Re: [PATCH v2 -next 18/18] Documentation: Update landlock doc for metadata rights
flat view
From: sashiko-bot@kernel.org
Date: 2026-10-15 12:39:27
Also in:
bpf, linux-trace-kernel, selinux
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] docs: landlock: missing case 12 in ABI fallback switch example
--
commit ffdbac73c2bfbb47b618cd72408a33f8fb82d15b
Author: Cai Xinchen [off-list ref]
Documentation: Update landlock doc for metadata rights
Update the user space documentation for the new
LANDLOCK_ACCESS_FS_READ_METADATA and
LANDLOCK_ACCESS_FS_WRITE_METADATA access rights.
quoted hunk ↗ jump to hunk
diff --git a/Documentation/userspace-api/landlock.rst b/Documentation/userspace-api/landlock.rst index 3d45b956b6407..62fe39a8b61e6 100644 --- a/Documentation/userspace-api/landlock.rst +++ b/Documentation/userspace-api/landlock.rst
[ ... ]
quoted hunk ↗ jump to hunk
@@ -159,6 +161,10 @@ version, and only use the available subset of access rights: ruleset_attr.handled_permissions &= ~(LANDLOCK_PERMISSION_NAMESPACE_USE | LANDLOCK_PERMISSION_CAPABILITY_USE); + /* Removes metadata rights for ABI < 13 */ + ruleset_attr.handled_access_fs &= + ~(LANDLOCK_ACCESS_FS_READ_METADATA | + LANDLOCK_ACCESS_FS_WRITE_METADATA); } This enables the creation of an inclusive ruleset that will contain our rules.
[Severity: Medium] Does this documentation example skip the removal of metadata rights when the Landlock ABI version is exactly 12? If a developer copies this example and runs it on a kernel providing Landlock ABI 12, the switch statement will fail to match any case since there is no case 12 label. This means it will bypass the removal of the ABI 13 features (LANDLOCK_ACCESS_FS_READ_METADATA and LANDLOCK_ACCESS_FS_WRITE_METADATA), which will subsequently cause landlock_create_ruleset() to fail with -EINVAL. Should this modification be introduced under a new case 12 label with a fallthrough from case 11, rather than being appended to the existing case 11 block? -- Sashiko AI review · https://sashiko.dev/#/patchset/20261015125425.3246251-1-caixinchen1@huawei.com?part=18