[PATCH 1/3] man/: tfix

[PATCH 1/3] man/: tfix

[Štěpán Němec]

Signed-off-by: Štěpán Němec <stepnem@smrk.net>
---
 man/man2/dup.2               | 2 +-
 man/man2/memfd_secret.2      | 2 +-
 man/man2/sched_setaffinity.2 | 2 +-
 man/man2/seccomp_unotify.2   | 2 +-
 man/man2/select.2            | 2 +-
 man/man2/send.2              | 2 +-
 man/man2/sigsuspend.2        | 2 +-
 man/man5/proc_meminfo.5      | 2 +-
 man/man7/landlock.7          | 4 ++--
 man/man7/pipe.7              | 2 +-
 man/man7/socket.7            | 2 +-
 11 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/man/man2/dup.2 b/man/man2/dup.2
index 0989209c40df..099f01d283ce 100644
--- a/man/man2/dup.2
+++ b/man/man2/dup.2
@@ -238,7 +238,7 @@ .SH NOTES
 before calling
 .BR dup2 (),
 because of the race condition described above.
-Instead, code something like the following could be used:
+Instead, something like the following could be used:
 .P
 .in +4n
 .EX
diff --git a/man/man2/memfd_secret.2 b/man/man2/memfd_secret.2
index 0ea4b8e93c37..4033adc75772 100644
--- a/man/man2/memfd_secret.2
+++ b/man/man2/memfd_secret.2
@@ -119,7 +119,7 @@ .SH ERRORS
 .B EMFILE
 The per-process limit on the number of open file descriptors has been reached.
 .TP
-.B EMFILE
+.B ENFILE
 The system-wide limit on the total number of open files has been reached.
 .TP
 .B ENOMEM
diff --git a/man/man2/sched_setaffinity.2 b/man/man2/sched_setaffinity.2
index 974c10835227..736627a2f183 100644
--- a/man/man2/sched_setaffinity.2
+++ b/man/man2/sched_setaffinity.2
@@ -223,7 +223,7 @@ .SS C library/kernel differences
 .P
 On success, the raw
 .BR sched_getaffinity ()
-system call returns the number of bytes placed copied into the
+system call returns the number of bytes copied into the
 .I mask
 buffer;
 this will be the minimum of
diff --git a/man/man2/seccomp_unotify.2 b/man/man2/seccomp_unotify.2
index 4dce9d7e897c..d7492a248600 100644
--- a/man/man2/seccomp_unotify.2
+++ b/man/man2/seccomp_unotify.2
@@ -982,7 +982,7 @@ .SS Design goals; use of SECCOMP_USER_NOTIF_FLAG_CONTINUE
 .B can not
 be used to implement a security policy!
 It should only ever be used in scenarios where a more privileged process
-supervises the system calls of a lesser privileged target to
+supervises the system calls of a less privileged target to
 get around kernel-enforced security restrictions when
 the supervisor deems this safe.
 In other words,
diff --git a/man/man2/select.2 b/man/man2/select.2
index 2d3344b3313f..a335b0a93e02 100644
--- a/man/man2/select.2
+++ b/man/man2/select.2
@@ -45,7 +45,7 @@ .SH SYNOPSIS
 .SH DESCRIPTION
 .BR "WARNING" :
 .BR select ()
-can monitor only file descriptors numbers that are less than
+can monitor only file descriptor numbers that are less than
 .B FD_SETSIZE
 (1024)\[em]an unreasonably low limit for many modern applications\[em]and
 this limitation will not change.
diff --git a/man/man2/send.2 b/man/man2/send.2
index 21b4b5553116..3ee9f423dcef 100644
--- a/man/man2/send.2
+++ b/man/man2/send.2
@@ -342,7 +342,7 @@ .SH ERRORS
 (For UNIX domain sockets, which are identified by pathname)
 Write permission is denied on the destination socket file,
 or search permission is denied for one of the directories
-the path prefix.
+in the path prefix.
 (See
 .BR path_resolution (7).)
 .IP
diff --git a/man/man2/sigsuspend.2 b/man/man2/sigsuspend.2
index 39b71846bf69..60f8715a0187 100644
--- a/man/man2/sigsuspend.2
+++ b/man/man2/sigsuspend.2
@@ -47,7 +47,7 @@ .SH DESCRIPTION
 or
 .BR SIGSTOP ;
 specifying these signals in
-.IR mask ,
+.I mask
 has no effect on the thread's signal mask.
 .SH RETURN VALUE
 .BR sigsuspend ()
diff --git a/man/man5/proc_meminfo.5 b/man/man5/proc_meminfo.5
index a9a9f0697830..8f5a1e8da2cf 100644
--- a/man/man5/proc_meminfo.5
+++ b/man/man5/proc_meminfo.5
@@ -20,7 +20,7 @@ .SH DESCRIPTION
 a parameter name,
 followed by a colon,
 the value of the parameter,
-and an option unit of measurement (e.g., "kB").
+and an optional unit of measurement (e.g., "kB").
 The list below describes the parameter names and
 the format specifier required to read the field value.
 Except as noted below,
diff --git a/man/man7/landlock.7 b/man/man7/landlock.7
index 55cd002d5789..293374ed9b46 100644
--- a/man/man7/landlock.7
+++ b/man/man7/landlock.7
@@ -21,7 +21,7 @@ .SH DESCRIPTION
 and unexpected or malicious behaviors in applications.
 .P
 A Landlock security policy is a set of access rights
-(e.g., open a file in read-only, make a directory, etc.)
+(e.g., open a file read-only, make a directory, etc.)
 tied to a file hierarchy.
 Such policy can be configured and enforced by processes for themselves
 using three system calls:
@@ -334,7 +334,7 @@ .SS Bind mounts and OverlayFS
 contains its own set of files and directories,
 which is different from a bind mount.
 A policy restricting an OverlayFS layer will not restrict
-the resulted merged hierarchy, and vice versa.
+the resulting merged hierarchy, and vice versa.
 Landlock users should then only think about file hierarchies they want to
 allow access to, regardless of the underlying filesystem.
 .\"
diff --git a/man/man7/pipe.7 b/man/man7/pipe.7
index dbf917cd4160..8641bcf4d807 100644
--- a/man/man7/pipe.7
+++ b/man/man7/pipe.7
@@ -385,7 +385,7 @@ .SS BUGS
 .PD
 .RE
 .IP
-This was racey.
+This was racy.
 Multiple processes could pass point (1) simultaneously,
 and then allocate pipe buffers that were accounted for only in step (3),
 with the result that the user's pipe buffer
diff --git a/man/man7/socket.7 b/man/man7/socket.7
index 96f6f173a40b..507ea916a56b 100644
--- a/man/man7/socket.7
+++ b/man/man7/socket.7
@@ -904,7 +904,7 @@ .SS Socket options
 load distribution in a multi-threaded server to be improved by
 using a distinct listener socket for each thread.
 This provides improved load distribution as compared
-to traditional techniques such using a single
+to traditional techniques such as using a single
 .BR accept (2)ing
 thread that distributes connections,
 or having multiple threads that compete to

