security/landlock/ruleset.c

100 	    const struct landlock_layer (*const layers)[], const u32 num_layers,
115 	new_rule = kzalloc(struct_size(new_rule, layers, new_num_layers),
129 	memcpy(new_rule->layers, layers,
130 	       flex_array_size(new_rule, layers, num_layers));
133 		new_rule->layers[new_rule->num_layers - 1] = *new_layer;
187  * @layers: One or multiple layers to be copied into the new rule.
188  * @num_layers: The number of @layers entries.
190  * When user space requests to add a new rule to a ruleset, @layers only
195  * When merging a ruleset in a domain, or copying a domain, @layers will be
201 		       const struct landlock_layer (*const layers)[],
211 	if (WARN_ON_ONCE(!layers))
240 		if ((*layers)[0].level == 0) {
247 			if (WARN_ON_ONCE(this->layers[0].level != 0))
249 			this->layers[0].access |= (*layers)[0].access;
253 		if (WARN_ON_ONCE(this->layers[0].level == 0))
260 		new_rule = create_rule(id, &this->layers, this->num_layers,
261 				       &(*layers)[0]);
273 	new_rule = create_rule(id, layers, num_layers, NULL);
298 	struct landlock_layer layers[] = { {
305 	return insert_rule(ruleset, id, &layers, ARRAY_SIZE(layers));
343 		struct landlock_layer layers[] = { {
354 		if (WARN_ON_ONCE(walker_rule->layers[0].level != 0))
357 		layers[0].access = walker_rule->layers[0].access;
359 		err = insert_rule(dst, id, &layers, ARRAY_SIZE(layers));
432 		err = insert_rule(child, id, &walker_rule->layers,
639 	 * the remaining layers for each inode, from the first added layer to
647 			&rule->layers[layer_level];
677  * the bits for all the layers are set where this access right is handled.
686  * in any of the active layers in @domain.