sean/linux
Watch
1
0
Fork
You've already forked linux
 0
Code Issues Pull requests Projects Releases 33 Packages Wiki Activity

feat(kernel): compile in the LSMs the config already declares #13

Merged
sean merged 1 commit from feat/lsm-yama-landlock into trunk 2026-08-08 01:02:16 +00:00
Conversation 0 Commits 1 Files changed 1 +2
sean commented 2026-08-08 00:45:30 +00:00
Owner
Copy link

CONFIG_LSM names landlock,lockdown,yama,integrity,apparmor,bpf but only apparmor and bpf are built.

Ground truth from worker seanfarm-worker-069094 running 6.18.42-seanfarm29-1-g4a449ea2ffd5:

/sys/kernel/security/lsm      = capability,apparmor,bpf
/proc/sys/kernel/yama/ptrace_scope = does not exist

So landlock and yama are declared but inert. This cluster runs arbitrary code as a service, and without yama any process can ptrace another process of the same uid.

Enables CONFIG_SECURITY_YAMA and CONFIG_SECURITY_LANDLOCK. Lockdown stays off deliberately: CONFIG_MODULES=n already does its main job and it interacts with BPF program loading that Tetragon depends on.

Acceptance after the roll: /sys/kernel/security/lsm gains landlock and yama, and /proc/sys/kernel/yama/ptrace_scope exists.

CONFIG_LSM names landlock,lockdown,yama,integrity,apparmor,bpf but only apparmor and bpf are built. Ground truth from worker seanfarm-worker-069094 running 6.18.42-seanfarm29-1-g4a449ea2ffd5: /sys/kernel/security/lsm = capability,apparmor,bpf /proc/sys/kernel/yama/ptrace_scope = does not exist So landlock and yama are declared but inert. This cluster runs arbitrary code as a service, and without yama any process can ptrace another process of the same uid. Enables CONFIG_SECURITY_YAMA and CONFIG_SECURITY_LANDLOCK. Lockdown stays off deliberately: CONFIG_MODULES=n already does its main job and it interacts with BPF program loading that Tetragon depends on. Acceptance after the roll: /sys/kernel/security/lsm gains landlock and yama, and /proc/sys/kernel/yama/ptrace_scope exists.
feat(kernel): compile in the LSMs the config already declares
All checks were successful
pipeline/ci CI green @ 00401ff399c6
Details
00401ff399 
CONFIG_LSM lists "landlock,lockdown,yama,integrity,apparmor,bpf", but only
apparmor and bpf are built. On a running worker
/sys/kernel/security/lsm reads "capability,apparmor,bpf", so the landlock and
yama entries in that list are inert.

This cluster runs arbitrary code as a service, so the gap matters. Without yama
there is no kernel.yama.ptrace_scope, and any process can ptrace another process
of the same uid. Landlock gives unprivileged workloads a way to sandbox
themselves.

Enable the two LSMs that the declared list already names:
  CONFIG_SECURITY_YAMA=y
  CONFIG_SECURITY_LANDLOCK=y

Lockdown stays off deliberately. CONFIG_MODULES=n already does its main job, and
it interacts with BPF program loading, which Tetragon depends on.

Verify after the roll: /sys/kernel/security/lsm must gain landlock and yama, and
/proc/sys/kernel/yama/ptrace_scope must exist.
sean merged commit 00401ff399 into trunk 2026-08-08 01:02:16 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
sean/linux!13
No description provided.