--- v2
+++ v4
@@ -4,8 +4,14 @@
https://www.kernel.org/doc/html/v5.13/userspace-api/landlock.html
Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
-Link: https://lore.kernel.org/r/20210712155745.831580-4-mic@digikod.net
+Link: https://lore.kernel.org/r/20210818155931.484070-4-mic@digikod.net
---
+
+Changes since v2:
+* Fix syscall's rule_attr pointer.
+* Add an EXAMPLES section referring to landlock(7).
+* Change list order in the SEE ALSO section.
+* Fix .IR and .BR use as explained by Alejandro Colomar.
Changes since v1:
* Replace all ".I" with ".IR", except when used for titles.
@@ -19,16 +25,16 @@
* Add a "CONFORMING TO" section.
* Replace "(2)" with "()" for the described syscall name.
---
- man2/landlock_add_rule.2 | 139 +++++++++++++++++++++++++++++++++++++++
- 1 file changed, 139 insertions(+)
+ man2/landlock_add_rule.2 | 144 +++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 144 insertions(+)
create mode 100644 man2/landlock_add_rule.2
diff --git a/man2/landlock_add_rule.2 b/man2/landlock_add_rule.2
new file mode 100644
-index 000000000000..06ff55821222
+index 000000000000..eafb8f8201b7
--- /dev/null
+++ b/man2/landlock_add_rule.2
-@@ -0,0 +1,139 @@
+@@ -0,0 +1,144 @@
+.\" Copyright © 2017-2020 Mickaël Salaün <mic@digikod.net>
+.\" Copyright © 2019-2020 ANSSI
+.\" Copyright © 2021 Microsoft Corporation
@@ -65,7 +71,7 @@
+.PP
+.BI "int syscall(SYS_landlock_add_rule, int " ruleset_fd ,
+.BI " enum landlock_rule_type " rule_type ,
-+.BI " const void * " rule_attr ", __u32 " flags );
++.BI " const void *" rule_attr ", __u32 " flags );
+.SH DESCRIPTION
+A Landlock rule describes an action on an object.
+An object is currently a file hierarchy, and the related filesystem actions
@@ -79,21 +85,21 @@
+.BR landlock (7)
+for a global overview.
+.PP
-+.IR ruleset_fd
++.I ruleset_fd
+is a Landlock ruleset file descriptor obtained with
+.BR landlock_create_ruleset (2).
+.PP
-+.IR rule_type
++.I rule_type
+identifies the structure type pointed to by
+.IR rule_attr .
+Currently, Linux supports the following
-+.IR rule_type
++.I rule_type
+value:
+.TP
+.B LANDLOCK_RULE_PATH_BENEATH
+This defines the object type as a file hierarchy.
+In this case,
-+.IR rule_attr
++.I rule_attr
+points to the following structure:
+.IP
+.in +4n
@@ -105,19 +111,21 @@
+.EE
+.in
+.IP
-+.IR allowed_access
++.I allowed_access
+contains a bitmask of allowed filesystem actions for this file hierarchy
+(see
-+.BR "Filesystem actions"
++.B Filesystem actions
+in
+.BR landlock (7)).
+.IP
-+.IR parent_fd
++.I parent_fd
+is an opened file descriptor, preferably with the
-+.IR O_PATH flag,
-+which identifies the parent directory of the file hierarchy or a just file.
++.I O_PATH
++flag,
++which identifies the parent directory of the file hierarchy or
++just a file.
+.PP
-+.IR flags
++.I flags
+must be 0.
+.SH RETURN VALUE
+On success,
@@ -131,43 +139,46 @@
+Landlock is supported by the kernel but disabled at boot time.
+.TP
+.B EINVAL
-+.IR flags
++.I flags
+is not 0, or the rule accesses are inconsistent (i.e.,
-+.IR rule_attr->allowed_access
++.I rule_attr->allowed_access
+is not a subset of the ruleset handled accesses).
+.TP
+.B ENOMSG
+Empty accesses (i.e.,
-+.IR rule_attr->allowed_access
++.I rule_attr->allowed_access
+is 0).
+.TP
+.B EBADF
-+.IR ruleset_fd
++.I ruleset_fd
+is not a file descriptor for the current thread, or a member of
-+.IR rule_attr
++.I rule_attr
+is not a file descriptor as expected.
+.TP
+.B EBADFD
-+.IR ruleset_fd
++.I ruleset_fd
+is not a ruleset file descriptor, or a member of
-+.IR rule_attr
++.I rule_attr
+is not the expected file descriptor type.
+.TP
+.B EPERM
-+.IR ruleset_fd
++.I ruleset_fd
+has no write access to the underlying ruleset.
+.TP
+.B EFAULT
-+.IR rule_attr
++.I rule_attr
+was not a valid address.
+.SH VERSIONS
+Landlock was added in Linux 5.13.
+.SH CONFORMING TO
+This system call is Linux-specific.
++.SH EXAMPLES
++See
++.BR landlock (7).
+.SH SEE ALSO
-+.BR landlock (7),
+.BR landlock_create_ruleset (2),
-+.BR landlock_restrict_self (2)
++.BR landlock_restrict_self (2),
++.BR landlock (7)
--
2.32.0