Re: [PATCH 1/3] landlock: Fix layer composition of LANDLOCK_ACCESS_FS_REFER

[Dwi Siswanto]

I saw the docs still describe the old one. include/uapi/linux/landlock.h
says:

   * For historical reasons, the %LANDLOCK_ACCESS_FS_REFER right is always denied
   * by default, even when its bit is not set in @handled_access_fs.

and, for LANDLOCK_ACCESS_FS_REFER itself:

   *   This is the only access right which is denied by default by any ruleset,
   *   even if the right is not specified as handled at ruleset creation time.

So ruleset that handles no filesystem access right never denies
LANDLOCK_ACCESS_FS_REFER -- alone or layered.

Also, the comment above _LANDLOCK_ACCESS_FS_INITIALLY_DENIED in access.h
has the same problem:

   * All access rights that are denied by default whether they are handled or not
   * by a ruleset/layer.  This must be ORed with all domain->handled_masks[]
   * entries when we need to get the absolute handled access masks, see
   * landlock_upgrade_handled_access_masks().

After this patch, the mask only applies to layers that handle filesystem
access, and after patch 3, nothing ORs it in at read time. *Someone* who
follows the comment could bring the bug back.

> +	access_mask_t handled = domain->handled_masks[layer_level].fs;
> +
> +	/*
> +	 * Handles all initially denied by default access rights, but only for
> +	 * layers handling filesystem accesses.
> +	 */
> +	if (handled)
> +		handled |= _LANDLOCK_ACCESS_FS_INITIALLY_DENIED;
> +
> +	return handled;

nit: I believe landlock_upgrade_handled_access_masks() already has the
same "only if fs is non-zero" rule, so this could be

	return landlock_upgrade_handled_access_masks(
		domain->handled_masks[layer_level]).fs;

Which keep the rule in one place. It matters little if patch 3 goes in
on top, and 6.12 doesn't have the helper. What do you think?

Best!
Dwi