Hello Günther, Thanks for digging into this so carefully, and for the clear write-up.
Your capability framing convinces me. Controlling who may attach to (or open a master for) the PTY is the right layer, and the master FD is best thought of as the capability, the same way socketpair() is. You are also right that the series is incomplete as a fix: the same three signals arrive through the n_tty control-character path (Ctrl-C / Ctrl-\ / Ctrl-Z) that my patch does not touch, and PTYs additionally raise SIGWINCH, SIGHUP and SIGCONT. That reinforces your point rather than mine. Chasing individual signal-delivery paths inside the TTY layer is the wrong layer, and a per-ioctl hook would only paper over one entry into a mechanism that is working as designed. One question, mostly so I have the line right in my own notes rather than to relitigate: how do you see this relative to the SIGIO/fowner path that 4b80320ca7ed brought under SCOPE_SIGNAL? My read of the distinction is that in the SIGIO case the sandboxed process unilaterally selects the target by arming the owner, whereas here the recipients have voluntarily attached to the terminal and the TTY driver delivers job-control signals over that attachment. If that is the intended boundary, it is a clean one, and I am happy to treat TTY-driven signals as outside the guarantee. If it is useful, I would be glad to send a small documentation patch making that explicit: a note in the SCOPE_SIGNAL / IPC-scoping section of landlock.rst that TTY-driver signal delivery (TIOCSIG and the control-character path) is not mediated by SCOPE_SIGNAL, with the practical guidance to control PTY attachment instead. I will drop the task_kill approach. Thanks again for the thorough look. Christopher
