[PATCH v3 1/2] docs: landlock: clarify TTY signal scoping

[Christopher Lusk]

LANDLOCK_SCOPE_SIGNAL limits signals sent to arbitrary processes outside
a domain.  A PTY master differs because its holder controls attached
processes through input and signal injection.

Clarify this boundary in the userspace guide and narrow the UAPI
description to arbitrary target processes.

Built the userspace-api docs; no new warnings.

Link: https://lore.kernel.org/r/20260916152336.1589383-1-clusk@xxxxxxxxxxxxx
Suggested-by: Günther Noack <gnoack@xxxxxxxxxx>
Suggested-by: Mickaël Salaün <mic@xxxxxxxxxxx>
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Christopher Lusk <clusk@xxxxxxxxxxxxx>
---
 Documentation/userspace-api/landlock.rst | 6 ++++++
 include/uapi/linux/landlock.h            | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/Documentation/userspace-api/landlock.rst b/Documentation/userspace-api/landlock.rst
index 84cb7bf6b3ed..4d9fb1f1588c 100644
--- a/Documentation/userspace-api/landlock.rst
+++ b/Documentation/userspace-api/landlock.rst
@@ -430,6 +430,12 @@ The operations which can be scoped are:
     This limits the sending of signals to target processes which run within the
     same or a nested Landlock domain.
 
+    Holding a PTY master FD grants control over the processes running under that
+    terminal, including the ability to inject input and signals.  A process able
+    to write to the master should therefore be considered as privileged as those
+    processes, and this capability is not restricted by
+    ``LANDLOCK_SCOPE_SIGNAL``.
+
 ``LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET``
     This limits the set of abstract :manpage:`unix(7)` sockets to which we can
     :manpage:`connect(2)` to socket addresses which were created by a process in
diff --git a/include/uapi/linux/landlock.h b/include/uapi/linux/landlock.h
index cceda3b3b961..ad7b1ebd62ed 100644
--- a/include/uapi/linux/landlock.h
+++ b/include/uapi/linux/landlock.h
@@ -500,7 +500,7 @@ struct landlock_net_port_attr {
  *   connecting to an abstract UNIX socket created by a process outside the
  *   related Landlock domain (e.g., a parent domain or a non-sandboxed process).
  * - %LANDLOCK_SCOPE_SIGNAL: Restrict a sandboxed process from sending a signal
- *   to another process outside the domain.
+ *   to an arbitrary process outside the domain.
  */
 /* clang-format off */
 #define LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET		(1ULL << 0)
-- 
2.55.0