Re: [PATCH 5/6] samples/landlock: Support POSIX message queue scoping
From: Mickaël Salaün <mic@digikod.net>
Date: 2026-07-28 11:04:34
Also in:
lkml
On Wed, Jul 22, 2026 at 01:29:41PM +0100, Oxana Kharitonova wrote:
Teach the sandboxer sample to request LANDLOCK_SCOPE_POSIX_MSG_QUEUE through LL_SCOPED. Add the "q" scope selector for POSIX message queues and document it in the sample help text. Also allow POSIX message queue denials to be quieted with "posix_msg_queue" through LL_QUIET_ACCESS.
This commit message should contains an example to prove with this sandboxer that the scope actually works, or at least to show how to use it.
quoted hunk ↗ jump to hunk
Signed-off-by: Oxana Kharitonova <redacted> --- samples/landlock/sandboxer.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-)diff --git a/samples/landlock/sandboxer.c b/samples/landlock/sandboxer.c index ac71019e6212..59024ca53398 100644 --- a/samples/landlock/sandboxer.c +++ b/samples/landlock/sandboxer.c@@ -240,10 +240,12 @@ static bool check_ruleset_scope(const char *const env_var, bool error = false; bool abstract_scoping = false; bool signal_scoping = false; + bool posix_mqueue_scoping = false; /* Scoping is not supported by Landlock ABI */ if (!(ruleset_attr->scoped & - (LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET | LANDLOCK_SCOPE_SIGNAL))) + (LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET | LANDLOCK_SCOPE_SIGNAL | + LANDLOCK_SCOPE_POSIX_MSG_QUEUE))) goto out_unset; env_type_scope = getenv(env_var);@@ -260,6 +262,9 @@ static bool check_ruleset_scope(const char *const env_var, } else if (strcmp("s", ipc_scoping_name) == 0 && !signal_scoping) { signal_scoping = true; + } else if (strcmp("q", ipc_scoping_name) == 0 && + !posix_mqueue_scoping) { + posix_mqueue_scoping = true; } else { fprintf(stderr, "Unknown or duplicate scope \"%s\"\n", ipc_scoping_name);@@ -276,6 +281,8 @@ static bool check_ruleset_scope(const char *const env_var, ruleset_attr->scoped &= ~LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET; if (!signal_scoping) ruleset_attr->scoped &= ~LANDLOCK_SCOPE_SIGNAL; + if (!posix_mqueue_scoping) + ruleset_attr->scoped &= ~LANDLOCK_SCOPE_POSIX_MSG_QUEUE; unsetenv(env_var); return error;@@ -354,6 +361,9 @@ static int add_quiet_access(const char *const env_var, LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET; else if (strcmp(str_access, "signal") == 0) ruleset_attr->quiet_scoped |= LANDLOCK_SCOPE_SIGNAL; + else if (strcmp(str_access, "posix_msg_queue") == 0) + ruleset_attr->quiet_scoped |= + LANDLOCK_SCOPE_POSIX_MSG_QUEUE; else { fprintf(stderr, "Unknown quiet access \"%s\"\n", str_access);@@ -400,6 +410,7 @@ static const char help[] = "* " ENV_SCOPED_NAME ": actions denied on the outside of the landlock domain\n" " - \"a\" to restrict opening abstract unix sockets\n" " - \"s\" to restrict sending signals\n" + " - \"q\" to restrict opening POSIX message queues\n" "\n" "A sandboxer should not log denied access requests to avoid spamming logs, " "but to test audit we can set " ENV_FORCE_LOG_NAME "=1\n"@@ -416,6 +427,7 @@ static const char help[] = " - \"udp_connect\" to quiet udp connect / send denials\n" " - \"abstract_unix_socket\" to quiet abstract unix socket denials\n" " - \"signal\" to quiet signal denials\n" + " - \"posix_msg_queue\" to quiet POSIX message queue denials\n" "\n" "Example:\n" ENV_FS_RO_NAME "=\"${PATH}:/lib:/usr:/proc:/etc:/dev/urandom\" "@@ -423,7 +435,7 @@ static const char help[] = ENV_TCP_BIND_NAME "=\"9418\" " ENV_TCP_CONNECT_NAME "=\"80:443\" " ENV_UDP_CONNECT_SEND_NAME "=\"53\" " - ENV_SCOPED_NAME "=\"a:s\" " + ENV_SCOPED_NAME "=\"a:s:q\" " "%1$s bash -i\n" "\n" "This sandboxer can use Landlock features up to ABI version "-- 2.50.1 (Apple Git-155)