[PATCH] man/man7/landlock.7: Document whiteout object peculiarities

[PATCH] man/man7/landlock.7: Document whiteout object peculiarities

[Günther Noack]

Bring documentation for LANDLOCK_ACCESS_FS_MAKE_REG in line with the
Landlock whiteout patch [1].

Link: [1] <https://lore.kernel.org/all/20260813093157.1436894-3-gnoack@google.com/>
Link: [2] <https://github.com/landlock-lsm/linux/issues/66>
---
 man/man7/landlock.7 | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/man/man7/landlock.7 b/man/man7/landlock.7
index 880dd50582f3..3642a64ff1f6 100644
--- a/man/man7/landlock.7
+++ b/man/man7/landlock.7
@@ -204,6 +204,9 @@ Create (or rename) a directory.
 .TP
 .B LANDLOCK_ACCESS_FS_MAKE_REG
 Create (or rename or link) a regular file.
+.IP
+This also guards the creation of whiteout objects
+as used in OverlayFS.
 .TP
 .B LANDLOCK_ACCESS_FS_MAKE_SOCK
 Create (or rename or link) a UNIX domain socket.
-- 
2.55.0

Re: [PATCH] man/man7/landlock.7: Document whiteout object peculiarities

[Günther Noack]

Hello Alejandro!

On Fri, Aug 28, 2026 at 06:03:41PM +0200, Günther Noack wrote:
> Bring documentation for LANDLOCK_ACCESS_FS_MAKE_REG in line with the
> Landlock whiteout patch [1].
> 
> Link: [1] <https://lore.kernel.org/all/20260813093157.1436894-3-gnoack@google.com/>
> Link: [2] <https://github.com/landlock-lsm/linux/issues/66>

Small out of band remark: This patch was sent for Linux 7.3, but is
CC'd to stable@ (should get backported).

https://lore.kernel.org/all/20260828160340.11238-2-gnoack3000@gmail.com/

–Günther

Re: [PATCH] man/man7/landlock.7: Document whiteout object peculiarities

[Alejandro Colomar]

[-- Attachment #1: Type: text/plain, Size: 1164 bytes --]

Hi Günther,

> Date: 2026-08-28 18:03:41+0200
> From: Günther Noack <gnoack3000@gmail.com>
>
> Bring documentation for LANDLOCK_ACCESS_FS_MAKE_REG in line with the
> Landlock whiteout patch [1].
> 
> Link: [1] <https://lore.kernel.org/all/20260813093157.1436894-3-gnoack@google.com/>
> Link: [2] <https://github.com/landlock-lsm/linux/issues/66>
> ---
>  man/man7/landlock.7 | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/man/man7/landlock.7 b/man/man7/landlock.7
> index 880dd50582f3..3642a64ff1f6 100644
> --- a/man/man7/landlock.7
> +++ b/man/man7/landlock.7
> @@ -204,6 +204,9 @@ Create (or rename) a directory.
>  .TP
>  .B LANDLOCK_ACCESS_FS_MAKE_REG
>  Create (or rename or link) a regular file.
> +.IP
> +This also guards the creation of whiteout objects
> +as used in OverlayFS.

Reviewed-by: Alejandro Colomar <alx@kernel.org>


I guess this should not be applied yet, right?  If it's ready, please
let me know.


Have a lovely night!
Alex

>  .TP
>  .B LANDLOCK_ACCESS_FS_MAKE_SOCK
>  Create (or rename or link) a UNIX domain socket.
> -- 
> 2.55.0
> 

-- 
<https://www.alejandro-colomar.es>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [PATCH] man/man7/landlock.7: Document whiteout object peculiarities

[Günther Noack]

Hello Alejandro,

On Fri, Aug 28, 2026 at 09:44:18PM +0200, Alejandro Colomar wrote:
> > Date: 2026-08-28 18:03:41+0200
> > From: Günther Noack <gnoack3000@gmail.com>
> >
> > Bring documentation for LANDLOCK_ACCESS_FS_MAKE_REG in line with the
> > Landlock whiteout patch [1].
> > 
> > Link: [1] <https://lore.kernel.org/all/20260813093157.1436894-3-gnoack@google.com/>
> > Link: [2] <https://github.com/landlock-lsm/linux/issues/66>
> > ---
> >  man/man7/landlock.7 | 3 +++
> >  1 file changed, 3 insertions(+)
> > 
> > diff --git a/man/man7/landlock.7 b/man/man7/landlock.7
> > index 880dd50582f3..3642a64ff1f6 100644
> > --- a/man/man7/landlock.7
> > +++ b/man/man7/landlock.7
> > @@ -204,6 +204,9 @@ Create (or rename) a directory.
> >  .TP
> >  .B LANDLOCK_ACCESS_FS_MAKE_REG
> >  Create (or rename or link) a regular file.
> > +.IP
> > +This also guards the creation of whiteout objects
> > +as used in OverlayFS.
> 
> Reviewed-by: Alejandro Colomar <alx@kernel.org>
> 
> 
> I guess this should not be applied yet, right?  If it's ready, please
> let me know.

The whiteout patch has been backported as bugfix to Linux 7.2, 6.18,
6.12, 6.6 and 6.1.  Since it is in stable, I think this can be
considered ready for the purpose of putting it into man pages?
(Otherwise, we can also wait for the 7.3 release.)

