landlock: Implement scope control for pathname Unix sockets #20

micromaomao · 2025-12-27T17:21:41Z

No description provided.

Copilot

Pull request overview

This PR extends Landlock's scope control mechanism to support pathname (filesystem path) Unix sockets in addition to the existing abstract Unix socket scoping. The changes introduce a new scope flag LANDLOCK_SCOPE_PATHNAME_UNIX_SOCKET and update the kernel's Landlock ABI to version 8.

Key changes:

Added LANDLOCK_SCOPE_PATHNAME_UNIX_SOCKET flag for restricting pathname Unix socket connections
Modified security hooks (hook_unix_stream_connect and hook_unix_may_send) to differentiate between abstract and pathname sockets
Extended test suite with comprehensive pathname socket test coverage alongside existing abstract socket tests

Reviewed changes

Copilot reviewed 17 out of 17 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
security/landlock/task.c	Implements pathname socket scope checking in Unix socket connection hooks
include/uapi/linux/landlock.h	Adds LANDLOCK_SCOPE_PATHNAME_UNIX_SOCKET flag definition
security/landlock/syscalls.c	Updates ABI version from 7 to 8
security/landlock/limits.h	Updates LANDLOCK_LAST_SCOPE to include pathname socket scope
security/landlock/audit.h	Adds LANDLOCK_REQUEST_SCOPE_PATHNAME_UNIX_SOCKET request type
security/landlock/audit.c	Adds audit blocker string for pathname socket scope
tools/testing/selftests/landlock/scoped_unix_test.c	Extends tests to cover both abstract and pathname socket variants
tools/testing/selftests/landlock/common.h	Updates set_unix_address() to support both abstract and pathname sockets
tools/testing/selftests/landlock/scoped_test.c	Updates ACCESS_LAST to include pathname socket scope
tools/testing/selftests/landlock/base_test.c	Updates expected ABI version to 8
tools/testing/selftests/landlock/scoped_signal_test.c	Updates set_unix_address() call to specify abstract socket
tools/testing/selftests/landlock/net_test.c	Updates set_unix_address() call to specify abstract socket
tools/testing/selftests/landlock/fs_test.c	Fixes typo in comment ("assume" → "assumed")
tools/testing/selftests/landlock/ptrace_test.c	Refactors to use shared scoped_base_variants.h
tools/testing/selftests/landlock/scoped_base_variants.h	Updates comment documentation
samples/landlock/sandboxer.c	Adds "u" option for pathname socket scoping and updates for ABI 8
Documentation/userspace-api/landlock.rst	Adds documentation for LANDLOCK_SCOPE_PATHNAME_UNIX_SOCKET

Comments suppressed due to low confidence (1)

tools/testing/selftests/landlock/scoped_unix_test.c:473

This assertion checks log_match_remaining after the stpncpy call, but log_match_remaining was never updated to reflect the remaining space after the copy operation (unlike the pathname branch at lines 493-494). The assertion should either be removed, or log_match_remaining should be updated after the stpncpy call for consistency with the pathname branch.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-12-27T17:25:20Z

include/uapi/linux/landlock.h

 */
 /* clang-format off */
 #define LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET		(1ULL << 0)
 #define LANDLOCK_SCOPE_SIGNAL		                (1ULL << 1)


Inconsistent whitespace formatting in macro definitions. Line 374 uses spaces while lines 373 and 375 use tabs. This should be consistent - all three lines should use the same whitespace character (tabs) for alignment.

Suggested change

#define LANDLOCK_SCOPE_SIGNAL (1ULL << 1)

#define LANDLOCK_SCOPE_SIGNAL (1ULL << 1)

Copilot · 2025-12-27T17:25:20Z

include/uapi/linux/landlock.h

 #define LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET		(1ULL << 0)
 #define LANDLOCK_SCOPE_SIGNAL		                (1ULL << 1)
+#define LANDLOCK_SCOPE_PATHNAME_UNIX_SOCKET			(1ULL << 2)
 /* clang-format on*/


Missing space before the closing comment marker. Should be "/* clang-format on /" instead of "/ clang-format on*/".

