diff options
| author | Günther Noack <gnoack3000@gmail.com> | 2026-02-06 16:11:54 +0100 |
|---|---|---|
| committer | Mickaël Salaün <mic@digikod.net> | 2026-02-10 16:46:48 +0100 |
| commit | 45f2a2926b2187d1b08132d2728af50785b007a7 (patch) | |
| tree | 05b03a2ebe590bda45a129c520d7d0939e320ffd /security | |
| parent | 9adbe8935152c511c1e43a47d69f44f0e969afc8 (diff) | |
landlock: Add access_mask_subset() helper
This helper function checks whether an access_mask_t has a subset of the
bits enabled than another one. This expresses the intent a bit smoother
in the code and does not cost us anything when it gets inlined.
Signed-off-by: Günther Noack <gnoack3000@gmail.com>
Link: https://lore.kernel.org/r/20260206151154.97915-4-gnoack3000@gmail.com
[mic: Improve subject]
Signed-off-by: Mickaël Salaün <mic@digikod.net>
Diffstat (limited to 'security')
| -rw-r--r-- | security/landlock/access.h | 7 | ||||
| -rw-r--r-- | security/landlock/fs.c | 4 |
2 files changed, 9 insertions, 2 deletions
diff --git a/security/landlock/access.h b/security/landlock/access.h index 7961c6630a2d..bab403470a6c 100644 --- a/security/landlock/access.h +++ b/security/landlock/access.h @@ -97,4 +97,11 @@ landlock_upgrade_handled_access_masks(struct access_masks access_masks) return access_masks; } +/* Checks the subset relation between access masks. */ +static inline bool access_mask_subset(access_mask_t subset, + access_mask_t superset) +{ + return (subset | superset) == superset; +} + #endif /* _SECURITY_LANDLOCK_ACCESS_H */ diff --git a/security/landlock/fs.c b/security/landlock/fs.c index 8205673c8b1c..aa8e7cddb929 100644 --- a/security/landlock/fs.c +++ b/security/landlock/fs.c @@ -331,7 +331,7 @@ int landlock_append_fs_rule(struct landlock_ruleset *const ruleset, /* Files only get access rights that make sense. */ if (!d_is_dir(path->dentry) && - (access_rights | ACCESS_FILE) != ACCESS_FILE) + !access_mask_subset(access_rights, ACCESS_FILE)) return -EINVAL; if (WARN_ON_ONCE(ruleset->num_layers != 1)) return -EINVAL; @@ -1704,7 +1704,7 @@ static int hook_file_open(struct file *const file) ARRAY_SIZE(layer_masks)); #endif /* CONFIG_AUDIT */ - if ((open_access_request & allowed_access) == open_access_request) + if (access_mask_subset(open_access_request, allowed_access)) return 0; /* Sets access to reflect the actual request. */ |