Re: [PATCH v2 1/3] landlock.7: Update description of Landlock rules

["Günther Noack" <gnoack@google.com>]

Hello!

On Fri, Feb 28, 2025 at 10:31:09PM +0100, Alejandro Colomar wrote:
> Hi,
> 
> On Wed, Feb 26, 2025 at 10:29:10PM +0100, Günther Noack wrote:
> > This brings it up to date with the wording in the kernel documentation.
> > 
> > Signed-off-by: Günther Noack <gnoack@google.com>
> 
> I'd like some more justification in the commit message.

Adding that. (linking to matching commit in kernel which introduced this)

> 
> > ---
> >  man/man7/landlock.7 | 20 ++++++++++++++++----
> >  1 file changed, 16 insertions(+), 4 deletions(-)
> > 
> > diff --git a/man/man7/landlock.7 b/man/man7/landlock.7
> > index c6b7272ea..11f76b072 100644
> > --- a/man/man7/landlock.7
> > +++ b/man/man7/landlock.7
> > @@ -39,13 +39,25 @@ the running kernel must support Landlock and
> >  it must be enabled at boot time.
> >  .\"
> >  .SS Landlock rules
> > -A Landlock rule describes an action on an object.
> > -An object is currently a file hierarchy,
> > -and the related filesystem actions are defined with access rights (see
> > -.BR landlock_add_rule (2)).
> > +A Landlock rule describes an action on an object
> > +which the process intends to perform.
> >  A set of rules is aggregated in a ruleset,
> >  which can then restrict the thread enforcing it,
> >  and its future children.
> > +.P
> > +The two existing types of rules are:
> > +.P
> 
> This will trigger a diagnostic due to being redundant before TP.
> 
> (Both P and TP are paragraphing macros, so you're theoretically creating
>  an empty paragraph, which is just ignored by groff(1).)

Thanks, fixed.


> > +.TP
> > +.B Filesystem rules
> > +For these rules, the object is a file hierarchy,
> > +and the related filesystem actions are defined with
> > +.IR "filesystem access rights" .
> > +.TP
> > +.B Network rules (since ABI v4)
> 
> Most of the pages use Roman for the parenthetical:
> 
> 	$ grep -rn 'BR.*(since' | sort -R | head
> 	man7/ip.7:782:.BR IP_PKTINFO " (since Linux 2.2)"
> 	man2/set_mempolicy.2:109:.BR MPOL_F_STATIC_NODES " (since Linux 2.6.26)"
> 	man2/kexec_load.2:60:.BR KEXEC_PRESERVE_CONTEXT " (since Linux 2.6.27)"
> 	man2/perf_event_open.2:823:.BR PERF_SAMPLE_REGS_USER " (since Linux 3.7)"
> 	man2/perf_event_open.2:1522:.BR PERF_SAMPLE_BRANCH_COND " (since Linux 3.16)"
> 	man7/socket.7:998:.BR SO_TIMESTAMPNS " (since Linux 2.6.22)"
> 	man2/perf_event_open.2:1537:.BR PERF_SAMPLE_BRANCH_CALL_STACK " (since Linux 4.1)"
> 	man2/clone.2:1303:.BR EINVAL " (since Linux 3.9)"
> 	man2/eventfd.2:52:.BR EFD_NONBLOCK " (since Linux 2.6.27)"
> 	man2/perf_event_open.2:912:.BR PERF_SAMPLE_CGROUP " (since Linux 5.7)"
> 
> > +For these rules, the object is a TCP port,
> > +and the related actions are defined with
> > +.IR "network access rights" .
> > +.BR landlock_add_rule (2)).

Removing this stray last line as well, which was left over from an earlier
version of the text.

—Günther