flag_no_new_privs",
+ .previous_domain = PREV_DOMAIN_NONE,
+ .restrict_flags = LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS,
+ .expect_enforced = true,
+ },
+ {
+ .name = "flag_log_same_exec_off",
+ .previous_domain = PREV_DOMAIN_NONE,
+ .restrict_flags = LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF,
+ .expect_enforced = true,
+ },
+ {
+ .name = "flag_log_new_exec_on",
+ .previous_domain = PREV_DOMAIN_NONE,
+ .restrict_flags = LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON,
+ .expect_enforced = true,
+ },
+ {
+ .name = "flag_log_subdomains_off",
+ .previous_domain = PREV_DOMAIN_NONE,
+ .restrict_flags = LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF,
+ .expect_enforced = true,
+ },
+ {
+ .name = "flag_tsync_rejected",
+ .previous_domain = PREV_DOMAIN_NONE,
+ .restrict_flags = LANDLOCK_RESTRICT_SELF_TSYNC,
+ .expected_restrict_ret = -EINVAL,
+ .expect_enforced = false,
+ },
+};
+
+static const struct operation_case operation_cases[] = {
+ {
+ .name = "read_file",
+ .kind = OPERATION_READ,
+ .handled_access_fs = LANDLOCK_ACCESS_FS_READ_FILE,
+ .allowed_access_fs = LANDLOCK_ACCESS_FS_READ_FILE,
+ },
+ {
+ .name = "write_file",
+ .kind = OPERATION_WRITE,
+ .handled_access_fs = LANDLOCK_ACCESS_FS_WRITE_FILE,
+ .allowed_access_fs = LANDLOCK_ACCESS_FS_WRITE_FILE,
+ },
+ {
+ .name = "make_reg",
+ .kind = OPERATION_CREATE,
+ .handled_access_fs = LANDLOCK_ACCESS_FS_MAKE_REG |
+ LANDLOCK_ACCESS_FS_WRITE_FILE,
+ .allowed_access_fs = LANDLOCK_ACCESS_FS_MAKE_REG |
+ LANDLOCK_ACCESS_FS_WRITE_FILE,
+ },
+};
+
+static int landlock_version(void)
+{
+ return landlock_create_ruleset(NULL, 0,
+ LANDLOCK_CREATE_RULESET_VERSION);
+}
+
+static int write_all(int fd, const char *buf, size_t len)
+{
+ while (len > 0) {
+ ssize_t written;
+
+ written = write(fd, buf, len);
+ if (written < 0) {
+ if (errno == EINTR)
+ continue;
+ return -errno;
+ }
+ buf += written;
+ len -= written;
+ }
+
+ return 0;
+}
+
+static int write_text_file(const char *path, const char *contents)
+{
+ int err;
+ int fd;
+
+ fd = open(path, O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC, 0600);
+ if (fd < 0)
+ return -errno;
+
+ err = write_all(fd, contents, strlen(contents));
+ close(fd);
+ return err;
+}
+
+static int read_text_file(const char *path, char *buf, size_t len)
+{
+ ssize_t bytes;
+ int fd;
+
+ fd = open(path, O_RDONLY | O_CLOEXEC);
+ if (fd < 0)
+ return -errno;
+
+ bytes = read(fd, buf, len - 1);
+ close(fd);
+ if (bytes < 0)
+ return -errno;
+
+ buf[bytes] = '\0';
+ return 0;
+}
+
+static bool path_exists(const char *path)
+{
+ return access(path, F_OK) == 0;
+}
+
+static int delete_ruleset_map_elem(struct landlock_kfuncs *skel)
+{
+ __u32 key = 0;
+ int err;
+
+ err = bpf_map_delete_elem(bpf_map__fd(skel->maps.ruleset_map), &key);
+ if (!err || errno == ENOENT)
+ return 0;
+ return -errno;
+}
+
+static int update_ruleset_map(struct landlock_kfuncs *skel, int ruleset_fd)
+{
+ __u32 key = 0;
+
+ if (bpf_map_update_elem(bpf_map__fd(skel->maps.ruleset_map), &key,
+ &ruleset_fd, BPF_ANY))
+ return -errno;
+
+ return 0;
+}
+
+static void reset_bss(struct landlock_kfuncs *skel)
+{
+ skel->bss->target_pid = 0;
+ skel->bss->enable_bprm_creds_for_exec = false;
+ skel->bss->enable_bprm_creds_from_file = false;
+ skel->bss->restrict_flags = 0;
+
+ skel->bss->matched_pid = 0;
+ skel->bss->bprm_creds_for_exec_hits = 0;
+ skel->bss->bprm_creds_from_file_hits = 0;
+ skel->bss->lookup_calls = 0;
+ skel->bss->lookup_failed = 0;
+ skel->bss->restrict_calls = 0;
+ skel->bss->restrict_ret = 0;
+ skel->bss->put_calls = 0;
+}
+
+static int add_path_rule(int ruleset_fd, const char *path, __u64 access)
+{
+ struct landlock_path_beneath_attr path_beneath = {
+ .allowed_access = access,
+ };
+ int err;
+ int parent_fd;
+
+ parent_fd = open(path, O_PATH | O_CLOEXEC | O_DIRECTORY);
+ if (parent_fd < 0)
+ return -errno;
+
+ path_beneath.parent_fd = parent_fd;
+ err = landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH,
+ &path_beneath, 0);
+ err = err ? -errno : 0;
+ close(parent_fd);
+ return err;
+}
+
+static int create_exec_ruleset(const struct landlock_test_env *env,
+ const struct operation_case *op)
+{
+ struct landlock_ruleset_attr attr = {
+ .handled_access_fs = op->handled_access_fs,
+ };
+ int err;
+ int ruleset_fd;
+
+ ruleset_fd = landlock_create_ruleset(&attr, sizeof(attr), 0);
+ if (ruleset_fd < 0)
+ return -errno;
+
+ err = add_path_rule(ruleset_fd, env->allowed_dir,
+ op->allowed_access_fs);
+ if (err) {
+ close(ruleset_fd);
+ return err;
+ }
+
+ return ruleset_fd;
+}
+
+static int create_and_apply_previous_domain(const struct landlock_test_env *env,
+ enum previous_domain_kind kind,
+ __u64 handled_access_fs)
+{
+ struct landlock_ruleset_attr attr = {};
+ int err;
+ int ruleset_fd;
+
+ if (kind == PREV_DOMAIN_NONE)
+ return 0;
+
+ attr.handled_access_fs = handled_access_fs;
+
+ ruleset_fd = landlock_create_ruleset(&attr, sizeof(attr), 0);
+ if (ruleset_fd < 0)
+ return -errno;
+
+ if (kind == PREV_DOMAIN_NESTED) {
+ err = add_path_rule(ruleset_fd, env->base_dir,
+ handled_access_fs);
+ if (err) {
+ close(ruleset_fd);
+ return err;
+ }
+ }
+
+ if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0))
+ return -errno;
+
+ err = landlock_restrict_self(ruleset_fd, 0);
+ err = err ? -errno : 0;
+ close(ruleset_fd);
+ return err;
+}
+
+static int prepare_layout(struct landlock_test_env *env)
+{
+ char template[] = "/tmp/landlock_kfuncsXXXXXX";
+ int err;
+
+ if (!mkdtemp(template))
+ return -errno;
+
