[PATCH v2 1/3] landlock: Require LANDLOCK_ACCESS_FS_MAKE_WHITEOUT for RENAME_WHITEOUT

[Günther Noack]

On Tue, Jun 09, 2026 at 06:09:51PM +0200, Mickaël Salaün wrote:
> On Wed, May 13, 2026 at 06:05:50PM +0200, Günther Noack wrote:
> > diff --git a/security/landlock/fs.c b/security/landlock/fs.c
> > index c1ecfe239032..09de6ba5c3a3 100644
> > --- a/security/landlock/fs.c
> > +++ b/security/landlock/fs.c
> > @@ -1519,6 +1519,21 @@ static int hook_path_rename(const struct path *const old_dir,
> >  			    const unsigned int flags)
> >  {
> >  	/* old_dir refers to old_dentry->d_parent and new_dir->mnt */
> > +	if (flags & RENAME_WHITEOUT) {
> > +		int err;
> > +
> > +		/*
> > +		 * Rename with RENAME_WHITEOUT creates a whiteout object in the
> > +		 * old location, so we check the access right for creating that.
> > +		 *
> > +		 * See Documentation/filesystems/overlayfs.rst and renameat2(2).
> > +		 */
> > +		err = current_check_access_path(
> > +			old_dir, LANDLOCK_ACCESS_FS_MAKE_WHITEOUT);
> 
> We should not need a second path walk, even if whiteouts are rare.
> Please propose another way.

I sent a V3 with that implemented differently:
https://lore.kernel.org/all/20260610092318.3868884-1-gnoack@google.com/

The tradeoff is that it complicates the common current_check_refer_path() to
solve this fringe use case.  In my understanding, the only software using this
is the FUSE OverlayFS implementation.

See the "tradeoffs" section in the V2 cover letter:
https://lore.kernel.org/all/20260513160552.4022649-1-gnoack@google.com/

I slightly prefer V2, but am OK with either variant if needed.  Please pick
the one that makes more sense to you.

—Günther