base-commit: 6fc2f7aa4502676a857124e05538824367c18c06
-- 
2.55.0

[PATCH 2/3] man/man7/pipe.7: Note kernel commit of the soft limit triggered cap increase

[Štěpán Němec]

7543e84442d7 did reference the kernel commit in its commit
message, but the convention to include it in the man page
source as well is helpful to wider audience.

Fixes: 7543e84442d7 ("pipe.7: Document change to default pipe size when soft limit is exceeded")
Signed-off-by: Štěpán Němec <stepnem@smrk.net>
---
 man/man7/pipe.7 | 1 +
 1 file changed, 1 insertion(+)

diff --git a/man/man7/pipe.7 b/man/man7/pipe.7
index 8641bcf4d807..d5744c2186b8 100644
--- a/man/man7/pipe.7
+++ b/man/man7/pipe.7
@@ -229,6 +229,7 @@ .SS /proc files
 So long as the total number of pages allocated to pipe buffers
 for this user is at this limit,
 individual pipes created by a user will be
+.\" commit 46c4c9d1beb7f5b4cec4dd90e7728720583ee348
 limited to two pages
 (one page before Linux 5.14),
 and attempts to increase a pipe's capacity will be denied.
-- 
2.55.0

[PATCH 3/3] man/man7/landlock.7: wfix

[Štěpán Němec]

