landlock: Add support for chmod and chown system calls families

Jeffrey Bencteux jeff at bencteux.fr
Sun Apr 12 09:50:39 UTC 2026


Hi,

This patch serie add support for chmod and chown system calls families
in Landlock.

These system calls could be used when exploiting applications. Two new
flags are added for struct landlock_ruleset_attr:

* LANDLOCK_ACCESS_FS_CHMOD
* LANDLOCK_ACCESS_FS_CHOWN

Restriction is limited to files as the security.c hooks for both
system calls seem to only applies to files. More digging is needed
before being able to restrict calls to chmod and chown on directories.

It adds basic tests for both family operations, one for when it is
allowed, one for when it is not.

First patch also fixes a bug I encountered when writing the tests.




More information about the Linux-security-module-archive mailing list