Re: [PATCH v5 7/8] samples/landlock: Add capability and namespace restriction support

Extend the sandboxer sample to demonstrate the new Landlock capability
and namespace restriction features.  LL_CAP takes a colon-delimited list
of allowed capabilities.  Numeric values are always accepted; when
libcap development files are available, use cap_from_name(3) to accept
names too.  Builds without libcap warn when capability settings are
used.  This keeps the sample buildable without optional development
files.  LL_NS takes a colon-delimited list of allowed namespace types by
short name.  Add best-effort degradation for older kernels that predate
the LANDLOCK_PERMISSION_* features.

Allow creating user and UTS namespaces but deny network namespaces, as
an unprivileged user.  The first command succeeds and sets the hostname
inside the new UTS namespace; the second is denied because the network
namespace type is not allowed:

[ ... ]
Cc: Günther Noack <gnoack@google.com>
Cc: Paul Moore <paul@paul-moore.com>
Cc: Serge E. Hallyn <serge@hallyn.com>
Cc: Tingmao Wang <redacted>
Signed-off-by: Mickaël Salaün <mic@digikod.net>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261007100255.1333386-1-mic@digikod.net?part=7