Commit 9af25400 for xz

commit 9af25400834aede88f1bc77b8524fcba10f15651
Author: Collin Funk <collin.funk1@gmail.com>
Date:   Sat Oct 17 21:36:10 2026 -0700

    Landlock: Support ABI version 10

    Like TCP sockets, we do not need UDP sockets.

    Co-authored-by: Lasse Collin <lasse.collin@tukaani.org>
    Closes: https://github.com/tukaani-project/xz/pull/257

diff --git a/src/common/my_landlock.h b/src/common/my_landlock.h
index 35aee08e..faee21f3 100644
--- a/src/common/my_landlock.h
+++ b/src/common/my_landlock.h
@@ -46,6 +46,15 @@
 #	define LANDLOCK_ACCESS_FS_RESOLVE_UNIX  (1ULL << 16)
 #endif

+// handled_access_net was added in ABI version 4. Provide fallbacks
+// for handled_access_net flags that were added in ABI version 10.
+#ifndef LANDLOCK_ACCESS_NET_BIND_UDP
+#	define LANDLOCK_ACCESS_NET_BIND_UDP         (1ULL << 2)
+#endif
+#ifndef LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP
+#	define LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP (1ULL << 3)
+#endif
+

 /// \brief      Initialize Landlock ruleset attributes to forbid everything
 ///
@@ -120,7 +129,10 @@ my_landlock_ruleset_attr_forbid_all(struct landlock_ruleset_attr *attr)
 	// ABI 4
 	attr->handled_access_net
 			= LANDLOCK_ACCESS_NET_BIND_TCP
-			| LANDLOCK_ACCESS_NET_CONNECT_TCP;
+			| LANDLOCK_ACCESS_NET_CONNECT_TCP
+			| LANDLOCK_ACCESS_NET_BIND_UDP // ABI 10
+			| LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP // ABI 10
+			;
 #endif

 #ifdef LANDLOCK_SCOPE_SIGNAL
@@ -168,9 +180,15 @@ my_landlock_ruleset_attr_forbid_all(struct landlock_ruleset_attr *attr)
 	case 8:
 		attr->handled_access_fs &= ~LANDLOCK_ACCESS_FS_RESOLVE_UNIX;
 		FALLTHROUGH;
+	case 9:
+#ifdef LANDLOCK_ACCESS_NET_BIND_TCP
+		attr->handled_access_net &= ~(LANDLOCK_ACCESS_NET_BIND_UDP
+				| LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP);
+#endif
+		FALLTHROUGH;

 	default:
-		// We only know about the features of the ABIs 1-6.
+		// We only know about the features of the ABIs 1-10.
 		break;
 	}