Hello Justin, Thank you for the review, and for thinking the implications through so carefully -- the concrete scenarios you describe were very helpful to settle the design.
I agree it should be a conscious decision: the next revision will make the *_METADATA checked at open time and follow the mechanic for the truncate right On 10/16/2026 10:44 PM, Justin Suess wrote:
LANDLOCK_ACCESS_FS_*_METADATA should be checked at open time and follow the mechanic for the truncate right. Otherwise the access for already opened file descriptors would be changed. See hook_file_open in security/landlock/fs.c and this discussion here [1] It should have clear documentation for this as well.
