update LANDLOCK_ACCESS_FS_{CHMOD, CHGRP} support and add abi change
in the document.

Signed-off-by: Xiu Jianfeng <xiujianfeng@huawei.com>
---
 Documentation/userspace-api/landlock.rst | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/Documentation/userspace-api/landlock.rst b/Documentation/userspace-api/landlock.rst
index 2509c2fbf98f..0e97a7998fa1 100644
--- a/Documentation/userspace-api/landlock.rst
+++ b/Documentation/userspace-api/landlock.rst
@@ -61,7 +61,9 @@ the need to be explicit about the denied-by-default access rights.
             LANDLOCK_ACCESS_FS_MAKE_BLOCK |
             LANDLOCK_ACCESS_FS_MAKE_SYM |
             LANDLOCK_ACCESS_FS_REFER |
-            LANDLOCK_ACCESS_FS_TRUNCATE,
+            LANDLOCK_ACCESS_FS_TRUNCATE |
+            LANDLOCK_ACCESS_FS_CHMOD |
+            LANDLOCK_ACCESS_FS_CHGRP
     };
 
 Because we may not know on which kernel version an application will be
@@ -90,6 +92,11 @@ the ABI.
     case 2:
             /* Removes LANDLOCK_ACCESS_FS_TRUNCATE for ABI < 3 */
             ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_TRUNCATE;
+            __attribute__((fallthrough));
+    case 3:
+            /* Removes LANDLOCK_ACCESS_FS_{CHMOD, CHGRP} for ABI < 4 */
+            ruleset_attr.handled_access_fs &= ~(LANDLOCK_ACCESS_FS_CHMOD |
+                                                LANDLOCK_ACCESS_FS_CHGRP);
     }
 
 This enables to create an inclusive ruleset that will contain our rules.
-- 
2.17.1

On Sat, Aug 27, 2022 at 07:12:15PM +0800, Xiu Jianfeng wrote:
> update LANDLOCK_ACCESS_FS_{CHMOD, CHGRP} support and add abi change
> in the document.
>
> Signed-off-by: Xiu Jianfeng <xiujianfeng@huawei.com>
> ---
>  Documentation/userspace-api/landlock.rst | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
>
> diff --git a/Documentation/userspace-api/landlock.rst b/Documentation/userspace-api/landlock.rst
> index 2509c2fbf98f..0e97a7998fa1 100644
> --- a/Documentation/userspace-api/landlock.rst
> +++ b/Documentation/userspace-api/landlock.rst
> @@ -61,7 +61,9 @@ the need to be explicit about the denied-by-default access rights.
>              LANDLOCK_ACCESS_FS_MAKE_BLOCK |
>              LANDLOCK_ACCESS_FS_MAKE_SYM |
>              LANDLOCK_ACCESS_FS_REFER |
> -            LANDLOCK_ACCESS_FS_TRUNCATE,
> +            LANDLOCK_ACCESS_FS_TRUNCATE |
> +            LANDLOCK_ACCESS_FS_CHMOD |
> +            LANDLOCK_ACCESS_FS_CHGRP
>      };
>
>  Because we may not know on which kernel version an application will be
> @@ -90,6 +92,11 @@ the ABI.
>      case 2:
>              /* Removes LANDLOCK_ACCESS_FS_TRUNCATE for ABI < 3 */
>              ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_TRUNCATE;
> +            __attribute__((fallthrough));
> +    case 3:
> +            /* Removes LANDLOCK_ACCESS_FS_{CHMOD, CHGRP} for ABI < 4 */
> +            ruleset_attr.handled_access_fs &= ~(LANDLOCK_ACCESS_FS_CHMOD |
> +                                                LANDLOCK_ACCESS_FS_CHGRP);
>      }
>
>  This enables to create an inclusive ruleset that will contain our rules.

There is a sentence just above this code example that neesd updating as well.

--

Hi,

在 2022/8/28 1:28, Günther Noack 写道:
> On Sat, Aug 27, 2022 at 07:12:15PM +0800, Xiu Jianfeng wrote:
>> update LANDLOCK_ACCESS_FS_{CHMOD, CHGRP} support and add abi change
>> in the document.
>>
>> Signed-off-by: Xiu Jianfeng <xiujianfeng@huawei.com>
>> ---
>>   Documentation/userspace-api/landlock.rst | 9 ++++++++-
>>   1 file changed, 8 insertions(+), 1 deletion(-)
>>
>> diff --git a/Documentation/userspace-api/landlock.rst b/Documentation/userspace-api/landlock.rst
>> index 2509c2fbf98f..0e97a7998fa1 100644
>> --- a/Documentation/userspace-api/landlock.rst
>> +++ b/Documentation/userspace-api/landlock.rst
>> @@ -61,7 +61,9 @@ the need to be explicit about the denied-by-default access rights.
>>               LANDLOCK_ACCESS_FS_MAKE_BLOCK |
>>               LANDLOCK_ACCESS_FS_MAKE_SYM |
>>               LANDLOCK_ACCESS_FS_REFER |
>> -            LANDLOCK_ACCESS_FS_TRUNCATE,
>> +            LANDLOCK_ACCESS_FS_TRUNCATE |
>> +            LANDLOCK_ACCESS_FS_CHMOD |
>> +            LANDLOCK_ACCESS_FS_CHGRP
>>       };
>>
>>   Because we may not know on which kernel version an application will be
>> @@ -90,6 +92,11 @@ the ABI.
>>       case 2:
>>               /* Removes LANDLOCK_ACCESS_FS_TRUNCATE for ABI < 3 */
>>               ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_TRUNCATE;
>> +            __attribute__((fallthrough));
>> +    case 3:
>> +            /* Removes LANDLOCK_ACCESS_FS_{CHMOD, CHGRP} for ABI < 4 */
>> +            ruleset_attr.handled_access_fs &= ~(LANDLOCK_ACCESS_FS_CHMOD |
>> +                                                LANDLOCK_ACCESS_FS_CHGRP);
>>       }
>>
>>   This enables to create an inclusive ruleset that will contain our rules.
> 
> There is a sentence just above this code example that neesd updating as well.
> 

Get it, it's the follwing sentence, thanks.
...
Let's check if we should
remove the `LANDLOCK_ACCESS_FS_REFER` or `LANDLOCK_ACCESS_FS_TRUNCATE` 
access
rights, which are only supported starting with the second and third 
version of
the ABI.
...

> --
> .
>