[GIT PULL] Landlock update for v7.2-rc1
From: Mickaël Salaün <mic@digikod.net>
Date: 2026-06-19 08:35:20
Also in:
lkml
Hi, This PR adds new Landlock access rights to control UDP bind and connect/send operations, and a new "quiet" feature to mute specific audit logs (and other future observability events). A few commits also fix Landlock issues. Please pull these changes for v7.2-rc1 . These commits merge cleanly with your master branch. Most kernel changes have been tested in the latest linux-next releases for some weeks, and I waited a bit more since last week to make sure the changes brought by the recently squashed fixes are ok. Test coverage for security/landlock is 91.5% of 2351 lines according to LLVM 22, and it was 90.9% of 2176 lines before this PR. syzkaller changes have been developed to cover these new features: https://github.com/google/syzkaller/pull/7493 Regards, Mickaël -- The following changes since commit 5d6919055dec134de3c40167a490f33c74c12581: Linux 7.1-rc3 (2026-05-10 14:08:09 -0700) are available in the Git repository at: https://git.kernel.org/pub/scm/linux/kernel/git/mic/linux.git tags/landlock-7.2-rc1 for you to fetch changes up to 1c236e7fe740a009ad8dd40a5ee0602ec402fffe: selftests/landlock: Add tests for invalid use of quiet flag (2026-06-14 20:17:25 +0200) ---------------------------------------------------------------- Landlock update for v7.2-rc1 ---------------------------------------------------------------- Bryam Vargas (2): landlock: Fix LANDLOCK_SCOPE_SIGNAL bypass on the SIGIO path selftests/landlock: Test SCOPE_SIGNAL on the SIGIO/fowner pgid path Matthieu Buffet (7): landlock: Fix unmarked concurrent access to socket family landlock: Add UDP bind() access control landlock: Add UDP send+connect access control selftests/landlock: Add tests for UDP bind/connect selftests/landlock: Add tests for UDP send samples/landlock: Add sandboxer UDP access control landlock: Add documentation for UDP support Maximilian Heyne (1): selftests/landlock: Explicitly disable audit in teardowns Mickaël Salaün (5): selftests/landlock: Filter dealloc records in audit_count_records() selftests/landlock: Increase default audit socket timeout landlock: Set audit_net.sk for socket access checks landlock: Account all audit data allocations to user space landlock: Demonstrate best-effort allowed_access filtering Tingmao Wang (9): landlock: Add a place for flags to layer rules landlock: Add API support and docs for the quiet flags landlock: Suppress logging when quiet flag is present samples/landlock: Add quiet flag support to sandboxer selftests/landlock: Replace hard-coded 16 with a constant selftests/landlock: Add tests for quiet flag with fs rules selftests/landlock: Add tests for quiet flag with net rules selftests/landlock: Add tests for quiet flag with scope selftests/landlock: Add tests for invalid use of quiet flag Documentation/admin-guide/LSM/landlock.rst | 13 +- Documentation/userspace-api/landlock.rst | 145 +- include/uapi/linux/landlock.h | 97 +- samples/landlock/sandboxer.c | 175 +- security/landlock/access.h | 44 +- security/landlock/audit.c | 292 ++- security/landlock/audit.h | 3 +- security/landlock/domain.c | 66 +- security/landlock/domain.h | 16 +- security/landlock/fs.c | 171 +- security/landlock/fs.h | 29 +- security/landlock/limits.h | 5 +- security/landlock/net.c | 185 +- security/landlock/net.h | 5 +- security/landlock/ruleset.c | 49 +- security/landlock/ruleset.h | 29 +- security/landlock/syscalls.c | 73 +- security/landlock/task.c | 11 + tools/testing/selftests/landlock/audit.h | 140 +- tools/testing/selftests/landlock/audit_test.c | 33 +- tools/testing/selftests/landlock/base_test.c | 122 +- tools/testing/selftests/landlock/common.h | 2 + tools/testing/selftests/landlock/fs_test.c | 2445 +++++++++++++++++++- tools/testing/selftests/landlock/net_test.c | 1392 ++++++++++- tools/testing/selftests/landlock/ptrace_test.c | 1 + .../selftests/landlock/scoped_abstract_unix_test.c | 78 +- .../selftests/landlock/scoped_signal_test.c | 182 ++ 27 files changed, 5368 insertions(+), 435 deletions(-)