[dependabot]

Bumps github.com/landlock-lsm/go-landlock from 0.0.0-20250303204525-1544bccde3a3 to 0.11.0.

Release notes

Sourced from github.com/landlock-lsm/go-landlock's releases.

ABI V11 Support

Transparent changes for Go-Landlock users:

• LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS: By using this new flag, Go-Landlock can avoid unnecessary thread locking and an extra syscall during Landlock enforcement. This feature is safe for all users and automatically used.

Documentation updates for better AI-assisted development:

• Added UPGRADE.md to point to upgrade procedure. This conventional file name is picked up by tools like Github's dependabot.
• Documented how to use Landlock in Go with raw syscalls. I hope that some vibe coded apps will avoid common pitfalls that way.

ABI V10 Support

Features:

• UDP bind/connect/send restrictions
• Quieting audit logging

ABI V9 support

Adds support for LANDLOCK_ACCESS_FS_RESOLVE_UNIX (see https://docs.kernel.org/userspace-api/landlock.html#filesystem-flags), as introduced by Linux 7.1 today.

Users are advised to use landlock.V9 to restrict outgoing connections to named UNIX sockets. Individual sockets or directories can be allow-listed using the FSRule.WithResolveUnix() modifier for file system rules. As usual, the things to look out for are documented in config.go next to the landlock.V9 identifier.

For a step-by-step instruction for upgrading (or when using an AI agent!), see https://github.com/landlock-lsm/go-landlock/blob/main/docs/upgrade.md

Full Changelog: landlock-lsm/go-landlock@v0.8.1...v0.9.0

v0.8.1

• The landlocktsync build constraint allows to build Go-Landlock without libpsx
• Documentation
  • docs/: Some .md files to document user-centric workflows (onboarding/updating/...)
  • Various documentation fixes

ABI V8 support

• composite rule support
  • landlock.CompositeRule(r1, r2, ...) creates a rule value that bundles the rules r1, r2, ... together into a single rule object
  • This is useful for building reusable libraries of related Landlock rules
• TSYNC support (Linux 7.0+)
  • Improves reliability when working with multithreaded cgo bindings
  • Fixes the slightly inaccurate semantics when signaling and using abstract UNIX sockets between independently spawned child processes

ABI V7 suppport

In v0.7.0, @​flavio has added support for Landlock's audit logging feature, which was introduced in Linux 6.15. Thank you!

• By default, Landlock logs access denials from the same Go process which enforced the Landlock policy, but not from its subprocesses.
• With new methods in the Config type, you can:
  • Disable Landlock denial audit logging for the current process
  • Enable Landlock denial audit logging for subprocesses
  • Suppress Landlock denial audit logging from nested Landlock policies

For details, see the Landlock announcement at: https://lore.kernel.org/landlock/20250519.queejoh3Phei@digikod.net/T/#m8739230658e1bd7b06cd1af69cc3fde7c7d37e88 and the documentation for landlock_restrict_self.

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)