Suggested change

/* clang-format on*/

/* clang-format on */

Copilot

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (4)

tools/testing/selftests/landlock/scoped_unix_test.c:1313

Type mismatch: scope is declared as const __u64 but create_scoped_domain() expects const __u16. While the values fit within 16 bits, this creates a type inconsistency. Change __u64 to __u16 for consistency with the function signature and other uses in this file (lines 100-101, 206-207).
tools/testing/selftests/landlock/scoped_unix_test.c:1410
Type mismatch: scope is declared as const __u64 but create_scoped_domain() expects const __u16. While the values fit within 16 bits, this creates a type inconsistency. Change __u64 to __u16 for consistency with the function signature and other uses in this file (lines 100-101, 206-207).
tools/testing/selftests/landlock/scoped_unix_test.c:600
Type mismatch: scope is declared as const __u64 but create_scoped_domain() expects const __u16. While the values fit within 16 bits, this creates a type inconsistency. Change __u64 to __u16 for consistency with the function signature and other uses in this file (lines 100-101, 206-207).
tools/testing/selftests/landlock/scoped_unix_test.c:890
Type mismatch: scope is declared as const __u64 but create_scoped_domain() expects const __u16. While the values fit within 16 bits, this creates a type inconsistency. Change __u64 to __u16 for consistency with the function signature and other uses in this file (lines 100-101, 206-207).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

tools/testing/selftests/landlock/scoped_unix_test.c:1410

The scope variable is declared as __u64 but should be __u16 to match the type used consistently throughout the rest of this file (lines 100, 206, 599, 888, 1311) and to match the scope parameter type expected by create_scoped_domain.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (2)

tools/testing/selftests/landlock/scoped_unix_test.c:1441

The scope variable is declared as __u64 but should be __u16 to match the type used consistently throughout the rest of the file (lines 110, 216, 608, 895, 1342) and the actual Landlock scope flag definitions which are 16-bit values.
tools/testing/selftests/landlock/scoped_unix_test.c:514
The comparison is incorrect. The regex_escape function returns a char pointer that may be cast from -ENOMEM on error (see audit.h line 225). The comparison should check if the pointer represents an error, for example by comparing against a negative value cast to a pointer or by using a macro. The current comparison treats the pointer as an integer which is likely to cause a compiler warning and may not work correctly.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (2)

tools/testing/selftests/landlock/scoped_unix_test.c:488

The comment states "It is assumed that absolute_path does not contain control characters nor spaces" but there's a typo in the original comment at line 487-489. The phrase should be "It is assumed" not "It is assume". However, I notice this same typo appears to exist in fs_test.c where it's being fixed. This comment in scoped_unix_test.c should also use "assumed" for consistency.
tools/testing/selftests/landlock/scoped_unix_test.c:737
Fixed: Added missing semicolon at the end of the close statement.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-12-28T11:50:26Z

Documentation/userspace-api/landlock.rst

+
+This allows sandboxing applications using only Landlock to protect against
+bypasses relying on connecting to Unix sockets of other services running
+under the same user.  These services typically assumes that any process


In the comment on line 633, there's a grammatical error. The phrase "Unix sockets of other services running under the same user" should use "that" instead of "These" in the next sentence. The sentence "These services typically assumes" should be "These services typically assume" (plural verb form to match plural subject).

Suggested change

under the same user. These services typically assumes that any process

under the same user that typically assume that any process

Copilot · 2025-12-28T11:50:26Z

Documentation/userspace-api/landlock.rst

+    ``LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET`` applies to abstract sockets,
+    and ``LANDLOCK_SCOPE_PATHNAME_UNIX_SOCKET`` applies to pathname
+    sockets.  Even though pathname sockets are represented in the
+    filesystem, Landlock filesystem rules does not currently control


In the documentation at line 349, there's a grammatical error. The phrase "Landlock filesystem rules does not currently control" should use the plural verb form "do not" instead of "does not".

