[PATCH v2] docs: landlock: clarify TTY signal scoping

[Christopher Lusk <clusk@northecho.dev>]

The LANDLOCK_SCOPE_SIGNAL documentation does not describe how TTY-driven
signals interact with signal scoping.  Holding a PTY master file descriptor
is a separate capability: its holder can cause the TTY layer to signal
processes running under that terminal, even across a Landlock domain
boundary.

Add a concise clarification to the userspace API guide and the UAPI header.
This records the capability boundary identified during review of the
TIOCSIG discussion without enumerating individual TTY signal paths.

The documentation text and changelog were drafted with assistance from
Codex (gpt-5.6-sol).

The userspace API documentation builds successfully with the kernel-pinned
Sphinx dependencies.  The patch introduces no new warnings; the existing
missing-graphviz and undefined-label warnings are unchanged.

Link: https://lore.kernel.org/r/aqqJAZfG9FC7PgMW@google.com
Suggested-by: Günther Noack <gnoack@google.com>
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Christopher Lusk <clusk@northecho.dev>
---
 Documentation/userspace-api/landlock.rst | 3 +++
 include/uapi/linux/landlock.h            | 2 ++
 2 files changed, 5 insertions(+)

diff --git a/Documentation/userspace-api/landlock.rst b/Documentation/userspace-api/landlock.rst
index 84cb7bf6b3ed..33a514ebc615 100644
--- a/Documentation/userspace-api/landlock.rst
+++ b/Documentation/userspace-api/landlock.rst
@@ -430,6 +430,9 @@ The operations which can be scoped are:
     This limits the sending of signals to target processes which run within the
     same or a nested Landlock domain.
 
+    Holding a PTY master FD still grants the capability to issue signals through
+    that PTY to the processes running under that terminal.
+
 ``LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET``
     This limits the set of abstract :manpage:`unix(7)` sockets to which we can
     :manpage:`connect(2)` to socket addresses which were created by a process in
diff --git a/include/uapi/linux/landlock.h b/include/uapi/linux/landlock.h
index cceda3b3b961..6485af37dd25 100644
--- a/include/uapi/linux/landlock.h
+++ b/include/uapi/linux/landlock.h
@@ -501,6 +501,8 @@ struct landlock_net_port_attr {
  *   related Landlock domain (e.g., a parent domain or a non-sandboxed process).
  * - %LANDLOCK_SCOPE_SIGNAL: Restrict a sandboxed process from sending a signal
  *   to another process outside the domain.
+ *   Holding a PTY master FD still grants the capability to issue signals
+ *   through that PTY to the processes running under that terminal.
  */
 /* clang-format off */
 #define LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET		(1ULL << 0)
-- 
2.55.0