landlock: Add counted_by in landlock_domain

For a domain, this array stores the access masks for each layer (of
which there are num_layers of them).  This annotation serves as useful
documentation.

Signed-off-by: Tingmao Wang <[email protected]>
Reviewed-by: Günther Noack <[email protected]>
Link: https://patch.msgid.link/[email protected]
[mic: Rebase on the ruleset/domain split, and update commit message]
Signed-off-by: Mickaël Salaün <[email protected]>

security/landlock/domain.h

@@ -243,7 +243,8 @@ struct landlock_domain {
 			 * overlapping access rights.  These layers are set once
 			 * and never changed for the lifetime of the domain.
 			 */
-			struct access_masks handled_masks[];
+			struct access_masks
+				handled_masks[] __counted_by(num_layers);
 		};
 	};
 };