Add LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS to the default flag setting.
Gate the flag on the ABI version, but do not expose any userspace
control over this flag as it has no practical effect on the resulting
sandbox.

Signed-off-by: Justin Suess <utilityemal77@gmail.com>
Link: https://patch.msgid.link/20260809154544.1253100-6-utilityemal77@gmail.com
Signed-off-by: Mickaël Salaün <mic@digikod.net>

Adds ability to set which access bits to quiet via LL_*_QUIET_ACCESS
(FS, NET or SCOPED), and attach quiet flags to individual objects via
LL_*_QUIET for FS and NET.

Assisted-by: GitHub-Copilot:claude-opus-4.8 copilot-reviepickw
Signed-off-by: Tingmao Wang <m@maowtm.org>
Link: https://patch.msgid.link/59b94997565032bc9870044f021214a2ed6df213.1781228815.git.m@maowtm.org
[mic: Fix comment formatting]
Signed-off-by: Mickaël Salaün <mic@digikod.net>

Add environment variables to control associated access rights:
- LL_UDP_BIND
- LL_UDP_CONNECT_SEND

Each one takes a list of ports separated by colons, like other list
options.

Signed-off-by: Matthieu Buffet <matthieu@buffet.re>
Link: https://patch.msgid.link/20260611162107.49278-6-matthieu@buffet.re
Signed-off-by: Mickaël Salaün <mic@digikod.net>

The access right for UNIX domain socket lookups is grouped with the
read-write rights in the sample tool.  Rationale: In the general case,
any operations are possible through a UNIX domain socket, including
data-mutating operations.

Cc: Justin Suess <utilityemal77@gmail.com>
Cc: Mickaël Salaün <mic@digikod.net>
Signed-off-by: Günther Noack <gnoack3000@gmail.com>
Link: https://lore.kernel.org/r/20260327164838.38231-7-gnoack3000@gmail.com
Signed-off-by: Mickaël Salaün <mic@digikod.net>

The sample tool should print a warning if it is not running on a
kernel that provides the newest Landlock ABI version.

Link: https://lore.kernel.org/all/20260218.ufao5Vaefa2u@digikod.net/
Suggested-by: Mickaël Salaün <mic@digikod.net>
Signed-off-by: Günther Noack <gnoack3000@gmail.com>
Link: https://lore.kernel.org/r/20260220160627.53913-1-gnoack3000@gmail.com
Signed-off-by: Mickaël Salaün <mic@digikod.net>

Building with make allyesconfig on musl results in the following

In file included from samples/landlock/sandboxer.c:22:
/usr/include/sys/prctl.h:88:8: error: redefinition of 'struct prctl_mm_map'
   88 | struct prctl_mm_map {
      |        ^~~~~~~~~~~~
In file included from samples/landlock/sandboxer.c:16:
usr/include/linux/prctl.h:134:8: note: originally defined here
  134 | struct prctl_mm_map {
      |        ^~~~~~~~~~~~

This is mainly due to difference in the sys/prctl.h between glibc and
musl. The struct prctl_mm_map is defined in sys/prctl.h in musl.

Signed-off-by: Brahmajit Das <listout@listout.xyz>
[mic: Move down the if/include/endif block]
Link: https://lore.kernel.org/r/20250630203248.16273-1-listout@listout.xyz
Signed-off-by: Mickaël Salaün <mic@digikod.net>

By default, denials from within the sandbox are not logged.  Indeed, the
sandboxer's security policy might not be fitted to the set of sandboxed
processes that could be spawned (e.g. from a shell).

For test purpose, parse the LL_FORCE_LOG environment variable to log
every sandbox denials, including after launching the initial sandboxed
program thanks to LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON.

Cc: Günther Noack <gnoack@google.com>
Link: https://lore.kernel.org/r/20250320190717.2287696-20-mic@digikod.net
[mic: Remove inappropriate hunk]
Signed-off-by: Mickaël Salaün <mic@digikod.net>

malloc() may return NULL, leading to NULL dereference.  Add a NULL
check.

Fixes: ba84b0bf5a16 ("samples/landlock: Add a sandbox manager example")
Signed-off-by: Zichen Xie <zichenxie0106@gmail.com>
Link: https://lore.kernel.org/r/20241128032955.11711-1-zichenxie0106@gmail.com
[mic: Simplify fix]
Signed-off-by: Mickaël Salaün <mic@digikod.net>

Clarify the distinction between filesystem variables (mandatory)
and all others (optional).

For optional variables, explain the difference between unset variables
(no access check performed) and empty variables (nothing allowed for
lists of allowed paths/ports, or no effect for lists of scopes).

List the known LL_SCOPED values and their effect.

Signed-off-by: Matthieu Buffet <matthieu@buffet.re>
Link: https://lore.kernel.org/r/20241019151534.1400605-4-matthieu@buffet.re
[mic: Add a missing colon]
Signed-off-by: Mickaël Salaün <mic@digikod.net>

Help message is getting larger with each new supported feature (scopes,
and soon UDP). Also the large number of calls to fprintf with
environment variables make it hard to read. Refactor it away into a
single simpler constant format string.

Signed-off-by: Matthieu Buffet <matthieu@buffet.re>
Link: https://lore.kernel.org/r/20241019151534.1400605-3-matthieu@buffet.re
[mic: Move the small cleanups in the next commit]
Signed-off-by: Mickaël Salaün <mic@digikod.net>