Re: [PATCH v2 -next 09/18] landlock: Add READ_METADATA and WRITE_METADATA access rights

[Cai Xinchen]

Hello Justin,

Thank you for the review, and for thinking the implications through so
carefully -- the concrete scenarios you describe were very helpful to
settle the design.

I agree it should be a conscious
decision: the next revision will make the *_METADATA checked at open time

and follow the mechanic for the truncate right

On 10/16/2026 10:44 PM, Justin Suess wrote:
> LANDLOCK_ACCESS_FS_*_METADATA should be checked at open time and follow
> the mechanic for the truncate right. Otherwise the access for already
> opened file descriptors would be changed. See hook_file_open in
> security/landlock/fs.c and this discussion here [1]
>
> It should have clear documentation for this as well.