+ err = snprintf(env->base_dir, sizeof(env->base_dir), "%s", template);
+ if (err < 0 || err >= (int)sizeof(env->base_dir))
+ return -ENAMETOOLONG;
+
+ if (unshare(CLONE_NEWNS))
+ return -errno;
+
+ if (mount("tmpfs", env->base_dir, "tmpfs", 0, MNT_TMP_DATA))
+ return -errno;
+
+ if (mount(NULL, env->base_dir, NULL, MS_PRIVATE | MS_REC, NULL))
+ return -errno;
+
+ err = snprintf(env->allowed_dir, sizeof(env->allowed_dir), "%s/allowed",
+ env->base_dir);
+ if (err < 0 || err >= (int)sizeof(env->allowed_dir))
+ return -ENAMETOOLONG;
+
+ err = snprintf(env->restricted_dir, sizeof(env->restricted_dir),
+ "%s/restricted", env->base_dir);
+ if (err < 0 || err >= (int)sizeof(env->restricted_dir))
+ return -ENAMETOOLONG;
+
+ err = snprintf(env->allowed_file, sizeof(env->allowed_file), "%s/file",
+ env->allowed_dir);
+ if (err < 0 || err >= (int)sizeof(env->allowed_file))
+ return -ENAMETOOLONG;
+
+ err = snprintf(env->restricted_file, sizeof(env->restricted_file),
+ "%s/file", env->restricted_dir);
+ if (err < 0 || err >= (int)sizeof(env->restricted_file))
+ return -ENAMETOOLONG;
+
+ err = snprintf(env->created_file, sizeof(env->created_file),
+ "%s/created", env->restricted_dir);
+ if (err < 0 || err >= (int)sizeof(env->created_file))
+ return -ENAMETOOLONG;
+
+ if (mkdir(env->allowed_dir, 0700))
+ return -errno;
+ if (mkdir(env->restricted_dir, 0700))
+ return -errno;
+
+ err = write_text_file(env->allowed_file, "allowed\n");
+ if (err)
+ return err;
+
+ err = write_text_file(env->restricted_file, "restricted\n");
+ if (err)
+ return err;
+
+ return 0;
+}
+
+static void cleanup_layout(const struct landlock_test_env *env)
+{
+ umount(env->base_dir);
+ rmdir(env->base_dir);
+}
+
+static int seed_operation_state(const struct landlock_test_env *env,
+ const struct operation_case *op)
+{
+ int err;
+
+ err = write_text_file(env->allowed_file, "allowed\n");
+ if (err)
+ return err;
+
+ err = write_text_file(env->restricted_file, "restricted\n");
+ if (err)
+ return err;
+
+ if (op->kind == OPERATION_CREATE && unlink(env->created_file) &&
+ errno != ENOENT)
+ return -errno;
+
+ return 0;
+}
+
+static int build_command(char *buf, size_t len,
+ const struct landlock_test_env *env,
+ const struct operation_case *op)
+{
+ switch (op->kind) {
+ case OPERATION_READ:
+ return snprintf(buf, len, "cat '%s' >/dev/null",
+ env->restricted_file);
+ case OPERATION_WRITE:
+ return snprintf(buf, len, "printf 'written\\n' >> '%s'",
+ env->restricted_file);
+ case OPERATION_CREATE:
+ return snprintf(buf, len, "printf 'created\\n' > '%s'",
+ env->created_file);
+ }
+
+ return -EINVAL;
+}
+
+static int run_exec_attempt(struct landlock_kfuncs *skel,
+ const struct landlock_test_env *env,
+ const struct operation_case *op,
+ const struct hook_variant *hook,
+ const struct restrict_variant *variant,
+ bool enable_bpf, int ruleset_fd, int *child_status)
+{
+ char command[PATH_MAX * 2];
+ char signal_byte = 1;
+ pid_t child;
+ pid_t target_pid;
+ int go_pipe[2];
+ int err;
+
+ err = build_command(command, sizeof(command), env, op);
+ if (err < 0 || err >= (int)sizeof(command))
+ return -ENAMETOOLONG;
+
+ if (pipe(go_pipe))
+ return -errno;
+
+ child = fork();
+ if (child < 0) {
+ err = -errno;
+ goto out_close_pipe;
+ }
+ target_pid = child;
+
+ if (child == 0) {
+ close(go_pipe[1]);
+
+ err = create_and_apply_previous_domain(env,
+ variant->previous_domain,
+ op->handled_access_fs);
+ if (err)
+ _exit(-err);
+
+ if (read(go_pipe[0], &signal_byte, sizeof(signal_byte)) !=
+ sizeof(signal_byte))
+ _exit(200);
+
+ execl(LANDLOCK_EXEC_PATH, "sh", "-ec", command, NULL);
+ _exit(errno);
+ }
+
+ close(go_pipe[0]);
+ reset_bss(skel);
+
+ if (enable_bpf) {
+ skel->bss->target_pid = target_pid;
+ skel->bss->enable_bprm_creds_for_exec =
+ hook->enable_bprm_creds_for_exec;
+ skel->bss->enable_bprm_creds_from_file =
+ hook->enable_bprm_creds_from_file;
+ skel->bss->restrict_flags = variant->restrict_flags;
+
+ err = update_ruleset_map(skel, ruleset_fd);
+ if (err)
+ goto out_kill_child;
+ }
+
+ if (write(go_pipe[1], &signal_byte, sizeof(signal_byte)) !=
+ sizeof(signal_byte)) {
+ err = -errno;
+ goto out_kill_child;
+ }
+ close(go_pipe[1]);
+
+ if (waitpid(child, child_status, 0) != child)
+ return -errno;
+
+ return 0;
+
+out_kill_child:
+ close(go_pipe[1]);
+ kill(child, SIGKILL);
+ waitpid(child, NULL, 0);
+ return err;
+
+out_close_pipe:
+ close(go_pipe[0]);
+ close(go_pipe[1]);
+ return err;
+}
+
+static void assert_operation_outcome(const struct landlock_test_env *env,
+ const struct operation_case *op,
+ bool expect_success, int child_status)
+{
+ char contents[256];
+
+ ASSERT_TRUE(WIFEXITED(child_status), "child_exited");
+ if (expect_success)
+ ASSERT_EQ(WEXITSTATUS(child_status), 0, "child_exit_code");
+ else
+ ASSERT_NEQ(WEXITSTATUS(child_status), 0, "child_exit_code");
+
+ switch (op->kind) {
+ case OPERATION_READ:
+ ASSERT_OK(read_text_file(env->restricted_file, contents,
+ sizeof(contents)),
+ "read_restricted_file");
+ ASSERT_STREQ(contents, "restricted\n", "restricted_contents");
+ break;
+ case OPERATION_WRITE:
+ ASSERT_OK(read_text_file(env->restricted_file, contents,
+ sizeof(contents)),
+ "read_restricted_file");
+ if (expect_success) {
+ ASSERT_STREQ(contents, "restricted\nwritten\n",
+ "restricted_contents");
+ } else {
+ ASSERT_STREQ(contents, "restricted\n",
+ "restricted_contents");
+ }
+ break;
+ case OPERATION_CREATE:
+ if (expect_success) {
+ ASSERT_TRUE(path_exists(env->created_file),
+ "created_file_exists");
+ ASSERT_OK(read_text_file(env->created_file, contents,
