landlock security module

Most active threads (last 7 days)

Recent patches

Latest 30 postings or standalone patches (up to 30), newest first. Counts below cover matching patches in linux-security-module touching this subsystem.

• landlock: Fix REFER in layered domains v2 · 4 matching patches

  Entire posting: Pending Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH v2 1/4] landlock: Fix layer composition of LANDLOCK_ACCESS_FS_REFER 2026-11-08
  • [PATCH v2 2/4] selftests/landlock: Test that layering does not break refer 2026-11-08
  • [PATCH v2 3/4] landlock: Simplify landlock_get_fs_access_mask() 2026-11-08
  • [PATCH v2 4/4] landlock: Clarify implicit handling of LANDLOCK_ACCESS_FS_REFER 2026-11-08
  2026-11-08 · Günther Noack <hidden>
• [PATCH] docs: landlock: clarify F_SETOWN signal scoping 2026-11-08 · Shi Lecun <hidden>
• Add offsetofp() and offsetofendp() for pointer arithmetic v1 · 1 matching patch

  Entire posting: Pending Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH 2/3] treewide: Use offsetofendp() 2026-11-05
  2026-11-05 · Bence Csokas <hidden>
• landlock: Selftest fixes and cleanups v2 · 27 matching patches

  Entire posting: Pending Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH v2 01/27] selftests/landlock: Propagate grandchild failures in unix_scoping 2026-11-04
  • [PATCH v2 02/27] selftests/landlock: Propagate EXPECT failures from forked children 2026-11-04
  • [PATCH v2 03/27] selftests/landlock: Check the thread result in audit.thread 2026-11-04
  • [PATCH v2 04/27] selftests/landlock: Zero-initialize the buffer in inconsistent_attr 2026-11-04
  • [PATCH v2 05/27] selftests/landlock: Fix the openat() success check in fs_bench 2026-11-04
  • [PATCH v2 06/27] selftests/landlock: Fix the reported clock tick rate in fs_bench 2026-11-04
  • [PATCH v2 07/27] selftests/landlock: Fix the ruleset_fd check in empty_or_same_ruleset 2026-11-04
  • [PATCH v2 08/27] selftests/landlock: Handle a missing control message in recv_fd() 2026-11-04
  • [PATCH v2 09/27] selftests/landlock: Assert tracefs_extract_field() results that are used 2026-11-04
  • [PATCH v2 10/27] selftests/landlock: Assert audit initialization in fixture setups 2026-11-04
  • [PATCH v2 11/27] selftests/landlock: Assert helper results that are used afterwards 2026-11-04
  • [PATCH v2 12/27] selftests/landlock: Assert audit_count_records() before using its result 2026-11-04
  • [PATCH v2 13/27] selftests/landlock: Fix memory leak in audit_init_filter_exe() 2026-11-04
  • [PATCH v2 14/27] selftests/landlock: Make audit_message large enough for any exe filter 2026-11-04
  • [PATCH v2 15/27] selftests/landlock: Close leaked file descriptors 2026-11-04
  • [PATCH v2 16/27] selftests/landlock: Check errno for combined VERSION and ERRATA flags 2026-11-04
  • [PATCH v2 17/27] selftests/landlock: Fix SIGURG handler setup in scoped_signal_test 2026-11-04
  • [PATCH v2 18/27] selftests/landlock: Fix regex_escape() error handling in matches_log_fs_extra() 2026-11-04
  • [PATCH v2 19/27] selftests/landlock: Fix off-by-one in regex_escape() 2026-11-04
  • [PATCH v2 20/27] selftests/landlock: Fix the snprintf() error check in matches_log_fs_extra() 2026-11-04
  • [PATCH v2 21/27] selftests/landlock: Use _exit() in the named_pipe_ioctl child 2026-11-04
  • [PATCH v2 22/27] selftests/landlock: Fix messages and comments in helper programs 2026-11-04
  • [PATCH v2 23/27] selftests/landlock: Fix stale comments in common.h and audit.h 2026-11-04
  • [PATCH v2 24/27] selftests/landlock: Use ASSERT for syscall failures before errno checks 2026-11-04
  • [PATCH v2 25/27] selftests/landlock: Assert WIFEXITED() before checking the exit status 2026-11-04
  • [PATCH v2 26/27] selftests/landlock: Use EXPECT for closing FDs and stopping threads 2026-11-04
  • [PATCH v2 27/27] selftests/landlock: Use EXPECT for checks that later steps do not need 2026-11-04
  2026-11-04 · Günther Noack <hidden>
• cred: gather the "same uid" checks between tasks in one place v2 · 1 matching patch

  Entire posting: Pending Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH v2 04/13] fcntl: use cred_ids_allow_sigio() 2026-11-04
  2026-11-04 · Josef Bacik <josef@toxicpanda.com>
• [PATCH] selftests/landlock: fix the regex_escape() error check 2026-11-03 · Sasha Levin <sashal@kernel.org>
• [PATCH] selftests/landlock: print st_ino as unsigned long long 2026-11-03 · Sasha Levin <sashal@kernel.org>
• Landlock: Restrict POSIX message queue creation and access v2 · 3 matching patches

  Entire posting: Pending Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH v2 2/4] Landlock: Enforce MAKE_REG for POSIX message queue creation 2026-11-02
  • [PATCH v2 3/4] Landlock: Add POSIX message queue scoping 2026-11-02
  • [PATCH v2 4/4] samples/landlock: Add POSIX message queue scoping to sandboxer 2026-11-02
  2026-11-02 · Oxana Kharitonova <hidden>
• [PATCH 3/3] landlock: Simplify landlock_get_fs_access_mask() 2026-10-30 · Günther Noack <hidden>
• [PATCH 2/3] selftests/landlock: Test that layering does not break refer 2026-10-30 · Günther Noack <hidden>
• [PATCH 1/3] landlock: Fix layer composition of LANDLOCK_ACCESS_FS_REFER 2026-10-30 · Günther Noack <hidden>
• ns: fixes for the namespace LSM hooks v2 · 1 matching patch

  Entire posting: PENDING · 3 of 7 reviewed Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH v2 4/7] ns: allocate the namespace id before the namespace_init hook 2026-10-29
  2026-10-29 · Christian Brauner <brauner@kernel.org>
• landlock: Add READ_METADATA and WRITE_METADATA access rights v3 · 4 matching patches

  Entire posting: Pending Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH v3 -next 15/18] landlock: Add READ_METADATA and WRITE_METADATA access rights 2026-10-27
  • [PATCH v3 -next 16/18] selftests/landlock: Add tests for metadata access rights 2026-10-27
  • [PATCH v3 -next 17/18] samples/landlock: Add metadata rights to sandboxer 2026-10-27
  • [PATCH v3 -next 18/18] Documentation: Update landlock doc for metadata rights 2026-10-27
  2026-10-27 · Cai Xinchen <hidden>
• ns: fixes for the namespace LSM hooks v1 · 1 matching patch

  Entire posting: SUPERSEDED Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH 4/8] landlock: pass the namespace id to log to check_ns_type() 2026-10-26
  2026-10-26 · Christian Brauner <brauner@kernel.org>
• landlock: Add access rights on created files rfc · 2 matching patches

  Entire posting: Pending Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH RFC 2/3] landlock: Add access rights on created files 2026-10-24
  • [PATCH RFC 3/3] selftests/landlock: Test LANDLOCK_ADD_RULE_CREATED 2026-10-24
  2026-10-24 · Farid Zakaria <hidden>
• cred: gather the "same uid" checks between tasks in one place v1 · 1 matching patch

  Entire posting: SUPERSEDED Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH 04/13] fcntl: use cred_ids_allow_sigio() 2026-10-18
  2026-10-18 · Josef Bacik <josef@toxicpanda.com>
• landlock: Add READ_METADATA and WRITE_METADATA access rights v2 · 9 matching patches

  Entire posting: SUPERSEDED Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH v2 -next 09/18] landlock: Add READ_METADATA and WRITE_METADATA access rights 2026-10-15
  • [PATCH v2 -next 10/18] LSM: rename inode_getattr to path_getattr 2026-10-15
  • [PATCH v2 -next 11/18] LSM: rename inode_setattr to path_setattr 2026-10-15
  • [PATCH v2 -next 12/18] LSM: rename the inode xattr hooks to path_xattr hooks 2026-10-15
  • [PATCH v2 -next 13/18] LSM: rename the inode posix acl hooks to path_*_acl hooks 2026-10-15
  • [PATCH v2 -next 14/18] LSM: rename the inode fileattr hooks to path_file_* hooks 2026-10-15
  • [PATCH v2 -next 16/18] selftests/landlock: Add tests for metadata access rights 2026-10-15
  • [PATCH v2 -next 17/18] samples/landlock: Add metadata rights to sandboxer 2026-10-15
  • [PATCH v2 -next 18/18] Documentation: Update landlock doc for metadata rights 2026-10-15
  2026-10-15 · Cai Xinchen <hidden>
• vfs: add inode iteration method super_iter_inodes v1 · 1 matching patch

  Entire posting: Pending Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH 3/3] vfs: convert sb->s_inodes iteration to super_iter_inodes() 2026-10-15
  2026-10-15 · Huang Shijie <hidden>
• Landlock: Namespace and capability control v6 · 8 matching patches

  Entire posting: LANDED Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH v6 1/8] landlock: Rename quiet_masks to quiet_access 2026-10-14
  • [PATCH v6 2/8] landlock: Wrap per-layer access masks in struct layer_config 2026-10-14
  • [PATCH v6 3/8] landlock: Enforce namespace use restrictions 2026-10-14
  • [PATCH v6 4/8] landlock: Enforce capability restrictions 2026-10-14
  • [PATCH v6 5/8] selftests/landlock: Add namespace restriction tests 2026-10-14
  • [PATCH v6 6/8] selftests/landlock: Add capability restriction tests 2026-10-14
  • [PATCH v6 7/8] samples/landlock: Add capability and namespace restriction support 2026-10-14
  • [PATCH v6 8/8] landlock: Add documentation for capability and namespace restrictions 2026-10-14
  2026-10-14 · Mickaël Salaün <mic@digikod.net>
• fs: unified VFS ancestor walk for Landlock and BPF v1 · 1 matching patch

  Entire posting: Pending Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH bpf-next v1 03/11] landlock: convert ancestor walk to vfs_walk_ancestors() 2026-10-13
  2026-10-13 · Justin Suess <hidden>
• LANDED [PATCH] landlock: Drop __counted_by from landlock_domain.layers 2026-10-10 · Nguyen Ngoc Thang <hidden>
• landlock: Selftest fixes and cleanups v1 · 27 matching patches

  Entire posting: SUPERSEDED Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH 01/27] selftests/landlock: Propagate grandchild failures in unix_scoping 2026-10-08
  • [PATCH 02/27] selftests/landlock: Propagate EXPECT failures from forked children 2026-10-08
  • [PATCH 03/27] selftests/landlock: Check the thread result in audit.thread 2026-10-08
  • [PATCH 04/27] selftests/landlock: Zero-initialize the buffer in inconsistent_attr 2026-10-08
  • [PATCH 05/27] selftests/landlock: Fix the openat() success check in fs_bench 2026-10-08
  • [PATCH 06/27] selftests/landlock: Fix the reported clock tick rate in fs_bench 2026-10-08
  • [PATCH 07/27] selftests/landlock: Fix the ruleset_fd check in empty_or_same_ruleset 2026-10-08
  • [PATCH 08/27] selftests/landlock: Handle a missing control message in recv_fd() 2026-10-08
  • [PATCH 09/27] selftests/landlock: Assert tracefs_extract_field() results that are used 2026-10-08
  • [PATCH 10/27] selftests/landlock: Assert audit initialization in fixture setups 2026-10-08
  • [PATCH 11/27] selftests/landlock: Assert helper results that are used afterwards 2026-10-08
  • [PATCH 12/27] selftests/landlock: Assert audit_count_records() before using its result 2026-10-08
  • [PATCH 13/27] selftests/landlock: Fix memory leak in audit_init_filter_exe() 2026-10-08
  • [PATCH 14/27] selftests/landlock: Make audit_message large enough for any exe filter 2026-10-08
  • [PATCH 15/27] selftests/landlock: Close leaked file descriptors 2026-10-08
  • [PATCH 16/27] selftests/landlock: Check errno for combined VERSION and ERRATA flags 2026-10-08
  • [PATCH 17/27] selftests/landlock: Fix SIGURG handler setup in scoped_signal_test 2026-10-08
  • [PATCH 18/27] selftests/landlock: Fix regex_escape() error handling in matches_log_fs_extra() 2026-10-08
  • [PATCH 19/27] selftests/landlock: Fix off-by-one in regex_escape() 2026-10-08
  • [PATCH 20/27] selftests/landlock: Fix the snprintf() error check in matches_log_fs_extra() 2026-10-08
  • [PATCH 21/27] selftests/landlock: Use _exit() in the named_pipe_ioctl child 2026-10-08
  • [PATCH 22/27] selftests/landlock: Fix messages and comments in helper programs 2026-10-08
  • [PATCH 23/27] selftests/landlock: Fix stale comments in common.h and audit.h 2026-10-08
  • [PATCH 24/27] selftests/landlock: Use ASSERT for syscall failures before errno checks 2026-10-08
  • [PATCH 25/27] selftests/landlock: Assert WIFEXITED() before checking the exit status 2026-10-08
  • [PATCH 26/27] selftests/landlock: Use EXPECT for closing FDs and stopping threads 2026-10-08
  • [PATCH 27/27] selftests/landlock: Use EXPECT for checks that later steps do not need 2026-10-08
  2026-10-08 · Günther Noack <hidden>
• [PATCH] landlock: Move the domain layer counter out of the anonymous union 2026-10-07 · Abel Vesa <hidden>
• Landlock: Namespace and capability control v5 · 8 matching patches

  Entire posting: SUPERSEDED Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH v5 1/8] landlock: Rename quiet_masks to quiet_access 2026-10-07
  • [PATCH v5 2/8] landlock: Wrap per-layer access masks in struct layer_config 2026-10-07
  • [PATCH v5 3/8] landlock: Enforce namespace use restrictions 2026-10-07
  • [PATCH v5 4/8] landlock: Enforce capability restrictions 2026-10-07
  • [PATCH v5 5/8] selftests/landlock: Add namespace restriction tests 2026-10-07
  • [PATCH v5 6/8] selftests/landlock: Add capability restriction tests 2026-10-07
  • [PATCH v5 7/8] samples/landlock: Add capability and namespace restriction support 2026-10-07
  • [PATCH v5 8/8] landlock: Add documentation for capability and namespace restrictions 2026-10-07
  2026-10-07 · Mickaël Salaün <mic@digikod.net>
• LANDED [PATCH] landlock: Fix superblock use-after-free in release_inode() 2026-10-06 · Günther Noack <gnoack@google.com>
• fs: unified VFS ancestor walk for Landlock and BPF rfc · 1 matching patch

  Entire posting: Pending Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [RFC PATCH bpf-next 03/12] landlock: convert ancestor walk to vfs_walk_ancestors() 2026-10-06
  2026-10-06 · Justin Suess <hidden>
• Landlock: Namespace and capability control v4 · 8 matching patches

  Entire posting: SUPERSEDED Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH v4 1/8] landlock: Rename quiet_masks to quiet_access 2026-10-02
  • [PATCH v4 2/8] landlock: Wrap per-layer access masks in struct layer_config 2026-10-02
  • [PATCH v4 3/8] landlock: Enforce namespace use restrictions 2026-10-02
  • [PATCH v4 4/8] landlock: Enforce capability restrictions 2026-10-02
  • [PATCH v4 5/8] selftests/landlock: Add namespace restriction tests 2026-10-02
  • [PATCH v4 6/8] selftests/landlock: Add capability restriction tests 2026-10-02
  • [PATCH v4 7/8] samples/landlock: Add capability and namespace restriction support 2026-10-02
  • [PATCH v4 8/8] landlock: Add documentation for capability and namespace restrictions 2026-10-02
  2026-10-02 · Mickaël Salaün <mic@digikod.net>
• landlock: Add READ_METADATA and WRITE_METADATA access rights rfc · 5 matching patches

  Entire posting: SUPERSEDED Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH RFC -next 08/12] landlock: Add READ_METADATA and WRITE_METADATA access rights 2026-09-24
  • [PATCH RFC -next 09/12] landlock: Implement metadata access hooks 2026-09-24
  • [PATCH RFC -next 10/12] selftests/landlock: Add tests for metadata access rights 2026-09-24
  • [PATCH RFC -next 11/12] samples/landlock: Add metadata rights to sandboxer 2026-09-24
  • [PATCH RFC -next 12/12] Documentation: Update landlock doc for metadata rights 2026-09-24
  2026-09-24 · Cai Xinchen <hidden>
• [PATCH] landlock: Fix domain leak on concurrent F_SETOWN and file release 2026-09-24 · Jiakai Xu <hidden>
• landlock: clarify TTY signal scoping v3 · 2 matching patches

  Entire posting: Pending Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH v3 1/2] docs: landlock: clarify TTY signal scoping 2026-09-23
  • [PATCH v3 2/2] selftests/landlock: cover TTY signal scoping 2026-09-23
  2026-09-23 · Christopher Lusk <hidden>