Big Landlock Networking Fix

Landlock’s current features for restricting networking are limited as of today (September 2026).

In my understanding, the missing pieces are:

The way to think about this is by considering the state graph for socket connections on connection-oriented protocols. Operations that we should restrict are highlighted in red:

Notes:

• This diagram omits bind(2), because both listen(2) and connect(2) work also without it.
• For connection-less protocols, the states are somewhat different, see LandlockUdpPortControl.

1. Make it impossible to contruct sockets of certain types

• Control socket(2): Restrict creating sockets, filtered by family, type and protocol arguments: LandlockSocketTypeControl

As I discussed on my weblog before, you can absolutely create listening sockets without calling bind(2). It is listen(2), not bind(2), which starts to listen on a port, and it hands out an emphemeral port if needed.

2. Control operations through which you can create connections

For socket types that are common, we may have cases where we want to permit their creation and use, but restrict the ways in which incoming and outgoing interactions can be done.

2.1. More protocol support

Control bind(2) and connect(2) for these additional connection-oriented protocols:

• Multipath-TCP: LandlockMptcpPortControl
• SCTP: LandlockSctpPortControl
• SMC: ?

Compare with Landlock erratum 1: In the initial version of the LandlockTcpPortControl, these additional protocols were accidentally restricted as they also use sockets of family AF_INET/AF_INET6 and type SOCK_STREAM.

Related Landlock controls which already exist:

• LandlockTcpPortControl (connection-oriented)
• LandlockUdpPortControl (connection-less)
• LandlockUnixConnectControl and LANDLOCK_ACCESS_FS_MAKE_SOCK (connection-oriented)

2.2. Control listen(2)

Additionally:

• Control listen(2) for all of the protocols where we restrict connect(2) as well: LandlockListenControl