Unverified Commit ef4536f1 authored by Tingmao Wang's avatar Tingmao Wang Committed by Mickaël Salaün
Browse files

landlock: Improve the comment for domain_is_scoped 



Currently it is not obvious what "scoped" mean, and the fact that the
function returns true when access should be denied is slightly surprising
and in need of documentation.

Cc: Tahera Fahimi <fahimitahera@gmail.com>
Signed-off-by: default avatarTingmao Wang <m@maowtm.org>
Link: https://lore.kernel.org/r/06393bc18aee5bc278df5ef31c64a05b742ebc10.1766885035.git.m@maowtm.org


[mic: Fix formatting and improve consistency]
Signed-off-by: default avatarMickaël Salaün <mic@digikod.net>
parent 55dc93a7

security/landlock/task.c

+4 −4
Original line number Diff line number Diff line
@@ -166,15 +166,15 @@ static int hook_ptrace_traceme(struct task_struct *const parent) 
}



/**

 * domain_is_scoped - Checks if the client domain is scoped in the same

 *		      domain as the server.

 * domain_is_scoped - Check if an interaction from a client/sender to a

 *		      server/receiver should be restricted based on scope controls.

 *

 * @client: IPC sender domain.

 * @server: IPC receiver domain.

 * @scope: The scope restriction criteria.

 *

 * Returns: True if the @client domain is scoped to access the @server,

 * unless the @server is also scoped in the same domain as @client.

 * Returns: True if @server is in a different domain from @client, and @client

 * is scoped to access @server (i.e. access should be denied).

 */

static bool domain_is_scoped(const struct landlock_ruleset *const client,

			     const struct landlock_ruleset *const server,