[PATCH v2 1/3] landlock: Add LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS

[Justin Suess]

On Fri, Jul 31, 2026 at 11:29:28PM +0200, Mickaël Salaün wrote:
> I like this series.
> 
Thanks!

> On Fri, Jul 17, 2026 at 06:03:17PM -0400, Justin Suess wrote:
> > Add a landlock_restrict_self(2) flag to set the no_new_privs attribute
> > of the calling thread atomically with the enforcement of the ruleset:
> 
> It looks atomic from the caller, but really this bit is set iff the
> ruleset enforcement succeed and before the call returns.  Even for user
> space, when we'll have an introspection interface (e.g.  tracepoints),
> user space could see inconsistencies wrt /proc/pid/status showing NNP
> because both operations are not atomic.
>

True, I did not consider the tracepoint perspective. Words mean things,
so "atomic" isn't the best choice of words when it's really an ordering
guarantee. (nnp set if and only if enforcement already succeeded).

I'll send a revised version next week (I don't have any objections to
any of your proposed changes)

Justin

> > no_new_privs is set if and only if the call succeeds.  This removes the
> > need for a prior prctl(2) PR_SET_NO_NEW_PRIVS call and guarantees that a
> > failed enforcement leaves the attribute unchanged.
> > 
> > Because no_new_privs is set by the call itself, the no_new_privs /
> > CAP_SYS_ADMIN requirement of landlock_restrict_self(2) is fulfilled by
> > construction, and the related EPERM check is skipped.  As a consequence,
> > an unprivileged caller passing unknown flags along with this flag gets
> > EINVAL instead of EPERM.
> > 
> > The attribute is only set past the last point of failure, just before
> > committing the new credentials.  When combined with
> > LANDLOCK_RESTRICT_SELF_TSYNC, no_new_privs is set on the sibling threads
> > as well, in their commit phase, with the same atomicity.
> > 
> > Bump the Landlock ABI version to 11.
> > 
> > Cc: Mickaël Salaün <mic at digikod.net>
> > Signed-off-by: Justin Suess <utilityemal77 at gmail.com>
> > ---
> >  include/uapi/linux/landlock.h | 13 +++++++++++++
> >  security/landlock/limits.h    |  2 +-
> >  security/landlock/syscalls.c  | 28 +++++++++++++++++++++-------
> >  security/landlock/tsync.c     |  8 ++++++--
> >  security/landlock/tsync.h     |  4 +++-
> >  5 files changed, 44 insertions(+), 11 deletions(-)