Signed-off-by: Štěpán Němec <stepnem@smrk.net>
---
 man/man7/landlock.7 | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/man/man7/landlock.7 b/man/man7/landlock.7
index 293374ed9b46..556b08fff04b 100644
--- a/man/man7/landlock.7
+++ b/man/man7/landlock.7
@@ -296,8 +296,8 @@ .SS Scope flags
 .SS Layers of file path access rights
 Each time a thread enforces a ruleset on itself,
 it updates its Landlock domain with a new layer of policy.
-Indeed, this complementary policy is composed with the
-potentially other rulesets already restricting this thread.
+Indeed, this complementary policy is composed with any
+other rulesets already restricting this thread.
 A sandboxed thread can then safely add more constraints to itself with a
 new enforced ruleset.
 .P
-- 
2.55.0

Re: [PATCH 1/3] man/: tfix

[Alejandro Colomar]

[-- Attachment #1: Type: text/plain, Size: 3229 bytes --]

[CC += Mike]
[CC += Mickaël, Günther]

Hi Štěpán!

On 2026-07-09T17:34:20+0200, Štěpán Němec wrote:
> Signed-off-by: Štěpán Němec <stepnem@smrk.net>
> ---
>  man/man2/dup.2               | 2 +-
>  man/man2/memfd_secret.2      | 2 +-
>  man/man2/sched_setaffinity.2 | 2 +-
>  man/man2/seccomp_unotify.2   | 2 +-
>  man/man2/select.2            | 2 +-
>  man/man2/send.2              | 2 +-
>  man/man2/sigsuspend.2        | 2 +-
>  man/man5/proc_meminfo.5      | 2 +-
>  man/man7/landlock.7          | 4 ++--
>  man/man7/pipe.7              | 2 +-
>  man/man7/socket.7            | 2 +-
>  11 files changed, 12 insertions(+), 12 deletions(-)
> 

[...]

> diff --git a/man/man2/memfd_secret.2 b/man/man2/memfd_secret.2
> index 0ea4b8e93c37..4033adc75772 100644
> --- a/man/man2/memfd_secret.2
> +++ b/man/man2/memfd_secret.2
> @@ -119,7 +119,7 @@ .SH ERRORS
>  .B EMFILE
>  The per-process limit on the number of open file descriptors has been reached.
>  .TP
> -.B EMFILE
> +.B ENFILE

I think I'd fix this typo in a separate commit, since it's a meaningful
typo (both EMFILE and ENFILE exist, and they have a slightly different
meaning).

In the fix, please include the following tags:

	Fixes: ac5edfeb1dd6 (2021-08-27; "memfd_secret.2: New page describing memfd_secret() system call")
	Cc: Mike Rapoport <rppt@linux.ibm.com>

>  The system-wide limit on the total number of open files has been reached.
>  .TP
>  .B ENOMEM

[...]

> diff --git a/man/man7/landlock.7 b/man/man7/landlock.7
> index 55cd002d5789..293374ed9b46 100644
> --- a/man/man7/landlock.7
> +++ b/man/man7/landlock.7
> @@ -21,7 +21,7 @@ .SH DESCRIPTION
>  and unexpected or malicious behaviors in applications.
>  .P
>  A Landlock security policy is a set of access rights
> -(e.g., open a file in read-only, make a directory, etc.)
> +(e.g., open a file read-only, make a directory, etc.)
>  tied to a file hierarchy.
>  Such policy can be configured and enforced by processes for themselves
>  using three system calls:
> @@ -334,7 +334,7 @@ .SS Bind mounts and OverlayFS
>  contains its own set of files and directories,
>  which is different from a bind mount.
>  A policy restricting an OverlayFS layer will not restrict
> -the resulted merged hierarchy, and vice versa.
> +the resulting merged hierarchy, and vice versa.
>  Landlock users should then only think about file hierarchies they want to
>  allow access to, regardless of the underlying filesystem.
>  .\"

This seems to also exist in the kernel internal documentation.  I've
CCd the maintainers of that documentation.

	$ find Documentation/ | grep landlock | xargs grep OverlayFS
	Documentation/userspace-api/landlock.rst:Bind mounts and OverlayFS
	Documentation/userspace-api/landlock.rst:An OverlayFS mount point consists of upper and lower layers.  These layers are
	Documentation/userspace-api/landlock.rst:on the upper layer.  From a Landlock policy point of view, all OverlayFS layers
	Documentation/userspace-api/landlock.rst:OverlayFS layer will not restrict the resulted merged hierarchy, and vice versa.

