Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Medium] docs: landlock: missing case 12 in ABI fallback switch example --
commit ffdbac73c2bfbb47b618cd72408a33f8fb82d15b Author: Cai Xinchen <[email protected]> Documentation: Update landlock doc for metadata rights Update the user space documentation for the new LANDLOCK_ACCESS_FS_READ_METADATA and LANDLOCK_ACCESS_FS_WRITE_METADATA access rights. > diff --git a/Documentation/userspace-api/landlock.rst > b/Documentation/userspace-api/landlock.rst > index 3d45b956b6407..62fe39a8b61e6 100644 > --- a/Documentation/userspace-api/landlock.rst > +++ b/Documentation/userspace-api/landlock.rst [ ... ] > @@ -159,6 +161,10 @@ version, and only use the available subset of access > rights: > ruleset_attr.handled_permissions &= > ~(LANDLOCK_PERMISSION_NAMESPACE_USE | > LANDLOCK_PERMISSION_CAPABILITY_USE); > + /* Removes metadata rights for ABI < 13 */ > + ruleset_attr.handled_access_fs &= > + ~(LANDLOCK_ACCESS_FS_READ_METADATA | > + LANDLOCK_ACCESS_FS_WRITE_METADATA); > } > > This enables the creation of an inclusive ruleset that will contain our > rules. [Severity: Medium] Does this documentation example skip the removal of metadata rights when the Landlock ABI version is exactly 12? If a developer copies this example and runs it on a kernel providing Landlock ABI 12, the switch statement will fail to match any case since there is no case 12 label. This means it will bypass the removal of the ABI 13 features (LANDLOCK_ACCESS_FS_READ_METADATA and LANDLOCK_ACCESS_FS_WRITE_METADATA), which will subsequently cause landlock_create_ruleset() to fail with -EINVAL. Should this modification be introduced under a new case 12 label with a fallthrough from case 11, rather than being appended to the existing case 11 block? -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=18