+ sizeof(contents)),
+ "read_created_file");
+ ASSERT_STREQ(contents, "created\n", "created_contents");
+ } else {
+ ASSERT_FALSE(path_exists(env->created_file),
+ "created_file_exists");
+ }
+ break;
+ }
+}
+
+static void assert_bpf_state(const struct landlock_kfuncs *skel,
+ const struct hook_variant *hook, bool expect_bpf,
+ int expected_restrict_ret)
+{
+ if (!expect_bpf) {
+ ASSERT_EQ(skel->bss->matched_pid, 0, "matched_pid");
+ ASSERT_EQ(skel->bss->bprm_creds_for_exec_hits, 0,
+ "bprm_creds_for_exec_hits");
+ ASSERT_EQ(skel->bss->bprm_creds_from_file_hits, 0,
+ "bprm_creds_from_file_hits");
+ ASSERT_EQ(skel->bss->lookup_calls, 0, "lookup_calls");
+ ASSERT_EQ(skel->bss->lookup_failed, 0, "lookup_failed");
+ ASSERT_EQ(skel->bss->restrict_calls, 0, "restrict_calls");
+ ASSERT_EQ(skel->bss->put_calls, 0, "put_calls");
+ return;
+ }
+
+ ASSERT_EQ(skel->bss->matched_pid, 1, "matched_pid");
+ ASSERT_EQ(skel->bss->lookup_calls, 1, "lookup_calls");
+ ASSERT_EQ(skel->bss->lookup_failed, 0, "lookup_failed");
+ ASSERT_EQ(skel->bss->restrict_calls, 1, "restrict_calls");
+ ASSERT_EQ(skel->bss->restrict_ret, expected_restrict_ret,
+ "restrict_ret");
+ ASSERT_EQ(skel->bss->put_calls, 1, "put_calls");
+
+ if (hook->enable_bprm_creds_for_exec) {
+ ASSERT_EQ(skel->bss->bprm_creds_for_exec_hits, 1,
+ "bprm_creds_for_exec_hits");
+ ASSERT_EQ(skel->bss->bprm_creds_from_file_hits, 0,
+ "bprm_creds_from_file_hits");
+ } else {
+ ASSERT_EQ(skel->bss->bprm_creds_for_exec_hits, 0,
+ "bprm_creds_for_exec_hits");
+ ASSERT_EQ(skel->bss->bprm_creds_from_file_hits, 1,
+ "bprm_creds_from_file_hits");
+ }
+}
+
+static void
+run_case(struct landlock_kfuncs *skel, const struct landlock_test_env *env,
+ const struct hook_variant *hook, const struct operation_case *op,
+ const struct restrict_variant *variant, const char *subtest_name)
+{
+ int child_status;
+ int err;
+ int ruleset_fd;
+
+ if (!test__start_subtest(subtest_name))
+ return;
+
+ err = seed_operation_state(env, op);
+ if (!ASSERT_OK(err, "seed_baseline"))
+ return;
+
+ err = run_exec_attempt(skel, env, op, hook, variant, false, -1,
+ &child_status);
+ if (!ASSERT_OK(err, "baseline_exec"))
+ return;
+ assert_operation_outcome(env, op, true, child_status);
+ assert_bpf_state(skel, hook, false, 0);
+
+ err = seed_operation_state(env, op);
+ if (!ASSERT_OK(err, "seed_enforced"))
+ return;
+
+ ruleset_fd = create_exec_ruleset(env, op);
+ if (!ASSERT_GE(ruleset_fd, 0, "create_ruleset"))
+ return;
+
+ err = run_exec_attempt(skel, env, op, hook, variant, true, ruleset_fd,
+ &child_status);
+ close(ruleset_fd);
+ if (!ASSERT_OK(err, "enforced_exec"))
+ return;
+
+ assert_operation_outcome(env, op, !variant->expect_enforced,
+ child_status);
+ assert_bpf_state(skel, hook, true, variant->expected_restrict_ret);
+ ASSERT_OK(delete_ruleset_map_elem(skel), "delete_ruleset_map_elem");
+}
+
+void test_landlock_kfuncs(void)
+{
+ struct landlock_test_env env = {};
+ struct landlock_kfuncs *skel = NULL;
+ int err;
+ int version;
+ size_t i;
+ size_t j;
+
+ version = landlock_version();
+ if (version < 1) {
+ test__skip();
+ return;
+ }
+
+ skel = landlock_kfuncs__open_and_load();
+ if (!ASSERT_OK_PTR(skel, "open_and_load"))
+ return;
+
+ err = landlock_kfuncs__attach(skel);
+ if (!ASSERT_OK(err, "attach"))
+ goto out;
+
+ err = prepare_layout(&env);
+ if (!ASSERT_OK(err, "prepare_layout"))
+ goto out;
+
+ ASSERT_OK(delete_ruleset_map_elem(skel), "delete_ruleset_map_elem");
+ reset_bss(skel);
+
+ for (i = 0; i < ARRAY_SIZE(hook_variants); i++) {
+ for (j = 0; j < ARRAY_SIZE(operation_cases); j++) {
+ char name[128];
+
+ ASSERT_LT(snprintf(name, sizeof(name),
+ "%s/%s/no_previous_domain",
+ hook_variants[i].name,
+ operation_cases[j].name),
+ (int)sizeof(name), "subtest_name_len");
+ run_case(skel, &env, &hook_variants[i],
+ &operation_cases[j], &domain_variants[0],
+ name);
+ }
+
+ for (j = 0; j < ARRAY_SIZE(domain_variants); j++) {
+ char name[128];
+
+ ASSERT_LT(snprintf(name, sizeof(name),
+ "%s/write_file/%s",
+ hook_variants[i].name,
+ domain_variants[j].name),
+ (int)sizeof(name), "subtest_name_len");
+ run_case(skel, &env, &hook_variants[i],
+ &operation_cases[1], &domain_variants[j],
+ name);
+ }
+
+ for (j = 0; j < ARRAY_SIZE(flag_variants); j++) {
+ char name[128];
+
+ ASSERT_LT(snprintf(name, sizeof(name),
+ "%s/write_file/%s",
+ hook_variants[i].name,
+ flag_variants[j].name),
+ (int)sizeof(name), "subtest_name_len");
+ run_case(skel, &env, &hook_variants[i],
+ &operation_cases[1], &flag_variants[j], name);
+ }
+ }
+
+out:
+ if (env.base_dir[0])
+ cleanup_layout(&env);
+ landlock_kfuncs__destroy(skel);
+}
--
2.53.0
^ permalink raw reply related
* [RFC PATCH 14/20] selftests/bpf: Add Landlock kfunc test program
From: Justin Suess @ 2026-04-07 20:01 UTC (permalink / raw)
To: ast, daniel, andrii, kpsingh, paul, mic, viro, brauner, kees
Cc: gnoack, jack, jmorris, serge, song, yonghong.song, martin.lau, m,
eddyz87, john.fastabend, sdf, skhan, bpf, linux-security-module,
linux-kernel, linux-fsdevel, Justin Suess
In-Reply-To: <20260407200157.3874806-1-utilityemal77@gmail.com>
Add a BPF program that enforces a Landlock ruleset at exec time for the
purposes of selftests. The program receives a PID and a Landlock ruleset
from userspace, and calls bpf_landlock_restrict_binprm to apply the
domain to the specified process. The program then calls
bpf_landlock_put_ruleset in order to release the ruleset.
Global counters are tracked to ensure proper execution via the test
harness.
