sphinx.addnodesdocument)}( rawsourcechildren]( translations LanguagesNode)}(hhh](h pending_xref)}(hhh]docutils.nodesTextChinese (Simplified)}parenthsba attributes}(ids]classes]names]dupnames]backrefs] refdomainstdreftypedoc reftarget,/translations/zh_CN/admin-guide/LSM/landlockmodnameN classnameN refexplicitutagnamehhh ubh)}(hhh]hChinese (Traditional)}hh2sbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget,/translations/zh_TW/admin-guide/LSM/landlockmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hItalian}hhFsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget,/translations/it_IT/admin-guide/LSM/landlockmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hJapanese}hhZsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget,/translations/ja_JP/admin-guide/LSM/landlockmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hKorean}hhnsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget,/translations/ko_KR/admin-guide/LSM/landlockmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hPortuguese (Brazilian)}hhsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget,/translations/pt_BR/admin-guide/LSM/landlockmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hSpanish}hhsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget,/translations/sp_SP/admin-guide/LSM/landlockmodnameN classnameN refexplicituh1hhh ubeh}(h]h ]h"]h$]h&]current_languageEnglishuh1h hh _documenthsourceNlineNubhcomment)}(h SPDX-License-Identifier: GPL-2.0h]h SPDX-License-Identifier: GPL-2.0}hhsbah}(h]h ]h"]h$]h&] xml:spacepreserveuh1hhhhhhF/var/lib/git/docbuild/linux/Documentation/admin-guide/LSM/landlock.rsthKubh)}(h'Copyright © 2025 Microsoft Corporationh]h'Copyright © 2025 Microsoft Corporation}hhsbah}(h]h ]h"]h$]h&]hhuh1hhhhhhhhKubh)}(h"Copyright © 2026 Cloudflare, Inc.h]h"Copyright © 2026 Cloudflare, Inc.}hhsbah}(h]h ]h"]h$]h&]hhuh1hhhhhhhhKubhsection)}(hhh](htitle)}(h Landlock: system-wide managementh]h Landlock: system-wide management}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhhhhhKubh field_list)}(hhh](hfield)}(hhh](h field_name)}(hAuthorh]hAuthor}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjhhhKubh field_body)}(hMickaël Salaünh]h paragraph)}(hjh]hMickaël Salaün}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK hjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1hhhhK hhhhubh)}(hhh](j)}(hDateh]hDate}(hj7hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj4hhhKubj)}(h October 2026 h]j)}(h October 2026h]h October 2026}(hjIhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK hjEubah}(h]h ]h"]h$]h&]uh1jhj4ubeh}(h]h ]h"]h$]h&]uh1hhhhK hhhhubeh}(h]h ]h"]h$]h&]uh1hhhhhhhhK ubj)}(h8Landlock can leverage the audit framework to log events.h]h8Landlock can leverage the audit framework to log events.}(hjihhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK hhhhubj)}(hUUser space documentation can be found here: Documentation/userspace-api/landlock.rst.h]hUUser space documentation can be found here: Documentation/userspace-api/landlock.rst.}(hjwhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhKhhhhubh)}(hhh](h)}(hAudith]hAudit}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKubj)}(hXnDenied access requests are logged by default for a sandboxed program if `audit` is enabled. This default behavior can be changed with the sys_landlock_restrict_self() flags (cf. Documentation/userspace-api/landlock.rst), suppressed on a per-object basis by using ``LANDLOCK_ADD_RULE_QUIET`` (ABI 10+), or suppressed for specific capability or namespace members with the corresponding permission rule's ``quiet_*`` field (ABI 12+). Quiet rules only suppress audit submission; they do not suppress denial trace events. Landlock logs can also be masked thanks to audit rules. Landlock can generate two audit record types.h](hHDenied access requests are logged by default for a sandboxed program if }(hjhhhNhNubhtitle_reference)}(h`audit`h]haudit}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh is enabled. This default behavior can be changed with the sys_landlock_restrict_self() flags (cf. Documentation/userspace-api/landlock.rst), suppressed on a per-object basis by using }(hjhhhNhNubhliteral)}(h``LANDLOCK_ADD_RULE_QUIET``h]hLANDLOCK_ADD_RULE_QUIET}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhr (ABI 10+), or suppressed for specific capability or namespace members with the corresponding permission rule’s }(hjhhhNhNubj)}(h ``quiet_*``h]hquiet_*}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh field (ABI 12+). Quiet rules only suppress audit submission; they do not suppress denial trace events. Landlock logs can also be masked thanks to audit rules. Landlock can generate two audit record types.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKhjhhubh)}(hhh](h)}(h Record typesh]h Record types}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKubhdefinition_list)}(hhh](hdefinition_list_item)}(hX{ AUDIT_LANDLOCK_ACCESS This record type identifies a denied access request to a kernel resource. The ``domain`` field indicates the ID of the domain that blocked the request. The ``blockers`` field indicates the cause(s) of this denial (separated by a comma), and the following fields identify the kernel object (similar to SELinux). There may be more than one of this record type per audit event. Example with a file link request generating two records in the same event:: domain=195ba459b blockers=fs.refer path="/usr/bin" dev="vda2" ino=351 domain=195ba459b blockers=fs.make_reg,fs.refer path="/usr/local" dev="vda2" ino=365 The ``blockers`` field uses dot-separated prefixes to indicate the type of restriction that caused the denial: **fs.*** - Filesystem access rights (ABI 1+): - fs.execute, fs.write_file, fs.read_file, fs.read_dir - fs.remove_dir, fs.remove_file - fs.make_char, fs.make_dir, fs.make_reg, fs.make_sock - fs.make_fifo, fs.make_block, fs.make_sym - fs.refer (ABI 2+) - fs.truncate (ABI 3+) - fs.ioctl_dev (ABI 5+) - fs.resolve_unix (ABI 9+) **net.*** - Network access rights (ABI 4+): - net.bind_tcp - TCP port binding was denied - net.connect_tcp - TCP connection was denied - net.bind_udp - UDP port binding was denied - net.connect_send_udp - UDP connection and send was denied **scope.*** - IPC scoping restrictions (ABI 6+): - scope.abstract_unix_socket - Abstract UNIX socket connection denied - scope.signal - Signal sending denied **namespace.*** - Namespace restrictions (ABI 12+): - namespace.use - Namespace use was denied (creation via :manpage:`unshare(2)`, :manpage:`clone(2)`, :manpage:`clone3(2)`, :manpage:`open_tree(2)`, or :manpage:`fsmount(2)`, or joining via :manpage:`setns(2)`); ``namespace_type`` indicates the type (hex ``CLONE_NEW*`` bitmask), and ``namespace_id`` identifies the target namespace for :manpage:`setns(2)` operations (zero for creation) **capability.*** - Capability restrictions (ABI 12+): - capability.use - Capability use was denied; ``capability`` indicates the capability number Multiple blockers can appear in a single event (comma-separated) when multiple access rights are missing. For example, creating a regular file in a directory that lacks both ``make_reg`` and ``refer`` rights would show ``blockers=fs.make_reg,fs.refer``. The object identification fields depend on the type of access being blocked: ``path``, ``dev``, ``ino`` for filesystem; ``opid``, ``ocomm`` for signals; ``namespace_type`` and ``namespace_id`` for namespace operations; ``capability`` for capability use. h](hterm)}(hAUDIT_LANDLOCK_ACCESSh]hAUDIT_LANDLOCK_ACCESS}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK\hjubh definition)}(hhh](j)}(hXxThis record type identifies a denied access request to a kernel resource. The ``domain`` field indicates the ID of the domain that blocked the request. The ``blockers`` field indicates the cause(s) of this denial (separated by a comma), and the following fields identify the kernel object (similar to SELinux). There may be more than one of this record type per audit event.h](hNThis record type identifies a denied access request to a kernel resource. The }(hjhhhNhNubj)}(h ``domain``h]hdomain}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhE field indicates the ID of the domain that blocked the request. The }(hjhhhNhNubj)}(h ``blockers``h]hblockers}(hj)hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh field indicates the cause(s) of this denial (separated by a comma), and the following fields identify the kernel object (similar to SELinux). There may be more than one of this record type per audit event.