From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-yx1-f49.google.com (mail-yx1-f49.google.com [74.125.224.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C3D6D23EA8B for ; Sun, 9 Aug 2026 15:45:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.224.49 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786290360; cv=none; b=QLZNVHWYgmvoUYQlla6yphJOKJyzCFdz4C+oJU922DYgnGoIYfrRneoxunD57bd8D992LDiEzXBgBL8jAHw6dqMxQNEiLhAmrcsC1GI3nDSqFBEDSIZKLngPlo6QsvXPkxZHai0n3eJ6mgGM2BQMuhpwcEj0HlZRsddXPrEwj3Q= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786290360; c=relaxed/simple; bh=9YgdDQB594YhY04UhKjFUKPBBqlh+WnhU+EuLELG1mM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=V2DoR73mZH8MeW4HR9YXZqAfbnrfra06q8y0QBUbjhRDORIxgUl1FKYkasKgt3U5lD3bWj5YVMQ0wD4MvC4YAuq4Ou0duRQAiPouATyctW6AnnPwuBreX3PATgoSo2adM1Ls5MyM+cnNIwAS3v6GZ3QwTr3mwD1jVswlgfCClV0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=gORyc2qm; arc=none smtp.client-ip=74.125.224.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="gORyc2qm" Received: by mail-yx1-f49.google.com with SMTP id 956f58d0204a3-6679d88abdcso1424571d50.2 for ; Sun, 09 Aug 2026 08:45:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786290358; x=1786895158; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=KdWOIkrtO8O1vO8qraAFeciOWzTCObEsIaLYBRcPpHo=; b=gORyc2qmbXP0g1bSUjkEZFuu/Rp1MT14CSODKxzkB/2TRymuUkMr2dq+aHOJq4c2mI QRuOZIxuoC4HaNtbFVDYT199l74E0sDq70r7+gf/4MDeAadp7Ao58JXG7ZIMwLiacb+4 F39sn2ZbuZACP/d3Ms0RD9Erv/rRiTfm9tSQNVRP4Db+5CLkmdjW3OxeVEAQMKiv2Q2L Z2hXeptSTwB4FDcsv1ZhffDJBR4YrfS8ybpFT+Tm4VuMcmv9tSsCM191934wBqbVurKW AQqP6lov9I/j+ql0GY89CzaAG2oVEw3/401lRkyEpiBJ/GeOU9IZIv9ZwQebmpnX7m8O ZPlA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786290358; x=1786895158; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=KdWOIkrtO8O1vO8qraAFeciOWzTCObEsIaLYBRcPpHo=; b=DO0nPsXFqUSbg8h1JlmHKlfttk0PLH1e8J3UZI+2YfZnKdKPgL2+xZXVW1wLDuuy/q XNJRDIOPqdup9R9voGxMwyBUH7SOHdgXnngIpXvriQ8ne4ko5m8qUs+Rgbcicc9vDkl9 C6KGx/3NqvGl/JnsZYdg8jbyP2o8Qhjx1u1Zst5VYrUgRaGJEFVUHENPKPT1c7MsJAKq mgKe2SzLn3xoNN5LUVhId4we3kN/8U12R8I5OL9TbuHmvGnhVYqnvCZ2nkD5Ttoe3QWt RKsQlgkU4sRLy35NnxwetMQe7CidS3SEPRnirjC/Qp9FUDyjTH/TbovLlFy6bPdszezm OgMQ== X-Gm-Message-State: AOJu0Yy/TCCz8NfuYmCLgsq62oHhhFURAxD2A8N8itapgJsViljHIwx8 dpXdLYNp64A4Hzbise9fC5bUoqWy5OzurGmqwcMXGvD8uUj1RgBkEz+NyDVa0rpJ X-Gm-Gg: AR+sD10jkNUpPcKvLHMh0mj63xBy4QACn60H8l/DKqyCojKDrwUyLFr7mGytX3vUGlz 02WjYPc6xnD845px7kvtAfQwCzC5DC3/mU9QIieOsxFY8nQGEhSBGgoe2lEfjLD7R5cwfj03vKa qukGiaV5SXqU/lc1PReKcy6ud3n/3XYyzsq8TtEOGqTnDAd0cZsYuBc751qqi+A46TZi7nEk2Ag LQRpdXLwuSvv/ZV9EUcUEjXrhuuD0GNR1VJMS2fVxhh0iLUHvaazDb2uQRPfaDfjv3PhpVW0GqB zqSs9umDF9Shdy1KfrUzC4y9p8C1TJ83qKm7eyYW7uX29ysanmSyzjNX512SBLqvqb7ObBlTqwh mzG+FpFRacUmlZdM+REozS3Ajelq4BUKeSXBJY7i2hHeD1Pvqpd/ip4QFUHEY8+iDmhmplNxyMe deqiKHzeq6ti22R9zzv8EQmrsj47/HtVnP9/JOGlUTHYrTBpcLpcRG8deyxWalSHyibzAuR97VB dETrmi+f1YVgto+lA32UjYIPdcTr7sWKw== X-Received: by 2002:a05:690e:1552:10b0:666:541f:6355 with SMTP id 956f58d0204a3-66ad72fa49amr6636286d50.35.1786290357741; Sun, 09 Aug 2026 08:45:57 -0700 (PDT) Received: from zenbox ([2600:1700:18fb:6011:4665:53b0:3ac9:3545]) by smtp.gmail.com with ESMTPSA id 956f58d0204a3-66acacdbea9sm4838001d50.3.2026.08.09.08.45.