The LANDLOCK_ACCESS_FS_REFER right is handled implicitly in a ruleset,
but only if any other filesystem access right is declared as handled
in the given ruleset.
The old documentation was still a remnant from the times when
filesystem access rights were the only access rights that existed in
Landlock, but it became misleading when we introduced additional types
of access rights.
Fixes: fff69fb03dde ("landlock: Support network rules with TCP bind and connect")
Signed-off-by: Günther Noack <redacted>
---
include/uapi/linux/landlock.h | 17 +++++++++--------
security/landlock/access.h | 9 +++++----
2 files changed, 14 insertions(+), 12 deletions(-)
diff --git a/include/uapi/linux/landlock.h b/include/uapi/linux/landlock.h
index 24510e5d8479..7e38b9d1bf12 100644
--- a/include/uapi/linux/landlock.h
+++ b/include/uapi/linux/landlock.h
@@ -22,10 +22,10 @@
* enacted. Vice versa, access rights that are not specifically listed here are
* not going to be denied by this ruleset when it is enacted.
*
- * For historical reasons, the %LANDLOCK_ACCESS_FS_REFER right is always denied
- * by default, even when its bit is not set in @handled_access_fs. In order to
- * add new rules with this access right, the bit must still be set explicitly
- * (cf. `Filesystem flags`_).
+ * For historical reasons, as soon as any filesystem access right is handled in
+ * @handled_access_fs, the %LANDLOCK_ACCESS_FS_REFER right is always denied as
+ * well. In order to add new rules with this access right, the bit must still
+ * be set explicitly (cf. `Filesystem flags`_).
*
* The explicit listing of *handled access rights* is required for backwards
* compatibility reasons. In most use cases, processes that use Landlock will
@@ -462,10 +462,11 @@ struct landlock_capability_attr {
* This access right is available since the second version of the Landlock
* ABI.
*
- * This is the only access right which is denied by default by any ruleset,
- * even if the right is not specified as handled at ruleset creation time.
- * The only way to make a ruleset grant this right is to explicitly allow it
- * for a specific directory by adding a matching rule to the ruleset.
+ * This is the only access right which is denied by default by any ruleset
+ * that handles filesystem access rights, even if the right is not specified
+ * as handled at ruleset creation time. The only way to make a ruleset grant
+ * this right is to explicitly allow it for a specific directory by adding a
+ * matching rule to the ruleset.
*
* In particular, when using the first Landlock ABI version, Landlock will
* always deny attempts to reparent files between different directories.diff --git a/security/landlock/access.h b/security/landlock/access.h
index f9eaa2f53686..c4a81f7dadeb 100644
--- a/security/landlock/access.h
+++ b/security/landlock/access.h
@@ -18,10 +18,11 @@
#include "limits.h"
/*
- * All access rights that are denied by default whether they are handled or not
- * by a ruleset/layer. This must be ORed with the .handled field of all
- * domain->layers[] entries when we need to get the absolute handled access
- * masks, see landlock_upgrade_handled_layer_config().
+ * All filesystem access rights that are denied by default as soon as any other
+ * filesystem access right is handled, even if the access right is not
+ * explicitly declared to be handled itself. This must be ORed with the
+ * .handled field of all domain->layers[] entries when we need to get the
+ * absolute handled access masks, see landlock_upgrade_handled_layer_config().
*/
/* clang-format off */
#define _LANDLOCK_ACCESS_FS_INITIALLY_DENIED ( \
--
2.56.0