selftests/landlock/fs_test.c

783 	 * allowed.
900 	 * opening for write-only should be allowed, but not read-write.
1311 	/* Readdir access is allowed. */
1316 	/* Readdir access is allowed. */
1334 	 * LANDLOCK_ACCESS_FS_WRITE_FILE must not be allowed because it would
1345 	/* Readdir access is still allowed. */
1350 	/* Readdir access is still allowed. */
1366 	/* Readdir access is still allowed. */
1371 	/* Readdir access is still allowed. */
1396 	/* Readdir access is still allowed. */
1402 	 * Readdir of dir_s1d3 is still allowed because of the OR policy inside
1424 	/* Readdir access is allowed for dir_s1d3. */
1426 	/* File access is allowed for file1_s1d3. */
1439 	/* Readdir access is still allowed for dir_s1d3. */
1441 	/* File access is still allowed for file1_s1d3. */
1580 	/* Checks allowed access. */
1789 	/* This dir_s3d3 would not be allowed and does not exist anyway. */
2268 	 * Moving should only be allowed when the source and the destination
2449 	 * This is OK for a file link, but it should not be allowed for a
2561 	 * This is OK for a file rename, but it should not be allowed for a
2577 	 * The first rename is allowed but not the exchange because dir_s1d3's
2594 	/* Renaming in the same directory is always allowed. */
2671 	 * Moving the dir_s1d3 directory below dir_s2d2 is allowed by Landlock
2678 	 * Moving the dir_s1d3 directory below dir_s2d3 is allowed, even if it
2680 	 * already allowed for dir_s1d3.
2686 	 * However, moving the file1_s1d3 file below dir_s2d3 is allowed
2782 	 * Checks with directories which creation could be allowed, but denied
2808 	 * directory-related access rights is allowed, and at the same time
2810 	 * grants less access rights is allowed too.
2951 	/* Access allowed thanks to the matching rights. */
3022 	 * Moving file1_s1d2 should be allowed even if dir_s2d2 grants a
3038 	 * Moving dir_s1d3 should be allowed even if dir_s2d2 grants a superset
3046 	 * Moving file1_s2d3 beneath dir_s1d2 is allowed, but moving it back
3702 	const __u64 allowed;
3711 	.allowed = LANDLOCK_ACCESS_FS_WRITE_FILE,
3720 	.allowed = LANDLOCK_ACCESS_FS_TRUNCATE,
3729 	.allowed = LANDLOCK_ACCESS_FS_WRITE_FILE,
3738 	.allowed = LANDLOCK_ACCESS_FS_WRITE_FILE | LANDLOCK_ACCESS_FS_TRUNCATE,
3747 	.allowed = LANDLOCK_ACCESS_FS_TRUNCATE,
3757 			.access = variant->allowed,
3798 				.access = variant->allowed,
4512 	 * is still allowed, and write access to lower file viewed (and copied)
4513 	 * through the merge point is still allowed.