[GIT PULL] Landlock update for v7.4-rc1

[Mickaël Salaün]

Hi,

The main change adds composable Landlock controls for namespace types
and Linux capabilities, thanks to new LSM hooks (merged via the LSM
tree).  A umount race condition is also fixed.

Please pull these changes for v7.4-rc1 .  These commits merge cleanly
with your master branch.  Kernel changes have been tested in the
latest linux-next releases, and I recently fixed a new merge conflict
(see the related merge commit message).

Test coverage for security/landlock is 91.8% of 2864 lines according to
LLVM 23, and it was 91.6% of 2625 lines before this PR.

Regards,
 Mickaël

--
The following changes since commit 24a19b953e2a3d0ea5a8c4951a0ab8f32720c907:

  Linux 7.3-rc7 (2026-10-11 20:04:55 -0700)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/mic/linux.git tags/landlock-7.4-rc1

for you to fetch changes up to 3e271a27c46fd591d1011c7de5a644a41e2010f1:

  landlock: Fix superblock use-after-free in release_inode() (2026-10-20 16:47:24 +0200)

----------------------------------------------------------------
Landlock update for v7.4-rc1

----------------------------------------------------------------
Christian Brauner (2):
      ns: Free anonymous mount namespaces via ns_common_free()
      lsm: add LSM blob and hooks for namespaces

Günther Noack (1):
      landlock: Fix superblock use-after-free in release_inode()

Jann Horn (1):
      cred: clarify that task_struct::cred is only for the current task

Mickaël Salaün (10):
      lsm: add LSM_AUDIT_DATA_NS for namespace audit records
      Merge branch 'lsm/dev' into master
      landlock: Rename quiet_masks to quiet_access
      landlock: Wrap per-layer access masks in struct layer_config
      landlock: Enforce namespace use restrictions
      landlock: Enforce capability restrictions
      selftests/landlock: Add namespace restriction tests
      selftests/landlock: Add capability restriction tests
      samples/landlock: Add capability and namespace restriction support
      landlock: Add documentation for capability and namespace restrictions

Paul Moore (1):
      lsm: update the BUILD_BUG_ON() in audit_log_lsm_data()

Wang Yan (1):
      selftests/landlock: Fix snprintf truncation checks in test files

 Documentation/admin-guide/LSM/landlock.rst     |   46 +-
 Documentation/security/landlock.rst            |  177 +-
 Documentation/trace/events-landlock.rst        |   66 +-
 Documentation/userspace-api/landlock.rst       |  243 ++-
 fs/namespace.c                                 |    3 +-
 include/linux/cred.h                           |   17 +-
 include/linux/landlock.h                       |   29 +-
 include/linux/lsm_audit.h                      |    5 +
 include/linux/lsm_hook_defs.h                  |    3 +
 include/linux/lsm_hooks.h                      |    1 +
 include/linux/ns/ns_common_types.h             |    3 +
 include/linux/sched.h                          |    8 +-
 include/linux/security.h                       |   20 +
 include/trace/events/landlock.h                |  244 ++-
 include/uapi/linux/landlock.h                  |  139 +-
 include/uapi/linux/nsfs.h                      |    1 +
 init/init_task.c                               |    2 +-
 kernel/auditsc.c                               |    5 +-
 kernel/cred.c                                  |    2 +-
 kernel/nscommon.c                              |   17 +-
 kernel/nsproxy.c                               |    6 +
 samples/Kconfig                                |   13 +-
 samples/landlock/Makefile                      |    5 +
 samples/landlock/sandboxer.c                   |  269 ++-
 security/landlock/Makefile                     |    4 +-
 security/landlock/access.h                     |   61 +-
 security/landlock/audit.c                      |   32 +-
 security/landlock/cap.c                        |  159 ++
 security/landlock/cap.h                        |   48 +
 security/landlock/cred.h                       |    2 +-
 security/landlock/domain.c                     |   13 +-
 security/landlock/domain.h                     |   97 +-
 security/landlock/fs.c                         |   12 +-
 security/landlock/limits.h                     |    9 +
 security/landlock/log.c                        |   53 +-
 security/landlock/log.h                        |   10 +-
 security/landlock/net.c                        |    2 +-
 security/landlock/ns.c                         |  241 +++
 security/landlock/ns.h                         |   18 +
 security/landlock/ruleset.c                    |   27 +-
 security/landlock/ruleset.h                    |   33 +-
 security/landlock/setup.c                      |    4 +
 security/landlock/syscalls.c                   |  217 +-
 security/landlock/trace.c                      |   27 +-
 security/lsm_audit.c                           |    6 +-
 security/lsm_init.c                            |    5 +-
 security/security.c                            |   72 +
 tools/testing/selftests/landlock/audit_test.c  |    2 +-
 tools/testing/selftests/landlock/base_test.c   |   21 +-
 tools/testing/selftests/landlock/cap_test.c    | 1370 ++++++++++++
 tools/testing/selftests/landlock/common.h      |   13 +
 tools/testing/selftests/landlock/config        |    5 +
 tools/testing/selftests/landlock/fs_test.c     |   13 +-
 tools/testing/selftests/landlock/net_test.c    |    4 +-
 tools/testing/selftests/landlock/ns_test.c     | 2647 ++++++++++++++++++++++++
 tools/testing/selftests/landlock/ptrace_test.c |    2 +-
 tools/testing/selftests/landlock/trace.h       |   52 +-
 tools/testing/selftests/landlock/trace_test.c  |    8 +-
 tools/testing/selftests/landlock/wrappers.h    |   29 +
 59 files changed, 6437 insertions(+), 205 deletions(-)
 create mode 100644 security/landlock/cap.c
 create mode 100644 security/landlock/cap.h
 create mode 100644 security/landlock/ns.c
 create mode 100644 security/landlock/ns.h
 create mode 100644 tools/testing/selftests/landlock/cap_test.c
 create mode 100644 tools/testing/selftests/landlock/ns_test.c