landlock: Check landlock_restrict_self(2)'s flags before privileges

Browse source

landlock_restrict_self(2) currently checks the no_new_privs /
CAP_SYS_ADMIN requirement before validating the flags argument.  An
unprivileged caller without no_new_privs thus gets EPERM even when the
passed flags are invalid, hiding the EINVAL error.

Move the no_new_privs / CAP_SYS_ADMIN check just after the flags check
so that malformed calls consistently error out with EINVAL whatever the
caller's privileges, the same way seccomp(2) validates its flags before
checking no_new_privs.

Update the restrict_self_checks_ordering test accordingly.

Cc: Mickaël Salaün <mic@digikod.net>
Signed-off-by: Justin Suess <utilityemal77@gmail.com>
Link: https://patch.msgid.link/20260809154544.1253100-2-utilityemal77@gmail.com
Signed-off-by: Mickaël Salaün <mic@digikod.net>

...

This commit is contained in:

Justin Suess 2026-08-09 11:45:19 -04:00 • committed by Mickaël Salaün

parent bfff8bec73

commit c2fe8b60b8

No known key found for this signature in database

GPG key ID: E5E3D0E88C82F6D2

2 changed files with 9 additions and 5 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

8

security/landlock/syscalls.c

View file

6

tools/testing/selftests/landlock/base_test.c

View file