landlock: Add support for chmod and chown system calls families

[Günther Noack]

Hello Jeffrey,

On Sun, Apr 12, 2026 at 11:50:39AM +0200, Jeffrey Bencteux wrote:
> This patch serie add support for chmod and chown system calls families
> in Landlock.
> 
> These system calls could be used when exploiting applications. Two new
> flags are added for struct landlock_ruleset_attr:
> 
> * LANDLOCK_ACCESS_FS_CHMOD
> * LANDLOCK_ACCESS_FS_CHOWN
> 
> Restriction is limited to files as the security.c hooks for both
> system calls seem to only applies to files. More digging is needed
> before being able to restrict calls to chmod and chown on directories.
> 
> It adds basic tests for both family operations, one for when it is
> allowed, one for when it is not.
> 
> First patch also fixes a bug I encountered when writing the tests.

Thanks for the initial patch!

Before you start your investigation completely from scratch,
did you see the prior work on this topic?

* https://github.com/landlock-lsm/linux/issues/11
* https://lore.kernel.org/all/20220822114701.26975-1-xiujianfeng@huawei.com/

That specific patchset was unfortunately abandoned at the time, but I
suspect that some of the discussion still applies for your patchset as
well?

In my understanding, it was in the end blocked on a LSM hook change.
(If this is needed, a common approach for doing that hook change is to
add it to the same patch series as one of the earliest commits.)

—Günther