Suggested change

filesystem, Landlock filesystem rules does not currently control

filesystem, Landlock filesystem rules do not currently control

Copilot

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (8)

tools/testing/selftests/landlock/scoped_unix_test.c:511

The comparison should check for NULL (error condition from regex_escape), not for a value less than 0. The function returns a char pointer, and error is indicated by returning (char *)-ENOMEM, which when cast to intptr_t would be a large positive value, not negative. The correct check should be: if (!log_match_cursor || log_match_cursor == (char *)-ENOMEM)
tools/testing/selftests/landlock/scoped_unix_test.c:62
The mkdir call will fail with EEXIST if the directory already exists from a previous test run or another test running concurrently. Consider using mkdir with error handling that ignores EEXIST, or ensuring the directory is cleaned up between test runs. This could cause test flakiness.
tools/testing/selftests/landlock/scoped_unix_test.c:380
The mkdir call will fail with EEXIST if the directory already exists from a previous test run or another test running concurrently. Consider using mkdir with error handling that ignores EEXIST, or ensuring the directory is cleaned up between test runs. This could cause test flakiness.
tools/testing/selftests/landlock/scoped_unix_test.c:553
The mkdir call will fail with EEXIST if the directory already exists from a previous test run or another test running concurrently. Consider using mkdir with error handling that ignores EEXIST, or ensuring the directory is cleaned up between test runs. This could cause test flakiness.
tools/testing/selftests/landlock/scoped_unix_test.c:516
The variable log_match_cursor is being reused after being assigned from regex_escape() without checking the return value first. If regex_escape() returns an error ((char *)-ENOMEM), this line will use that error pointer value in the calculation, leading to incorrect results. The error check on line 511 should come before this line.
tools/testing/selftests/landlock/scoped_unix_test.c:860
The mkdir call will fail with EEXIST if the directory already exists from a previous test run or another test running concurrently. Consider using mkdir with error handling that ignores EEXIST, or ensuring the directory is cleaned up between test runs. This could cause test flakiness.
tools/testing/selftests/landlock/scoped_unix_test.c:1045
The mkdir call will fail with EEXIST if the directory already exists from a previous test run or another test running concurrently. Consider using mkdir with error handling that ignores EEXIST, or ensuring the directory is cleaned up between test runs. This could cause test flakiness.
tools/testing/selftests/landlock/scoped_unix_test.c:1318
The mkdir call will fail with EEXIST if the directory already exists from a previous test run or another test running concurrently. Consider using mkdir with error handling that ignores EEXIST, or ensuring the directory is cleaned up between test runs. This could cause test flakiness.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-12-30T16:55:50Z

Documentation/userspace-api/landlock.rst

+
+This allows sandboxing applications using only Landlock to protect against
+bypasses relying on connecting to Unix sockets of other services running
+under the same user.  These services typically assumes that any process


Grammatical error: "assumes" should be "assume" to match the plural subject "These services".

Suggested change

under the same user. These services typically assumes that any process

under the same user. These services typically assume that any process

Copilot

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-12-30T17:00:45Z

Documentation/userspace-api/landlock.rst

+
+This allows sandboxing applications using only Landlock to protect against
+bypasses relying on connecting to Unix sockets of other services running
+under the same user.  These services typically assume that any process


Grammar error: "These services typically assumes" should be "These services typically assume" (plural subject requires plural verb form).

Copilot · 2025-12-30T17:00:46Z

Documentation/userspace-api/landlock.rst

        /* Removes LANDLOCK_SCOPE_* for ABI < 6 */
        ruleset_attr.scoped &= ~(LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET |
                                 LANDLOCK_SCOPE_SIGNAL);
+        __attribute__((fallthrough));


Missing case statement for ABI version 6. The switch statement jumps from case 5 to case 7, skipping case 6. This should include a case 6 to handle Landlock ABI version 6, even if no features need to be removed for that version. The pattern should maintain sequential case statements with fallthrough for clarity and correctness.

