Re: [PATCH v2 1/3] landlock.7: Update description of Landlock rules

Alejandro Colomar
2025-02-28T21:31:14Z

[-- Attachment #1: Type: text/plain, Size: 2590 bytes --]

Hi,

On Wed, Feb 26, 2025 at 10:29:10PM +0100, Günther Noack wrote:
> This brings it up to date with the wording in the kernel documentation.
>
> Signed-off-by: Günther Noack <gnoack@google.com>

I'd like some more justification in the commit message.

> ---
> man/man7/landlock.7 | 20 ++++++++++++++++----
> 1 file changed, 16 insertions(+), 4 deletions(-)
>
> diff --git a/man/man7/landlock.7 b/man/man7/landlock.7
> index c6b7272ea..11f76b072 100644
> --- a/man/man7/landlock.7
> +++ b/man/man7/landlock.7
> @@ -39,13 +39,25 @@ the running kernel must support Landlock and
> it must be enabled at boot time.
> .\"
> .SS Landlock rules
> -A Landlock rule describes an action on an object.
> -An object is currently a file hierarchy,
> -and the related filesystem actions are defined with access rights (see
> -.BR landlock_add_rule (2)).
> +A Landlock rule describes an action on an object
> +which the process intends to perform.
> A set of rules is aggregated in a ruleset,
> which can then restrict the thread enforcing it,
> and its future children.
> +.P
> +The two existing types of rules are:
> +.P

This will trigger a diagnostic due to being redundant before TP.

(Both P and TP are paragraphing macros, so you're theoretically creating
an empty paragraph, which is just ignored by groff(1).)

> +.TP
> +.B Filesystem rules
> +For these rules, the object is a file hierarchy,
> +and the related filesystem actions are defined with
> +.IR "filesystem access rights" .
> +.TP
> +.B Network rules (since ABI v4)

Most of the pages use Roman for the parenthetical:

$ grep -rn 'BR.*(since' | sort -R | head
man7/ip.7:782:.BR IP_PKTINFO " (since Linux 2.2)"
man2/set_mempolicy.2:109:.BR MPOL_F_STATIC_NODES " (since Linux 2.6.26)"
man2/kexec_load.2:60:.BR KEXEC_PRESERVE_CONTEXT " (since Linux 2.6.27)"
man2/perf_event_open.2:823:.BR PERF_SAMPLE_REGS_USER " (since Linux 3.7)"
man2/perf_event_open.2:1522:.BR PERF_SAMPLE_BRANCH_COND " (since Linux 3.16)"
man7/socket.7:998:.BR SO_TIMESTAMPNS " (since Linux 2.6.22)"
man2/perf_event_open.2:1537:.BR PERF_SAMPLE_BRANCH_CALL_STACK " (since Linux 4.1)"
man2/clone.2:1303:.BR EINVAL " (since Linux 3.9)"
man2/eventfd.2:52:.BR EFD_NONBLOCK " (since Linux 2.6.27)"
man2/perf_event_open.2:912:.BR PERF_SAMPLE_CGROUP " (since Linux 5.7)"

> +For these rules, the object is a TCP port,
> +and the related actions are defined with
> +.IR "network access rights" .
> +.BR landlock_add_rule (2)).

Cheers,
Alex

--
<https://www.alejandro-colomar.es/>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]