Re: [PATCH 0/6] landlock: Add POSIX message queue scoping

Hi Oxana,

Thanks for this patch series.  Overall it looks good but you'll find
some feedback to improve and send a v2, following Günther's and Justin's
ones.

You should also Cc Christian and Al and ask for a review of the
mqueue-specific patches (e.g. patch 1) for v2.

You'll find AI reviews here:
https://sashiko.dev/#/patchset/20260722122952.42149-1-oxana%40cloudflare.com

A test should create a domain that denies LANDLOCK_ACCESS_FS_READ_FILE
and make sure the msgqueue scoping control stays the same.

The question about unlinking mqueue is a bit tricky.  I don't think this
should be restricted by an mqueue scope because that would mean that a
sandboxed process creating an mqueue would not be able to remove the
next time the same sandboxed program tries to clean up its files.  So,
we should check if such file are automatically removed if its creator
exits.  In any case, this should at least be documented in the user
documentation.

The user doc should explain this new scope (see previous scope addition
for examples).

tools/testing/selftests/landlock/config must be updated with
CONFIG_POSIX_MQUEUE=y

Other questions/comments should either be answered to explain why they
don't make sense or otherwise be implemented with v2.


On Wed, Jul 22, 2026 at 01:29:36PM +0100, Oxana Kharitonova wrote:

Hi,

This series adds landlock support for scoping POSIX message queuesi [1].

Nit: Landlock (in all docs, comments, and messages).

 
Landlock already supports scoped IPC restrictions for signals and abstract
UNIX sockets. These restrictions make it possible to prevent a sandboxed
task from interacting with IPC objects outside of its Landlock domain,
while still allowing communication within the same domain or with nested
domains.
 
This series extends the same model to POSIX message queues with a new
LANDLOCK_SCOPE_POSIX_MSG_QUEUE scope. When this scope is enforced, a task
can only open POSIX message queues that were created by a task in the same
landlock domain or in a nested domain.
 
The implementation tags mqueuefs inodes at creation time with the creator's
landlock domain. This domain is kept alive for the lifetime of the inode
and is checked when the queue is opened.
 
The series also exposes the mqueuefs magic number through the shared UAPI
magic header, bumps the Landlock ABI, updates documentation, adds sandboxer
support, and adds selftests.
 
The new behavior is:
 
- a task restricted with LANDLOCK_SCOPE_POSIX_MSG_QUEUE cannot open a queue
  created outside of its Landlock scope;
- a task can still open a queue created within its own Landlock domain;
- queues created outside of any Landlock domain are treated as outside the
  scope for a scoped opener.

[1] https://man7.org/linux/man-pages/man7/mq_overview.7.html

Oxana Kharitonova (6):
  ipc: Move mqueue fs magic to uapi magic header
  landlock: Scope POSIX message queue opens
  landlock: Bump ABI for LANDLOCK_SCOPE_POSIX_MSG_QUEUE
  selftests/landlock: Test POSIX message queue scoping
  samples/landlock: Support POSIX message queue scoping
  landlock: Document POSIX message queue scoping

 Documentation/admin-guide/LSM/landlock.rst    |   6 +-
 Documentation/userspace-api/landlock.rst      |  11 +-
 include/uapi/linux/landlock.h                 |   7 +-
 include/uapi/linux/magic.h                    |   2 +
 ipc/mqueue.c                                  |   2 +-
 samples/landlock/sandboxer.c                  |  16 +-
 security/landlock/audit.c                     |   9 +
 security/landlock/audit.h                     |   1 +
 security/landlock/fs.c                        |  35 +++
 security/landlock/fs.h                        |  15 ++
 security/landlock/limits.h                    |   2 +-
 security/landlock/ruleset.c                   |   1 -
 security/landlock/syscalls.c                  |   2 +-
 security/landlock/task.c                      |  43 ++++
 security/landlock/task.h                      |   4 +
 tools/testing/selftests/landlock/base_test.c  |   2 +-
 .../landlock/scoped_posix_msg_queue_test.c    | 223 ++++++++++++++++++
 .../testing/selftests/landlock/scoped_test.c  |   2 +-
 18 files changed, 371 insertions(+), 12 deletions(-)
 create mode 100644 tools/testing/selftests/landlock/scoped_posix_msg_queue_test.c

-- 
2.50.1 (Apple Git-155)