Re: [PATCH v2 3/4] landlock: Simplify landlock_get_fs_access_mask()

["Günther Noack" <gnoack3000@gmail.com>]

On Fri, Nov 13, 2026 at 12:25:36AM +0100, Mickaël Salaün wrote:
> On Sun, Nov 08, 2026 at 09:23:50PM +0100, Günther Noack wrote:
> > Return the handled FS access mask as it is, instead of artificially
> > adding LANDLOCK_ACCESS_FS_REFER to it.
> > 
> > Since commit d6c7cf84a24f ("landlock: Simplify initially denied access
> > rights"), the merge operation already bakes the initially denied
> > access rights (LANDLOCK_ACCESS_FS_REFER) into the a layer's handled FS
> > access rights. -- They don't need to be added explicitly any more.
> > 
> > No functional change.
> > 
> > Signed-off-by: Günther Noack <gnoack3000@gmail.com>
> > ---
> >  security/landlock/domain.h | 12 ++++--------
> >  1 file changed, 4 insertions(+), 8 deletions(-)
> > 
> > diff --git a/security/landlock/domain.h b/security/landlock/domain.h
> > index d9ebf4857fce..812c324cb6ef 100644
> > --- a/security/landlock/domain.h
> > +++ b/security/landlock/domain.h
> > @@ -262,16 +262,12 @@ static inline access_mask_t
> >  landlock_get_fs_access_mask(const struct landlock_domain *const domain,
> >  			    const u16 layer_level)
> >  {
> > -	access_mask_t handled = domain->layers[layer_level].handled.fs;
> > -
> >  	/*
> > -	 * Handles all initially denied by default access rights, but only for
> > -	 * layers handling filesystem accesses.
> > +	 * Initially denied by default access rights are already included for
> > +	 * layers handling filesystem accesses, see
> > +	 * landlock_upgrade_handled_layer_config().
> >  	 */
> > -	if (handled)
> > -		handled |= _LANDLOCK_ACCESS_FS_INITIALLY_DENIED;
> > -
> > -	return handled;
> > +	return domain->layers[layer_level].handled.fs;
> 
> Could we add a small companion KUnit test to make sure the semantic
> doesn't change?

Sounds good, I'll add one.

I'm running under the assumption that what you mean here is a test
that covers both the upgrade function and
landlock_get_fs_access_mask(), so that that KUnit test keeps working
in both versions of the change.  I'll stack it as a separate commit
after the first of the two changes to landlock_get_fs_access_mask().

–Günther