Re: [PATCH v2 0/4] landlock: Fix REFER in layered domains

["Mickaël Salaün" <mic@digikod.net>]

On Sun, Nov 08, 2026 at 09:23:47PM +0100, Günther Noack wrote:
> This patchset fixes a bug in Landlock layering,
> reported by Dwi Siswanto in [1] and [2].  (Thanks!)
> 
> The bug
> =======
> 
> When Landlock initializes layer masks for path walk based checks, it
> unconditionally adds the LANDLOCK_ACCESS_FS_REFER access right to the
> handled access rights.
> 
> This leads to a wrong layer composition, in cases where the following
> layers are stacked:
> 
> 1. A FS layer restricting REFER, but also allowing REFER in a rule
>    (e.g., handle REFER, but allow REFER on /)
> 2. A non-FS layer (e.g., networking-only layer)
> 
> When these rulesets are enforced **individually**, there are REFER
> operations that are allowed in both rulesets -- the ones that 1
> allows.
> 
> When these rulesets are enforced **on top of each other**, the non-FS
> layer starts enforcing REFER implicitly as well, and all REFER
> operations are denied.

Good catch!

> 
> This patchset
> =============
> 
> This patchset fixes the issue in three commits:

Four patches now.

> 
> 1) The fix, which should be backportable to older kernels
>    and which is CC'd to stable@.
> 2) Regression selftests.
> 3) A more elegant fix for newer kernels,
>    which is intentionally *not* CC'd to stable@,
>    because it would break on older kernels.
> 
>    In newer kernels, we already add the "REFER" access right to the
>    handled access rights when we merge the ruleset into the new
>    domain, so there is no additional calculation to do for it.
> 4) A documentation update to clarify the situations where the *_REFER
>    right is implicit.
> 
> Please let me know what you think!
> 
> –Günther
> 
> [1] https://github.com/landlock-lsm/go-landlock/issues/66
> [2] https://github.com/landlock-lsm/linux/issues/67
> 
> ---
> Changes in v2:
> - Rebase on master and resolve conflicts
> - Fixed documentation as pointed out by Dwi Siswanto in
>   https://lore.kernel.org/all/20261101125114.19009-1-me@dw1.io/
> - Link to v1: https://patch.msgid.link/20261030102411.12985-1-gnoack3000@gmail.com
> 
> ---
> Günther Noack (4):
>       landlock: Fix layer composition of LANDLOCK_ACCESS_FS_REFER
>       selftests/landlock: Test that layering does not break refer
>       landlock: Simplify landlock_get_fs_access_mask()
>       landlock: Clarify implicit handling of LANDLOCK_ACCESS_FS_REFER
> 
>  include/uapi/linux/landlock.h              | 17 +++++++------
>  security/landlock/access.h                 |  9 ++++---
>  security/landlock/domain.h                 |  9 ++++---
>  tools/testing/selftests/landlock/fs_test.c | 39 ++++++++++++++++++++++++++++++
>  4 files changed, 59 insertions(+), 15 deletions(-)
> ---
> base-commit: fa4ad798f6f681031775266044ba1b0cf3c670bd
> change-id: 20261108-b4-landlock-refer-nonfs-layer-fda8bcbe0b44
> 
> Best regards,
> --  
> Günther Noack <gnoack3000@gmail.com>
> 
>