[PATCH v2 0/4] landlock: Fix REFER in layered domains

[PATCH v2 0/4] landlock: Fix REFER in layered domains

[Günther Noack]

This patchset fixes a bug in Landlock layering,
reported by Dwi Siswanto in [1] and [2].  (Thanks!)

The bug
=======

When Landlock initializes layer masks for path walk based checks, it
unconditionally adds the LANDLOCK_ACCESS_FS_REFER access right to the
handled access rights.

This leads to a wrong layer composition, in cases where the following
layers are stacked:

1. A FS layer restricting REFER, but also allowing REFER in a rule
   (e.g., handle REFER, but allow REFER on /)
2. A non-FS layer (e.g., networking-only layer)

When these rulesets are enforced **individually**, there are REFER
operations that are allowed in both rulesets -- the ones that 1
allows.

When these rulesets are enforced **on top of each other**, the non-FS
layer starts enforcing REFER implicitly as well, and all REFER
operations are denied.

This patchset
=============

This patchset fixes the issue in three commits:

1) The fix, which should be backportable to older kernels
   and which is CC'd to stable@.
2) Regression selftests.
3) A more elegant fix for newer kernels,
   which is intentionally *not* CC'd to stable@,
   because it would break on older kernels.

   In newer kernels, we already add the "REFER" access right to the
   handled access rights when we merge the ruleset into the new
   domain, so there is no additional calculation to do for it.
4) A documentation update to clarify the situations where the *_REFER
   right is implicit.

Please let me know what you think!

–Günther

[1] https://github.com/landlock-lsm/go-landlock/issues/66
[2] https://github.com/landlock-lsm/linux/issues/67

---
Changes in v2:
- Rebase on master and resolve conflicts
- Fixed documentation as pointed out by Dwi Siswanto in
  https://lore.kernel.org/all/20261101125114.19009-1-me@dw1.io/
- Link to v1: https://patch.msgid.link/20261030102411.12985-1-gnoack3000@gmail.com

---
Günther Noack (4):
      landlock: Fix layer composition of LANDLOCK_ACCESS_FS_REFER
      selftests/landlock: Test that layering does not break refer
      landlock: Simplify landlock_get_fs_access_mask()
      landlock: Clarify implicit handling of LANDLOCK_ACCESS_FS_REFER

 include/uapi/linux/landlock.h              | 17 +++++++------
 security/landlock/access.h                 |  9 ++++---
 security/landlock/domain.h                 |  9 ++++---
 tools/testing/selftests/landlock/fs_test.c | 39 ++++++++++++++++++++++++++++++
 4 files changed, 59 insertions(+), 15 deletions(-)
---
base-commit: fa4ad798f6f681031775266044ba1b0cf3c670bd
change-id: 20261108-b4-landlock-refer-nonfs-layer-fda8bcbe0b44

Best regards,
--  
Günther Noack <gnoack3000@gmail.com>

[PATCH v2 1/4] landlock: Fix layer composition of LANDLOCK_ACCESS_FS_REFER

[Günther Noack]

In landlock_get_fs_access_mask(), only add the
LANDLOCK_ACCESS_FS_REFER right if any filesystem access rights are
handled at all.  This prevents us from accidentally treating
non-filesystem layers as if they handled LANDLOCK_ACCESS_FS_REFER.

landlock_get_fs_access_mask() is used when initializing the layer
masks for doing access right checks, so this bug meant that we
unintentionally denied "refer" (e.g., link, rename) operations in
layered cases, where the same operation would have been accepted if
only either one of the two layers had been enforced.  If the rulesets
individually allow an operation, the composition of these rulesets
should also allow it.

The bug only manifests as soon as one other layer handles filesystem
access rights.  Otherwise, Landlock filesystem path walk is guarded by
an early exit for the case that no filesystem-enforcing layer exists.

Reported-by: Dwi Siswanto <me@dw1.io>
Link: https://github.com/landlock-lsm/linux/issues/67
Link: https://github.com/landlock-lsm/go-landlock/issues/66
Fixes: fff69fb03dde ("landlock: Support network rules with TCP bind and connect")
Cc: stable@vger.kernel.org
Signed-off-by: Günther Noack <gnoack3000@gmail.com>
---
 security/landlock/domain.h | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/security/landlock/domain.h b/security/landlock/domain.h
index 935e18b12b3c..d9ebf4857fce 100644
--- a/security/landlock/domain.h
+++ b/security/landlock/domain.h
@@ -262,9 +262,16 @@ static inline access_mask_t
 landlock_get_fs_access_mask(const struct landlock_domain *const domain,
 			    const u16 layer_level)
 {
-	/* Handles all initially denied by default access rights. */
-	return domain->layers[layer_level].handled.fs |
-	       _LANDLOCK_ACCESS_FS_INITIALLY_DENIED;
+	access_mask_t handled = domain->layers[layer_level].handled.fs;
+
+	/*
+	 * Handles all initially denied by default access rights, but only for
+	 * layers handling filesystem accesses.
+	 */
+	if (handled)
+		handled |= _LANDLOCK_ACCESS_FS_INITIALLY_DENIED;
+
+	return handled;
 }
 
 static inline access_mask_t

-- 
2.56.0

Re: [PATCH v2 0/4] landlock: Fix REFER in layered domains

[Mickaël Salaün]

On Sun, Nov 08, 2026 at 09:23:47PM +0100, Günther Noack wrote:
> This patchset fixes a bug in Landlock layering,
> reported by Dwi Siswanto in [1] and [2].  (Thanks!)
> 
> The bug
> =======
> 
> When Landlock initializes layer masks for path walk based checks, it
> unconditionally adds the LANDLOCK_ACCESS_FS_REFER access right to the
> handled access rights.
> 
> This leads to a wrong layer composition, in cases where the following
> layers are stacked:
> 
> 1. A FS layer restricting REFER, but also allowing REFER in a rule
>    (e.g., handle REFER, but allow REFER on /)
> 2. A non-FS layer (e.g., networking-only layer)
> 
> When these rulesets are enforced **individually**, there are REFER
> operations that are allowed in both rulesets -- the ones that 1
> allows.
> 
> When these rulesets are enforced **on top of each other**, the non-FS
> layer starts enforcing REFER implicitly as well, and all REFER
> operations are denied.

Good catch!

> 
> This patchset
> =============
> 
> This patchset fixes the issue in three commits:

Four patches now.

> 
> 1) The fix, which should be backportable to older kernels
>    and which is CC'd to stable@.
> 2) Regression selftests.
> 3) A more elegant fix for newer kernels,
>    which is intentionally *not* CC'd to stable@,
>    because it would break on older kernels.
> 
>    In newer kernels, we already add the "REFER" access right to the
>    handled access rights when we merge the ruleset into the new
>    domain, so there is no additional calculation to do for it.
> 4) A documentation update to clarify the situations where the *_REFER
>    right is implicit.
> 
> Please let me know what you think!
> 
> –Günther
> 
> [1] https://github.com/landlock-lsm/go-landlock/issues/66
> [2] https://github.com/landlock-lsm/linux/issues/67
> 
> ---
> Changes in v2:
> - Rebase on master and resolve conflicts
> - Fixed documentation as pointed out by Dwi Siswanto in
>   https://lore.kernel.org/all/20261101125114.19009-1-me@dw1.io/
> - Link to v1: https://patch.msgid.link/20261030102411.12985-1-gnoack3000@gmail.com
> 
> ---
> Günther Noack (4):
>       landlock: Fix layer composition of LANDLOCK_ACCESS_FS_REFER
>       selftests/landlock: Test that layering does not break refer
>       landlock: Simplify landlock_get_fs_access_mask()
>       landlock: Clarify implicit handling of LANDLOCK_ACCESS_FS_REFER
> 
>  include/uapi/linux/landlock.h              | 17 +++++++------
>  security/landlock/access.h                 |  9 ++++---
>  security/landlock/domain.h                 |  9 ++++---
>  tools/testing/selftests/landlock/fs_test.c | 39 ++++++++++++++++++++++++++++++
>  4 files changed, 59 insertions(+), 15 deletions(-)
> ---
> base-commit: fa4ad798f6f681031775266044ba1b0cf3c670bd
> change-id: 20261108-b4-landlock-refer-nonfs-layer-fda8bcbe0b44
> 
> Best regards,
> --  
> Günther Noack <gnoack3000@gmail.com>
> 
> 

Re: [PATCH v2 1/4] landlock: Fix layer composition of LANDLOCK_ACCESS_FS_REFER

[Mickaël Salaün]

Good. Please add erratum 5 in this patch with abi-4.h .

On Sun, Nov 08, 2026 at 09:23:48PM +0100, Günther Noack wrote:
> In landlock_get_fs_access_mask(), only add the
> LANDLOCK_ACCESS_FS_REFER right if any filesystem access rights are
> handled at all.  This prevents us from accidentally treating
> non-filesystem layers as if they handled LANDLOCK_ACCESS_FS_REFER.
> 
> landlock_get_fs_access_mask() is used when initializing the layer
> masks for doing access right checks, so this bug meant that we
> unintentionally denied "refer" (e.g., link, rename) operations in
> layered cases, where the same operation would have been accepted if
> only either one of the two layers had been enforced.  If the rulesets
> individually allow an operation, the composition of these rulesets
> should also allow it.
> 
> The bug only manifests as soon as one other layer handles filesystem
> access rights.  Otherwise, Landlock filesystem path walk is guarded by
> an early exit for the case that no filesystem-enforcing layer exists.
> 
> Reported-by: Dwi Siswanto <me@dw1.io>
> Link: https://github.com/landlock-lsm/linux/issues/67
> Link: https://github.com/landlock-lsm/go-landlock/issues/66
> Fixes: fff69fb03dde ("landlock: Support network rules with TCP bind and connect")
> Cc: stable@vger.kernel.org
> Signed-off-by: Günther Noack <gnoack3000@gmail.com>
> ---
>  security/landlock/domain.h | 13 ++++++++++---
>  1 file changed, 10 insertions(+), 3 deletions(-)
> 
> diff --git a/security/landlock/domain.h b/security/landlock/domain.h
> index 935e18b12b3c..d9ebf4857fce 100644
> --- a/security/landlock/domain.h
> +++ b/security/landlock/domain.h
> @@ -262,9 +262,16 @@ static inline access_mask_t
>  landlock_get_fs_access_mask(const struct landlock_domain *const domain,
>  			    const u16 layer_level)
>  {
> -	/* Handles all initially denied by default access rights. */
> -	return domain->layers[layer_level].handled.fs |
> -	       _LANDLOCK_ACCESS_FS_INITIALLY_DENIED;
> +	access_mask_t handled = domain->layers[layer_level].handled.fs;
> +
> +	/*
> +	 * Handles all initially denied by default access rights, but only for
> +	 * layers handling filesystem accesses.
> +	 */
> +	if (handled)
> +		handled |= _LANDLOCK_ACCESS_FS_INITIALLY_DENIED;
> +
> +	return handled;
>  }
>  
>  static inline access_mask_t
> 
> -- 
> 2.56.0
> 
>