setpriv: More Landlock improvements by Skyb0rg007 · Pull Request #4551 · util-linux/util-linux

Skyb0rg007 · 2026-08-11T21:00:26Z

This PR adds support to setpriv for handling network access rights and the scope restrictions.
Kernel documentation can be found here, but the new features are:

--landlock-access net:connect-tcp
--landlock-access net:bind-tcp
--landlock-rule net-port:connect-tcp,bind-tcp:80
--landlock-access scope:signal
--landlock-access scope:abstract-unix-socket

There are also features added to the test_mkfds command to allow just binding or just connecting to a TCP or abstract unix socket, to test the corresponding Landlock restrictions.

I also improved the error message for unsupported Landlock rights.

Notes

When parsing fs rights, the landlock_fs_access_to_mask function doesn't ensure that the user provided the name of a filesystem right, but instead works with the first matching prefix.
This is "fixed" for the net and scope rights, especially since it resulted in weird situations (ex. path-beneath:read:/ only gives read-file, not read-dir). The next Linux release is adding net:bind-udp, so it's a good idea to require full qualification now, and it is hopefully not as much of a pain to type out the rights now that shell completion is working.

The scope rights are technically not access rights, and I try to make sure the error messages and other output are clear on that. The --landlock-access option is just poorly named; not much anyone can do about that now.

--list-landlock-access would previously print fs, even if the kernel didn't support Landlock at all. This behavior is changed to now produce an error if Landlock isn't supported at all.

ABI 10 is currently merged into Linus's tree, which includes net:bind-udp and net:connect-send-udp. I didn't add those in this PR since I couldn't test it but they're likely safe to add in early. Just say the word -- it's a 4 line change.

I added myself to the copyright comments on the Landlock files, as my name is >50% of the git blame. I have no clue if there's a different criteria for that.

masatake

I reviewed the code extending test_mkfds and the test case using test_mkfds. LGTM.

cgoesche · 2026-08-13T02:12:59Z

@Skyb0rg007 what do you think of moving the network specific Landlock tests to a dedicated script ? I fear that overtime the current script that we have will bloat with the addition of more Landlock features.

Skyb0rg007 · 2026-08-13T02:23:21Z

@Skyb0rg007 what do you think of moving the network specific Landlock tests to a dedicated script ? I fear that overtime the current script that we have will bloat with the addition of more Landlock features.

I'm fine with that, though this test files probably don't need to grow that much because future net and scope restrictions don't really need corresponding tests (since we're testing that setpriv works, not that the Landlock subsystem works).

Testing the audit integration (the last missing Landlock feature in setpriv) would need a new file anyways for root privileges, so to me it's just a question of "is this script too long now".

Signed-off-by: Skye Soss <skye@soss.website>

The ability to connect and listen via two different invocations is important for testing Landlock functionality. Signed-off-by: Skye Soss <skye@soss.website>

Each access right is tested against the ABI version. If a right is not supported, immediately raise an error that includes the name of the right that is not supported, rather than waiting for the syscall to fail with a generic "invalid argument" error. Signed-off-by: Skye Soss <skye@soss.website>

Support the Landlock TCP bind and connect rights together with net-port rules. These were added in ABI 4. Signed-off-by: Skye Soss <skye@soss.website>

Support Landlock scope restrictions for signals and abstract Unix sockets. These were added in ABI version 6. Signed-off-by: Skye Soss <skye@soss.website>

Skyb0rg007 · 2026-08-14T18:59:27Z

All the for loops over arrays now use size_t indices.
I don't think the for (size_t changes should be applied, since the rest of setpriv doesn't use that style (ex. line 217 of setpriv.c). Perhaps in a different PR.

I think keeping the tests in one file for now is fine; I'll split it up as needed in the future.
~~I haven't solved the TS_ERRLOG comment yet though~~ Fixed with sed.

cgoesche · 2026-08-14T23:34:22Z

 					compopt -o nospace
 					_setpriv_landlock_rights "$1" fs 'path-beneath:' "${cur#path-beneath:}"
 					;;
+				net-port:*:*)


Is this really needed ? Tested the completion without this fallthrough case and it seems to work just fine.

I think removing that causes the completion to call setpriv --list-landlock-rights net:, which errors and thus returns no completions

I tested this, and it doesn't error out, but without that pattern setpriv --list-landlock-rights net is called every time tab completion is asked for, even after the second colon is entered. This pattern saves that call.