Suggested change

__attribute__((fallthrough));

__attribute__((fallthrough));

case 6:

/* No features removed for ABI < 7 */

__attribute__((fallthrough));

Add the new scope bit to the uAPI header, add documentation, and bump ABI version to 8. This documentation edit specifically calls out the security implications of not restricting sockets. Fix some minor cosmetic issue in landlock.h around the changed lines as well. Signed-off-by: Tingmao Wang <m@maowtm.org> --- Changes in v2: - Fix grammar Note that in the code block in "Defining and enforcing a security policy" the switch case currently jumps from 5 to 7. This should be fixed by https://lore.kernel.org/all/20251216210248.4150777-1-samasth.norway.ananda@oracle.com/

Extend the existing abstract UNIX socket scoping to pathname sockets as well. Basically all of the logic is reused between the two types, just that pathname sockets scoping are controlled by another bit, and has its own audit request type (since the current one is named "abstract_unix_socket"). Closes: landlock-lsm#51 Signed-off-by: Tingmao Wang <m@maowtm.org> --- Changes in v2: - Factor out common code in hook_unix_stream_connect and hook_unix_may_send into check_socket_access(), and inline is_abstract_socket().

Signed-off-by: Tingmao Wang <m@maowtm.org> --- I've decided to use "u" as the character to control this scope bit since it stands for (normal) Unix sockets. Imo using "p" or "n" would make it less clear / memorable. Open to suggestions. Also, open to suggestion whether socket scoping (pathname and abstract) should be enabled by default, if LL_SCOPED is not set. This would break backward compatibility, but maybe we shouldn't guarentee backward compatibility of this sandboxer in the first place, and almost all cases of Landlock usage would want socket scoping.

To prepare for extending the socket tests to do non-abstract sockets too, extend set_unix_address() to also be able to populate a non-abstract socket path under TMP_DIR. Also use snprintf for good measure. This also changes existing callers to pass true for the abstract argument. Signed-off-by: Tingmao Wang <m@maowtm.org>

…e sockets too. Since there is very little difference between abstract and pathname sockets in terms of testing of the scoped access checks (the only difference is in which scope bit control which form of socket), it makes sense to reuse the existing test for both type of sockets. Therefore, we rename scoped_abstract_unix_test.c to scoped_unix_test.c and extend the scoped_domains test to test pathname (i.e. non-abstract) sockets too. Since we can't change the variant data of scoped_domains (as it is defined in the shared .h file), we do this by extracting the actual test code into a function, and call it from different test cases. Also extend scoped_audit (this time we can use variants) to test both abstract and pathname sockets. For pathname sockets, audit_log_lsm_data will produce path="..." (or hex if path contains control characters) with absolute paths from the dentry, so we need to construct the escaped regex for the real path like in fs_test. Signed-off-by: Tingmao Wang <m@maowtm.org>

While this produces a lot of change, it does allow us to "simultaneously" test both abstract and pathname UNIX sockets with reletively little code duplication, since they are really similar. Tests touched: scoped_vs_unscoped, outside_socket, various_address_sockets, datagram_sockets, self_connect. Signed-off-by: Tingmao Wang <m@maowtm.org>

micromaomao requested a review from Copilot December 27, 2025 17:21

Copilot started reviewing on behalf of micromaomao December 27, 2025 17:22 View session

Copilot AI reviewed Dec 27, 2025

View reviewed changes

micromaomao force-pushed the landlock.scopednamedsock branch 2 times, most recently from 1dccf3b to 096a208 Compare December 27, 2025 17:33

micromaomao requested a review from Copilot December 27, 2025 17:33

Copilot started reviewing on behalf of micromaomao December 27, 2025 17:34 View session

