From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ed1-f54.google.com (mail-ed1-f54.google.com [209.85.208.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 358FC375F65 for ; Wed, 22 Jul 2026 12:30:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.54 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784723415; cv=none; b=ZHIXVSEeTqWEqOlqhCGQlnPLSFHhnVahMbk2mvjEc5LHLlPrphHxGSG2EXndHwZ/WayGgbGcXMlNWyDB8UGbGtsiMDsHhsRDIso3DKlKIjY8QTxzoMIB+BwADWXbGjB/unXiQ37reH2DqsDpUs8Kd/3XiDqhllxpzHa+shpMCc0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784723415; c=relaxed/simple; bh=XXP6So6EytIRNbavWUyVFlypJEjg8u4P/XJmPMsD3mg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=XHyS03eJgEHr2HilL7NqVNrUqCJ6J4Kl8foJkUJQoxih1UyO69ieaoFLu3RjObGx3DH2s9Og05hmt6G+VOpTELkFD0p5iA/W5p7sE0lr4X5jLUoMD5fe6arnKelXVvsSQrnCqmzJlUs7O5GikpY5ld0Uau7USmo474hIAAEF2tY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=cloudflare.com; spf=pass smtp.mailfrom=cloudflare.com; dkim=pass (2048-bit key) header.d=cloudflare.com header.i=@cloudflare.com header.b=OvNL3QxQ; arc=none smtp.client-ip=209.85.208.54 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=cloudflare.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cloudflare.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cloudflare.com header.i=@cloudflare.com header.b="OvNL3QxQ" Received: by mail-ed1-f54.google.com with SMTP id 4fb4d7f45d1cf-6986287534eso22872055a12.3 for ; Wed, 22 Jul 2026 05:30:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloudflare.com; s=google09082023; t=1784723411; x=1785328211; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=P42HCFpkq11qC2COB01ikocfGvftDj76wdm0yvbU3UM=; b=OvNL3QxQTxJ4/10TiccCe/IxeCcHtK6AT+Z+TrFFD7NYOk1VTYL9HrAYj0pG4KXWpa ndu8vHarLB5XaXIxwlT8geiWSr2XR5jE7GV/EwF15dq9RhJzSbVlwr6XxGmShMBwIfv9 ehthctNHUnxiJHES0GHpal0AaOOsMGSXD+LwQjJX7F+u5PRsD/Z6WIn3xNEthEhdbufF SQJxbtRM7CitP2JtOMjYT6806tlGaVjTLP57w/LjayU41YLa95mwPI6CmnLaQsNZTDGU xz8ZlEAlHdmIp26Yk9h3hbTcZDfUZLp/jSEUIxlfl/Ii/0SWLfT5YC2DiRWVN0wB6Dhm gDIQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784723411; x=1785328211; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=P42HCFpkq11qC2COB01ikocfGvftDj76wdm0yvbU3UM=; b=SjrkLrtAgcvA1QIqtlFRyOD9K3tfiK4ie1g204F/Xf3OeJvq7TghV17JuLvteDV64E VO4SgGNdcUSuxUNACUpKhCjno3YefgjeqMk8hyXGXwKkI2LtT9lZVjAW3xMGAUC7/t9Z 32gmdyuuIqBE5O1QZGQC21CsjtOT6GUTRG4KeBUmTil9FeOpdE5TsUgKybipZu0R9KDC 5Ad0Umj8E+C1ePDriymzwS2mm1QwDjRISIT3mXFse45V9kyIJxWGH08IEELPpu1Uq3GT p4z1E3aE5AS8OVVAAJb/q5ccR9OIinipA/tWIzSlpiU1H8vDbEcdhRA48BCwJz8AVrJz HseQ== X-Forwarded-Encrypted: i=1; AHgh+RrRq11vhwz+jmOo449lK3ufosCj8d/QDWpNolaGYppr0sDN0sSdpU4ujZ/cWqCqS6MWjfhiMSWzBRGjt0Y=@vger.kernel.org X-Gm-Message-State: AOJu0YxTFu4mq+bzmB3QLprX+Fq3/FSZ4kezlmyUsX+V4zwtoEfCLr9a ra30Ga9GCqmAvgVb5ZwYusbfmZGOH5W8PqkLqRbEfVhIntnamCBq6YMqcXCumN3p/bM= X-Gm-Gg: AR+sD11vk0O1DO0yHeGOTAxORCZslL6RQF2jcJlSDMBG0D5noWBi2v7iVBFesmQslSD 8ab+IdgwiWTQEgCu5qKOTICKm8BT5wgqhSCeXvYQwpQtpV66ACZ+WoeGBvqKK+IGYVw+1TwwC86 LPS/4O8QUxM/V4cr1pTA87ji7GQ6y7NDnNYXLjCO+fic5nyL+V31/vnn/OBQ7mjRwn9qd0tv7Qr W0BEsr8rM9gKh5vJoU6a0CYi+8Bxf4sJhDRhx66myvHTlxDi90WOEzHo+/3ua+wwyoXMqSpHAMw gs9wOsyJlnTcH239Zhbqsna4UFJyxjkrx+9tu7b+J91MJz6abZX/RCqkooVG1xZDLJhE33zBoLX KyCzmjx+EwDljJfAi7hyCsbYi9hqy4bZ9Cyc+TydeDjeXmH8rQiYt02xX0MKFijc8FyLzDBVHIQ == X-Received: by 2002:a05:6402:4402:b0:69c:9197:4413 with SMTP id 4fb4d7f45d1cf-69e652dfccemr9233139a12.36.1784723410993; Wed, 22 Jul 2026 05:30:10 -0700 (PDT) Received: from DW927H4LGF ([2a09:bac6:37e6:1e5a::306:2]) by smtp.gmail.com with ESMTPSA id 4fb4d7f45d1cf-69f34f1b867sm835007a12.14.2026.07.22.05.30.09 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Wed, 22 Jul 2026 05:30:10 -0700 (PDT) From: Oxana Kharitonova To: mic@digikod.net, gnoack@google.com Cc: paul@paul-moore.com, jmorris@namei.or, serge@hallyn.com, wangyan01@kylinos.cn, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, landlock@lists.linux.dev, oxana@cloudflare.com, webprosto@gmail.com Subject: [PATCH 6/6] landlock: Document POSIX message queue scoping Date: Wed, 22 Jul 2026 13:29:42 +0100 Message-ID: <20260722122952.42149-7-oxana@cloudflare.