[PATCH] landlock: Document io_uring credentials management

[PATCH] landlock: Document io_uring credentials management

[Günther Noack]

io_uring can override credentials (including the Landlock domain) and
interfere with Landlock domains in ways that may come as a surprise to
users.  To reduce the incoming questions about that subject, document it
explicitly as a common surprise.

I am intentionally vague about io_uring's credential management, as this is
better documented by io_uring than in the Landlock documentation.

Signed-off-by: Günther Noack <gnoack@google.com>
---
 Documentation/userspace-api/landlock.rst | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/Documentation/userspace-api/landlock.rst b/Documentation/userspace-api/landlock.rst
index 5a63d4476c1c..dab04f8e4962 100644
--- a/Documentation/userspace-api/landlock.rst
+++ b/Documentation/userspace-api/landlock.rst
@@ -675,6 +675,19 @@ fine-grained in the future.  Until then, users are advised to establish the
 guarantees that they need through the file hierarchy, by only allowing the
 ``LANDLOCK_ACCESS_FS_IOCTL_DEV`` right on files where it is really required.
 
+io_uring
+--------
+
+Operations issued over an ``io_uring`` can be executed with overridden
+credentials (including the Landlock domain), which are either captured at the
+time of request submission, at the time of ``io_uring`` creation, or at the time
+of registering a personality with the ``io_uring``.
+
+Depending on its configuration, an ``io_uring`` may therefore use a Landlock
+domain that differs from the one used by the current thread.  When using
+``io_uring``, it is recommended to double check its credential management so
+that the credentials with the appropriate Landlock domains are used.
+
 Previous limitations
 ====================
 
-- 
2.55.0.229.g6434b31f56-goog