Re: [PATCH] landlock/ruleset: Minor comments improvements
From: Tingmao Wang <hidden>
Date: 2025-06-03 21:57:06
Subsystem:
landlock security module, security subsystem, the rest · Maintainers:
Mickaël Salaün, Paul Moore, James Morris, "Serge E. Hallyn", Linus Torvalds
As discussed in chat, here is another one for you to consider and squash :) Current comment here is IMO a bit confusing - it says "Only allow ... internal filesystems" but that's not the case. Signed-off-by: Tingmao Wang <redacted> --- security/landlock/fs.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/security/landlock/fs.c b/security/landlock/fs.c
index 9396d2d9df40..11b469002c03 100644
--- a/security/landlock/fs.c
+++ b/security/landlock/fs.c@@ -911,9 +911,10 @@ static bool is_access_to_paths_allowed( } if (unlikely(IS_ROOT(walker_path.dentry))) { /* - * Stops at disconnected root directories. Only allows - * access to internal filesystems (e.g. nsfs, which is - * reachable through /proc/<pid>/ns/<namespace>). + * Stops at disconnected root directories. Allows access to + * internal filesystems (e.g. nsfs, which is reachable through + * /proc/<pid>/ns/<namespace>), in addition to what's already + * allowed. */ if (walker_path.mnt->mnt_flags & MNT_INTERNAL) { allowed_parent1 = true; --
2.49.0