Signed-off-by: Justin Suess <utilityemal77@gmail.com>
---
.../selftests/bpf/progs/landlock_kfuncs.c | 92 +++++++++++++++++++
1 file changed, 92 insertions(+)
create mode 100644 tools/testing/selftests/bpf/progs/landlock_kfuncs.c
diff --git a/tools/testing/selftests/bpf/progs/landlock_kfuncs.c b/tools/testing/selftests/bpf/progs/landlock_kfuncs.c
new file mode 100644
index 000000000000..7ca089716356
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/landlock_kfuncs.c
@@ -0,0 +1,92 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include "vmlinux.h"
+#include <bpf/bpf_helpers.h>
+#include <bpf/bpf_tracing.h>
+#include "bpf_kfuncs.h"
+
+u32 target_pid;
+bool enable_bprm_creds_for_exec;
+bool enable_bprm_creds_from_file;
+u32 restrict_flags;
+
+int matched_pid;
+int bprm_creds_for_exec_hits;
+int bprm_creds_from_file_hits;
+int lookup_calls;
+int lookup_failed;
+int restrict_calls;
+int restrict_ret;
+int put_calls;
+
+struct {
+ __uint(type, BPF_MAP_TYPE_LANDLOCK_RULESET);
+ __uint(max_entries, 1);
+ __type(key, __u32);
+ __type(value, __u32);
+} ruleset_map SEC(".maps");
+
+char _license[] SEC("license") = "GPL";
+
+static __always_inline bool is_target_exec(void)
+{
+ u32 pid;
+
+ if (!target_pid)
+ return false;
+
+ pid = bpf_get_current_pid_tgid() >> 32;
+ if (pid != target_pid)
+ return false;
+
+ matched_pid = 1;
+ return true;
+}
+
+static __always_inline int apply_landlock_ruleset(struct linux_binprm *bprm,
+ int *hook_hits)
+{
+ const struct bpf_landlock_ruleset *ruleset;
+ __u32 key = 0;
+
+ if (!is_target_exec())
+ return 0;
+
+ (*hook_hits)++;
+
+ lookup_calls++;
+ ruleset = bpf_map_lookup_elem(&ruleset_map, &key);
+ if (!ruleset) {
+ lookup_failed++;
+ return 0;
+ }
+
+ restrict_calls++;
+ restrict_ret =
+ bpf_landlock_restrict_binprm(bprm, ruleset, restrict_flags);
+ put_calls++;
+ bpf_landlock_put_ruleset(ruleset);
+
+ return 0;
+}
+
+SEC("lsm.s/bprm_creds_for_exec")
+int BPF_PROG(bprm_creds_for_exec, struct linux_binprm *bprm)
+{
+ if (!enable_bprm_creds_for_exec)
+ return 0;
+
+ return apply_landlock_ruleset(bprm, &bprm_creds_for_exec_hits);
+}
+
+SEC("lsm.s/bprm_creds_from_file")
+int BPF_PROG(bprm_creds_from_file, struct linux_binprm *bprm,
+ const struct file *file)
+{
+ (void)file;
+
+ if (!enable_bprm_creds_from_file)
+ return 0;
+
+ return apply_landlock_ruleset(bprm, &bprm_creds_from_file_hits);
+}
--
2.53.0
^ permalink raw reply related
* [RFC PATCH 13/20] selftests/bpf: Enable Landlock in selftests kernel.
From: Justin Suess @ 2026-04-07 20:01 UTC (permalink / raw)
To: ast, daniel, andrii, kpsingh, paul, mic, viro, brauner, kees
Cc: gnoack, jack, jmorris, serge, song, yonghong.song, martin.lau, m,
eddyz87, john.fastabend, sdf, skhan, bpf, linux-security-module,
linux-kernel, linux-fsdevel, Justin Suess
In-Reply-To: <20260407200157.3874806-1-utilityemal77@gmail.com>
Enable the BPF selftests to build the kernel with Landlock built into
the kernel and enabled at boottime. Existing LSMs
(SELinux,BPF,integrity) were moved from x86_64 specific config to be
built into all architectures.
Signed-off-by: Justin Suess <utilityemal77@gmail.com>
---
tools/testing/selftests/bpf/config | 5 +++++
tools/testing/selftests/bpf/config.x86_64 | 1 -
2 files changed, 5 insertions(+), 1 deletion(-)
diff --git a/tools/testing/selftests/bpf/config b/tools/testing/selftests/bpf/config
index 24855381290d..8eca3773e968 100644
--- a/tools/testing/selftests/bpf/config
+++ b/tools/testing/selftests/bpf/config
@@ -115,6 +115,11 @@ CONFIG_RC_CORE=y
CONFIG_SAMPLES=y
CONFIG_SAMPLE_LIVEPATCH=m
CONFIG_SECURITY=y
+CONFIG_SECURITY_LANDLOCK=y
+CONFIG_SECURITY_NETWORK=y
+CONFIG_SECURITY_SELINUX=y
+CONFIG_SECURITY_PATH=y
+CONFIG_LSM="selinux,bpf,integrity,landlock"
CONFIG_SECURITYFS=y
CONFIG_SYN_COOKIES=y
CONFIG_TEST_BPF=m
diff --git a/tools/testing/selftests/bpf/config.x86_64 b/tools/testing/selftests/bpf/config.x86_64
index 42ad817b00ae..8a6d2af3805c 100644
--- a/tools/testing/selftests/bpf/config.x86_64
+++ b/tools/testing/selftests/bpf/config.x86_64
@@ -126,7 +126,6 @@ CONFIG_LEGACY_VSYSCALL_NONE=y
CONFIG_LOG_BUF_SHIFT=21
CONFIG_LOG_CPU_MAX_BUF_SHIFT=0
CONFIG_LOGO=y
-CONFIG_LSM="selinux,bpf,integrity"
CONFIG_MAC_PARTITION=y
CONFIG_MAGIC_SYSRQ=y
CONFIG_MCORE2=y
--
2.53.0
^ permalink raw reply related
* [RFC PATCH 12/20] selftests/landlock: Rename gettid wrapper for BPF reuse
From: Justin Suess @ 2026-04-07 20:01 UTC (permalink / raw)
To: ast, daniel, andrii, kpsingh, paul, mic, viro, brauner, kees
Cc: gnoack, jack, jmorris, serge, song, yonghong.song, martin.lau, m,
eddyz87, john.fastabend, sdf, skhan, bpf, linux-security-module,
linux-kernel, linux-fsdevel, Justin Suess
In-Reply-To: <20260407200157.3874806-1-utilityemal77@gmail.com>
Prevent a name conflict when importing the Landlock wrappers header from
the Landlock selftests into the bpf selftests by renaming the gettid
syscall wrapper.
Signed-off-by: Justin Suess <utilityemal77@gmail.com>
---
tools/testing/selftests/landlock/common.h | 4 ++--
tools/testing/selftests/landlock/wrappers.h | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/tools/testing/selftests/landlock/common.h b/tools/testing/selftests/landlock/common.h
index f6d6a6a99c52..5fe0158885e5 100644
--- a/tools/testing/selftests/landlock/common.h
+++ b/tools/testing/selftests/landlock/common.h
@@ -262,8 +262,8 @@ static void __maybe_unused set_unix_address(struct service_fixture *const srv,
{
srv->unix_addr.sun_family = AF_UNIX;
sprintf(srv->unix_addr.sun_path,
- "_selftests-landlock-abstract-unix-tid%d-index%d", sys_gettid(),
- index);
+ "_selftests-landlock-abstract-unix-tid%d-index%d",
+ landlock_gettid(), index);
srv->unix_addr_len = SUN_LEN(&srv->unix_addr);
srv->unix_addr.sun_path[0] = '\0';
}
diff --git a/tools/testing/selftests/landlock/wrappers.h b/tools/testing/selftests/landlock/wrappers.h
index 65548323e45d..114b8c60630d 100644
--- a/tools/testing/selftests/landlock/wrappers.h
+++ b/tools/testing/selftests/landlock/wrappers.h
@@ -41,7 +41,7 @@ static inline int landlock_restrict_self(const int ruleset_fd,
}
#endif
-static inline pid_t sys_gettid(void)
+static inline pid_t landlock_gettid(void)
{
return syscall(__NR_gettid);
}
--
2.53.0
^ permalink raw reply related
* [RFC PATCH 11/20] selftests/bpf: Add Landlock kfunc declarations
From: Justin Suess @ 2026-04-07 20:01 UTC (permalink / raw)
To: ast, daniel, andrii, kpsingh, paul, mic, viro, brauner, kees
Cc: gnoack, jack, jmorris, serge, song, yonghong.song, martin.lau, m,
eddyz87, john.fastabend, sdf, skhan, bpf, linux-security-module,
linux-kernel, linux-fsdevel, Justin Suess
In-Reply-To: <20260407200157.3874806-1-utilityemal77@gmail.com>
Expose the Landlock kfuncs to the BPF selftests.
