Landlock

No entries match these filters. Clear filters

1. docs update Sep 2, 2026 · issue 062

   Landlock ABI 11 adds LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS flag to atomically tie no_new_privsno_new_privsA Linux process flag, set via `prctl()`, that prevents a process or its children from gaining elevated privileges through `setuid` binaries or file capabilities, limiting exploit escalation paths. to ruleset enforcement.

   └──▷ USE IT
   Enforce a Landlock ruleset and atomically set no_new_privs in one syscall, avoiding a separate prctl call — safe for unprivileged processes on ABI 11+.
   c copy

   if (abi > 10) {
       // LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS sets no_new_privs only on success
       if (landlock_restrict_self(ruleset_fd, LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS) != 0)
           err(1, "landlock_restrict_self");
   } else {
       // ABI < 11: must set no_new_privs manually first
       if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) != 0)
           err(1, "prctl");
       if (landlock_restrict_self(ruleset_fd, 0) != 0)
           err(1, "landlock_restrict_self");
   }

   • When LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS is combined with thread-group-wide enforcement, no_new_privs is propagated to sibling threads as well.
   • Adds Landlock Trace Events as an always-on observability channel for audit and monitoring of sandbox decisions, independent of audit flag settings.

   2 details in Everything

2. docs update Sep 2, 2026 · issue 062

   Landlock: Adds LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS flag to landlock_restrict_self(2) (ABI ≥ 11): sets the no_new_privsno_new_privsA Linux process flag, set via `prctl()`, that prevents a process or its children from gaining elevated privileges through `setuid` binaries or file capabilities, limiting exploit escalation paths. attribute on the calling thread only if ruleset enforcement succeeds, eliminating the need for a prior prctl(PR_SET_NO_NEW_PRIVS, ...) call.

   └──▷ USE IT
   Enforce a Landlock ruleset and set no_new_privs atomically on success, replacing the separate prctl call — safe for ABI 11+ environments.
   c copy

   /* ABI >= 11: tie no_new_privs to successful enforcement */
   int ret = landlock_restrict_self(ruleset_fd, LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS);
   if (ret) {
       perror("landlock_restrict_self");
       exit(EXIT_FAILURE);
   }
   /* no_new_privs is now set; no separate prctl(PR_SET_NO_NEW_PRIVS, ...) needed */

   Fall back to the manual prctl path on kernels older than ABI 11, where LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS is not available.
   c copy

   if (abi < 11) {
       /* Removes no new privs flag for ABI < 11 */
       if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0))
           exit(EXIT_FAILURE);
       if (landlock_restrict_self(ruleset_fd, 0))
           exit(EXIT_FAILURE);
   } else {
       if (landlock_restrict_self(ruleset_fd, LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS))
           exit(EXIT_FAILURE);
   }

   • Landlock tracepoints now provide an always-on observability channel independent of audit flag settings, documented under Landlock Trace Events.

   1 detail in Everything