[GIT PULL] Landlock update for v7.2-rc1

[Mickaël Salaün]

Hi,

This PR adds new Landlock access rights to control UDP bind and
connect/send operations, and a new "quiet" feature to mute specific
audit logs (and other future observability events).  A few commits also
fix Landlock issues.

Please pull these changes for v7.2-rc1 .  These commits merge cleanly
with your master branch.  Most kernel changes have been tested in the
latest linux-next releases for some weeks, and I waited a bit more since
last week to make sure the changes brought by the recently squashed
fixes are ok.

Test coverage for security/landlock is 91.5% of 2351 lines according to
LLVM 22, and it was 90.9% of 2176 lines before this PR.

syzkaller changes have been developed to cover these new features:
https://github.com/google/syzkaller/pull/7493

Regards,
 Mickaël

--
The following changes since commit 5d6919055dec134de3c40167a490f33c74c12581:

  Linux 7.1-rc3 (2026-05-10 14:08:09 -0700)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/mic/linux.git tags/landlock-7.2-rc1

for you to fetch changes up to 1c236e7fe740a009ad8dd40a5ee0602ec402fffe:

  selftests/landlock: Add tests for invalid use of quiet flag (2026-06-14 20:17:25 +0200)

----------------------------------------------------------------
Landlock update for v7.2-rc1

----------------------------------------------------------------
Bryam Vargas (2):
      landlock: Fix LANDLOCK_SCOPE_SIGNAL bypass on the SIGIO path
      selftests/landlock: Test SCOPE_SIGNAL on the SIGIO/fowner pgid path

Matthieu Buffet (7):
      landlock: Fix unmarked concurrent access to socket family
      landlock: Add UDP bind() access control
      landlock: Add UDP send+connect access control
      selftests/landlock: Add tests for UDP bind/connect
      selftests/landlock: Add tests for UDP send
      samples/landlock: Add sandboxer UDP access control
      landlock: Add documentation for UDP support

Maximilian Heyne (1):
      selftests/landlock: Explicitly disable audit in teardowns

Mickaël Salaün (5):
      selftests/landlock: Filter dealloc records in audit_count_records()
      selftests/landlock: Increase default audit socket timeout
      landlock: Set audit_net.sk for socket access checks
      landlock: Account all audit data allocations to user space
      landlock: Demonstrate best-effort allowed_access filtering

Tingmao Wang (9):
      landlock: Add a place for flags to layer rules
      landlock: Add API support and docs for the quiet flags
      landlock: Suppress logging when quiet flag is present
      samples/landlock: Add quiet flag support to sandboxer
      selftests/landlock: Replace hard-coded 16 with a constant
      selftests/landlock: Add tests for quiet flag with fs rules
      selftests/landlock: Add tests for quiet flag with net rules
      selftests/landlock: Add tests for quiet flag with scope
      selftests/landlock: Add tests for invalid use of quiet flag

 Documentation/admin-guide/LSM/landlock.rst         |   13 +-
 Documentation/userspace-api/landlock.rst           |  145 +-
 include/uapi/linux/landlock.h                      |   97 +-
 samples/landlock/sandboxer.c                       |  175 +-
 security/landlock/access.h                         |   44 +-
 security/landlock/audit.c                          |  292 ++-
 security/landlock/audit.h                          |    3 +-
 security/landlock/domain.c                         |   66 +-
 security/landlock/domain.h                         |   16 +-
 security/landlock/fs.c                             |  171 +-
 security/landlock/fs.h                             |   29 +-
 security/landlock/limits.h                         |    5 +-
 security/landlock/net.c                            |  185 +-
 security/landlock/net.h                            |    5 +-
 security/landlock/ruleset.c                        |   49 +-
 security/landlock/ruleset.h                        |   29 +-
 security/landlock/syscalls.c                       |   73 +-
 security/landlock/task.c                           |   11 +
 tools/testing/selftests/landlock/audit.h           |  140 +-
 tools/testing/selftests/landlock/audit_test.c      |   33 +-
 tools/testing/selftests/landlock/base_test.c       |  122 +-
 tools/testing/selftests/landlock/common.h          |    2 +
 tools/testing/selftests/landlock/fs_test.c         | 2445 +++++++++++++++++++-
 tools/testing/selftests/landlock/net_test.c        | 1392 ++++++++++-
 tools/testing/selftests/landlock/ptrace_test.c     |    1 +
 .../selftests/landlock/scoped_abstract_unix_test.c |   78 +-
 .../selftests/landlock/scoped_signal_test.c        |  182 ++
 27 files changed, 5368 insertions(+), 435 deletions(-)