[PATCH] docs: landlock: clarify F_SETOWN signal scoping

[PATCH] docs: landlock: clarify F_SETOWN signal scoping

[Shi Lecun]

The signal scope check for asynchronous I/O notifications uses the
Landlock domain saved when fcntl(F_SETOWN) configures the recipient.
Adding LANDLOCK_SCOPE_SIGNAL later therefore does not retroactively
restrict these pre-existing registrations.

Document this boundary in the IPC scoping section and link to the fcntl
documentation for I/O availability signaling.

Link: https://lore.kernel.org/linux-security-module/20261107.2f1fa9977739@gnoack.org/
Suggested-by: Günther Noack <gnoack3000@gmail.com>
Signed-off-by: Shi Lecun <shilc2025@mail.sustech.edu.cn>
---
 Documentation/userspace-api/landlock.rst | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/Documentation/userspace-api/landlock.rst b/Documentation/userspace-api/landlock.rst
index 3d45b956b640..cc9c5b102b8d 100644
--- a/Documentation/userspace-api/landlock.rst
+++ b/Documentation/userspace-api/landlock.rst
@@ -499,6 +499,10 @@ The operations which can be scoped are:
     This limits the sending of signals to target processes which run within the
     same or a nested Landlock domain.
 
+    For signaling of I/O availability (:manpage:`F_GETSIG(2const)`), Landlock
+    checks are done with respect to the Landlock domain at the time of
+    ``fcntl(F_SETOWN)``.
+
 ``LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET``
     This limits the set of abstract :manpage:`unix(7)` sockets to which we can
     :manpage:`connect(2)` to socket addresses which were created by a process in

base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
-- 
2.56.0

Re: [PATCH] docs: landlock: clarify F_SETOWN signal scoping

[Günther Noack]

On Sun, Nov 08, 2026 at 01:50:48PM +0800, Shi Lecun wrote:
> The signal scope check for asynchronous I/O notifications uses the
> Landlock domain saved when fcntl(F_SETOWN) configures the recipient.
> Adding LANDLOCK_SCOPE_SIGNAL later therefore does not retroactively
> restrict these pre-existing registrations.
> 
> Document this boundary in the IPC scoping section and link to the fcntl
> documentation for I/O availability signaling.
> 
> Link: https://lore.kernel.org/linux-security-module/20261107.2f1fa9977739@gnoack.org/
> Suggested-by: Günther Noack <gnoack3000@gmail.com>
> Signed-off-by: Shi Lecun <shilc2025@mail.sustech.edu.cn>
> ---
>  Documentation/userspace-api/landlock.rst | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/Documentation/userspace-api/landlock.rst b/Documentation/userspace-api/landlock.rst
> index 3d45b956b640..cc9c5b102b8d 100644
> --- a/Documentation/userspace-api/landlock.rst
> +++ b/Documentation/userspace-api/landlock.rst
> @@ -499,6 +499,10 @@ The operations which can be scoped are:
>      This limits the sending of signals to target processes which run within the
>      same or a nested Landlock domain.
>  
> +    For signaling of I/O availability (:manpage:`F_GETSIG(2const)`), Landlock
> +    checks are done with respect to the Landlock domain at the time of
> +    ``fcntl(F_SETOWN)``.
> +
>  ``LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET``
>      This limits the set of abstract :manpage:`unix(7)` sockets to which we can
>      :manpage:`connect(2)` to socket addresses which were created by a process in
> 
> base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
> -- 
> 2.56.0
> 

Reviewed-by: Günther Noack <gnoack3000@gmail.com>

Thanks, looks good!

–Günther