Ok, thanks for clarifying :)

cgoesche · 2026-08-14T23:36:12Z

 				--apparmor-profile
 				--landlock-access
 				--landlock-rule
 				--landlock-support


Just these two missing.

Suggested change

--landlock-support

--list-landlock-access

--list-landlock-rights

Normally this should've been caught by tools/checkcompletion.sh, I'll investigate on my end.

--landlock-support is already there. The --list-* options aren't there for the same reason --list-caps isn't: they're used to implement bash completion so aren't really public APIs

Yes, --landlock-support can be ignored, that was a formatting error. However, the --list* would be nice to have still, we try to maintain a solid coherence between the available long options and the bash completions.

But if you really don't want these in the completion spec, you can annotate the lines where the long options are defined with IGNORECHECK=yes, tools/get-options.sh will ignore them so tools/checkcompletion.sh doesn't annoy us with false positives in the future (since I found the cause of the detection bug).

So in setpriv.c

{ "list-landlock-access", no_argument, NULL, LIST_LANDLOCK_ACCESS }, /* IGNORECHECK=yes */ { "list-landlock-rights", required_argument, NULL, LIST_LANDLOCK_RIGHTS },, /* IGNORECHECK=yes */

I'm okay with adding completion for them, my original PR just copied what was done for --list-caps

Completion added

This includes --list-landlock-access, --list-landlock-rights, and --list-caps.

cgoesche

All the points I have raised have been properly addressed. LGTM

masatake self-requested a review August 12, 2026 00:41

karelzak reviewed Aug 12, 2026

View reviewed changes

Comment thread sys-utils/setpriv-landlock.c Outdated

Skyb0rg007 force-pushed the landlock-improvements-v2 branch 3 times, most recently from 65cf01a to 1fe8170 Compare August 12, 2026 15:02

masatake suggested changes Aug 12, 2026

View reviewed changes

Comment thread tests/helpers/test_mkfds.c Outdated

Comment thread tests/helpers/test_mkfds.c

Skyb0rg007 force-pushed the landlock-improvements-v2 branch from 464778d to 1029514 Compare August 12, 2026 16:50

masatake approved these changes Aug 12, 2026

View reviewed changes

Skyb0rg007 commented Aug 13, 2026

View reviewed changes

Comment thread tests/ts/setpriv/landlock

cgoesche suggested changes Aug 13, 2026

View reviewed changes

Skyb0rg007 added 8 commits August 14, 2026 13:39

test_mkfds: fix backlog decode

21b9c1c

Signed-off-by: Skye Soss <skye@soss.website>

test_mkfds: add standalone stream socket factories

5496e75

The ability to connect and listen via two different invocations is important for testing Landlock functionality. Signed-off-by: Skye Soss <skye@soss.website>

setpriv: add Landlock network restrictions

1ec8d87

Support the Landlock TCP bind and connect rights together with net-port rules. These were added in ABI 4. Signed-off-by: Skye Soss <skye@soss.website>

setpriv: add Landlock IPC scope restrictions

08b9496

Support Landlock scope restrictions for signals and abstract Unix sockets. These were added in ABI version 6. Signed-off-by: Skye Soss <skye@soss.website>

setpriv: remove unnecessary checks in landlock test

cbb83f1

setpriv: use size_t for array indices

d8758d8

test_mkfds: remove spaces used for code alignment

6672fa9

Skyb0rg007 force-pushed the landlock-improvements-v2 branch from 43af5b3 to 6672fa9 Compare August 14, 2026 18:40

Skyb0rg007 force-pushed the landlock-improvements-v2 branch from 7919999 to 5040a66 Compare August 14, 2026 19:07

setpriv: track command output in tests

a811c9a

Skyb0rg007 force-pushed the landlock-improvements-v2 branch from 5040a66 to a811c9a Compare August 14, 2026 19:15

cgoesche suggested changes Aug 14, 2026

View reviewed changes

setpriv: add completion for --list-* options

5535a77

This includes --list-landlock-access, --list-landlock-rights, and --list-caps.

cgoesche approved these changes Aug 15, 2026

View reviewed changes

+				--landlock-support
+				--list-landlock-access
+				--list-landlock-rights

Uh oh!

Conversation

Skyb0rg007 commented Aug 11, 2026

Notes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

masatake left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cgoesche commented Aug 13, 2026

Uh oh!

Skyb0rg007 commented Aug 13, 2026

Uh oh!

Skyb0rg007 commented Aug 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cgoesche left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Skyb0rg007 commented Aug 14, 2026 •

edited

Loading