Landlock gains separate rights for file metadata access

Linux's Landlock sandbox is set to gain two new filesystem rights that separately govern reading and writing of file metadata, closing a long-standing gap in what unprivileged processes can lock down.

Cai Xinchen of Huawei posted a third revision of the work toward the kernel's -next tree. It introduces LANDLOCK_ACCESS_FS_READ_METADATA and LANDLOCK_ACCESS_FS_WRITE_METADATA. The read right covers stat-family calls, extended attribute and POSIX ACL reads, and flag/attribute queries. The write right covers chmod, chown, utimensat, xattr and ACL changes, and the corresponding flag-setting interfaces. Grouping follows security relevance rather than one right per syscall, matching earlier list consensus.

Until now a Landlock ruleset could deny reading or writing file contents and still leave metadata fully exposed, so a confined process could still inspect ownership, modes, timestamps, and xattrs, or change them. The new rights plug that hole. For already-open file descriptors, checks follow the rights present at open time, the same model Landlock already uses for truncate; path-based operations and O_PATH descriptors are always rechecked against the calling thread. Documentation warns that READ_METADATA usually needs to be granted alongside ordinary file and directory read rights, because common tools expect stat(2) to succeed when listing or reading.

Delivering the feature required a broad VFS and LSM refactor: several inode hooks that already carried a path are renamed to the path_* convention, and path plus optional file are threaded through getattr, setattr, xattr, ACL, fileattr, and security-context hooks so Landlock (and other LSMs) see both the path and the file used for the request. SELinux, Smack, EVM, IMA, BPF selftests, and the sample sandboxer are updated; the Landlock ABI moves to 13, with older ABIs stripping the new bits on fallback.

Automated review of the series flagged residual edge cases around O_PATH and AT_EMPTY_PATH handling, nullable file arguments for BPF LSM programs, and stacked-filesystem bypasses. Those items remain to be settled before merge.