Changes in Kconfig

7199989f3f3194d653b024ce8e79cea6b15e38b9 - Merge tag 'landlock-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux

Fri, 21 Aug 2026 21:28:35 +0200

Merge tag 'landlock-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linuxPull Landlock update from Mickaël Salaün: "This improves observability with Landlock tracepoints support, which required some refactoring for dedicated domain types and common helpers shared with audit code. A LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS flag is also added to improve process-wide domain enforcement consistency. Whiteout files are now correctly handled and tested, and a few other fixes"* tag 'landlock-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux: (34 commits) landlock: Document tracepoints selftests/landlock: Add landlock_enforce_domain trace tests selftests/landlock: Add scope and ptrace tracepoint tests selftests/landlock: Add network tracepoint tests selftests/landlock: Add filesystem tracepoint tests selftests/landlock: Add trace event test infrastructure and tests landlock: Add tracepoints for ptrace and scope denials landlock: Add landlock_deny_access_fs and landlock_deny_access_net landlock: Add tracepoints for rule checking landlock: Add landlock_enforce_domain tracepoint landlock: Add create_domain and free_domain tracepoints landlock: Add landlock_add_rule_fs and landlock_add_rule_net tracepoints landlock: Add create_ruleset and free_ruleset tracepoints landlock: Consolidate access-right and scope names in a shared header landlock: Decouple the per-denial logging decision from CONFIG_AUDIT landlock: Split denial logging from audit into common framework landlock: Split struct landlock_domain from struct landlock_ruleset landlock: Move domain query functions to domain.c landlock: Prepare ruleset and domain type split samples/landlock: Add LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS to sampler ... List of files: /linux/security/landlock/Kconfig

b4540a72be4138a97c7cb74f803e57a7350a55ec - landlock: Add create_ruleset and free_ruleset tracepoints

Tue, 11 Aug 2026 11:43:21 +0200

landlock: Add create_ruleset and free_ruleset tracepointsAdd the first Landlock tracepoints, for ruleset lifecycle:landlock_create_ruleset fires from the landlock_create_ruleset() syscallhandler, and landlock_free_ruleset fires in free_ruleset() before theruleset is freed.These tracepoints, and the ones added by the following commits, share acommon design. Rather than one polymorphic event distinguished by astatus field (as audit uses a shared record type with a "status="field), each lifecycle transition and denial type gets its own eventwith a type-safe TP_PROTO, giving precise ftrace filtering by event nameand type-safe eBPF access. TP_PROTO passes the object pointer and thefields are read from it in TP_fast_assign, so an eBPF program reads thefull object state (rules, access masks, hierarchy) via BTF from a singlepointer rather than from the flattened TP_STRUCT__entry fields. Thewhole cost is paid only when a tracer is attached; the static branch isnot taken otherwise. Trace fields carry the bare access-right and scopenames (read_file), reusing the audit name tables; audit prepends thecategory (fs.read_file), which the trace event name already conveys.The trace header's DOC comment documents the consistency and lockingguarantees these events share.create_ruleset needs no lock because the ruleset is not yet shared (itsfile descriptor is not yet installed). The deallocation events use the"free_" prefix, not "drop_", because they fire when the object isactually freed.Add trace.c, built for CONFIG_TRACEPOINTS, which definesCREATE_TRACE_POINTS, and extend CONFIG_SECURITY_LANDLOCK_LOG to also beselected by CONFIG_TRACEPOINTS so the common log framework is availableto a tracepoints-only build.Add an id field to struct landlock_ruleset, gated on CONFIG_TRACEPOINTSand assigned from landlock_get_id_range() at creation. Only thetracepoints consume it (audit identifies domains, not rulesets), so itdoes not exist in an audit-only build. The Landlock ID is a stable u64that names the ruleset across the trace stream and uses the same schemeas audit, so a ruleset can be correlated between trace and auditrecords.Cc: Günther Noack Cc: Justin Suess Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Steven Rostedt Cc: Tingmao Wang Link: https://patch.msgid.link/20260811094338.288094-8-mic@digikod.netSigned-off-by: Mickaël Salaün List of files: /linux/security/landlock/Kconfig

e761a88cedeb46de17b6d9e8c7c41c7671e83a6b - landlock: Split denial logging from audit into common framework

