Re: [PATCH v2 3/4] landlock: Simplify landlock_get_fs_access_mask()

["Mickaël Salaün" <mic@digikod.net>]

On Sun, Nov 08, 2026 at 09:23:50PM +0100, Günther Noack wrote:
> Return the handled FS access mask as it is, instead of artificially
> adding LANDLOCK_ACCESS_FS_REFER to it.
> 
> Since commit d6c7cf84a24f ("landlock: Simplify initially denied access
> rights"), the merge operation already bakes the initially denied
> access rights (LANDLOCK_ACCESS_FS_REFER) into the a layer's handled FS
> access rights. -- They don't need to be added explicitly any more.
> 
> No functional change.
> 
> Signed-off-by: Günther Noack <gnoack3000@gmail.com>
> ---
>  security/landlock/domain.h | 12 ++++--------
>  1 file changed, 4 insertions(+), 8 deletions(-)
> 
> diff --git a/security/landlock/domain.h b/security/landlock/domain.h
> index d9ebf4857fce..812c324cb6ef 100644
> --- a/security/landlock/domain.h
> +++ b/security/landlock/domain.h
> @@ -262,16 +262,12 @@ static inline access_mask_t
>  landlock_get_fs_access_mask(const struct landlock_domain *const domain,
>  			    const u16 layer_level)
>  {
> -	access_mask_t handled = domain->layers[layer_level].handled.fs;
> -
>  	/*
> -	 * Handles all initially denied by default access rights, but only for
> -	 * layers handling filesystem accesses.
> +	 * Initially denied by default access rights are already included for
> +	 * layers handling filesystem accesses, see
> +	 * landlock_upgrade_handled_layer_config().
>  	 */
> -	if (handled)
> -		handled |= _LANDLOCK_ACCESS_FS_INITIALLY_DENIED;
> -
> -	return handled;
> +	return domain->layers[layer_level].handled.fs;

Could we add a small companion KUnit test to make sure the semantic
doesn't change?

>  }
>  
>  static inline access_mask_t
> 
> -- 
> 2.56.0
> 
>