[PATCH 3/3] landlock: Document LANDLOCK_RESTRICT_SELF_NNP_ON_EXEC
From: Justin Suess <hidden>
Date: 2026-07-08 13:39:55
Subsystem:
documentation, landlock security module, the rest · Maintainers:
Jonathan Corbet, Mickaël Salaün, Linus Torvalds
Document staged no_new_privs on exec, following the same compatibility section style as previous ABI additions. Signed-off-by: Justin Suess <redacted> --- Documentation/userspace-api/landlock.rst | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-)
diff --git a/Documentation/userspace-api/landlock.rst b/Documentation/userspace-api/landlock.rst
index 5a63d4476c1c..1d779dd7bb5f 100644
--- a/Documentation/userspace-api/landlock.rst
+++ b/Documentation/userspace-api/landlock.rst@@ -8,7 +8,7 @@ Landlock: unprivileged access control ===================================== :Author: Mickaël Salaün -:Date: June 2026 +:Date: July 2026 The goal of Landlock is to enable restriction of ambient rights (e.g. global filesystem or network access) for a set of processes. Because Landlock
@@ -789,6 +789,25 @@ when at least one sys_landlock_add_rule() call is made for it with the ``LANDLOCK_ADD_RULE_QUIET`` flag, additional add-rule calls for the same object without this flag do not clear it. +Staged no_new_privs on exec (ABI < 11) +-------------------------------------- + +Starting with the Landlock ABI version 11, it is possible to stage +no_new_privs so that it is only set at the next :manpage:`execve(2)` of the +calling thread, past its point of no return, using the +``LANDLOCK_RESTRICT_SELF_NNP_ON_EXEC`` flag passed to +sys_landlock_restrict_self(). This flag may be used with a ``ruleset_fd`` +value of -1 to stage no_new_privs without enforcing a ruleset, and does not +relax the no_new_privs / ``CAP_SYS_ADMIN`` requirement of the system call. +This flag does not change how the next :manpage:`execve(2)` itself computes +credentials: set-user-ID, set-group-ID and file capabilities are still +honored for that execution. The executed program then runs with +no_new_privs set, with its usual effect on subsequent :manpage:`execve(2)` +calls. Staging is per-thread by default: when combined with +``LANDLOCK_RESTRICT_SELF_TSYNC``, the staged no_new_privs is propagated to +the sibling threads along with the rest of the Landlock configuration, and +each thread then sets no_new_privs at its own next :manpage:`execve(2)`. + .. _kernel_support: Kernel support
--
2.54.0