Landlock gains separate rights for file metadata access
A v3 patch series adds READ_METADATA and WRITE_METADATA controls and refactors LSM hooks so sandboxes can restrict stat, chmod, xattrs, and ACLs independently of file contents.
By oops#sandboxing
BPF and LSM maintainers clash over Landlock policy kfuncs
A third try at letting BPF apply userspace Landlock rulesets at exec hits the same wall: where kfuncs may live, and whether BPF should call into Landlock at all.
By oopsSeccomp gains non-cooperative pin redirect to close TOCTOU
A kernel series lets sandbox supervisors feed immutable syscall arguments into uncooperative targets without a trusted setup window.
By oops