[PATCH v2] landlock: Clarify documentation for the LANDLOCK_ACCESS_FS_REFER right

[Günther Noack]

Hello!

On Thu, Feb 16, 2023 at 07:42:51PM +0100, Mickaël Salaün wrote:
> On 15/02/2023 21:34, Günther Noack wrote:
> > Sorry, correction (+ABI, s/to/for/):
> > 
> >    This access right is available since the second version of the
> >    Landlock ABI.  This is also the only access right which is
> >    implicitly handled by any ruleset, even if the right is not
> >    specified at the time of creating the ruleset. So, by default,
> >    Landlock will deny linking and reparenting files between different
> >    directories, and only grant this right when it is explicitly
> 
> and will only grant…?

Good point, done.

> > > Both valid points. How about the following phrasing which is
> > > formulated a bit closer to the actual goal (not creating a loophole
> > > through which you can gain more access rights for a file):
> > > 
> > >    * The reparented file may not attain more access rights in the
> 
> s/may not/cannot/ ?

I think "may not" is used when it's about permissions, whereas "can
not" is about ability. "may not" seems more appropriate here, because
the process is still free to attempt it, and we are explaining the
consequences below.

> s/attain/gain/ ?

Yes, thanks -- apparently, "attain" is more used for goals whereas
"gain" more for resources, so "gain" seems more correct here.

> 
> > >      destination directory than it previously had in the source
> > >      directory.  If this is attempted, the operation results in an
> > >      ``EXDEV`` error.
> 
> Better too!
> 
> This is becoming a bit difficult to follow, you can send a new patch with
> Alex in Cc. :)

Thanks for the feedback, I will send a revised patch.

–-Günther