[WIP PATCH v2] Landlock supervise

[micromaomao]

v1: https://lore.kernel.org/linux-security-module/cover.1741047969.git.m@maowtm.org/

---

scratchpad:

// gated-access mode for file/folders - maybe ability to list dirs, but
// trying to open with RO or RW will trigger interactive prompt

Need to not hold dir inode lock while waiting supervisor response...  Then
test file with same name being removed/created by another process does not
crash us

Need to track count of supervisor-fd, the refcount for supervisor also
includes layers and thus closing supervisor won't cause all events to be
denied.

TODOs:
- Don't invoke supervisor pointlessly - check inode_permission first
- refer (link and rename) support
- supervise net rule denials
- tests
- documentation
- perf benchmark (for both non-enabled and enabled case)
- file operations for the supervisor fd - dup
- testing fork
- memchg

lookup_open in namei.c:
  may_o_create gets called if dcache does not contain the dentry, but the
  actual fs might still do.
    Not a problem for landlock itself because even if may_o_create returns
    error, it is ignored if open without O_CREAT succeeds.
    However, this will result in spurious supervisor calls for create
    permission check (even in the absence of races)
    ...
    In fact we might want to _always_ ask the supervisor, even if it is in
    the dcache, since we won't be taking the parent dir's lock. Otherwise
    we might end up in a situation like:

    Landlocked process                        Some other process creates
                                              "/aa"
                                              Does stuff with it
    open("/aa", O_CREAT)...

      we see that "/aa" is in dcache

      therefore we skip asking supervisor for
      create permission, and allow access (as
      long as landlock ruleset allows it
      otherwise)

                                              unlink("/aa")

    --- at this point, if supervisor doesn't want /aa to be
        created again, it has no chance to object.

    ...open returns, /aa is recreated.

git format-patch \
        --cover-letter --cover-from-description=subject --rfc \
        --to 'Mickaël Salaün <mic@digikod.net>' \
        --to 'Günther Noack <gnoack@google.com>' \
        --to 'Jan Kara <jack@suse.cz>' \
        --cc 'linux-security-module@vger.kernel.org' \
        --cc 'Amir Goldstein <amir73il@gmail.com>' \
        --cc 'Matthew Bobrowski <repnop@google.com>' \
        --cc 'linux-fsdevel@vger.kernel.org' \
        --cc 'Tycho Andersen <tycho@tycho.pizza>' \
        --thread landlock-supervise-base..landlock-supervise \
        --base 78332fdb956f18accfbca5993b10c5ed69f00a2c \
        -o /tmp/patch.test