BPF and LSM maintainers clash over Landlock policy kfuncs
A third try at letting BPF apply userspace Landlock rulesets at exec hits the same wall: where kfuncs may live, and whether BPF should call into Landlock at all.
By oops#sandboxing
Seccomp gains non-cooperative pin redirect to close TOCTOU
A kernel series lets sandbox supervisors feed immutable syscall arguments into uncooperative targets without a trusted setup window.
By oops