Use-Time Semantics

Every operation on an open fd is a mask check against the granted mask, with one v0.20 exception: execveat(AT_EMPTY_PATH) uses a live AccessCheck rather than the cached mask (see Execution below).

§11.4.1 Data operations #

§11.4.2 Metadata operations #

Canonical SD xattr reads and writes MUST be denied unconditionally via the xattr hooks. The canonical SD xattr is security.peios.sd, or system.ntfs_security on NTFS as defined by §11.5. All SD access MUST go through kacs_get_sd / kacs_set_sd. POSIX ACL xattr writes (system.posix_acl_access, system.posix_acl_default) MUST also be denied unconditionally.

§11.4.3 Directory traversal #

Path resolution checks FILE_TRAVERSE on FACS-managed directory components. If the current effective token has SeChangeNotifyPrivilege, intermediate path-resolution traverse checks are bypassed, including on directories whose SD is missing. Explicit current-directory/root-directory changes are not intermediate path resolution: chdir() and chroot() require a live FILE_TRAVERSE check on the final directory. Normal-fd fchdir() checks the fd's cached granted mask for FILE_TRAVERSE; O_PATH fchdir() performs a live FILE_TRAVERSE check.

§11.4.4 Append-only enforcement #

A handle with FILE_APPEND_DATA but not FILE_WRITE_DATA allows only true append-intent writes. Append intent means the effective write position is forced to EOF by O_APPEND or per-I/O RWF_APPEND, unless the same operation uses RWF_NOAPPEND to negate append semantics. It MUST deny:

• Positioned writes without effective append intent (pwrite64, pwritev, pwritev2 with an explicit offset, io_uring writes with an explicit offset, and AIO writes with an offset).
• Any write using RWF_NOAPPEND, including pwritev2, io_uring, or AIO, because it can negate append semantics inherited from O_APPEND.
• Shared writable mmap / mprotect upgrades to PROT_WRITE.
• fallocate mutation modes (PUNCH_HOLE, ZERO_RANGE, COLLAPSE_RANGE, INSERT_RANGE, UNSHARE_RANGE, WRITE_ZEROES).

§11.4.5 fcntl enforcement #

For F_SETFL, KACS evaluates the mutable status flags accepted by Linux: O_APPEND, O_NONBLOCK / O_NDELAY, O_DIRECT, and O_NOATIME.

• F_SETFL clearing O_APPEND: denied if fd has FILE_APPEND_DATA but not FILE_WRITE_DATA.
• F_SETFL setting O_APPEND: always allowed (privilege reduction).
• F_SETFL adding O_NOATIME: requires FILE_WRITE_ATTRIBUTES.
• F_SETFL clearing O_NOATIME: always allowed.
• F_SETFL changing only O_NONBLOCK, O_NDELAY, or O_DIRECT: no additional KACS right; ordinary Linux validation still applies.

The following non-F_SETFL commands are fd-local or handle-local and require no additional KACS file right. They MUST NOT widen the cached granted mask:

The following commands are object-state queries or mutations and are checked against the cached granted mask before Linux-specific validation:

Lock, lease, and delegation acquisition or release commands (F_SETLK, F_SETLKW, F_SETLK64, F_SETLKW64, F_OFD_SETLK, F_OFD_SETLKW, F_SETLEASE, F_SETDELEG) are allowed through the security_file_fcntl hook so they can be enforced by the later security_file_lock hook, which receives normalized F_RDLCK, F_WRLCK, or F_UNLCK values. Unknown lock types still fail closed at that hook.

For F_NOTIFY, removing a watch (zero event mask, ignoring DN_MULTISHOT) requires no KACS file right. Installing a watch with any known DN_* event requires FILE_LIST_DIRECTORY. Unknown DN_* bits on a managed fd MUST fail closed.

Unmanaged fds are outside the ordinary FACS handle check. Unknown managed fcntl commands MUST fail closed.

§11.4.6 ioctl enforcement #

Known ioctls are classified by required right. Unclassified ioctls fall back to: allowed if the fd has at least one data right (FILE_READ_DATA, FILE_WRITE_DATA, or FILE_APPEND_DATA).

The 32-bit compat aliases for the listed commands use the same required right as their native command. This includes FS_IOC32_GETFLAGS, FS_IOC32_SETFLAGS, FS_IOC32_GETVERSION, FS_IOC32_SETVERSION, and the compat FS_IOC_*_32 preallocation commands.

§11.4.6.1 FD-local ioctl commands #

§11.4.6.2 Common VFS ioctls #

§11.4.6.3 Classified file/object ioctls #

§11.4.6.4 Classified directory ioctls #

§11.4.6.5 Unclassified ioctls #

Any ioctl not in the tables above is allowed if the fd carries at least one data right (FILE_READ_DATA, FILE_WRITE_DATA, or FILE_APPEND_DATA). Future versions will expand the classified list and may deny unclassified ioctls.

Device nodes, pipes, sockets: unclassified/device-specific ioctls are allowed if the fd has at least one data right. Device-specific ioctl semantics are outside FACS scope — the device node's SD is the FACS authorization boundary, and Linux device-specific validation may still deny the operation.

§11.4.7 Execution #

Execution is a two-layer check:

• Mode execute bit — prerequisite. "This file is a program." Set by package managers and chmod +x. Applies only to execve / execveat, not to mmap(PROT_EXEC).
• SD FILE_EXECUTE — access control. "This principal may execute this file." Gates both execve and mmap(PROT_EXEC).

For execve: both +x AND FILE_EXECUTE MUST be true. For mmap(PROT_EXEC): only FILE_EXECUTE is checked.

For fd-based exec (execveat with AT_EMPTY_PATH) in v0.20, a live AccessCheck for FILE_EXECUTE is performed on the re-opened file. O_PATH fds use the same live AccessCheck. Future versions will check the fd's cached granted mask directly (snapshot mode).