Tue, 11 Aug 2026 11:43:18 +0200

landlock: Split denial logging from audit into common frameworkTracepoint emission requires the denial framework (layer identification,request validation) without depending on CONFIG_AUDIT. Separate thedenial logging infrastructure from the audit-specific code byintroducing a common log framework.Create CONFIG_SECURITY_LANDLOCK_LOG, enabled by default whenCONFIG_AUDIT is set; a following commit extends it to CONFIG_TRACEPOINTSwhen the first tracepoint consumer is added. Move the common framework(the request types, the layer identification and request validation, andthe landlock_log_denial() and landlock_log_free_domain() entry points)into log.c and log.h, and keep the audit-specific record formatting inaudit.c. log.o is built for CONFIG_SECURITY_LANDLOCK_LOG and audit.o forCONFIG_AUDIT, so the common framework is available to a tracepoints-onlybuild. The entry points dispatch to no-op static inline audit stubswithout CONFIG_AUDIT, so the call sites stay unconditional. Rename theformer landlock_log_drop_domain() to landlock_log_free_domain() to matchthe landlock_free_domain tracepoint added in a following commit.landlock_log_denial() counts denials even without audit, so itsdeclaration and no-op stub are guarded by CONFIG_SECURITY_LANDLOCK_LOG,not CONFIG_AUDIT; a CONFIG_AUDIT guard would expose the stub and clashwith log.c's definition in a tracepoints-only build.Widen the ID allocation (id.o and the landlock_init_id() /landlock_get_id_range() declarations) and the log-state representation(the domain_exec and log_subdomains_off credential fields, thelandlock_hierarchy log fields, and the code that maintains them) fromCONFIG_AUDIT to CONFIG_SECURITY_LANDLOCK_LOG, so each field and itswriter share one guard and are available to tracing without auditsupport.Widen the denial-path state that feeds the per-denial logging decisionthe same way, so the "logged" verdict is computed identically whether ornot CONFIG_AUDIT is set. Widening fown_layer is what keeps thefile-owner-signal path valid without audit: otherwisehook_file_send_sigiotask() would leave layer_plus_one at zero, trippingthe is_valid_request() canary and dropping the LANDLOCK_SCOPE_SIGNALdenial from tracing.The ruleset-level quiet_masks stays on no CONFIG guard: it is builderstate validated and stored from user input, kept available soLANDLOCK_ADD_RULE_QUIET flags are accepted and ignored, not rejected,when CONFIG_SECURITY_LANDLOCK_LOG is disabled.Cc: Günther Noack Link: https://patch.msgid.link/20260811094338.288094-5-mic@digikod.netSigned-off-by: Mickaël Salaün List of files: /linux/security/landlock/Kconfig

a23e1966932464e1c5226cb9ac4ce1d5fc10ba22 - Merge branch 'next' into for-linus

Mon, 15 Jul 2024 23:03:44 +0200

Merge branch 'next' into for-linusPrepare input updates for 6.11 merge window. List of files: /linux/security/landlock/Kconfig

6f47c7ae8c7afaf9ad291d39f0d3974f191a7946 - Merge tag 'v6.9' into next

Tue, 28 May 2024 06:37:18 +0200

Merge tag 'v6.9' into nextSync up with the mainline to bring in the new cleanup API. List of files: /linux/security/landlock/Kconfig

60a2f25de7b8b785baee2932db932ae9a5b8c86d - Merge drm/drm-next into drm-intel-gt-next

Thu, 16 May 2024 09:33:01 +0200

Merge drm/drm-next into drm-intel-gt-nextSome display refactoring patches are needed in order to allow conflict-less merging.Signed-off-by: Tvrtko Ursulin List of files: /linux/security/landlock/Kconfig

594ce0b8a998aa4d05827cd7c0d0dcec9a1e3ae2 - Merge topic branches 'clkdev' and 'fixes' into for-linus

Mon, 10 Jun 2024 13:03:21 +0200

Merge topic branches 'clkdev' and 'fixes' into for-linus List of files: /linux/security/landlock/Kconfig

b228ab57e51b62663a80ca820c87ba2650583f08 - Merge branch 'master' into mm-stable

Mon, 18 Mar 2024 17:55:12 +0100

Merge branch 'master' into mm-stable List of files: /linux/security/landlock/Kconfig

79790b6818e96c58fe2bffee1b418c16e64e7b80 - Merge drm/drm-next into drm-xe-next

Fri, 12 Apr 2024 15:14:25 +0200

Merge drm/drm-next into drm-xe-nextBackmerging drm-next in order to get up-to-date and in particularto access commit 9ca5facd0400f610f3f7f71aeb7fc0b949a48c67.Signed-off-by: Thomas Hellström List of files: /linux/security/landlock/Kconfig

3e5a516f3bf1a33f2bf219f570e9b5c031616f6a - Merge tag 'phy_dp_modes_6.10' into msm-next-lumag

Mon, 08 Apr 2024 17:35:51 +0200

Merge tag 'phy_dp_modes_6.10' into msm-next-lumagMerge DisplayPort subnode API in order to allow DisplayPort driver toconfigure the PHYs either to the DP or eDP mode, depending on hardwareconfiguration.Signed-off-by: Dmitry Baryshkov List of files: /linux/security/landlock/Kconfig

5add703f6acad1c63f8a532b6de56e50d548e904 - Merge drm/drm-next into drm-intel-next

Tue, 02 Apr 2024 14:17:13 +0200

Merge drm/drm-next into drm-intel-nextCatching up on 6.9-rc2Signed-off-by: Rodrigo Vivi List of files: /linux/security/landlock/Kconfig

0d21364c6e8dc1f62c34bbc49d49935c8b01844c - Merge drm/drm-next into drm-misc-next

Tue, 02 Apr 2024 09:51:30 +0200

Merge drm/drm-next into drm-misc-nextBackmerging to get v6.9-rc2 changes into drm-misc-next.Signed-off-by: Thomas Zimmermann List of files: /linux/security/landlock/Kconfig

b7e1e969c887c897947fdc3754fe9b0c24acb155 - Merge branch 'topic/sound-devel-6.10' into for-next

Tue, 26 Mar 2024 12:19:11 +0100

Merge branch 'topic/sound-devel-6.10' into for-next List of files: /linux/security/landlock/Kconfig

537c2e91d3549e5d6020bb0576cf9b54a845255f - Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Fri, 22 Mar 2024 00:14:13 +0100

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netCross-merge networking fixes after downstream PR.Signed-off-by: Jakub Kicinski List of files: /linux/security/landlock/Kconfig

f4566a1e73957800df75a3dd2dccee8a4697f327 - Merge tag 'v6.9-rc1' into sched/core, to pick up fixes and to refresh the branch

Mon, 25 Mar 2024 11:32:29 +0100

Merge tag 'v6.9-rc1' into sched/core, to pick up fixes and to refresh the branchSigned-off-by: Ingo Molnar List of files: /linux/security/landlock/Kconfig

100c85421b52e41269ada88f7d71a6b8a06c7a11 - Merge tag 'asoc-fix-v6.9-rc2' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus

Fri, 05 Apr 2024 08:48:12 +0200

Merge tag 'asoc-fix-v6.9-rc2' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linusASoC: Fixes for v6.9A relatively large set of fixes here, the biggest piece of it is aseries correcting some problems with the delay reporting for Intel SOFcards but there's a bunch of other things. Everything here is driverspecific except for a fix in the core for an issue with sign extensionhandling volume controls. List of files: /linux/security/landlock/Kconfig