Copilot AI reviewed Dec 27, 2025

View reviewed changes

micromaomao force-pushed the landlock.scopednamedsock branch from 096a208 to f8af697 Compare December 27, 2025 17:41

micromaomao requested a review from Copilot December 27, 2025 17:42

Copilot started reviewing on behalf of micromaomao December 27, 2025 17:43 View session

Copilot AI reviewed Dec 27, 2025

View reviewed changes

micromaomao force-pushed the landlock.scopednamedsock branch 2 times, most recently from 176b698 to 813acde Compare December 27, 2025 19:19

micromaomao requested a review from Copilot December 27, 2025 19:19

Copilot started reviewing on behalf of micromaomao December 27, 2025 19:20 View session

micromaomao force-pushed the landlock.scopednamedsock branch from 813acde to 9c05537 Compare December 27, 2025 19:21

Copilot AI reviewed Dec 27, 2025

View reviewed changes

micromaomao force-pushed the landlock.scopednamedsock branch 3 times, most recently from 0994a10 to 860fa4d Compare December 27, 2025 21:27

micromaomao requested a review from Copilot December 27, 2025 21:28

Copilot started reviewing on behalf of micromaomao December 27, 2025 21:29 View session

Copilot AI reviewed Dec 27, 2025

View reviewed changes

micromaomao force-pushed the landlock.scopednamedsock branch 2 times, most recently from 68f0b27 to 2b2761b Compare December 28, 2025 11:46

micromaomao requested a review from Copilot December 28, 2025 11:46

Copilot started reviewing on behalf of micromaomao December 28, 2025 11:47 View session

Copilot AI reviewed Dec 28, 2025

View reviewed changes

micromaomao force-pushed the landlock.scopednamedsock branch from 2b2761b to 33985b3 Compare December 28, 2025 11:51

micromaomao force-pushed the landlock.scopednamedsock branch 2 times, most recently from 38fddf5 to 5718e0f Compare December 28, 2025 11:53

micromaomao force-pushed the landlock.scopednamedsock-base branch from 161db18 to ef4536f Compare December 30, 2025 15:25

micromaomao force-pushed the landlock.scopednamedsock branch from 5718e0f to 9517619 Compare December 30, 2025 15:25

micromaomao requested a review from Copilot December 30, 2025 16:51

Copilot started reviewing on behalf of micromaomao December 30, 2025 16:52 View session

micromaomao force-pushed the landlock.scopednamedsock branch from 9517619 to 5d8dbb3 Compare December 30, 2025 16:55

Copilot AI reviewed Dec 30, 2025

View reviewed changes

micromaomao requested a review from Copilot December 30, 2025 16:56

micromaomao force-pushed the landlock.scopednamedsock branch from 5d8dbb3 to 6b69163 Compare December 30, 2025 16:57

Copilot started reviewing on behalf of micromaomao December 30, 2025 16:57 View session

Copilot AI reviewed Dec 30, 2025

View reviewed changes

micromaomao force-pushed the landlock.scopednamedsock branch from 6b69163 to a05f163 Compare December 30, 2025 17:03

micromaomao force-pushed the landlock.scopednamedsock branch from a05f163 to 293ef45 Compare December 30, 2025 17:05

micromaomao force-pushed the landlock.scopednamedsock branch from 293ef45 to 88de5be Compare December 30, 2025 17:13

micromaomao added 4 commits December 30, 2025 17:14

	#define LANDLOCK_SCOPE_SIGNAL (1ULL << 1)
	#define LANDLOCK_SCOPE_SIGNAL (1ULL << 1)

	under the same user. These services typically assumes that any process
	under the same user that typically assume that any process

	filesystem, Landlock filesystem rules does not currently control
	filesystem, Landlock filesystem rules do not currently control

landlock: Implement scope control for pathname Unix sockets #20

Are you sure you want to change the base?

landlock: Implement scope control for pathname Unix sockets #20

Uh oh!

Conversation

micromaomao commented Dec 27, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Dec 27, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 27, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Dec 28, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 28, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Dec 30, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Dec 30, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 30, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants