[PATCH] landlock: Document fallocate(2) as another truncation corner case

[Mickaël Salaün]

On Wed, Apr 01, 2026 at 05:09:10PM +0200, Günther Noack wrote:
> Reinforce the already stated policy that LANDLOCK_ACCESS_FS_TRUNCATE should
> always go hand in hand with LANDLOCK_ACCESS_FS_WRITE_FILE, as their
> meanings and enforcement overlap in counterintuitive ways.
> 
> On many common file systems, fallocate(2) offers a way to shorten files as
> long as the file is opened for writing, side-stepping the
> LANDLOCK_ACCESS_FS_TRUNCATE right.
> 
> Assisted-by: Gemini-CLI:gemini-3.1
> Signed-off-by: Günther Noack <gnoack at google.com>
> ---
>  Documentation/userspace-api/landlock.rst | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/Documentation/userspace-api/landlock.rst b/Documentation/userspace-api/landlock.rst
> index 7f86d7a37dc2..d5691ec136cc 100644
> --- a/Documentation/userspace-api/landlock.rst
> +++ b/Documentation/userspace-api/landlock.rst
> @@ -378,8 +378,8 @@ Truncating files
>  
>  The operations covered by ``LANDLOCK_ACCESS_FS_WRITE_FILE`` and
>  ``LANDLOCK_ACCESS_FS_TRUNCATE`` both change the contents of a file and sometimes
> -overlap in non-intuitive ways.  It is recommended to always specify both of
> -these together.
> +overlap in non-intuitive ways.  It is strongly recommended to always specify
> +both of these together (either granting both, or granting none).
>  
>  A particularly surprising example is :manpage:`creat(2)`.  The name suggests
>  that this system call requires the rights to create and write files.  However,
> @@ -391,6 +391,10 @@ It should also be noted that truncating files does not require the
>  system call, this can also be done through :manpage:`open(2)` with the flags
>  ``O_RDONLY | O_TRUNC``.
>  
> +At the same time, on some filesystems, :manpage:`fallocate(2)` offers a way to
> +shorten file contents with ``FALLOC_FL_COLLAPSE_RANGE`` when the file is opened
> +for writing, sidestepping the ``LANDLOCK_ACCESS_FS_TRUNCATE`` right.

Interesting, which filesystems?  Shouldn't it be fixed in the code
instead?

> +
>  The truncate right is associated with the opened file (see below).
>  
>  Rights associated with file descriptors
> -- 
> 2.53.0.1185.g05d4b7b318-goog
> 
>