# Re: \[PATCH 1/3\] landlock: Fix layer composition of LANDLOCK\_ACCESS\_FS\_REFER

- From: sashiko-bot@kernel.org
- Date: 2026-10-30 10:29:41 
- List: linux-security-module
- Page: https://ratatoskr.run/linux-security-module/2026/10/17832091
- Thread: https://ratatoskr.run/linux-security-module/2026/10/17832032/t.md

```text
> In landlock_get_fs_access_mask(), only add the
> LANDLOCK_ACCESS_FS_REFER right if any filesystem access rights are
> handled at all.  This prevents us from accidentally treating
> non-filesystem layers as if they handled LANDLOCK_ACCESS_FS_REFER.
> 
> landlock_get_fs_access_mask() is used when initializing the layer
> masks for doing access right checks, so this bug meant that we
> unintentionally denied "refer" (e.g., link, rename) operations in
> layered cases, where the same operation would have been accepted if
> only either one of the two layers had been enforced.  If the rulesets
> individually allow an operation, the composition of these rulesets
> should also allow it.
> 
> The bug only manifests as soon as one other layer handles filesystem
> access rights.  Otherwise, Landlock filesystem path walk is guarded by
> an early exit for the case that no filesystem-enforcing layer exists.
> 
> Reported-by: Dwi Siswanto <redacted>
> Link: https://github.com/landlock-lsm/linux/issues/67
> Link: https://github.com/landlock-lsm/go-landlock/issues/66
> Fixes: fff69fb03dde ("landlock: Support network rules with TCP bind and connect")
> Cc: <redacted>
> Signed-off-by: Günther Noack <redacted>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261030102411.12985-1-gnoack3000@gmail.com?part=1

```