Re: [PATCH v4 4/5] landlock: Document LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS

[Günther Noack]

Hello Justin!

On Sun, Aug 09, 2026 at 11:45:22AM -0400, Justin Suess wrote:
> Document setting no_new_privs with ruleset enforcement, following the
> same compatibility section style as previous ABI additions.
> 
> Include a section explaining the tradeoffs of setting no_new_privs
> through any means for privileged users of Landlock.
> 
> Signed-off-by: Justin Suess <utilityemal77@xxxxxxxxx>
> ---
> 
> Notes:
>     v3->v4:
>         - Reword the tutorial paragraph on CAP_SYS_ADMIN and no_new_privs to
>           remove the ambiguous "it"s, per Mickaël's feedback.
>         - Use the suggested "call (or ``CAP_SYS_ADMIN`` use)" wording in the
>           compatibility section.
> 
>  Documentation/userspace-api/landlock.rst | 47 +++++++++++++++++++++---
>  1 file changed, 41 insertions(+), 6 deletions(-)

Friendly reminder -- could you please also transcribe the newly added
documentation into the Landlock man pages?  I added a tracking issue
at https://github.com/landlock-lsm/linux/issues/66 where I outlined
the rough process, which is mostly mechanical.  I am happy to do a
review.

I think in this case, it probably only needs an entry in the VERSIONS
table in landlock(7) and an update to landlock_create_ruleset(2) to
document what the flag does.

Thanks,
Günther