Re: [PATCH v5 7/8] samples/landlock: Add capability and namespace restriction support

[sashiko-bot@kernel.org]

> Extend the sandboxer sample to demonstrate the new Landlock capability
> and namespace restriction features.  LL_CAP takes a colon-delimited list
> of allowed capabilities.  Numeric values are always accepted; when
> libcap development files are available, use cap_from_name(3) to accept
> names too.  Builds without libcap warn when capability settings are
> used.  This keeps the sample buildable without optional development
> files.  LL_NS takes a colon-delimited list of allowed namespace types by
> short name.  Add best-effort degradation for older kernels that predate
> the LANDLOCK_PERMISSION_* features.
> 
> Allow creating user and UTS namespaces but deny network namespaces, as
> an unprivileged user.  The first command succeeds and sets the hostname
> inside the new UTS namespace; the second is denied because the network
> namespace type is not allowed:
> 
> [ ... ]
> Cc: Günther Noack <gnoack@google.com>
> Cc: Paul Moore <paul@paul-moore.com>
> Cc: Serge E. Hallyn <serge@hallyn.com>
> Cc: Tingmao Wang <m@maowtm.org>
> Signed-off-by: Mickaël Salaün <mic@digikod.net>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261007100255.1333386-1-mic@digikod.net?part=7