Re: [RFC PATCH 0/2] Landlock signal scope and TIOCSIG

["Mickaël Salaün" <mic@digikod.net>]

Hi Christopher,

I agree with Günther and I'd like to bring, from my point of view, the
most important thing about TTY master FDs: they are mean to send
arbitrary data/signals to TTY slaves, and in most cases this mean inject
keys and then commands.  So TTY master FDs should be seen as a
(legitimate) way to control another process, even if that might not
always be the case.

A case in point would be an SSH or sudo/su command attached to a slave
TTY.  The process able to write on the related master TTY FD should be
considered as privileged as the slave command.  This illustrates why
human-computer interfaces (including TTYs, desktop interfaces...) are so
critical.

Also, just adding these LSM hook changes would break exisiting LSM's
security policies.

Updating the Landlock doc with this rationale is defenitely a good idea.

Testing this invariant is also valiable, so it would be nice to tweak a
bit your test and include it with the doc update.

Regards,
 Mickaël


On Mon, Sep 14, 2026 at 09:40:13AM -0400, Christopher Lusk wrote:
> Hello Günther,
> 
> Thanks for digging into this so carefully, and for the clear write-up.
> 
> Your capability framing convinces me.  Controlling who may attach to (or
> open a master for) the PTY is the right layer, and the master FD is best
> thought of as the capability, the same way socketpair() is.
> 
> You are also right that the series is incomplete as a fix: the same three
> signals arrive through the n_tty control-character path (Ctrl-C / Ctrl-\ /
> Ctrl-Z) that my patch does not touch, and PTYs additionally raise SIGWINCH,
> SIGHUP and SIGCONT.  That reinforces your point rather than mine.  Chasing
> individual signal-delivery paths inside the TTY layer is the wrong layer,
> and a per-ioctl hook would only paper over one entry into a mechanism that
> is working as designed.
> 
> One question, mostly so I have the line right in my own notes rather than
> to relitigate: how do you see this relative to the SIGIO/fowner path that
> 4b80320ca7ed brought under SCOPE_SIGNAL?  My read of the distinction is
> that in the SIGIO case the sandboxed process unilaterally selects the target
> by arming the owner, whereas here the recipients have voluntarily attached
> to the terminal and the TTY driver delivers job-control signals over that
> attachment.  If that is the intended boundary, it is a clean one, and I am
> happy to treat TTY-driven signals as outside the guarantee.
> 
> If it is useful, I would be glad to send a small documentation patch making
> that explicit: a note in the SCOPE_SIGNAL / IPC-scoping section of
> landlock.rst that TTY-driver signal delivery (TIOCSIG and the
> control-character path) is not mediated by SCOPE_SIGNAL, with the practical
> guidance to control PTY attachment instead.  I will drop the task_kill
> approach.
> 
> Thanks again for the thorough look.
> 
> Christopher
>