Re: [PATCH v2 4/4] landlock: Clarify implicit handling of LANDLOCK_ACCESS_FS_REFER

["Günther Noack" <gnoack3000@gmail.com>]

On Fri, Nov 13, 2026 at 12:28:56AM +0100, Mickaël Salaün wrote:
> On Sun, Nov 08, 2026 at 09:23:51PM +0100, Günther Noack wrote:
> > The LANDLOCK_ACCESS_FS_REFER right is handled implicitly in a ruleset,
> > but only if any other filesystem access right is declared as handled
> > in the given ruleset.
> > 
> > The old documentation was still a remnant from the times when
> > filesystem access rights were the only access rights that existed in
> > Landlock, but it became misleading when we introduced additional types
> > of access rights.
> > 
> > Fixes: fff69fb03dde ("landlock: Support network rules with TCP bind and connect")
> > Signed-off-by: Günther Noack <gnoack3000@gmail.com>
> > ---
> >  include/uapi/linux/landlock.h | 17 +++++++++--------
> >  security/landlock/access.h    |  9 +++++----
> >  2 files changed, 14 insertions(+), 12 deletions(-)
> > 
> > diff --git a/include/uapi/linux/landlock.h b/include/uapi/linux/landlock.h
> > index 24510e5d8479..7e38b9d1bf12 100644
> > --- a/include/uapi/linux/landlock.h
> > +++ b/include/uapi/linux/landlock.h
> > @@ -22,10 +22,10 @@
> >   * enacted.  Vice versa, access rights that are not specifically listed here are
> >   * not going to be denied by this ruleset when it is enacted.
> >   *
> > - * For historical reasons, the %LANDLOCK_ACCESS_FS_REFER right is always denied
> > - * by default, even when its bit is not set in @handled_access_fs.  In order to
> > - * add new rules with this access right, the bit must still be set explicitly
> > - * (cf. `Filesystem flags`_).
> > + * For historical reasons, as soon as any filesystem access right is handled in
> > + * @handled_access_fs, the %LANDLOCK_ACCESS_FS_REFER right is always denied as
> > + * well.  In order to add new rules with this access right, the bit must still
> > + * be set explicitly (cf. `Filesystem flags`_).
> >   *
> >   * The explicit listing of *handled access rights* is required for backwards
> >   * compatibility reasons.  In most use cases, processes that use Landlock will
> > @@ -462,10 +462,11 @@ struct landlock_capability_attr {
> >   *   This access right is available since the second version of the Landlock
> >   *   ABI.
> >   *
> > - *   This is the only access right which is denied by default by any ruleset,
> > - *   even if the right is not specified as handled at ruleset creation time.
> > - *   The only way to make a ruleset grant this right is to explicitly allow it
> > - *   for a specific directory by adding a matching rule to the ruleset.
> > + *   This is the only access right which is denied by default by any ruleset
> > + *   that handles filesystem access rights, even if the right is not specified
> > + *   as handled at ruleset creation time.  The only way to make a ruleset grant
> > + *   this right is to explicitly allow it for a specific directory by adding a
> > + *   matching rule to the ruleset.
> >   *
> >   *   In particular, when using the first Landlock ABI version, Landlock will
> >   *   always deny attempts to reparent files between different directories.
> > diff --git a/security/landlock/access.h b/security/landlock/access.h
> > index f9eaa2f53686..c4a81f7dadeb 100644
> > --- a/security/landlock/access.h
> > +++ b/security/landlock/access.h
> > @@ -18,10 +18,11 @@
> >  #include "limits.h"
> >  
> >  /*
> > - * All access rights that are denied by default whether they are handled or not
> > - * by a ruleset/layer.  This must be ORed with the .handled field of all
> > - * domain->layers[] entries when we need to get the absolute handled access
> > - * masks, see landlock_upgrade_handled_layer_config().
> > + * All filesystem access rights that are denied by default as soon as any other
> > + * filesystem access right is handled, even if the access right is not
> > + * explicitly declared to be handled itself.  This must be ORed with the
> > + * .handled field of all domain->layers[] entries when we need to get the
> > + * absolute handled access masks, see landlock_upgrade_handled_layer_config().
> >   */
> >  /* clang-format off */
> >  #define _LANDLOCK_ACCESS_FS_INITIALLY_DENIED ( \
> 
> This is good, but it should also be extended to
> landlock_upgrade_handled_layer_config()'s and
> reparent-exdev_layers_rename[12]'s comments.

Wow, good catch!  Updated.

Used the same wording there as well, "...as soon as any other
filesystem access right is handled".  It's a bit verbose, but it's
unambiguous and I'm hoping that we won't need another edit to that
wording.

–Günther