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhK"hj ubj)}(hKExample with a file link request generating two records in the same event::h]hJExample with a file link request generating two records in the same event:}(hjAhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK)hj ubh literal_block)}(hdomain=195ba459b blockers=fs.refer path="/usr/bin" dev="vda2" ino=351 domain=195ba459b blockers=fs.make_reg,fs.refer path="/usr/local" dev="vda2" ino=365h]hdomain=195ba459b blockers=fs.refer path="/usr/bin" dev="vda2" ino=351 domain=195ba459b blockers=fs.make_reg,fs.refer path="/usr/local" dev="vda2" ino=365}hjQsbah}(h]h ]h"]h$]h&]hhuh1jOhhhK+hj ubj)}(hnThe ``blockers`` field uses dot-separated prefixes to indicate the type of restriction that caused the denial:h](hThe }(hj_hhhNhNubj)}(h ``blockers``h]hblockers}(hjghhhNhNubah}(h]h ]h"]h$]h&]uh1jhj_ubh^ field uses dot-separated prefixes to indicate the type of restriction that caused the denial:}(hj_hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhK/hj ubj)}(hhh](j)}(hXE**fs.*** - Filesystem access rights (ABI 1+): - fs.execute, fs.write_file, fs.read_file, fs.read_dir - fs.remove_dir, fs.remove_file - fs.make_char, fs.make_dir, fs.make_reg, fs.make_sock - fs.make_fifo, fs.make_block, fs.make_sym - fs.refer (ABI 2+) - fs.truncate (ABI 3+) - fs.ioctl_dev (ABI 5+) - fs.resolve_unix (ABI 9+) h](j)}(h-**fs.*** - Filesystem access rights (ABI 1+):h](hstrong)}(h**fs.***h]hfs.*}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh% - Filesystem access rights (ABI 1+):}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhK:hjubj )}(hhh]h bullet_list)}(hhh](h list_item)}(h4fs.execute, fs.write_file, fs.read_file, fs.read_dirh]j)}(hjh]h4fs.execute, fs.write_file, fs.read_file, fs.read_dir}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK3hjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hfs.remove_dir, fs.remove_fileh]j)}(hjh]hfs.remove_dir, fs.remove_file}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK4hjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(h4fs.make_char, fs.make_dir, fs.make_reg, fs.make_sockh]j)}(hjh]h4fs.make_char, fs.make_dir, fs.make_reg, fs.make_sock}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK5hjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(h(fs.make_fifo, fs.make_block, fs.make_symh]j)}(hjh]h(fs.make_fifo, fs.make_block, fs.make_sym}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK6hjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hfs.refer (ABI 2+)h]j)}(hj h]hfs.refer (ABI 2+)}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK7hj ubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hfs.truncate (ABI 3+)h]j)}(hj#h]hfs.truncate (ABI 3+)}(hj%hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK8hj!ubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hfs.ioctl_dev (ABI 5+)h]j)}(hj:h]hfs.ioctl_dev (ABI 5+)}(hj<hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK9hj8ubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hfs.resolve_unix (ABI 9+) h]j)}(hfs.resolve_unix (ABI 9+)h]hfs.resolve_unix (ABI 9+)}(hjShhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK:hjOubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]bullet-uh1jhhhK3hjubah}(h]h ]h"]h$]h&]uh1j hjubeh}(h]h ]h"]h$]h&]uh1jhhhK:hjubj)}(h**net.*** - Network access rights (ABI 4+): - net.bind_tcp - TCP port binding was denied - net.connect_tcp - TCP connection was denied - net.bind_udp - UDP port binding was denied - net.connect_send_udp - UDP connection and send was denied h](j)}(h+**net.*** - Network access rights (ABI 4+):h](j)}(h **net.***h]hnet.