[PATCH v2 1/3] landlock: Add LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS

[Mickaël Salaün]

I like this series.

On Fri, Jul 17, 2026 at 06:03:17PM -0400, Justin Suess wrote:
> Add a landlock_restrict_self(2) flag to set the no_new_privs attribute
> of the calling thread atomically with the enforcement of the ruleset:

It looks atomic from the caller, but really this bit is set iff the
ruleset enforcement succeed and before the call returns.  Even for user
space, when we'll have an introspection interface (e.g.  tracepoints),
user space could see inconsistencies wrt /proc/pid/status showing NNP
because both operations are not atomic.

> no_new_privs is set if and only if the call succeeds.  This removes the
> need for a prior prctl(2) PR_SET_NO_NEW_PRIVS call and guarantees that a
> failed enforcement leaves the attribute unchanged.
> 
> Because no_new_privs is set by the call itself, the no_new_privs /
> CAP_SYS_ADMIN requirement of landlock_restrict_self(2) is fulfilled by
> construction, and the related EPERM check is skipped.  As a consequence,
> an unprivileged caller passing unknown flags along with this flag gets
> EINVAL instead of EPERM.
> 
> The attribute is only set past the last point of failure, just before
> committing the new credentials.  When combined with
> LANDLOCK_RESTRICT_SELF_TSYNC, no_new_privs is set on the sibling threads
> as well, in their commit phase, with the same atomicity.
> 
> Bump the Landlock ABI version to 11.
> 
> Cc: Mickaël Salaün <mic at digikod.net>
> Signed-off-by: Justin Suess <utilityemal77 at gmail.com>
> ---
>  include/uapi/linux/landlock.h | 13 +++++++++++++
>  security/landlock/limits.h    |  2 +-
>  security/landlock/syscalls.c  | 28 +++++++++++++++++++++-------
>  security/landlock/tsync.c     |  8 ++++++--
>  security/landlock/tsync.h     |  4 +++-
>  5 files changed, 44 insertions(+), 11 deletions(-)