[PATCH v2 10/15] landlock: Expose the ruleset fd lookup to the rest of Landlock
From: Justin Suess <hidden>
Date: 2026-08-31 15:00:30
Also in:
bpf, lkml
Subsystem:
landlock security module, security subsystem, the rest · Maintainers:
Mickaël Salaün, Paul Moore, James Morris, "Serge E. Hallyn", Linus Torvalds
Rename get_ruleset_from_fd() to landlock_get_ruleset_from_fd() and give it external linkage within Landlock, declared in ruleset.h next to the other ruleset lifetime helpers. A following commit implements the LSM kfunc policy hooks, which need to translate a ruleset fd into a landlock_ruleset reference from outside syscalls.c. No behavioral change. Cc: Mickaël Salaün <mic@digikod.net> Signed-off-by: Justin Suess <redacted> --- security/landlock/ruleset.h | 3 +++ security/landlock/syscalls.c | 9 +++++---- 2 files changed, 8 insertions(+), 4 deletions(-)
diff --git a/security/landlock/ruleset.h b/security/landlock/ruleset.h
index b536fa0425b7..b58e3d9846af 100644
--- a/security/landlock/ruleset.h
+++ b/security/landlock/ruleset.h@@ -214,6 +214,9 @@ int landlock_store_rule(struct landlock_rules *const rules, void landlock_free_rules(struct landlock_rules *const rules); +struct landlock_ruleset *landlock_get_ruleset_from_fd(const int fd, + const fmode_t mode); + /** * landlock_get_rule_root - Get the root of a rule tree by key type *
diff --git a/security/landlock/syscalls.c b/security/landlock/syscalls.c
index 1d02d57f4c48..cb294a3582ae 100644
--- a/security/landlock/syscalls.c
+++ b/security/landlock/syscalls.c@@ -305,8 +305,8 @@ SYSCALL_DEFINE3(landlock_create_ruleset, * Returns an owned ruleset from a FD. It is thus needed to call * landlock_put_ruleset() on the return value. */ -static struct landlock_ruleset *get_ruleset_from_fd(const int fd, - const fmode_t mode) +struct landlock_ruleset *landlock_get_ruleset_from_fd(const int fd, + const fmode_t mode) { CLASS(fd, ruleset_f)(fd); struct landlock_ruleset *ruleset;
@@ -486,7 +486,7 @@ SYSCALL_DEFINE4(landlock_add_rule, const int, ruleset_fd, return -EINVAL; /* Gets and checks the ruleset. */ - ruleset = get_ruleset_from_fd(ruleset_fd, FMODE_CAN_WRITE); + ruleset = landlock_get_ruleset_from_fd(ruleset_fd, FMODE_CAN_WRITE); if (IS_ERR(ruleset)) return PTR_ERR(ruleset);
@@ -585,7 +585,8 @@ SYSCALL_DEFINE2(landlock_restrict_self, const int, ruleset_fd, const __u32, (flags & ~LANDLOCK_RESTRICT_SELF_TSYNC) == LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF)) { /* Gets and checks the ruleset. */ - ruleset = get_ruleset_from_fd(ruleset_fd, FMODE_CAN_READ); + ruleset = landlock_get_ruleset_from_fd(ruleset_fd, + FMODE_CAN_READ); if (IS_ERR(ruleset)) return PTR_ERR(ruleset); }
--
2.55.0