Re: [PATCH 0/3] landlock: Fix REFER in layered domains

["Günther Noack" <gnoack3000@gmail.com>]

On Fri, Oct 30, 2026 at 11:24:07AM +0100, Günther Noack wrote:
> This patchset
> =============
> 
> This patchset fixes the issue in three commits:
> 
> 1) The fix, which should be backportable to older kernels
>    and which is CC'd to stable@.

To be more precise, the fix needs to go in 7.2, 6.18 and 6.12.
Other stable releases predate 6.7 where the bug was introduced.

It does unfortunately not apply cleanly on the stable kernels 7.2,
6.18 and 6.12, but I have backported versions.

(Differences: In the stable versions, the affected helper function was
still in ruleset.h instead of domain.h.  In 6.12, the constant name
did not have a _ prefix yet.  In 6.12 in the tests, the
drop_access_rights() helper didn't exist.)


> 2) Regression selftests.
> 3) A more elegant fix for newer kernels,
>    which is intentionally *not* CC'd to stable@,
>    because it would break on older kernels.
> 
>    In newer kernels, we already add the "REFER" access right to the
>    handled access rights when we merge the ruleset into the new
>    domain, so there is no additional calculation to do for it.
> 
> 
> Please let me know what you think!

P.S. Mickaël: Specifically, I'd like to know whether you think this
warrants an erratum.  If yes, here is a tentative wording:


   Erratum 5: Correct REFER semantics when layering Landlock policies
   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

   This fix addresses an issue where, when multiple Landlock ruleset
   are layered, Landlock would restrict LANDLOCK_ACCESS_FS_REFER
   operations which would have been allowed by the same rulesets
   individually.

   This change ensures that a LANDLOCK_ACCESS_FS_REFER operation is
   allowed in a layered domain if all of the enforced rulesets allow
   it individually as well.

   Impact:

   This occurs in situations where one of the layers does not handle
   any filesystem access rights, but one of the other layers does.  In
   that case, the non-filesystem layer is interpreted to deny the
   LANDLOCK_ACCESS_FS_REFER right.


–Günther