[PATCH v2 -next 18/18] Documentation: Update landlock doc for metadata rights

[sashiko-bot at kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] docs: landlock: missing case 12 in ABI fallback switch example
--

commit ffdbac73c2bfbb47b618cd72408a33f8fb82d15b
Author: Cai Xinchen <caixinchen1 at huawei.com>

    Documentation: Update landlock doc for metadata rights
    
    Update the user space documentation for the new
    LANDLOCK_ACCESS_FS_READ_METADATA and
    LANDLOCK_ACCESS_FS_WRITE_METADATA access rights.

> diff --git a/Documentation/userspace-api/landlock.rst b/Documentation/userspace-api/landlock.rst
> index 3d45b956b6407..62fe39a8b61e6 100644
> --- a/Documentation/userspace-api/landlock.rst
> +++ b/Documentation/userspace-api/landlock.rst

[ ... ]

> @@ -159,6 +161,10 @@ version, and only use the available subset of access rights:
>          ruleset_attr.handled_permissions &=
>              ~(LANDLOCK_PERMISSION_NAMESPACE_USE |
>                LANDLOCK_PERMISSION_CAPABILITY_USE);
> +        /* Removes metadata rights for ABI < 13 */
> +        ruleset_attr.handled_access_fs &=
> +            ~(LANDLOCK_ACCESS_FS_READ_METADATA |
> +              LANDLOCK_ACCESS_FS_WRITE_METADATA);
>      }
>  
>  This enables the creation of an inclusive ruleset that will contain our rules.

[Severity: Medium]
Does this documentation example skip the removal of metadata rights when the
Landlock ABI version is exactly 12?

If a developer copies this example and runs it on a kernel providing Landlock
ABI 12, the switch statement will fail to match any case since there is no
case 12 label.

This means it will bypass the removal of the ABI 13 features
(LANDLOCK_ACCESS_FS_READ_METADATA and LANDLOCK_ACCESS_FS_WRITE_METADATA),
which will subsequently cause landlock_create_ruleset() to fail with -EINVAL.

Should this modification be introduced under a new case 12 label with a
fallthrough from case 11, rather than being appended to the existing case 11
block?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261015125425.3246251-1-caixinchen1@huawei.com?part=18