archives/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-03-08 01:24:47 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

landlock: Add access_mask_subset() helper

Browse source 
This helper function checks whether an access_mask_t has a subset of the
bits enabled than another one.  This expresses the intent a bit smoother
in the code and does not cost us anything when it gets inlined.

Signed-off-by: Günther Noack <gnoack3000@gmail.com>
Link: https://lore.kernel.org/r/20260206151154.97915-4-gnoack3000@gmail.com
[mic: Improve subject]
Signed-off-by: Mickaël Salaün <mic@digikod.net>
This commit is contained in:
Günther Noack 2026-02-06 16:11:54 +01:00 • committed by Mickaël Salaün
parent 9adbe89351
commit 45f2a2926b
No known key found for this signature in database
GPG key ID: E5E3D0E88C82F6D2
2 changed files with 9 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

7
security/landlock/access.h
View file

@ -97,4 +97,11 @@ landlock_upgrade_handled_access_masks(struct access_masks access_masks)
return access_masks;
}
/* Checks the subset relation between access masks. */
static inline bool access_mask_subset(access_mask_t subset,
access_mask_t superset)
{
return (subset | superset) == superset;
}
#endif /* _SECURITY_LANDLOCK_ACCESS_H */

4
security/landlock/fs.c
View file

@ -331,7 +331,7 @@ int landlock_append_fs_rule(struct landlock_ruleset *const ruleset,
/* Files only get access rights that make sense. */
if (!d_is_dir(path->dentry) &&
(access_rights | ACCESS_FILE) != ACCESS_FILE)
!access_mask_subset(access_rights, ACCESS_FILE))
return -EINVAL;
if (WARN_ON_ONCE(ruleset->num_layers != 1))
return -EINVAL;
@ -1704,7 +1704,7 @@ static int hook_file_open(struct file *const file)
ARRAY_SIZE(layer_masks));
#endif /* CONFIG_AUDIT */
if ((open_access_request & allowed_access) == open_access_request)
if (access_mask_subset(open_access_request, allowed_access))
return 0;
/* Sets access to reflect the actual request. */