Signed-off-by: Justin Suess <utilityemal77@gmail.com>
---
tools/testing/selftests/bpf/bpf_kfuncs.h | 20 ++++++++++++++++++++
1 file changed, 20 insertions(+)
diff --git a/tools/testing/selftests/bpf/bpf_kfuncs.h b/tools/testing/selftests/bpf/bpf_kfuncs.h
index 7dad01439391..00f2b337a232 100644
--- a/tools/testing/selftests/bpf/bpf_kfuncs.h
+++ b/tools/testing/selftests/bpf/bpf_kfuncs.h
@@ -79,6 +79,26 @@ extern int bpf_verify_pkcs7_signature(struct bpf_dynptr *data_ptr,
struct bpf_dynptr *sig_ptr,
struct bpf_key *trusted_keyring) __ksym;
+struct bpf_landlock_ruleset;
+/*
+ * Description
+ * Put a Landlock ruleset obtained from a Landlock ruleset map lookup.
+ */
+
+void bpf_landlock_put_ruleset(const struct bpf_landlock_ruleset *ruleset)
+ __ksym __weak;
+/*
+ * Description
+ * Modifies the credential of the passed binary parameters to enforce the
+ * provided landlock ruleset on the new credentials. The ruleset should
+ * have been obtained from a Landlock ruleset map lookup.
+ * Returns
+ * Error code same as those returned by landlock_restrict_self
+ */
+int bpf_landlock_restrict_binprm(struct linux_binprm *bprm,
+ const struct bpf_landlock_ruleset *ruleset,
+ __u32 flags) __ksym __weak;
+
struct dentry;
/* Description
* Returns xattr of a dentry
--
2.53.0
^ permalink raw reply related
* [RFC PATCH 10/20] bpf: verifier: Add Landlock ruleset map support
From: Justin Suess @ 2026-04-07 20:01 UTC (permalink / raw)
To: ast, daniel, andrii, kpsingh, paul, mic, viro, brauner, kees
Cc: gnoack, jack, jmorris, serge, song, yonghong.song, martin.lau, m,
eddyz87, john.fastabend, sdf, skhan, bpf, linux-security-module,
linux-kernel, linux-fsdevel, Justin Suess
In-Reply-To: <20260407200157.3874806-1-utilityemal77@gmail.com>
Add support for the BPF_MAP_TYPE_LANDLOCK_RULESET in the verifier. Mark
the map as storing a trusted pointer to a BTF object.
Specify the map as being usable from sleepable contexts.
Signed-off-by: Justin Suess <utilityemal77@gmail.com>
---
kernel/bpf/verifier.c | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index f108c01ff6d0..52ba58536387 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -493,7 +493,8 @@ static bool is_acquire_function(enum bpf_func_id func_id,
if (func_id == BPF_FUNC_map_lookup_elem &&
(map_type == BPF_MAP_TYPE_SOCKMAP ||
- map_type == BPF_MAP_TYPE_SOCKHASH))
+ map_type == BPF_MAP_TYPE_SOCKHASH ||
+ map_type == BPF_MAP_TYPE_LANDLOCK_RULESET))
return true;
return false;
@@ -2269,6 +2270,10 @@ static void mark_ptr_not_null_reg(struct bpf_reg_state *reg)
} else if (map->map_type == BPF_MAP_TYPE_SOCKMAP ||
map->map_type == BPF_MAP_TYPE_SOCKHASH) {
reg->type = PTR_TO_SOCKET;
+ } else if (map->map_type == BPF_MAP_TYPE_LANDLOCK_RULESET) {
+ reg->type = PTR_TO_BTF_ID | PTR_TRUSTED;
+ reg->btf = btf_vmlinux;
+ reg->btf_id = *bpf_landlock_ruleset_btf_ids;
} else {
reg->type = PTR_TO_MAP_VALUE;
}
@@ -10238,6 +10243,13 @@ static int check_map_func_compatibility(struct bpf_verifier_env *env,
!may_update_sockmap(env, func_id))
goto error;
break;
+ case BPF_MAP_TYPE_LANDLOCK_RULESET:
+ if (resolve_prog_type(env->prog) != BPF_PROG_TYPE_LSM)
+ goto error;
+ if (func_id != BPF_FUNC_map_lookup_elem &&
+ func_id != BPF_FUNC_map_delete_elem)
+ goto error;
+ break;
case BPF_MAP_TYPE_REUSEPORT_SOCKARRAY:
if (func_id != BPF_FUNC_sk_select_reuseport)
goto error;
@@ -21662,6 +21674,7 @@ static int check_map_prog_compatibility(struct bpf_verifier_env *env,
case BPF_MAP_TYPE_ARENA:
case BPF_MAP_TYPE_INSN_ARRAY:
case BPF_MAP_TYPE_PROG_ARRAY:
+ case BPF_MAP_TYPE_LANDLOCK_RULESET:
break;
default:
verbose(env,
--
2.53.0
^ permalink raw reply related
* [RFC PATCH 09/20] bpf: syscall: Handle Landlock ruleset maps
From: Justin Suess @ 2026-04-07 20:01 UTC (permalink / raw)
To: ast, daniel, andrii, kpsingh, paul, mic, viro, brauner, kees
Cc: gnoack, jack, jmorris, serge, song, yonghong.song, martin.lau, m,
eddyz87, john.fastabend, sdf, skhan, bpf, linux-security-module,
linux-kernel, linux-fsdevel, Justin Suess
In-Reply-To: <20260407200157.3874806-1-utilityemal77@gmail.com>
Allow userspace to create maps of type BPF_MAP_TYPE_LANDLOCK_RULESET via
the bpf syscall. If CONFIG_SECURITY_LANDLOCK != y, these
programs will still be accepted by the verifier but return an error at
runtime.
