[PATCH v2 0/2] landlock: Simplify path walk logic

[Justin Suess]

Hello,

This is v2 of a 2-patch Landlock cleanup series for security/landlock/fs.c.

These patches simplify path handling and path-based access checks. The cleanup
was initially part of my LANDLOCK_ADD_RULE_NO_INHERIT work, but it is more
appropriate as a separate preparatory series.

v1: https://lore.kernel.org/linux-security-module/20260218201857.1194667-1-utilityemal77@gmail.com/

Changes since v1
-----

- Split and clarified the series as:
  1) "landlock: Add path walk helper"
  2) "landlock: Refactor path access checks"
- Introduced landlock_walk_path_up() and enum landlock_walk_result to
  centralize upward path traversal state.
- Refactored is_access_to_paths_allowed() and callers around a
  struct landlock_check state object.
- Inlined collect_domain_accesses() into current_check_refer_path() and
  reused current_check_access_path() for same-directory refer checks.

Motivation
-----

Current path-walk logic is tightly coupled to specific call sites and is hard
to read and maintain. Centralizing traversal and per-check state should make
future Landlock path-based features easier to implement and review, including
follow-up work related to no-inherit semantics.

Patch overview
-----

Patch 1 introduces landlock_walk_path_up(), which walks a struct path
toward the VFS root and reports whether the current position is an internal
mount point, the real root, or neither.

Patch 2 applies the helper to access-check paths, introduces a struct landlock_check
to aggregate reused local variables used to check accesses, and removes collect_domain_accesses()
as a standalone helper.

Patch 1 can be applied independently. Patch 2 contains some more aggressive trimming
and refactoring of logic enabled by the first patch.

Thank you for your time.

Kind regards,
Justin Suess

Justin Suess (2):
  landlock: Add path walk helper
  landlock: Refactor path access checks

 security/landlock/fs.c | 507 ++++++++++++++++++-----------------------
 1 file changed, 225 insertions(+), 282 deletions(-)


base-commit: 8ff74a72b8af3672beca7f6b6b72557a9db94382
-- 
2.51.0