*}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh" - Network access rights (ABI 4+):}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhK@hj{ubj )}(hhh]j)}(hhh](j)}(h*net.bind_tcp - TCP port binding was deniedh]j)}(hjh]h*net.bind_tcp - TCP port binding was denied}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK=hjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(h+net.connect_tcp - TCP connection was deniedh]j)}(hjh]h+net.connect_tcp - TCP connection was denied}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK>hjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(h*net.bind_udp - UDP port binding was deniedh]j)}(hjh]h*net.bind_udp - UDP port binding was denied}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK?hjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(h:net.connect_send_udp - UDP connection and send was denied h]j)}(h9net.connect_send_udp - UDP connection and send was deniedh]h9net.connect_send_udp - UDP connection and send was denied}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK@hjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]jmjnuh1jhhhK=hjubah}(h]h ]h"]h$]h&]uh1j hj{ubeh}(h]h ]h"]h$]h&]uh1jhhhK@hjubj)}(h**scope.*** - IPC scoping restrictions (ABI 6+): - scope.abstract_unix_socket - Abstract UNIX socket connection denied - scope.signal - Signal sending denied h](j)}(h0**scope.*** - IPC scoping restrictions (ABI 6+):h](j)}(h **scope.***h]hscope.*}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh% - IPC scoping restrictions (ABI 6+):}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKDhjubj )}(hhh]j)}(hhh](j)}(hCscope.abstract_unix_socket - Abstract UNIX socket connection deniedh]j)}(hj8h]hCscope.abstract_unix_socket - Abstract UNIX socket connection denied}(hj:hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhKChj6ubah}(h]h ]h"]h$]h&]uh1jhj3ubj)}(h%scope.signal - Signal sending denied h]j)}(h$scope.signal - Signal sending deniedh]h$scope.signal - Signal sending denied}(hjQhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhKDhjMubah}(h]h ]h"]h$]h&]uh1jhj3ubeh}(h]h ]h"]h$]h&]jmjnuh1jhhhKChj0ubah}(h]h ]h"]h$]h&]uh1j hjubeh}(h]h ]h"]h$]h&]uh1jhhhKDhjubj)}(hX**namespace.*** - Namespace restrictions (ABI 12+): - namespace.use - Namespace use was denied (creation via :manpage:`unshare(2)`, :manpage:`clone(2)`, :manpage:`clone3(2)`, :manpage:`open_tree(2)`, or :manpage:`fsmount(2)`, or joining via :manpage:`setns(2)`); ``namespace_type`` indicates the type (hex ``CLONE_NEW*`` bitmask), and ``namespace_id`` identifies the target namespace for :manpage:`setns(2)` operations (zero for creation) h](j)}(h3**namespace.*** - Namespace restrictions (ABI 12+):h](j)}(h**namespace.***h]h namespace.*}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj{ubh$ - Namespace restrictions (ABI 12+):}(hj{hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKMhjwubj )}(hhh]j)}(hhh]j)}(hXnamespace.use - Namespace use was denied (creation via :manpage:`unshare(2)`, :manpage:`clone(2)`, :manpage:`clone3(2)`, :manpage:`open_tree(2)`, or :manpage:`fsmount(2)`, or joining via :manpage:`setns(2)`); ``namespace_type`` indicates the type (hex ``CLONE_NEW*`` bitmask), and ``namespace_id`` identifies the target namespace for :manpage:`setns(2)` operations (zero for creation) h]j)}(hXnamespace.use - Namespace use was denied (creation via :manpage:`unshare(2)`, :manpage:`clone(2)`, :manpage:`clone3(2)`, :manpage:`open_tree(2)`, or :manpage:`fsmount(2)`, or joining via :manpage:`setns(2)`); ``namespace_type`` indicates the type (hex ``CLONE_NEW*`` bitmask), and ``namespace_id`` identifies the target namespace for :manpage:`setns(2)` operations (zero for creation)h](h7namespace.use - Namespace use was denied (creation via }(hjhhhNhNubhmanpage)}(h:manpage:`unshare(2)`h]h unshare(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhƌpath unshare(2)pageunsharesection2uh1jhjubh, }(hjhhhNhNubj)}(h:manpage:`clone(2)`h]hclone(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhjclone(2)jclonejjuh1jhjubh, }hjsbj)}(h:manpage:`clone3(2)`h]h clone3(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj clone3(2)jclone3jjuh1jhjubh, }(hjhhhNhNubj)}(h:manpage:`open_tree(2)`h]h