36a1818f5a1e50b805317ba13f827067d50f6970 - Merge drm/drm-fixes into drm-misc-fixes

Mon, 25 Mar 2024 21:11:58 +0100

Merge drm/drm-fixes into drm-misc-fixesBackmerging to get drm-misc-fixes to the state of v6.9-rc1.Signed-off-by: Thomas Zimmermann List of files: /linux/security/landlock/Kconfig

35e886e88c803920644c9d3abb45a9ecb7f1e761 - Merge tag 'landlock-6.9-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux

Fri, 15 Mar 2024 00:00:27 +0100

Merge tag 'landlock-6.9-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linuxPull landlock updates from Mickaël Salaün: "Some miscellaneous improvements, including new KUnit tests, extended documentation and boot help, and some cosmetic cleanups. Additional test changes already went through the net tree"* tag 'landlock-6.9-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux: samples/landlock: Don't error out if a file path cannot be opened landlock: Use f_cred in security_file_open() hook landlock: Rename "ptrace" files to "task" landlock: Simplify current_check_access_socket() landlock: Warn once if a Landlock action is requested while disabled landlock: Extend documentation for kernel support landlock: Add support for KUnit tests selftests/landlock: Clean up error logs related to capabilities List of files: /linux/security/landlock/Kconfig

b4007fd27206c478a4b76e299bddf4a71787f520 - landlock: Add support for KUnit tests

Thu, 18 Jan 2024 12:36:32 +0100

landlock: Add support for KUnit testsAdd the SECURITY_LANDLOCK_KUNIT_TEST option to enable KUnit tests forLandlock. The minimal required configuration is listed in thesecurity/landlock/.kunitconfig file.Add an initial landlock_fs KUnit test suite with 7 test cases forfilesystem helpers. These are related to the LANDLOCK_ACCESS_FS_REFERright.There is one KUnit test case per:* mutated state (e.g. test_scope_to_request_*) or,* shared state between tests (e.g. test_is_eaccess_*).Add macros to improve readability of tests (i.e. one per line). Testcases are collocated with the tested functions to help maintenance andimprove documentation. This is why SECURITY_LANDLOCK_KUNIT_TEST cannotbe set as module.This is a nice complement to Landlock's user space kselftests. Weexpect new Landlock features to come with KUnit tests as well.Thanks to UML support, we can run all KUnit tests for Landlock with:./tools/testing/kunit/kunit.py run --kunitconfig security/landlock[00:00:00] ======================= landlock_fs =======================[00:00:00] [PASSED] test_no_more_access[00:00:00] [PASSED] test_scope_to_request_with_exec_none[00:00:00] [PASSED] test_scope_to_request_with_exec_some[00:00:00] [PASSED] test_scope_to_request_without_access[00:00:00] [PASSED] test_is_eacces_with_none[00:00:00] [PASSED] test_is_eacces_with_refer[00:00:00] [PASSED] test_is_eacces_with_write[00:00:00] =================== [PASSED] landlock_fs ===================[00:00:00] ============================================================[00:00:00] Testing complete. Ran 7 tests: passed: 7Cc: Konstantin Meskhidze Reviewed-by: Günther Noack Link: https://lore.kernel.org/r/20240118113632.1948478-1-mic@digikod.netSigned-off-by: Mickaël Salaün List of files: /linux/security/landlock/Kconfig

0ea5c948cb64bab5bc7a5516774eb8536f05aa0d - Merge drm/drm-next into drm-intel-next

Mon, 15 Jan 2024 08:38:05 +0100

Merge drm/drm-next into drm-intel-nextBackmerge to bring Xe driver to drm-intel-next.Signed-off-by: Jani Nikula List of files: /linux/security/landlock/Kconfig