linux-kernel - [GIT PULL] Landlock update for v7.0-rc1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20260211141302.1134092-1-mic@digikod.net>
Date: Wed, 11 Feb 2026 15:13:02 +0100
From: Mickaël Salaün <mic@...ikod.net>
To: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: Mickaël Salaün <mic@...ikod.net>,
	Günther Noack <gnoack@...gle.com>,
	Matthieu Buffet <matthieu@...fet.re>,
	Samasth Norway Ananda <samasth.norway.ananda@...cle.com>,
	linux-kernel@...r.kernel.org,
	linux-security-module@...r.kernel.org
Subject: [GIT PULL] Landlock update for v7.0-rc1

Hi,

These changes extend Landlock to enforce restrictions on a whole
process, similarly to the seccomp's TSYNC flag.  Data structure
refactoring simplifies code and improves performance.  Documentation is
extended to cover missing parts.

Please pull these changes for v7.0-rc1 .  These commits merge cleanly
with your master branch.  The kernel changes have been tested in the
latest linux-next releases for some weeks, but I rebased the last
commits to fix a kselftest build issue on old distros, and to add a
review tag.

Test coverage for security/landlock is 91.4% of 2093 lines according to
LLVM 21, and it was 91.9% of 1933 lines before this PR.

Regards,
 Mickaël


PS: I recently updated my PGP key:
    https://lore.kernel.org/keys/20260206.waiCh9iex3ai@digikod.net/

--
The following changes since commit 24d479d26b25bce5faea3ddd9fa8f3a6c3129ea7:

  Linux 6.19-rc6 (2026-01-18 15:42:45 -0800)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/mic/linux.git tags/landlock-7.0-rc1

for you to fetch changes up to e265b330b93e3a3f9ff5256451d4f09b5f89b239:

  mailmap: Add entry for Mickaël Salaün (2026-02-11 12:03:44 +0100)

----------------------------------------------------------------
Landlock update for v7.0-rc1

----------------------------------------------------------------
Günther Noack (6):
      landlock: Multithreading support for landlock_restrict_self()
      selftests/landlock: Add LANDLOCK_RESTRICT_SELF_TSYNC tests
      landlock: Document LANDLOCK_RESTRICT_SELF_TSYNC
      selftests/landlock: Add filesystem access benchmark
      landlock: Add access_mask_subset() helper
      landlock: Transpose the layer masks data structure

Matthieu Buffet (2):
      landlock: Minor reword of docs for TCP access rights
      landlock: Refactor TCP socket type check

Mickaël Salaün (1):
      mailmap: Add entry for Mickaël Salaün

Samasth Norway Ananda (3):
      landlock: Add backwards compatibility for restrict flags
      landlock: Add errata documentation section
      landlock: Document audit blocker field format

 .mailmap                                      |   1 +
 Documentation/admin-guide/LSM/landlock.rst    |  35 +-
 Documentation/userspace-api/landlock.rst      | 105 ++++-
 include/uapi/linux/landlock.h                 |  30 +-
 security/landlock/Makefile                    |  11 +-
 security/landlock/access.h                    |  35 +-
 security/landlock/audit.c                     |  81 ++--
 security/landlock/audit.h                     |   3 +-
 security/landlock/cred.h                      |  12 +
 security/landlock/domain.c                    |  44 +-
 security/landlock/domain.h                    |   3 +-
 security/landlock/errata/abi-1.h              |   8 +
 security/landlock/errata/abi-4.h              |   7 +
 security/landlock/errata/abi-6.h              |  10 +
 security/landlock/fs.c                        | 352 ++++++++--------
 security/landlock/limits.h                    |   2 +-
 security/landlock/net.c                       |  30 +-
 security/landlock/ruleset.c                   |  91 ++---
 security/landlock/ruleset.h                   |   6 +-
 security/landlock/syscalls.c                  |  65 +--
 security/landlock/tsync.c                     | 561 ++++++++++++++++++++++++++
 security/landlock/tsync.h                     |  16 +
 tools/testing/selftests/landlock/.gitignore   |   1 +
 tools/testing/selftests/landlock/Makefile     |   1 +
 tools/testing/selftests/landlock/base_test.c  |   8 +-
 tools/testing/selftests/landlock/fs_bench.c   | 214 ++++++++++
 tools/testing/selftests/landlock/tsync_test.c | 161 ++++++++
 27 files changed, 1490 insertions(+), 403 deletions(-)
 create mode 100644 security/landlock/tsync.c
 create mode 100644 security/landlock/tsync.h
 create mode 100644 tools/testing/selftests/landlock/fs_bench.c
 create mode 100644 tools/testing/selftests/landlock/tsync_test.c