open_tree(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj open_tree(2)j open_treejjuh1jhjubh, or }(hjhhhNhNubj)}(h:manpage:`fsmount(2)`h]h fsmount(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj fsmount(2)jfsmountjjuh1jhjubh, or joining via }(hjhhhNhNubj)}(h:manpage:`setns(2)`h]hsetns(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhjsetns(2)jsetnsjjuh1jhjubh); }(hjhhhNhNubj)}(h``namespace_type``h]hnamespace_type}(hj'hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh indicates the type (hex }(hjhhhNhNubj)}(h``CLONE_NEW*``h]h CLONE_NEW*}(hj9hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh bitmask), and }(hjhhhNhNubj)}(h``namespace_id``h]h namespace_id}(hjKhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh% identifies the target namespace for }(hjhhhNhNubj)}(h:manpage:`setns(2)`h]hsetns(2)}(hj]hhhNhNubah}(h]h ]jah"]h$]h&]hhjsetns(2)jsetnsjjuh1jhjubh operations (zero for creation)}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKGhjubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]jmjnuh1jhhhKGhjubah}(h]h ]h"]h$]h&]uh1j hjwubeh}(h]h ]h"]h$]h&]uh1jhhhKMhjubj)}(h**capability.*** - Capability restrictions (ABI 12+): - capability.use - Capability use was denied; ``capability`` indicates the capability number h](j)}(h5**capability.*** - Capability restrictions (ABI 12+):h](j)}(h**capability.***h]h capability.*}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh% - Capability restrictions (ABI 12+):}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKQhjubj )}(hhh]j)}(hhh]j)}(h[capability.use - Capability use was denied; ``capability`` indicates the capability number h]j)}(hZcapability.use - Capability use was denied; ``capability`` indicates the capability numberh](h,capability.use - Capability use was denied; }(hjhhhNhNubj)}(h``capability``h]h capability}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh indicates the capability number}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKPhjubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]jmjnuh1jhhhKPhjubah}(h]h ]h"]h$]h&]uh1j hjubeh}(h]h ]h"]h$]h&]uh1jhhhKQhjubeh}(h]h ]h"]h$]h&]uh1jhj ubj)}(hMultiple blockers can appear in a single event (comma-separated) when multiple access rights are missing. For example, creating a regular file in a directory that lacks both ``make_reg`` and ``refer`` rights would show ``blockers=fs.make_reg,fs.refer``.h](hMultiple blockers can appear in a single event (comma-separated) when multiple access rights are missing. For example, creating a regular file in a directory that lacks both }(hjhhhNhNubj)}(h ``make_reg``h]hmake_reg}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh and }(hjhhhNhNubj)}(h ``refer``h]hrefer}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh rights would show }(hjhhhNhNubj)}(h!``blockers=fs.make_reg,fs.refer``h]hblockers=fs.make_reg,fs.refer}(hj#hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKShj ubj)}(hThe object identification fields depend on the type of access being blocked: ``path``, ``dev``, ``ino`` for filesystem; ``opid``, ``ocomm`` for signals; ``namespace_type`` and ``namespace_id`` for namespace operations; ``capability`` for capability use.h](hMThe object identification fields depend on the type of access being blocked: }(hj;hhhNhNubj)}(h``path``h]hpath}(hjChhhNhNubah}(h]h ]h"]h$]h&]uh1jhj;ubh, }(hj;hhhNhNubj)}(h``dev``h]hdev}(hjUhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj;ubh, }hj;sbj)}(h``ino``h]hino}(hjghhhNhNubah}(h]h ]h"]h$]h&]uh1jhj;ubh for filesystem; }(hj;hhhNhNubj)}(h``opid``h]hopid}(hjyhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj;ubh, }hj;sbj)}(h ``ocomm``h]hocomm}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj;ubh for signals; }(hj;hhhNhNubj)}(h``namespace_type``h]hnamespace_type}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj;ubh and }(hj;hhhNhNubj)}(h``namespace_id``h]h namespace_id}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj;ubh for namespace operations; }(hj;hhhNhNubj)}(h``capability``h]h capability}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj;ubh for capability use.