–Günther

Re: [PATCH] man/man7/landlock.7: Document whiteout object peculiarities

[Alejandro Colomar]

[-- Attachment #1: Type: text/plain, Size: 1760 bytes --]

Hi Günther,

> Date: 2026-09-26 16:10:44+0200
> From: Günther Noack <gnoack3000@gmail.com>
>
> Hello Alejandro,
> 
> On Fri, Aug 28, 2026 at 09:44:18PM +0200, Alejandro Colomar wrote:
> > > Date: 2026-08-28 18:03:41+0200
> > > From: Günther Noack <gnoack3000@gmail.com>
> > >
> > > Bring documentation for LANDLOCK_ACCESS_FS_MAKE_REG in line with the
> > > Landlock whiteout patch [1].
> > > 
> > > Link: [1] <https://lore.kernel.org/all/20260813093157.1436894-3-gnoack@google.com/>
> > > Link: [2] <https://github.com/landlock-lsm/linux/issues/66>
> > > ---
> > >  man/man7/landlock.7 | 3 +++
> > >  1 file changed, 3 insertions(+)
> > > 
> > > diff --git a/man/man7/landlock.7 b/man/man7/landlock.7
> > > index 880dd50582f3..3642a64ff1f6 100644
> > > --- a/man/man7/landlock.7
> > > +++ b/man/man7/landlock.7
> > > @@ -204,6 +204,9 @@ Create (or rename) a directory.
> > >  .TP
> > >  .B LANDLOCK_ACCESS_FS_MAKE_REG
> > >  Create (or rename or link) a regular file.
> > > +.IP
> > > +This also guards the creation of whiteout objects
> > > +as used in OverlayFS.
> > 
> > Reviewed-by: Alejandro Colomar <alx@kernel.org>
> > 
> > 
> > I guess this should not be applied yet, right?  If it's ready, please
> > let me know.
> 
> The whiteout patch has been backported as bugfix to Linux 7.2, 6.18,
> 6.12, 6.6 and 6.1.  Since it is in stable, I think this can be
> considered ready for the purpose of putting it into man pages?
> (Otherwise, we can also wait for the 7.3 release.)

Yes, it's good for the man pages.  Does it need any update regarding
version numbers or HISTORY, or should I pick the patch as is?


Have a lovely night!
Alex

> 
> –Günther
> 

-- 
<https://www.alejandro-colomar.es>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [PATCH] man/man7/landlock.7: Document whiteout object peculiarities

[Günther Noack]

Hello Alejandro!

On Sun, Oct 11, 2026 at 07:09:31PM +0200, Alejandro Colomar wrote:
> > On Fri, Aug 28, 2026 at 09:44:18PM +0200, Alejandro Colomar wrote:
> > > > Date: 2026-08-28 18:03:41+0200
> > > > From: Günther Noack <gnoack3000@gmail.com>
> > > >
> > > > Bring documentation for LANDLOCK_ACCESS_FS_MAKE_REG in line with the
> > > > Landlock whiteout patch [1].
> > > > 
> > > > Link: [1] <https://lore.kernel.org/all/20260813093157.1436894-3-gnoack@google.com/>
> > > > Link: [2] <https://github.com/landlock-lsm/linux/issues/66>
> > > > ---
> > > >  man/man7/landlock.7 | 3 +++
> > > >  1 file changed, 3 insertions(+)
> > > > 
> > > > diff --git a/man/man7/landlock.7 b/man/man7/landlock.7
> > > > index 880dd50582f3..3642a64ff1f6 100644
> > > > --- a/man/man7/landlock.7
> > > > +++ b/man/man7/landlock.7
> > > > @@ -204,6 +204,9 @@ Create (or rename) a directory.
> > > >  .TP
> > > >  .B LANDLOCK_ACCESS_FS_MAKE_REG
> > > >  Create (or rename or link) a regular file.
> > > > +.IP
> > > > +This also guards the creation of whiteout objects
> > > > +as used in OverlayFS.
> > > 
> > > Reviewed-by: Alejandro Colomar <alx@kernel.org>
> > > 
> > > 
> > > I guess this should not be applied yet, right?  If it's ready, please
> > > let me know.
> > 
> > The whiteout patch has been backported as bugfix to Linux 7.2, 6.18,
> > 6.12, 6.6 and 6.1.  Since it is in stable, I think this can be
> > considered ready for the purpose of putting it into man pages?
> > (Otherwise, we can also wait for the 7.3 release.)
> 
> Yes, it's good for the man pages.  Does it need any update regarding
> version numbers or HISTORY, or should I pick the patch as is?

I think it is fine to pick it as it is.

It was a bugfix and it is available on all Landlock ABI versions
exposed by stable kernels.  So the described behaviour applies on all
supported kernels and Landlock ABI versions.

Because it is a behavioural change, callers can probe for the presence
of the fix with Landlock's "errata" mechanism, as documented in
landlock_create_ruleset(2).  The list of the existing errata is best
checked in the most up-to-date source in the kernel documentation,
which we are also linking from landlock_create_ruleset(2), so that
users are encouraged to look for the most up to date list there.

–Günther