Lines Matching defs:layer

133  * (per-layer) unfulfilled access rights @masks so that all the access rights
138  * @masks: A matrix of unfulfilled access rights for each layer.
163 	 * An access is granted if, for each policy layer, at least one rule
165 	 * of its position in the layer stack.  We must then check the remaining
166 	 * layers for each inode, from the first added layer to the last one.
167 	 * When there are multiple requested accesses, for each policy layer,
174 	 * is per-layer: access is granted iff masks->layers[l].access == 0 for
176 	 * within a layer (e.g. a path rule OR a scope exception), the
177 	 * composition must evaluate per-layer: FOR-ALL l (A(l) OR B(l)), not
182 		const struct landlock_layer *const layer = &rule->layers[i];
184 		/* Clear the bits where the layer in the rule grants access. */
185 		masks->layers[layer->level - 1].access &= ~layer->access;
188 		/* Collect rule flags for each layer. */
189 		if (layer->flags.quiet)
190 			masks->layers[layer->level - 1].quiet = true;
206  * landlock_init_layer_masks - Initialize layer masks from an access request
327 	/* Stacks the new layer. */
405 	 * Copies the parent layer stack and leaves a space for the new layer.
606 		    const unsigned long access_bit, const size_t layer)
614 	if (WARN_ON_ONCE(layer >= LANDLOCK_MAX_NUM_LAYERS))
622 	return layer
631  * @deny_masks: Domain layer levels that denied each optional access (the
652 		const u8 layer =
657 		if (masks->layers[layer].quiet)