github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

landlock: Rename quiet_masks to quiet_access

Browse Source 
The base stores the fs/net/scope quiet bitmasks in a struct access_masks
field named quiet_masks.  A following commit adds the sibling struct
permission_masks field quiet_permission for capabilities and namespaces.
quiet_masks drops the access category and keeps the type half ("masks"),
while quiet_permission keeps the category and drops the type half, so
the two read as an inconsistent pair.

Rename the base field to quiet_access, giving the symmetric,
category-named pair quiet_access/quiet_permission that also matches the
UAPI handled_access_*/quiet_access_* naming.  This is a
no-functional-change rename.

Cc: Günther Noack <gnoack@google.com>
Cc: Tingmao Wang <m@maowtm.org>
Reviewed-by: Tingmao Wang <m@maowtm.org>
Reviewed-by: Günther Noack <gnoack3000@gmail.com>
Link: https://patch.msgid.link/20261014082718.1435842-2-mic@digikod.net
Signed-off-by: Mickaël Salaün <mic@digikod.net>
This commit is contained in:
Mickaël Salaün 2026-10-14 10:27:07 +02:00
parent 69ac1bff64
commit 9c2a44d83e
No known key found for this signature in database
GPG Key ID: E5E3D0E88C82F6D2
5 changed files with 13 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
security/landlock/domain.c
View File

@ -479,7 +479,7 @@ landlock_merge_ruleset(struct landlock_domain *const parent,
return ERR_PTR(err);
#ifdef CONFIG_SECURITY_LANDLOCK_LOG
new_dom->hierarchy->quiet_masks = ruleset->quiet_masks;
new_dom->hierarchy->quiet_access = ruleset->quiet_access;
#endif /* CONFIG_SECURITY_LANDLOCK_LOG */
return no_free_ptr(new_dom);

4
security/landlock/domain.h
View File

@ -130,10 +130,10 @@ struct landlock_hierarchy {
*/
log_new_exec : 1;
/**
* @quiet_masks: Bitmasks of access that should be quieted (i.e. not
* @quiet_access: Bitmasks of access that should be quieted (i.e. not
* logged) if the related object is marked as quiet.
*/
struct access_masks quiet_masks;
struct access_masks quiet_access;
#endif /* CONFIG_SECURITY_LANDLOCK_LOG */
};

6
security/landlock/log.c
View File

@ -436,7 +436,7 @@ is_denial_quieted(const struct landlock_request *const request,
if (object_quiet_flag) {
const access_mask_t quiet_mask =
pick_access_mask_for_request_type(
request->type, youngest_denied->quiet_masks);
request->type, youngest_denied->quiet_access);
return (quiet_mask & missing) == missing;
}
@ -447,10 +447,10 @@ is_denial_quieted(const struct landlock_request *const request,
*/
switch (request->type) {
case LANDLOCK_REQUEST_SCOPE_SIGNAL:
return !!(youngest_denied->quiet_masks.scope &
return !!(youngest_denied->quiet_access.scope &
LANDLOCK_SCOPE_SIGNAL);
case LANDLOCK_REQUEST_SCOPE_ABSTRACT_UNIX_SOCKET:
return !!(youngest_denied->quiet_masks.scope &
return !!(youngest_denied->quiet_access.scope &
LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET);
/*
* Leave LANDLOCK_REQUEST_PTRACE and LANDLOCK_REQUEST_FS_CHANGE_TOPOLOGY

4
security/landlock/ruleset.h
View File

@ -182,11 +182,11 @@ struct landlock_ruleset {
#endif /* CONFIG_TRACEPOINTS */
/**
* @quiet_masks: Stores the quiet flags for an unmerged ruleset. For a
* @quiet_access: Stores the quiet flags for an unmerged ruleset. For a
* merged domain, this is stored in each layer's struct
* landlock_hierarchy instead.
*/
struct access_masks quiet_masks;
struct access_masks quiet_access;
/**
* @handled_masks: Contains the subset of filesystem and network actions
* that are handled by this ruleset.

10
security/landlock/syscalls.c
View File

@ -280,9 +280,9 @@ SYSCALL_DEFINE3(landlock_create_ruleset,
if (IS_ERR(ruleset))
return PTR_ERR(ruleset);
ruleset->quiet_masks.fs = ruleset_attr.quiet_access_fs;
ruleset->quiet_masks.net = ruleset_attr.quiet_access_net;
ruleset->quiet_masks.scope = ruleset_attr.quiet_scoped;
ruleset->quiet_access.fs = ruleset_attr.quiet_access_fs;
ruleset->quiet_access.net = ruleset_attr.quiet_access_net;
ruleset->quiet_access.scope = ruleset_attr.quiet_scoped;
/*
* Emits before anon_inode_getfd() installs the file descriptor, while
@ -382,7 +382,7 @@ static int add_rule_path_beneath(struct landlock_ruleset *const ruleset,
return -EINVAL;
/* Checks for useless quiet flag. */
if (flags & LANDLOCK_ADD_RULE_QUIET && !ruleset->quiet_masks.fs)
if (flags & LANDLOCK_ADD_RULE_QUIET && !ruleset->quiet_access.fs)
return -EINVAL;
/* Gets and checks the new rule. */
@ -423,7 +423,7 @@ static int add_rule_net_port(struct landlock_ruleset *ruleset,
return -EINVAL;
/* Checks for useless quiet flag. */
if (flags & LANDLOCK_ADD_RULE_QUIET && !ruleset->quiet_masks.net)
if (flags & LANDLOCK_ADD_RULE_QUIET && !ruleset->quiet_access.net)
return -EINVAL;
/* Denies inserting a rule with port greater than 65535. */