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 09 Aug 2026 08:45:57 -0700 (PDT) From: Justin Suess To: gnoack3000@gmail.com, mic@digikod.net Cc: linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, Justin Suess Subject: [PATCH v4 5/5] samples/landlock: Add LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS to sampler Date: Sun, 9 Aug 2026 11:45:23 -0400 Message-ID: <20260809154544.1253100-6-utilityemal77@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260809154544.1253100-1-utilityemal77@gmail.com> References: <20260809154544.1253100-1-utilityemal77@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Add LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS to the default flag setting. Gate the flag on the ABI version, but do not expose any userspace control over this flag as it has no practical effect on the resulting sandbox. Signed-off-by: Justin Suess --- Notes: v3->v4: - No change. samples/landlock/sandboxer.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/samples/landlock/sandboxer.c b/samples/landlock/sandboxer.c index ac71019e6212..030583273f3f 100644 --- a/samples/landlock/sandboxer.c +++ b/samples/landlock/sandboxer.c @@ -369,7 +369,7 @@ static int add_quiet_access(const char *const env_var, return 0; } -#define LANDLOCK_ABI_LAST 10 +#define LANDLOCK_ABI_LAST 11 #define XSTR(s) #s #define STR(s) XSTR(s) @@ -453,8 +453,9 @@ int main(const int argc, char *const argv[], char *const *const envp) .quiet_scoped = 0, }; bool quiet_supported = true; - int supported_restrict_flags = LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON; - int set_restrict_flags = 0; + int supported_restrict_flags = LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON | + LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS; + int set_restrict_flags = LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS; if (argc < 2) { fprintf(stderr, help, argv[0]); @@ -545,6 +546,12 @@ int main(const int argc, char *const argv[], char *const *const envp) LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP); /* Removes quiet flags for ABI < 10 later on. */ quiet_supported = false; + __attribute__((fallthrough)); + case 10: + /* Removes LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS for ABI < 11 */ + supported_restrict_flags &= + ~LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS; + set_restrict_flags &= ~LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS; /* Must be printed for any ABI < LANDLOCK_ABI_LAST. */ fprintf(stderr, @@ -673,7 +680,8 @@ int main(const int argc, char *const argv[], char *const *const envp) } } - if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { + if (!(set_restrict_flags & LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS) && + prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { perror("Failed to restrict privileges"); goto err_close_ruleset; } -- 2.55.0