[PATCH v3 06/12] landlock: Copy the quiet mask in the ruleset merge helper

[Mickaël Salaün]

Relocate the quiet_access hierarchy copy from landlock_merge_ruleset()
into merge_ruleset(), where the ruleset lock is already held and the
per-layer state is snapshotted.

No behavioral change: quiet_access is set once in create_ruleset() and
never modified afterwards.  This is done for consistency with the
following commit, which copies quiet_perm (mutated per rule by
landlock_add_rule()) at the same site so it is captured atomically with
the allowed mask.

Cc: Günther Noack <gnoack@xxxxxxxxxx>
Cc: Tingmao Wang <m@xxxxxxxxxx>
Signed-off-by: Mickaël Salaün <mic@xxxxxxxxxxx>
---

Changes since v2:
- New patch.
---
 security/landlock/ruleset.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/security/landlock/ruleset.c b/security/landlock/ruleset.c
index af08a8cc705c..b6552415f3be 100644
--- a/security/landlock/ruleset.c
+++ b/security/landlock/ruleset.c
@@ -402,6 +402,10 @@ static int merge_ruleset(struct landlock_ruleset *const dst,
 		goto out_unlock;
 #endif /* IS_ENABLED(CONFIG_INET) */
 
+#ifdef CONFIG_AUDIT
+	dst->hierarchy->quiet_access = src->quiet_access;
+#endif /* CONFIG_AUDIT */
+
 out_unlock:
 	mutex_unlock(&src->lock);
 	mutex_unlock(&dst->lock);
@@ -587,10 +591,6 @@ landlock_merge_ruleset(struct landlock_ruleset *const parent,
 	if (err)
 		return ERR_PTR(err);
 
-#ifdef CONFIG_AUDIT
-	new_dom->hierarchy->quiet_access = ruleset->quiet_access;
-#endif /* CONFIG_AUDIT */
-
 	return no_free_ptr(new_dom);
 }
 
-- 
2.54.0