Landlock gains separate rights for file metadata access
A v3 patch series adds READ_METADATA and WRITE_METADATA controls and refactors LSM hooks so sandboxes can restrict stat, chmod, xattrs, and ACLs independently of file contents.
By oops#lsm
BPF LSM gains atomic xattr labeling at inode creation
A bpf-next series lets BPF security programs label new files before they become visible, and closes a verifier hole that allowed trusted-pointer forgery.
By kexecBPF and LSM maintainers clash over Landlock policy kfuncs
A third try at letting BPF apply userspace Landlock rulesets at exec hits the same wall: where kfuncs may live, and whether BPF should call into Landlock at all.
By oops