landlock: Move domain query functions to domain.c

Browse source

Grouping domain-specific code in one compilation unit reduces coupling
between domain and ruleset implementations.

Move the access-check functions that only operate on a domain (rule
lookup, layer unmasking, layer-mask init, access-mask union) from
ruleset.[ch] to domain.[ch].  They evaluate whether a domain grants a
requested access during the pathwalk and network checks and do not
modify the domain.

The merge and inherit chain stays in ruleset.c for now because it calls
the static create_ruleset() allocator; a following commit moves it once
the domain type switch eliminates that dependency.

No behavioral change.  The functions move with unchanged signatures and
bodies.

Cc: Günther Noack <gnoack@google.com>
Cc: Tingmao Wang <m@maowtm.org>
Link: https://patch.msgid.link/20260811094338.288094-3-mic@digikod.net
Signed-off-by: Mickaël Salaün <mic@digikod.net>

...

This commit is contained in:

Mickaël Salaün 2026-08-11 11:43:16 +02:00

parent e76ef456bb

commit 2bbba0905a

No known key found for this signature in database

GPG key ID: E5E3D0E88C82F6D2

5 changed files with 201 additions and 188 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

162

security/landlock/domain.c

View file

38

security/landlock/domain.h

View file

1

security/landlock/net.c

View file

150

security/landlock/ruleset.c

View file

38

security/landlock/ruleset.h

View file