Re: [PATCH v3 -next 00/18] landlock: Add READ_METADATA and WRITE_METADATA access rights

[Cai Xinchen <caixinchen1@huawei.com>]

You are right, and thanks for catching it.

I have been working on these modifications over the past two weeks and 
have deployed sashiko locally. However, my current changes are still 
being flagged for some bugs by my local sashiko, and I am still in the 
process of fixing them. I expect to release v4 in a few days. Regarding 
these issues, my current fixes are as follows: - AT_EMPTY_PATH: v4 will 
use CLASS(fd_raw, f)(dfd), the   same lookup path_init() does for an 
empty path, so O_PATH descriptors   work again.  do_utimes_fd() 
(futimens(2)) intentionally keeps   CLASS(fd, f), matching 
fchmod(2)/fchown(2); AT_EMPTY_PATH returns   -EINVAL there anyway.  The 
same patch rejects a NULL pathname with   -EFAULT before 
CLASS(filename_maybe_null) can turn it into an empty   path relative to 
AT_FDCWD, and adds the missing audit_file() on the   do_utimes_path() fd 
branch. - __nullable (patches 5-9, 11-13): v4 will extend 
kernel/bpf/bpf_lsm_proto.c (the existing   strong-override file used for 
mmap_file) with strong definitions for   all 11 hooks that gained a file 
argument, each declared   file__nullable, so the verifier sees 
PTR_MAYBE_NULL and a program must   check before dereferencing. - ntfs 
named stream setattr (patch 1): v3 forwarded with   
__notify_change(idmap, base_dentry, ...).  v4 will use   
notify_change_target(idmap, attr->ia_path, base_dentry, ...), so the   
hook is checked against the path the syscall used while the attributes   
still land on the base inode. - overlayfs fileattr (patch 8): v3 removed 
the ovl_security_fileattr()   workaround but then called the unchecked 
__vfs_fileattr_get()/_set()   on the real dentry, which bypasses the 
hooks.  v4 will call the checked   vfs_fileattr_get()/_set() with the 
real upper/lower path, so the hooks   also run for the underlying layer; 
ecryptfs is switched the same way.

Best regards.

Cai

On 11/11/2026 12:52 AM, Christian Brauner wrote:
> This regresses AT_EMPTY_PATH. fchmodat2(), fchownat() and utimensat()
> with an empty path now go through CLASS(fd) which is fdget() and that
> refuses O_PATH file descriptors. IOW, this is very very broken.
>
> Please also go through Sashiko's review of v3 (cf. [1]). The new struct
> file arguments need __nullable or bpf programs can dereference NULL,
> and the ntfs3 stream setattr and overlayfs fileattr paths that bypass
> the hooks need treatment.