Re: [PATCH man] landlock.7: Re-group description of IOCTL access right

["Günther Noack" <gnoack3000@gmail.com>]

Hi Alejandro!

On Tue, Jan 13, 2026 at 01:01:22AM +0100, Alejandro Colomar wrote:
> > Cc: Alejandro Colomar <alx.manpages@gmail.com>, 
> 
> Please remember to use <alx@kernel.org>.  :)

Thanks, updated my helper scripts.

> > Subject: Re: [PATCH man] landlock.7: Re-group description of IOCTL access right
> 
> Please use full path of the manual page (this can be done with the tab
> key --autocompletion--).

Done, will do.


> On Mon, Jan 12, 2026 at 08:45:17PM +0100, Günther Noack wrote:
> > Move the description of the LANDLOCK_ACCESS_FS_IOCTL_DEV access right
> > together with the file access rights.
> > 
> > This group of access rights applies to files (in this case device
> > files), and they can be added to file or directory inodes using
> > landlock_add_rule(2).  The check for that works the same for all file
> > access rights, including LANDLOCK_ACCESS_FS_IOCTL_DEV.
> > 
> > Invoking ioctl(2) on directory FDs can not currently be restricted
> > with Landlock.  Having it grouped separately in the documentation is a
> > remnant from earlier revisions of the LANDLOCK_ACCESS_FS_IOCTL_DEV
> > patch set.
> 
> If I understand correctly, the behavior has never changed, and the
> documentation was wrong.  Did I understand correctly?

Yes, that is correct.  It made more sense in an earlier version of the
LANDLOCK_ACCESS_FS_IOCTL_DEV patch set, but then did not make sense in
the final version any more.  I missed to keep the documentation up to
date.


> > 
> > The same change was also done in kernel documentation, linked below.
> > 
> 
> Could you please add a Fixes: tag?

Done. Thanks for sharing the handy git alias as well - this is very
neat, I added that to my toolbox :)

Will send a v2 shortly.

–Günther