Signed-off-by: Justin Suess <utilityemal77@gmail.com>
---
kernel/bpf/syscall.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 274039e36465..e885451b64a0 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -48,7 +48,8 @@
#define IS_FD_ARRAY(map) ((map)->map_type == BPF_MAP_TYPE_PERF_EVENT_ARRAY || \
(map)->map_type == BPF_MAP_TYPE_CGROUP_ARRAY || \
- (map)->map_type == BPF_MAP_TYPE_ARRAY_OF_MAPS)
+ (map)->map_type == BPF_MAP_TYPE_ARRAY_OF_MAPS || \
+ (map)->map_type == BPF_MAP_TYPE_LANDLOCK_RULESET)
#define IS_FD_PROG_ARRAY(map) ((map)->map_type == BPF_MAP_TYPE_PROG_ARRAY)
#define IS_FD_HASH(map) ((map)->map_type == BPF_MAP_TYPE_HASH_OF_MAPS)
#define IS_FD_MAP(map) (IS_FD_ARRAY(map) || IS_FD_PROG_ARRAY(map) || \
@@ -1488,6 +1489,7 @@ static int map_create(union bpf_attr *attr, bpfptr_t uattr)
case BPF_MAP_TYPE_CPUMAP:
case BPF_MAP_TYPE_ARENA:
case BPF_MAP_TYPE_INSN_ARRAY:
+ case BPF_MAP_TYPE_LANDLOCK_RULESET:
if (!bpf_token_capable(token, CAP_BPF))
goto put_token;
break;
--
2.53.0
^ permalink raw reply related
* [RFC PATCH 08/20] bpf: Add Landlock ruleset map type
From: Justin Suess @ 2026-04-07 20:01 UTC (permalink / raw)
To: ast, daniel, andrii, kpsingh, paul, mic, viro, brauner, kees
Cc: gnoack, jack, jmorris, serge, song, yonghong.song, martin.lau, m,
eddyz87, john.fastabend, sdf, skhan, bpf, linux-security-module,
linux-kernel, linux-fsdevel, Justin Suess
In-Reply-To: <20260407200157.3874806-1-utilityemal77@gmail.com>
Expose the new BPF_MAP_TYPE_LANDLOCK_RULESET via headers, allowing
programs to utilize the map.
Signed-off-by: Justin Suess <utilityemal77@gmail.com>
---
include/linux/bpf_types.h | 1 +
include/uapi/linux/bpf.h | 1 +
tools/include/uapi/linux/bpf.h | 1 +
tools/lib/bpf/libbpf.c | 1 +
tools/lib/bpf/libbpf_probes.c | 6 ++++++
5 files changed, 10 insertions(+)
diff --git a/include/linux/bpf_types.h b/include/linux/bpf_types.h
index b13de31e163f..0fa3b9031d90 100644
--- a/include/linux/bpf_types.h
+++ b/include/linux/bpf_types.h
@@ -134,6 +134,7 @@ BPF_MAP_TYPE(BPF_MAP_TYPE_BLOOM_FILTER, bloom_filter_map_ops)
BPF_MAP_TYPE(BPF_MAP_TYPE_USER_RINGBUF, user_ringbuf_map_ops)
BPF_MAP_TYPE(BPF_MAP_TYPE_ARENA, arena_map_ops)
BPF_MAP_TYPE(BPF_MAP_TYPE_INSN_ARRAY, insn_array_map_ops)
+BPF_MAP_TYPE(BPF_MAP_TYPE_LANDLOCK_RULESET, landlock_ruleset_map_ops)
BPF_LINK_TYPE(BPF_LINK_TYPE_RAW_TRACEPOINT, raw_tracepoint)
BPF_LINK_TYPE(BPF_LINK_TYPE_TRACING, tracing)
diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index c8d400b7680a..7e4478afa162 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -1046,6 +1046,7 @@ enum bpf_map_type {
BPF_MAP_TYPE_CGRP_STORAGE,
BPF_MAP_TYPE_ARENA,
BPF_MAP_TYPE_INSN_ARRAY,
+ BPF_MAP_TYPE_LANDLOCK_RULESET,
__MAX_BPF_MAP_TYPE
};
diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index 5e38b4887de6..6dd7d70b198a 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -1046,6 +1046,7 @@ enum bpf_map_type {
BPF_MAP_TYPE_CGRP_STORAGE,
BPF_MAP_TYPE_ARENA,
BPF_MAP_TYPE_INSN_ARRAY,
+ BPF_MAP_TYPE_LANDLOCK_RULESET,
__MAX_BPF_MAP_TYPE
};
diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index 0be7017800fe..9ccd5df1ea6c 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -192,6 +192,7 @@ static const char * const map_type_name[] = {
[BPF_MAP_TYPE_CGRP_STORAGE] = "cgrp_storage",
[BPF_MAP_TYPE_ARENA] = "arena",
[BPF_MAP_TYPE_INSN_ARRAY] = "insn_array",
+ [BPF_MAP_TYPE_LANDLOCK_RULESET] = "landlock_ruleset",
};
static const char * const prog_type_name[] = {
diff --git a/tools/lib/bpf/libbpf_probes.c b/tools/lib/bpf/libbpf_probes.c
index bccf4bb747e1..1407d54aef67 100644
--- a/tools/lib/bpf/libbpf_probes.c
+++ b/tools/lib/bpf/libbpf_probes.c
@@ -367,6 +367,12 @@ static int probe_map_create(enum bpf_map_type map_type)
case BPF_MAP_TYPE_INSN_ARRAY:
key_size = sizeof(__u32);
value_size = sizeof(struct bpf_insn_array_value);
+ max_entries = 1;
+ break;
+ case BPF_MAP_TYPE_LANDLOCK_RULESET:
+ key_size = sizeof(__u32);
+ value_size = sizeof(__u32);
+ max_entries = 1;
break;
case BPF_MAP_TYPE_UNSPEC:
default:
--
2.53.0
^ permalink raw reply related
* [RFC PATCH 07/20] bpf: arraymap: Implement Landlock ruleset map
From: Justin Suess @ 2026-04-07 20:01 UTC (permalink / raw)
To: ast, daniel, andrii, kpsingh, paul, mic, viro, brauner, kees
Cc: gnoack, jack, jmorris, serge, song, yonghong.song, martin.lau, m,
eddyz87, john.fastabend, sdf, skhan, bpf, linux-security-module,
linux-kernel, linux-fsdevel, Justin Suess
In-Reply-To: <20260407200157.3874806-1-utilityemal77@gmail.com>
Implement a new BPF map BPF_MAP_LANDLOCK_RULESET. This specialized map type
is designed to store ruleset file descriptors, and uses the exposed
Landlock helper functions to ensure that the ruleset isn't freed
unexpectedly. This map type may only be inserted into from userspace,
and only with a file descriptor referring to a valid Landlock ruleset.
Updating a Landlock ruleset directly through a map is not supported,
as there are no fields that can be changed, but you may add rules from
userspace as long as the file descriptor is open, or replace the fd with
another. Elements in a Landlock ruleset map may be deleted from
BPF or userspace. Looking up an element is supported only in BPF, this
is enforced with the map_lookup_elem_sys_only field in the map ops.
Reuse the existing fd_array_map operations for inserting and deleting to
avoid code duplication with existing FD maps.
