[RFC PATCH 1/2] landlock: access_mask_subset() helper

[Mickaël Salaün]

On Tue, Dec 30, 2025 at 11:39:19AM +0100, Günther Noack wrote:
> This helper function checks whether an access_mask_t has a subset of the
> bits enabled than another one.  This expresses the intent a bit smoother
> in the code and does not cost us anything when it gets inlined.
> 
> Signed-off-by: Günther Noack <gnoack3000 at gmail.com>
> ---
>  security/landlock/fs.c | 11 ++++++++++-
>  1 file changed, 10 insertions(+), 1 deletion(-)
> 
> diff --git a/security/landlock/fs.c b/security/landlock/fs.c
> index fe794875ad461..b4ce03bef4b8e 100644
> --- a/security/landlock/fs.c
> +++ b/security/landlock/fs.c
> @@ -398,6 +398,15 @@ static const struct access_masks any_fs = {
>  	.fs = ~0,
>  };
>  
> +/*
> + * Returns true iff a has a subset of the bits of b.
> + * It helps readability and gets inlined.
> + */
> +static bool access_mask_subset(access_mask_t a, access_mask_t b)
> +{
> +	return (a | b) == b;

I'm curious about why this switches to a binary OR instead of the
original AND.

> +}
> +
>  /*
>   * Check that a destination file hierarchy has more restrictions than a source
>   * file hierarchy.  This is only used for link and rename actions.
> @@ -1696,7 +1705,7 @@ static int hook_file_open(struct file *const file)
>  		ARRAY_SIZE(layer_masks));
>  #endif /* CONFIG_AUDIT */
>  
> -	if ((open_access_request & allowed_access) == open_access_request)
> +	if (access_mask_subset(open_access_request, allowed_access))
>  		return 0;
>  
>  	/* Sets access to reflect the actual request. */
> -- 
> 2.52.0
> 
>