Hi, The initial motivation for this series is a fix for the signal scoping restriction (see patch 5/8). Because some user space code cannot use the signal scoping feature without this fix, we need to have a way to identify if this fix is applied to the running kernel. This led me to implement a new "errata" interface to let user space know if it can use some fixed features. This should be especially useful in the Landlock Go library to be able to use the signal scoping control. Testing this series with Sparse, I had to add a check for __has_include support to avoid Sparse errors. I guess this could be fixed in Sparse but for now let's just ignore this error. This second patch series also brings new tests for this fix. Previous version: v1: https://lore.kernel.org/r/20250313145904.3238184-1-mic@xxxxxxxxxxx Regards, Mickaël Salaün (8): landlock: Move code to ease future backports landlock: Add the errata interface landlock: Add erratum for TCP fix landlock: Prepare to add second errata landlock: Always allow signals between threads of the same process selftests/landlock: Split signal_scoping_threads tests selftests/landlock: Add a new test for setuid() landlock: Document errata Documentation/userspace-api/landlock.rst | 24 +++- include/uapi/linux/landlock.h | 2 + security/landlock/errata.h | 99 ++++++++++++++++ security/landlock/errata/abi-4.h | 15 +++ security/landlock/errata/abi-6.h | 19 +++ security/landlock/fs.c | 22 +++- security/landlock/setup.c | 38 +++++- security/landlock/setup.h | 3 + security/landlock/syscalls.c | 22 +++- security/landlock/task.c | 12 ++ tools/testing/selftests/landlock/base_test.c | 38 +++++- tools/testing/selftests/landlock/common.h | 1 + .../selftests/landlock/scoped_signal_test.c | 108 +++++++++++++++--- 13 files changed, 374 insertions(+), 29 deletions(-) create mode 100644 security/landlock/errata.h create mode 100644 security/landlock/errata/abi-4.h create mode 100644 security/landlock/errata/abi-6.h base-commit: 7eb172143d5508b4da468ed59ee857c6e5e01da6 -- 2.48.1