Signed-off-by: Justin Suess <utilityemal77@gmail.com>
---
kernel/bpf/arraymap.c | 67 +++++++++++++++++++++++++++++++++++++++++++
1 file changed, 67 insertions(+)
diff --git a/kernel/bpf/arraymap.c b/kernel/bpf/arraymap.c
index 33de68c95ad8..f0da17e0e23e 100644
--- a/kernel/bpf/arraymap.c
+++ b/kernel/bpf/arraymap.c
@@ -8,6 +8,7 @@
#include <linux/slab.h>
#include <linux/mm.h>
#include <linux/filter.h>
+#include <linux/landlock.h>
#include <linux/perf_event.h>
#include <uapi/linux/btf.h>
#include <linux/rcupdate_trace.h>
@@ -1458,3 +1459,69 @@ const struct bpf_map_ops array_of_maps_map_ops = {
.map_mem_usage = array_map_mem_usage,
.map_btf_id = &array_map_btf_ids[0],
};
+
+static int landlock_ruleset_map_alloc_check(union bpf_attr *attr)
+{
+ if (!IS_ENABLED(CONFIG_SECURITY_LANDLOCK))
+ return -EOPNOTSUPP;
+
+ return fd_array_map_alloc_check(attr);
+}
+
+static void landlock_ruleset_map_put_ptr(struct bpf_map *map, void *ptr,
+ bool need_defer)
+{
+ if (!ptr)
+ return;
+
+ if (need_defer)
+ landlock_put_ruleset_deferred(ptr);
+ else
+ landlock_put_ruleset(ptr);
+}
+
+static void *landlock_ruleset_map_get_ptr(struct bpf_map *map,
+ struct file *map_file, int fd)
+{
+ return landlock_get_ruleset_from_fd(fd, FMODE_CAN_READ);
+}
+
+static void *landlock_ruleset_map_lookup_elem(struct bpf_map *map, void *key)
+{
+ struct landlock_ruleset **elem, *ruleset;
+
+ rcu_read_lock();
+
+ elem = array_map_lookup_elem(map, key);
+ if (!elem) {
+ rcu_read_unlock();
+ return NULL;
+ }
+ ruleset = READ_ONCE(*elem);
+ if (!landlock_try_get_ruleset(ruleset))
+ ruleset = NULL;
+
+ rcu_read_unlock();
+
+ return ruleset;
+}
+
+static void landlock_ruleset_array_free(struct bpf_map *map)
+{
+ bpf_fd_array_map_clear(map, false);
+ fd_array_map_free(map);
+}
+
+const struct bpf_map_ops landlock_ruleset_map_ops = {
+ .map_alloc_check = landlock_ruleset_map_alloc_check,
+ .map_alloc = array_map_alloc,
+ .map_free = landlock_ruleset_array_free,
+ .map_get_next_key = bpf_array_get_next_key,
+ .map_lookup_elem_sys_only = fd_array_map_lookup_elem,
+ .map_lookup_elem = landlock_ruleset_map_lookup_elem,
+ .map_delete_elem = fd_array_map_delete_elem,
+ .map_fd_get_ptr = landlock_ruleset_map_get_ptr,
+ .map_fd_put_ptr = landlock_ruleset_map_put_ptr,
+ .map_mem_usage = array_map_mem_usage,
+ .map_btf_id = &array_map_btf_ids[0],
+};
--
2.53.0
^ permalink raw reply related
* [RFC PATCH 06/20] bpf: lsm: Add Landlock kfuncs
From: Justin Suess @ 2026-04-07 20:01 UTC (permalink / raw)
To: ast, daniel, andrii, kpsingh, paul, mic, viro, brauner, kees
Cc: gnoack, jack, jmorris, serge, song, yonghong.song, martin.lau, m,
eddyz87, john.fastabend, sdf, skhan, bpf, linux-security-module,
linux-kernel, linux-fsdevel, Justin Suess
In-Reply-To: <20260407200157.3874806-1-utilityemal77@gmail.com>
Create 2 kfuncs exposing control over Landlock functionality to BPF
callers. Export an opaque struct bpf_landlock_ruleset preventing callers
from accessing unstable internal Landlock fields.
1) bpf_landlock_put_ruleset releases a reference on a bpf_landlock_ruleset.
This is properly passed to the verifier with the KF_RELEASE annotation.
2) bpf_landlock_restrict_binprm alters the pre-committed credentials in the
linux_binprm struct, ensuring the program will start with the specified
landlock ruleset. Normal domain inheritance, for existing and future
domains apply as normal.
To enable proper reference counting and destruction, a destructor is
registered for the bpf_landlock_ruleset.
Additionally, both kfuncs are restricted to LSM programs attached to
bprm_creds_for_exec or bprm_creds_from_file, and only sleepable varients
of these hooks. Landlock may block because a ruleset is protected by a
lock, so both of the above kfuncs may sleep and are KF_SLEEPABLE.
If RESTRICT_FLAGS_NO_NEW_PRIVS is set, and the task doesn't have
CAP_SYS_ADMIN or is not already running with no_new_privs, we set the
set_nnp_on_point_of_no_return to ensure that the next execution
transition (but not the current one) will be subject to no_new_privs.
Running task_set_no_new_privs directly is unsafe in this path, as a
failed execution will result in a lingering side effect of no_new_privs
being set on the original thread.
Signed-off-by: Justin Suess <utilityemal77@gmail.com>
---
include/linux/bpf_lsm.h | 15 +++++
kernel/bpf/bpf_lsm.c | 145 ++++++++++++++++++++++++++++++++++++++++
2 files changed, 160 insertions(+)
diff --git a/include/linux/bpf_lsm.h b/include/linux/bpf_lsm.h
index 643809cc78c3..1fc019c0db44 100644
--- a/include/linux/bpf_lsm.h
+++ b/include/linux/bpf_lsm.h
@@ -31,6 +31,21 @@ int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog,
bool bpf_lsm_is_sleepable_hook(u32 btf_id);
bool bpf_lsm_is_trusted(const struct bpf_prog *prog);
+/*
+ * Opaque type for BPF landlock ruleset. This is used to prevent BPF programs
+ * from directly accessing the landlock_ruleset structure, which is not designed
+ * for external use and may change in the future.
+ */
+struct bpf_landlock_ruleset {};
+BTF_ID_LIST_SINGLE(bpf_landlock_ruleset_btf_ids, struct, bpf_landlock_ruleset)
+__bpf_kfunc void
+bpf_landlock_put_ruleset(const struct bpf_landlock_ruleset *ruleset);
+__bpf_kfunc int
+bpf_landlock_restrict_binprm(struct linux_binprm *bprm,
+ const struct bpf_landlock_ruleset *ruleset,
+ u32 flags);
+__bpf_kfunc void bpf_landlock_put_ruleset_dtor(void *ruleset);
+
static inline struct bpf_storage_blob *bpf_inode(
const struct inode *inode)
{
diff --git a/kernel/bpf/bpf_lsm.c b/kernel/bpf/bpf_lsm.c
index 0c4a0c8e6f70..5da9950aa555 100644
--- a/kernel/bpf/bpf_lsm.c
+++ b/kernel/bpf/bpf_lsm.c
@@ -16,6 +16,7 @@
#include <linux/btf_ids.h>
#include <linux/ima.h>
#include <linux/bpf-cgroup.h>
+#include <linux/landlock.h>
/* For every LSM hook that allows attachment of BPF programs, declare a nop
* function where a BPF program can be attached. Notably, we qualify each with
@@ -447,3 +448,147 @@ int bpf_lsm_get_retval_range(const struct bpf_prog *prog,
}
return 0;
}
+
+BTF_SET_START(bpf_landlock_kfunc_hooks)
+BTF_ID(func, bpf_lsm_bprm_creds_for_exec)
+BTF_ID(func, bpf_lsm_bprm_creds_from_file)
+BTF_SET_END(bpf_landlock_kfunc_hooks)
+
+BTF_KFUNCS_START(bpf_landlock_kfunc_btf_ids)
+BTF_ID_FLAGS(func, bpf_landlock_put_ruleset, KF_RELEASE | KF_SLEEPABLE)
+BTF_ID_FLAGS(func, bpf_landlock_restrict_binprm, KF_SLEEPABLE)
+BTF_KFUNCS_END(bpf_landlock_kfunc_btf_ids)
+
