Re: [PATCH v2 -next 09/18] landlock: Add READ_METADATA and WRITE_METADATA access rights

Hello Justin,

Thank you for the review, and for thinking the implications through so
carefully -- the concrete scenarios you describe were very helpful to
settle the design.

I agree it should be a conscious
decision: the next revision will make the *_METADATA checked at open time

and follow the mechanic for the truncate right

On 10/16/2026 10:44 PM, Justin Suess wrote:

LANDLOCK_ACCESS_FS_*_METADATA should be checked at open time and follow
the mechanic for the truncate right. Otherwise the access for already
opened file descriptors would be changed. See hook_file_open in
security/landlock/fs.c and this discussion here [1]

It should have clear documentation for this as well.