Re: [PATCH 0/3] landlock: Fix REFER in layered domains

["Mickaël Salaün" <mic@digikod.net>]

On Fri, Oct 30, 2026 at 03:29:56PM +0100, Günther Noack wrote:
> On Fri, Oct 30, 2026 at 11:24:07AM +0100, Günther Noack wrote:
> > This patchset
> > =============
> > 
> > This patchset fixes the issue in three commits:
> > 
> > 1) The fix, which should be backportable to older kernels
> >    and which is CC'd to stable@.
> 
> To be more precise, the fix needs to go in 7.2, 6.18 and 6.12.
> Other stable releases predate 6.7 where the bug was introduced.
> 
> It does unfortunately not apply cleanly on the stable kernels 7.2,
> 6.18 and 6.12, but I have backported versions.
> 
> (Differences: In the stable versions, the affected helper function was
> still in ruleset.h instead of domain.h.  In 6.12, the constant name
> did not have a _ prefix yet.  In 6.12 in the tests, the
> drop_access_rights() helper didn't exist.)
> 
> 
> > 2) Regression selftests.
> > 3) A more elegant fix for newer kernels,
> >    which is intentionally *not* CC'd to stable@,
> >    because it would break on older kernels.
> > 
> >    In newer kernels, we already add the "REFER" access right to the
> >    handled access rights when we merge the ruleset into the new
> >    domain, so there is no additional calculation to do for it.
> > 
> > 
> > Please let me know what you think!
> 
> P.S. Mickaël: Specifically, I'd like to know whether you think this
> warrants an erratum.  If yes, here is a tentative wording:

Yes, this warrants an erratum because independently stacking filessytem
and network or scope policies is legitimate but an unfixed kernel may
be overly restrictive by denying FS_REFER operations that every policy
allows individually.  It can then be useful to know when to tweak such
layered policies or when it's fixed.

> 
> 
>    Erratum 5: Correct REFER semantics when layering Landlock policies
>    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> 
>    This fix addresses an issue where, when multiple Landlock ruleset
>    are layered, Landlock would restrict LANDLOCK_ACCESS_FS_REFER
>    operations which would have been allowed by the same rulesets
>    individually.
> 
>    This change ensures that a LANDLOCK_ACCESS_FS_REFER operation is
>    allowed in a layered domain if all of the enforced rulesets allow
>    it individually as well.

I think these paragraphs can be merged and simplified a bit.

> 
>    Impact:
> 
>    This occurs in situations where one of the layers does not handle
>    any filesystem access rights, but one of the other layers does.  In
>    that case, the non-filesystem layer is interpreted to deny the
>    LANDLOCK_ACCESS_FS_REFER right.

Overall, this looks good to me.

> 
> 
> –Günther
>