+BTF_ID_LIST(bpf_landlock_dtor_ids)
+BTF_ID(struct, bpf_landlock_ruleset)
+BTF_ID(func, bpf_landlock_put_ruleset_dtor)
+
+static int bpf_landlock_kfunc_filter(const struct bpf_prog *prog, u32 kfunc_id)
+{
+ if (!btf_id_set8_contains(&bpf_landlock_kfunc_btf_ids, kfunc_id))
+ return 0;
+
+ /* BPF_LSM_CGROUP programs run under classic RCU and cannot sleep. */
+ if (prog->expected_attach_type == BPF_LSM_CGROUP)
+ return -EACCES;
+
+ if (!btf_id_set_contains(&bpf_landlock_kfunc_hooks,
+ prog->aux->attach_btf_id))
+ return -EACCES;
+
+ return 0;
+}
+
+static const struct btf_kfunc_id_set bpf_landlock_kfunc_set = {
+ .owner = THIS_MODULE,
+ .set = &bpf_landlock_kfunc_btf_ids,
+ .filter = bpf_landlock_kfunc_filter,
+};
+
+static int __init bpf_landlock_kfunc_init(void)
+{
+ const struct btf_id_dtor_kfunc bpf_landlock_dtors[] = {
+ {
+ .btf_id = bpf_landlock_dtor_ids[0],
+ .kfunc_btf_id = bpf_landlock_dtor_ids[1],
+ },
+ };
+ int ret;
+
+ ret = register_btf_kfunc_id_set(BPF_PROG_TYPE_LSM,
+ &bpf_landlock_kfunc_set);
+ if (ret)
+ return ret;
+
+ return register_btf_id_dtor_kfuncs(bpf_landlock_dtors,
+ ARRAY_SIZE(bpf_landlock_dtors),
+ THIS_MODULE);
+}
+
+late_initcall(bpf_landlock_kfunc_init);
+
+__bpf_kfunc_start_defs();
+
+#if IS_ENABLED(CONFIG_SECURITY_LANDLOCK)
+
+/**
+ * bpf_landlock_put_ruleset - put a Landlock ruleset
+ * @ruleset: Landlock ruleset to put
+ */
+__bpf_kfunc void
+bpf_landlock_put_ruleset(const struct bpf_landlock_ruleset *ruleset)
+{
+ landlock_put_ruleset((struct landlock_ruleset *)ruleset);
+}
+
+/**
+ * bpf_landlock_restrict_binprm - enforce a Landlock ruleset on exec credentials
+ * @bprm: execution context providing the prepared credentials to restrict
+ * @ruleset: Landlock ruleset to enforce, may be NULL only with
+ * LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF
+ * @flags: landlock_restrict_self() flags
+ *
+ * When @flags contains LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS, the request is
+ * staged through @bprm and committed only after exec reaches point-of-no-return.
+ * This guarantees that the resulting task cannot gain more privileges through
+ * later exec transitions, including when called from bprm_creds_from_file.
+ * The current execution is unaffected, and may escalate as usual until the next
+ * exec.
+ */
+__bpf_kfunc int
+bpf_landlock_restrict_binprm(struct linux_binprm *bprm,
+ const struct bpf_landlock_ruleset *ruleset,
+ u32 flags)
+{
+ int err = landlock_restrict_cred_precheck(flags, false);
+
+ if (err)
+ return err;
+
+ err = landlock_restrict_cred(bprm->cred,
+ (struct landlock_ruleset *)ruleset,
+ flags);
+
+ if (err)
+ return err;
+ /*
+ * Stage no_new_privs through @bprm so exec can honor it without
+ * mutating the current task before point-of-no-return.
+ */
+ if ((flags & LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS)
+ && !task_no_new_privs(current)
+ && !ns_capable_noaudit(current_user_ns(), CAP_SYS_ADMIN))
+ bprm->set_nnp_on_point_of_no_return = 1;
+
+ return err;
+}
+
+/* We define stubs for these to allow ebpf programs using landlock kfuncs to load
+ * even when CONFIG_SECURITY_LANDLOCK is not enabled.
+ */
+#else /* IS_ENABLED(CONFIG_SECURITY_LANDLOCK) */
+
+__bpf_kfunc void
+bpf_landlock_put_ruleset(const struct bpf_landlock_ruleset *ruleset)
+{
+}
+
+__bpf_kfunc int
+bpf_landlock_restrict_binprm(struct linux_binprm *bprm,
+ const struct bpf_landlock_ruleset *ruleset,
+ u32 flags)
+{
+ return -EOPNOTSUPP;
+}
+
+#endif /* IS_ENABLED(CONFIG_SECURITY_LANDLOCK) */
+
+/* Destructor does nothing when Landlock is not enabled */
+__bpf_kfunc void bpf_landlock_put_ruleset_dtor(void *ruleset)
+{
+ bpf_landlock_put_ruleset(ruleset);
+}
+
+CFI_NOSEAL(bpf_landlock_put_ruleset_dtor);
+
+__bpf_kfunc_end_defs();
--
2.53.0
^ permalink raw reply related
* [RFC PATCH 05/20] landlock: Make ruleset deferred free RCU safe
From: Justin Suess @ 2026-04-07 20:01 UTC (permalink / raw)
To: ast, daniel, andrii, kpsingh, paul, mic, viro, brauner, kees
Cc: gnoack, jack, jmorris, serge, song, yonghong.song, martin.lau, m,
eddyz87, john.fastabend, sdf, skhan, bpf, linux-security-module,
linux-kernel, linux-fsdevel, Justin Suess
In-Reply-To: <20260407200157.3874806-1-utilityemal77@gmail.com>
Use INIT_RCU_WORK in the landlock deferred free function, ensuring that
deferred ruleset freeing is also RCU safe.
This is important for future consumers who may free a Landlock ruleset
under RCU in subsequent patches.
Signed-off-by: Justin Suess <utilityemal77@gmail.com>
---
security/landlock/ruleset.c | 9 +++++----
security/landlock/ruleset.h | 6 +++---
2 files changed, 8 insertions(+), 7 deletions(-)
diff --git a/security/landlock/ruleset.c b/security/landlock/ruleset.c
index 4f0305796165..5845cdc58d0d 100644
--- a/security/landlock/ruleset.c
+++ b/security/landlock/ruleset.c
@@ -699,16 +699,17 @@ static void free_ruleset_work(struct work_struct *const work)
{
struct landlock_ruleset *ruleset;
- ruleset = container_of(work, struct landlock_ruleset, work_free);
+ ruleset = container_of(to_rcu_work(work), struct landlock_ruleset,
+ work_free);
free_ruleset(ruleset);
}
-/* Only called by hook_cred_free(). */
+/* Called by deferred ruleset owners that cannot free from their context. */
void landlock_put_ruleset_deferred(struct landlock_ruleset *const ruleset)
{
if (ruleset && refcount_dec_and_test(&ruleset->usage)) {
- INIT_WORK(&ruleset->work_free, free_ruleset_work);
- schedule_work(&ruleset->work_free);
+ INIT_RCU_WORK(&ruleset->work_free, free_ruleset_work);
+ queue_rcu_work(system_wq, &ruleset->work_free);
}
}
diff --git a/security/landlock/ruleset.h b/security/landlock/ruleset.h
index 0facc5cb6555..fbbd1b73476e 100644
--- a/security/landlock/ruleset.h
+++ b/security/landlock/ruleset.h
@@ -146,13 +146,13 @@ struct landlock_ruleset {
struct landlock_hierarchy *hierarchy;
union {
/**
- * @work_free: Enables to free a ruleset within a lockless
- * section. This is only used by
+ * @work_free: Enables to free a ruleset after an RCU grace
+ * period from a sleepable context. This is only used by
* landlock_put_ruleset_deferred() when @usage reaches zero.
* The fields @lock, @usage, @num_rules, @num_layers and
* @access_masks are then unused.
*/
- struct work_struct work_free;
+ struct rcu_work work_free;
struct {
/**
* @lock: Protects against concurrent modifications of
--
2.53.0
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox