[PATCH 1/6] samples/landlock: Implement best-effort fallback for network rules.
From: Günther Noack <hidden>
Date: 2026-08-30 20:17:04
Also in:
linux-security-module, mptcp
Subsystem:
landlock security module, the rest · Maintainers:
Mickaël Salaün, Linus Torvalds
The sandboxer sample tool added network rules unconditionally, even on systems that only support lower Landlock ABI versions, resulting in errors. This change implements the correct best-effort fallback: As on older Landlock ABI versions, the given operation is not restrictable, is also does not need to be allow-listed. Signed-off-by: Günther Noack <redacted> --- samples/landlock/sandboxer.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-)
diff --git a/samples/landlock/sandboxer.c b/samples/landlock/sandboxer.c
index 030583273f3f..1c514efecafb 100644
--- a/samples/landlock/sandboxer.c
+++ b/samples/landlock/sandboxer.c@@ -198,6 +198,10 @@ static int populate_ruleset_net(const char *const env_var, const int ruleset_fd, .allowed_access = allowed_access, }; + /* A rule without access rights and flags is a no-op. */ + if (!allowed_access && !flags) + return 0; + env_port_name = getenv(env_var); if (!env_port_name) return 0;
@@ -657,19 +661,27 @@ int main(const int argc, char *const argv[], char *const *const envp) } if (populate_ruleset_net(ENV_TCP_BIND_NAME, ruleset_fd, - LANDLOCK_ACCESS_NET_BIND_TCP, 0)) { + ruleset_attr.handled_access_net & + LANDLOCK_ACCESS_NET_BIND_TCP, + 0)) { goto err_close_ruleset; } if (populate_ruleset_net(ENV_TCP_CONNECT_NAME, ruleset_fd, - LANDLOCK_ACCESS_NET_CONNECT_TCP, 0)) { + ruleset_attr.handled_access_net & + LANDLOCK_ACCESS_NET_CONNECT_TCP, + 0)) { goto err_close_ruleset; } if (populate_ruleset_net(ENV_UDP_BIND_NAME, ruleset_fd, - LANDLOCK_ACCESS_NET_BIND_UDP, 0)) { + ruleset_attr.handled_access_net & + LANDLOCK_ACCESS_NET_BIND_UDP, + 0)) { goto err_close_ruleset; } if (populate_ruleset_net(ENV_UDP_CONNECT_SEND_NAME, ruleset_fd, - LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP, 0)) { + ruleset_attr.handled_access_net & + LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP, + 0)) { goto err_close_ruleset; }
--
2.55.0