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260722122952.42149-1-oxana@cloudflare.com> References: <20260722122952.42149-1-oxana@cloudflare.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Document LANDLOCK_SCOPE_POSIX_MSG_QUEUE in the userspace API and UAPI kernel-doc. Signed-off-by: Oxana Kharitonova --- Documentation/admin-guide/LSM/landlock.rst | 6 ++++-- Documentation/userspace-api/landlock.rst | 11 ++++++++++- include/uapi/linux/landlock.h | 6 +++++- 3 files changed, 19 insertions(+), 4 deletions(-) diff --git a/Documentation/admin-guide/LSM/landlock.rst b/Documentation/admin-guide/LSM/landlock.rst index 8eb85c9381ff..1ecb2017271b 100644 --- a/Documentation/admin-guide/LSM/landlock.rst +++ b/Documentation/admin-guide/LSM/landlock.rst @@ -60,9 +60,11 @@ AUDIT_LANDLOCK_ACCESS - net.bind_udp - UDP port binding was denied - net.connect_send_udp - UDP connection and send was denied - **scope.*** - IPC scoping restrictions (ABI 6+): + **scope.*** - IPC scoping restrictions: - scope.abstract_unix_socket - Abstract UNIX socket connection denied - - scope.signal - Signal sending denied + (ABI 6+) + - scope.signal - Signal sending denied (ABI 6+) + - scope.posix_msg_queue - POSIX message queue opening denied (ABI 11+) Multiple blockers can appear in a single event (comma-separated) when multiple access rights are missing. For example, creating a regular file diff --git a/Documentation/userspace-api/landlock.rst b/Documentation/userspace-api/landlock.rst index 5a63d4476c1c..c4fa84e6d281 100644 --- a/Documentation/userspace-api/landlock.rst +++ b/Documentation/userspace-api/landlock.rst @@ -86,7 +86,8 @@ to be explicit about the denied-by-default access rights. LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP, .scoped = LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET | - LANDLOCK_SCOPE_SIGNAL, + LANDLOCK_SCOPE_SIGNAL | + LANDLOCK_SCOPE_POSIX_MSG_QUEUE, }; Because we may not know which kernel version an application will be executed @@ -140,6 +141,10 @@ version, and only use the available subset of access rights: ruleset_attr.handled_access_net &= ~(LANDLOCK_ACCESS_NET_BIND_UDP | LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP); + __attribute__((fallthrough)); + case 10: + /* Removes LANDLOCK_SCOPE_POSIX_MSG_QUEUE for ABI < 11 */ + ruleset_attr.scoped &= ~LANDLOCK_SCOPE_POSIX_MSG_QUEUE; } This enables the creation of an inclusive ruleset that will contain our rules. @@ -420,6 +425,10 @@ The operations which can be scoped are: A :manpage:`sendto(2)` on a socket which was previously connected will not be restricted. This works for both datagram and stream sockets. +``LANDLOCK_SCOPE_POSIX_MSG_QUEUE`` + This limits opening POSIX message queues to queues created by a process in + the same or a nested Landlock domain. + IPC scoping does not support exceptions via :manpage:`landlock_add_rule(2)`. If an operation is scoped within a domain, no rules can be added to allow access to resources or processes outside of the scope. diff --git a/include/uapi/linux/landlock.h b/include/uapi/linux/landlock.h index 96d0c3b423ac..21ba31ad4d4b 100644 --- a/include/uapi/linux/landlock.h +++ b/include/uapi/linux/landlock.h @@ -478,7 +478,9 @@ struct landlock_net_port_attr { * Setting a flag for a ruleset will isolate the Landlock domain to forbid * connections to resources outside the domain. * - * This is supported since Landlock ABI version 6. + * This is supported since Landlock ABI version 6. The + * %LANDLOCK_SCOPE_POSIX_MSG_QUEUE scope is supported since Landlock ABI version + * 11. * * Scopes: * @@ -487,6 +489,8 @@ struct landlock_net_port_attr { * related Landlock domain (e.g., a parent domain or a non-sandboxed process). * - %LANDLOCK_SCOPE_SIGNAL: Restrict a sandboxed process from sending a signal * to another process outside the domain. + * - %LANDLOCK_SCOPE_POSIX_MSG_QUEUE: Restrict a sandboxed process from opening + * a POSIX message queue created outside the domain. */ /* clang-format off */ #define LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET (1ULL << 0) -- 2.50.1 (Apple Git-155)