[...]


Have a lovely day!
Alex

-- 
<https://www.alejandro-colomar.es>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [PATCH 2/3] man/man7/pipe.7: Note kernel commit of the soft limit triggered cap increase

[Alejandro Colomar]

[-- Attachment #1: Type: text/plain, Size: 1097 bytes --]

Hi,

On 2026-07-09T17:34:21+0200, Štěpán Němec wrote:
> 7543e84442d7 did reference the kernel commit in its commit
> message, but the convention to include it in the man page
> source as well is helpful to wider audience.
> 
> Fixes: 7543e84442d7 ("pipe.7: Document change to default pipe size when soft limit is exceeded")
> Signed-off-by: Štěpán Němec <stepnem@smrk.net>

Thanks!  I've applied the patch.


Cheers,
Alex

> ---
>  man/man7/pipe.7 | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/man/man7/pipe.7 b/man/man7/pipe.7
> index 8641bcf4d807..d5744c2186b8 100644
> --- a/man/man7/pipe.7
> +++ b/man/man7/pipe.7
> @@ -229,6 +229,7 @@ .SS /proc files
>  So long as the total number of pages allocated to pipe buffers
>  for this user is at this limit,
>  individual pipes created by a user will be
> +.\" commit 46c4c9d1beb7f5b4cec4dd90e7728720583ee348
>  limited to two pages
>  (one page before Linux 5.14),
>  and attempts to increase a pipe's capacity will be denied.
> -- 
> 2.55.0
> 
> 

-- 
<https://www.alejandro-colomar.es>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [PATCH 3/3] man/man7/landlock.7: wfix

[Alejandro Colomar]

[-- Attachment #1: Type: text/plain, Size: 1160 bytes --]

Hi!

On 2026-07-09T17:34:22+0200, Štěpán Němec wrote:
> Signed-off-by: Štěpán Němec <stepnem@smrk.net>
> ---
>  man/man7/landlock.7 | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/man/man7/landlock.7 b/man/man7/landlock.7
> index 293374ed9b46..556b08fff04b 100644
> --- a/man/man7/landlock.7
> +++ b/man/man7/landlock.7
> @@ -296,8 +296,8 @@ .SS Scope flags
>  .SS Layers of file path access rights
>  Each time a thread enforces a ruleset on itself,
>  it updates its Landlock domain with a new layer of policy.
> -Indeed, this complementary policy is composed with the
> -potentially other rulesets already restricting this thread.
> +Indeed, this complementary policy is composed with any
> +other rulesets already restricting this thread.
>  A sandboxed thread can then safely add more constraints to itself with a
>  new enforced ruleset.

I've added to CC the landlock maintainers, so that they review the text.
They maintain the same text in the kernel, so it's better to have it
coordinated.


Cheers,
Alex

>  .P
> -- 
> 2.55.0
> 
> 

-- 
<https://www.alejandro-colomar.es>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [PATCH 3/3] man/man7/landlock.7: wfix

[Štěpán Němec]

On Fri, 10 Jul 2026 18:48:36 +0200
Alejandro Colomar wrote:

> On 2026-07-09T17:34:22+0200, Štěpán Němec wrote:
>> Signed-off-by: Štěpán Němec <stepnem@smrk.net>
>> ---
>>  man/man7/landlock.7 | 4 ++--
>>  1 file changed, 2 insertions(+), 2 deletions(-)
>> 
>> diff --git a/man/man7/landlock.7 b/man/man7/landlock.7
>> index 293374ed9b46..556b08fff04b 100644
>> --- a/man/man7/landlock.7
>> +++ b/man/man7/landlock.7
>> @@ -296,8 +296,8 @@ .SS Scope flags
>>  .SS Layers of file path access rights
>>  Each time a thread enforces a ruleset on itself,
>>  it updates its Landlock domain with a new layer of policy.
>> -Indeed, this complementary policy is composed with the
>> -potentially other rulesets already restricting this thread.
>> +Indeed, this complementary policy is composed with any
>> +other rulesets already restricting this thread.
>>  A sandboxed thread can then safely add more constraints to itself with a
>>  new enforced ruleset.
>
> I've added to CC the landlock maintainers, so that they review the text.
> They maintain the same text in the kernel, so it's better to have it
> coordinated.

