Re: [PATCH] landlock: Add counted_by and fix comment in landlock_ruleset

["Mickaël Salaün" <mic@digikod.net>]

Thanks!

On Sun, Feb 08, 2026 at 11:54:48PM +0000, Tingmao Wang wrote:
> For a domain, this array stores the access masks for each layer (of
> which there are num_layers of them).  For an unmerged ruleset, we have
> one "layer", and one element in this array.  This annotation serves as
> useful documentation.
> 
> This also removes a comment saying that num_layers = 0 for unmerged
> rulesets, which is incorrect (it is 1).
> 
> Signed-off-by: Tingmao Wang <m@maowtm.org>
> ---
> 
> I'm not sure if I should add a Fixes tag, but if I should had, it would
> be ae271c1b14 ("landlock: Add ruleset and domain management").
> 
>  security/landlock/ruleset.h | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/security/landlock/ruleset.h b/security/landlock/ruleset.h
> index 9d6dc632684c..7005840ac641 100644
> --- a/security/landlock/ruleset.h
> +++ b/security/landlock/ruleset.h
> @@ -168,8 +168,7 @@ struct landlock_ruleset {
>  			/**
>  			 * @num_layers: Number of layers that are used in this
>  			 * ruleset.  This enables to check that all the layers
> -			 * allow an access request.  A value of 0 identifies a
> -			 * non-merged ruleset (i.e. not a domain).
> +			 * allow an access request.
>  			 */
>  			u32 num_layers;
>  			/**
> @@ -184,7 +183,8 @@ struct landlock_ruleset {
>  			 * layers are set once and never changed for the
>  			 * lifetime of the ruleset.
>  			 */
> -			struct access_masks access_masks[];
> +			struct access_masks
> +				access_masks[] __counted_by(num_layers);
>  		};
>  	};
>  };
> 
> base-commit: f179e1859c711214412876c57f56f9b0cfb13264
> -- 
> 2.53.0
>