Re: [PATCH v5 3/3] landlock.7: Explain the best-effort fallback mechanism in the example

[Alejandro Colomar <alx.manpages@gmail.com>]

[-- Attachment #1.1: Type: text/plain, Size: 2426 bytes --]

Hello!

On 4/4/23 09:33, Günther Noack wrote:
> Hello!
> 
> On Sun, Apr 02, 2023 at 12:01:43AM +0200, Alejandro Colomar wrote:
>> On 4/1/23 19:19, Günther Noack wrote:
>>> (It feels out of scope for this documentation patch, but do you think
>>> these bitmasks should be defined in the uapi/linux/landlock.h header?
>>> You have looked at so many man pages already -- Do you happen to know
>>> other places in the kernel API where such a problem has come up?)
>>
>> I don't remember having seen something similar in other pages.
>>
>> I think defining a macro in uapi headers could be the right thing to
>> do.  Something like LANDLOCK_ACCESS_FS_RIGHTS_MASK_ABI_{1,2,3} or
>> other similar name?
> 
> Noted it on my TODO list - it's probably best discussed on the kernel
> list whether this is the right approach.

Sure!  Feel free to CC me there.

> 
> 
>>> 1) Make assumptions about the numbers, for brevity
>>>    (as done in the patch I sent).
>>>
>>>    [...]
>>>
>>> 2) Use the constants from the header and OR them.
>>>
>>>    [...]
>>>
>>> 3) Third option is the middle way,
>>>    naming the "highest" known access right for each ABI version:
>>>
>>> __u64 landlock_fs_access_rights[] = {
>>>     (LANDLOCK_ACCESS_FS_MAKE_SYM << 1) - 1,  /* ABI v1                 */
>>>     (LANDLOCK_ACCESS_FS_REFER << 1) - 1,     /* ABI v2: add "refer"    */
>>>     (LANDLOCK_ACCESS_FS_TRUNCATE << 1) - 1,  /* ABI v3: add "truncate" */
>>> }
>>
>> I'm not sure if I like this one.  I'll leave it up to you to decide
>> the one you like.  :)
> 
> I'll ponder it a bit and send a new patch soon.

Ok.  No hurries.

> 
> Mickaël, do you have any opinions/preferences on this?
> 
> –Günther

On 4/4/23 09:17, Günther Noack wrote:
>> <https://git.kernel.org/pub/scm/docs/man-pages/man-pages.git/tree/CONTRIBUTING#n132>
>> ...
> Thank you for pointing this out (and for reworking this
> documentation)!

:-)

>  I had indeed missed the CONTRIBUTING doc.
> The "make -t" trick is also new to me.

Heh, I've fine-tuned makefiles too much to come up with this
workflow. :p

I met that feature long ago reading make(1)'s man page, but didn't
know what it would be useful for, until I recently realized it could
help in this use case.

Cheers,
Alex



-- 
<http://www.alejandro-colomar.es/>
GPG key fingerprint: A9348594CE31283A826FBDD8D57633D441E25BB5

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]