Thanks, I did not realize that.

I see now that the texts have already diverged and the
equivalent paragraph in the kernel docs
(Documentation/userspace-api/landlock.rst) now reads

  Each time a thread enforces a ruleset on itself, it updates its Landlock domain
  with a new layer of policy.  This complementary policy is stacked with any
  other rulesets potentially already restricting this thread.  A sandboxed thread
  can then safely add more constraints to itself with a new enforced ruleset.

(Wording introduced by linux commit dad2f2071516
(2024-10-15; "landlock: Fix grammar issues in documentation").)

FWIW I see little point in this kind of duplication, given
that the kernel docs are as readily available to anyone
interested as the man pages are; OTOH it seems that the
duplication is only partial here (i.e., the documents
differ, with only isolated verbatim overlaps), so perhaps
the rationale is that the different documents target
slightly different audiences (I'm not sure I'd agree).

Anyway, here is a patch simply adjusting the man page text
to match the kernel docs (I still believe "potentially" is
more distracting than useful there, but it is an improvement
on the original.):

----------------------------------- 8< --------------------------------
Subject: [PATCH] man/man7/landlock.7: wfix

Use the current wording of the equivalent paragraph in
Linux kernel Documentation/userspace-api/landlock.rst.

Signed-off-by: Štěpán Němec <stepnem@smrk.net>
---
 man/man7/landlock.7 | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/man/man7/landlock.7 b/man/man7/landlock.7
index 293374ed9b46..f0a9b6db4bc8 100644
--- a/man/man7/landlock.7
+++ b/man/man7/landlock.7
@@ -296,8 +296,8 @@ .SS Scope flags
 .SS Layers of file path access rights
 Each time a thread enforces a ruleset on itself,
 it updates its Landlock domain with a new layer of policy.
-Indeed, this complementary policy is composed with the
-potentially other rulesets already restricting this thread.
+This complementary policy is stacked with any
+other rulesets potentially already restricting this thread.
 A sandboxed thread can then safely add more constraints to itself with a
 new enforced ruleset.
 .P

base-commit: 794e74fd54156f767801eb60a0d79a496c73e505
-- 
2.55.0

[PATCH] man/man2/memfd_secret.2: tfix

[Štěpán Němec]

Fixes: ac5edfeb1dd6 (2021-08-27; "memfd_secret.2: New page describing memfd_secret() system call")
Cc: Mike Rapoport <rppt@linux.ibm.com>
Signed-off-by: Štěpán Němec <stepnem@smrk.net>
---
On Fri, 10 Jul 2026 18:44:19 +0200
Alejandro Colomar wrote:

> I think I'd fix this typo in a separate commit, since it's a meaningful
> typo (both EMFILE and ENFILE exist, and they have a slightly different
> meaning).
>
> In the fix, please include the following tags:
>
> 	Fixes: ac5edfeb1dd6 (2021-08-27; "memfd_secret.2: New page describing memfd_secret() system call")
> 	Cc: Mike Rapoport <rppt@linux.ibm.com>

Fair enough.

FWIW, out of abundance of caution (admittedly verging on paranoia), I
did verify that unprivileged memfd_secret distinguished EMFILE and
ENFILE as expected (brought about by setrlimit for the former and
limiting fs.file-max for the latter in a VM running a recent alpine-edge
image) before sending the original patch, but the hypothesis that this
was anything other than a typo or a copy-paste error seemed too
far-fetched to mention that.

 man/man2/memfd_secret.2 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/man/man2/memfd_secret.2 b/man/man2/memfd_secret.2
index 0ea4b8e93c37..4033adc75772 100644
--- a/man/man2/memfd_secret.2
+++ b/man/man2/memfd_secret.2
@@ -119,7 +119,7 @@ .SH ERRORS
 .B EMFILE
 The per-process limit on the number of open file descriptors has been reached.
 .TP
-.B EMFILE
+.B ENFILE
 The system-wide limit on the total number of open files has been reached.
 .TP
 .B ENOMEM

-- 
2.55.0