I saw the docs still describe the old one. include/uapi/linux/landlock.h
says:
* For historical reasons, the %LANDLOCK_ACCESS_FS_REFER right is always denied
* by default, even when its bit is not set in @handled_access_fs.
and, for LANDLOCK_ACCESS_FS_REFER itself:
* This is the only access right which is denied by default by any ruleset,
* even if the right is not specified as handled at ruleset creation time.
So ruleset that handles no filesystem access right never denies
LANDLOCK_ACCESS_FS_REFER -- alone or layered.
Also, the comment above _LANDLOCK_ACCESS_FS_INITIALLY_DENIED in access.h
has the same problem:
* All access rights that are denied by default whether they are handled or not
* by a ruleset/layer. This must be ORed with all domain->handled_masks[]
* entries when we need to get the absolute handled access masks, see
* landlock_upgrade_handled_access_masks().
After this patch, the mask only applies to layers that handle filesystem
access, and after patch 3, nothing ORs it in at read time. *Someone* who
follows the comment could bring the bug back.
quoted hunk ↗ jump to hunk
+ access_mask_t handled = domain->handled_masks[layer_level].fs;
+
+ /*
+ * Handles all initially denied by default access rights, but only for
+ * layers handling filesystem accesses.
+ */
+ if (handled)
+ handled |= _LANDLOCK_ACCESS_FS_INITIALLY_DENIED;
+
+ return handled;
nit: I believe landlock_upgrade_handled_access_masks() already has the
same "only if fs is non-zero" rule, so this could be
return landlock_upgrade_handled_access_masks(
domain->handled_masks[layer_level]).fs;
Which keep the rule in one place. It matters little if patch 3 goes in
on top, and 6.12 doesn't have the helper. What do you think?
Best!
Dwi