[PATCH 5/6] samples/landlock: Support POSIX message queue scoping

[Mickaël Salaün]

On Wed, Jul 22, 2026 at 01:29:41PM +0100, Oxana Kharitonova wrote:
> Teach the sandboxer sample to request LANDLOCK_SCOPE_POSIX_MSG_QUEUE
> through LL_SCOPED.
> 
> Add the "q" scope selector for POSIX message queues and document it in
> the sample help text. Also allow POSIX message queue denials to be
> quieted with "posix_msg_queue" through LL_QUIET_ACCESS.

This commit message should contains an example to prove with this
sandboxer that the scope actually works, or at least to show how to use
it.

> 
> Signed-off-by: Oxana Kharitonova <oxana at cloudflare.com>
> ---
>  samples/landlock/sandboxer.c | 16 ++++++++++++++--
>  1 file changed, 14 insertions(+), 2 deletions(-)
> 
> diff --git a/samples/landlock/sandboxer.c b/samples/landlock/sandboxer.c
> index ac71019e6212..59024ca53398 100644
> --- a/samples/landlock/sandboxer.c
> +++ b/samples/landlock/sandboxer.c
> @@ -240,10 +240,12 @@ static bool check_ruleset_scope(const char *const env_var,
>  	bool error = false;
>  	bool abstract_scoping = false;
>  	bool signal_scoping = false;
> +	bool posix_mqueue_scoping = false;
>  
>  	/* Scoping is not supported by Landlock ABI */
>  	if (!(ruleset_attr->scoped &
> -	      (LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET | LANDLOCK_SCOPE_SIGNAL)))
> +	      (LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET | LANDLOCK_SCOPE_SIGNAL |
> +	       LANDLOCK_SCOPE_POSIX_MSG_QUEUE)))
>  		goto out_unset;
>  
>  	env_type_scope = getenv(env_var);
> @@ -260,6 +262,9 @@ static bool check_ruleset_scope(const char *const env_var,
>  		} else if (strcmp("s", ipc_scoping_name) == 0 &&
>  			   !signal_scoping) {
>  			signal_scoping = true;
> +		} else if (strcmp("q", ipc_scoping_name) == 0 &&
> +			   !posix_mqueue_scoping) {
> +			posix_mqueue_scoping = true;
>  		} else {
>  			fprintf(stderr, "Unknown or duplicate scope \"%s\"\n",
>  				ipc_scoping_name);
> @@ -276,6 +281,8 @@ static bool check_ruleset_scope(const char *const env_var,
>  		ruleset_attr->scoped &= ~LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET;
>  	if (!signal_scoping)
>  		ruleset_attr->scoped &= ~LANDLOCK_SCOPE_SIGNAL;
> +	if (!posix_mqueue_scoping)
> +		ruleset_attr->scoped &= ~LANDLOCK_SCOPE_POSIX_MSG_QUEUE;
>  
>  	unsetenv(env_var);
>  	return error;
> @@ -354,6 +361,9 @@ static int add_quiet_access(const char *const env_var,
>  				LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET;
>  		else if (strcmp(str_access, "signal") == 0)
>  			ruleset_attr->quiet_scoped |= LANDLOCK_SCOPE_SIGNAL;
> +		else if (strcmp(str_access, "posix_msg_queue") == 0)
> +			ruleset_attr->quiet_scoped |=
> +				LANDLOCK_SCOPE_POSIX_MSG_QUEUE;
>  		else {
>  			fprintf(stderr, "Unknown quiet access \"%s\"\n",
>  				str_access);
> @@ -400,6 +410,7 @@ static const char help[] =
>  	"* " ENV_SCOPED_NAME ": actions denied on the outside of the landlock domain\n"
>  	"  - \"a\" to restrict opening abstract unix sockets\n"
>  	"  - \"s\" to restrict sending signals\n"
> +	"  - \"q\" to restrict opening POSIX message queues\n"
>  	"\n"
>  	"A sandboxer should not log denied access requests to avoid spamming logs, "
>  	"but to test audit we can set " ENV_FORCE_LOG_NAME "=1\n"
> @@ -416,6 +427,7 @@ static const char help[] =
>  	"  - \"udp_connect\" to quiet udp connect / send denials\n"
>  	"  - \"abstract_unix_socket\" to quiet abstract unix socket denials\n"
>  	"  - \"signal\" to quiet signal denials\n"
> +	"  - \"posix_msg_queue\" to quiet POSIX message queue denials\n"
>  	"\n"
>  	"Example:\n"
>  	ENV_FS_RO_NAME "=\"${PATH}:/lib:/usr:/proc:/etc:/dev/urandom\" "
> @@ -423,7 +435,7 @@ static const char help[] =
>  	ENV_TCP_BIND_NAME "=\"9418\" "
>  	ENV_TCP_CONNECT_NAME "=\"80:443\" "
>  	ENV_UDP_CONNECT_SEND_NAME "=\"53\" "
> -	ENV_SCOPED_NAME "=\"a:s\" "
> +	ENV_SCOPED_NAME "=\"a:s:q\" "
>  	"%1$s bash -i\n"
>  	"\n"
>  	"This sandboxer can use Landlock features up to ABI version "
> -- 
> 2.50.1 (Apple Git-155)
> 
>