unmask_scoped_access(9)

💖 unmask_scoped_access(9) 💖

okay so bestie, this is the manual page for unmask_scoped_access(9) — kernel API manual energy, and we're getting into it.

🎀 NAME 🎀

unmask_scoped_access — removes access right bits in @masks in all layers where @client and @server have the same domain. periodt.

✨ SYNOPSIS ✨

void unmask_scoped_access (const struct landlock_domain *const client ,
const struct landlock_domain *const server , struct layer_masks *const
masks , const access_mask_t access );

💅 ARGUMENTS 💅

• client — client domain. That's the client domain, bestie.
• server — server domain. And this one's the server domain.
• masks — layer access masks to unmask. The layer access masks we're unmasking.
• access — access bits that control scoping. These are the access bits that control scoping.

🫶 DESCRIPTION 🫶

This one does the same thing as domain_is_scoped, except it unmasks bits in masks. It can not return early as domain_is_scoped does — nope, it's gotta keep going. 💀

A scoped access for a given access right bit is allowed iff, for all layer depths where the access bit is set, the client and server domain are the same. iykyk

This function clears the access rights access in masks at all layer depths where the client and server domain are the same, so that, when they are all cleared, the access is allowed. slay.

👀 SEE ALSO 👀

Kernel file ./security/landlock/fs.c is hanging out with is_masked_device_ioctl(9), get_inode_id(9), is_access_to_paths_allowed(9), collect_domain_accesses(9), current_check_refer_path(9), and get_required_file_open_access(9). go read those too, bestie 🫶

Signed with love from the ./security/landlock source spot, dated October 2026 🎀✨