Return the handled FS access mask as it is, instead of artificially
adding LANDLOCK_ACCESS_FS_REFER to it.
Since commit d6c7cf84a24f ("landlock: Simplify initially denied access
rights"), the merge operation already bakes the initially denied
access rights (LANDLOCK_ACCESS_FS_REFER) into the a layer's handled FS
access rights. -- They don't need to be added explicitly any more.
No functional change.
Signed-off-by: Günther Noack <redacted>
---
security/landlock/domain.h | 12 ++++--------
1 file changed, 4 insertions(+), 8 deletions(-)
diff --git a/security/landlock/domain.h b/security/landlock/domain.h
index d9ebf4857fce..812c324cb6ef 100644
--- a/security/landlock/domain.h
+++ b/security/landlock/domain.h
@@ -262,16 +262,12 @@ static inline access_mask_t
landlock_get_fs_access_mask(const struct landlock_domain *const domain,
const u16 layer_level)
{
- access_mask_t handled = domain->layers[layer_level].handled.fs;
-
/*
- * Handles all initially denied by default access rights, but only for
- * layers handling filesystem accesses.
+ * Initially denied by default access rights are already included for
+ * layers handling filesystem accesses, see
+ * landlock_upgrade_handled_layer_config().
*/
- if (handled)
- handled |= _LANDLOCK_ACCESS_FS_INITIALLY_DENIED;
-
- return handled;
+ return domain->layers[layer_level].handled.fs;
}
static inline access_mask_t
--
2.56.0