}(hj;hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKXhj ubeh}(h]h ]h"]h$]h&]uh1j hjubeh}(h]h ]h"]h$]h&]uh1jhhhK\hjubj)}(hXAUDIT_LANDLOCK_DOMAIN This record type describes the status of a Landlock domain. The ``status`` field can be either ``allocated`` or ``deallocated``. The ``allocated`` status is part of the same audit event and follows the first logged ``AUDIT_LANDLOCK_ACCESS`` record of a domain. It identifies Landlock domain information at the time of the sys_landlock_restrict_self() call with the following fields: - the ``domain`` ID - the enforcement ``mode`` - the domain creator's ``pid`` - the domain creator's ``uid`` - the domain creator's executable path (``exe``) - the domain creator's command line (``comm``) Example:: domain=195ba459b status=allocated mode=enforcing pid=300 uid=0 exe="/root/sandboxer" comm="sandboxer" The ``deallocated`` status is an event on its own and it identifies a Landlock domain release. After such event, it is guarantee that the related domain ID will never be reused during the lifetime of the system. The ``domain`` field indicates the ID of the domain which is released, and the ``denials`` field indicates the total number of denied access request, which might not have been logged according to the audit rules and sys_landlock_restrict_self()'s flags. Example:: domain=195ba459b status=deallocated denials=3 h](j)}(hAUDIT_LANDLOCK_DOMAINh]hAUDIT_LANDLOCK_DOMAIN}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK}hjubj )}(hhh](j)}(hThis record type describes the status of a Landlock domain. The ``status`` field can be either ``allocated`` or ``deallocated``.h](hAThis record type describes the status of a Landlock domain. The }(hjhhhNhNubj)}(h ``status``h]hstatus}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh field can be either }(hjhhhNhNubj)}(h ``allocated``h]h allocated}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh or }(hjhhhNhNubj)}(h``deallocated``h]h deallocated}(hj&hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhK_hjubj)}(hThe ``allocated`` status is part of the same audit event and follows the first logged ``AUDIT_LANDLOCK_ACCESS`` record of a domain. It identifies Landlock domain information at the time of the sys_landlock_restrict_self() call with the following fields:h](hThe }(hj>hhhNhNubj)}(h ``allocated``h]h allocated}(hjFhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj>ubhE status is part of the same audit event and follows the first logged }(hj>hhhNhNubj)}(h``AUDIT_LANDLOCK_ACCESS``h]hAUDIT_LANDLOCK_ACCESS}(hjXhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj>ubh record of a domain. It identifies Landlock domain information at the time of the sys_landlock_restrict_self() call with the following fields:}(hj>hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKbhjubj)}(hhh](j)}(hthe ``domain`` IDh]j)}(hjuh](hthe }(hjwhhhNhNubj)}(h ``domain``h]hdomain}(hj~hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjwubh ID}(hjwhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKghjsubah}(h]h ]h"]h$]h&]uh1jhjpubj)}(hthe enforcement ``mode``h]j)}(hjh](hthe enforcement }(hjhhhNhNubj)}(h``mode``h]hmode}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhhhKhhjubah}(h]h ]h"]h$]h&]uh1jhjpubj)}(hthe domain creator's ``pid``h]j)}(hjh](hthe domain creator’s }(hjhhhNhNubj)}(h``pid``h]hpid}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhhhKihjubah}(h]h ]h"]h$]h&]uh1jhjpubj)}(hthe domain creator's ``uid``h]j)}(hjh](hthe domain creator’s }(hjhhhNhNubj)}(h``uid``h]huid}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhhhKjhjubah}(h]h ]h"]h$]h&]uh1jhjpubj)}(h.the domain creator's executable path (``exe``)h]j)}(hj h](h(the domain creator’s executable path (}(hjhhhNhNubj)}(h``exe``h]hexe}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh)}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKkhj ubah}(h]h ]h"]h$]h&]uh1jhjpubj)}(h-the domain creator's command line (``comm``) h]j)}(h,the domain creator's command line (``comm``)h](h%the domain creator’s command line (}(hj8hhhNhNubj)}(h``comm``h]hcomm}(hj@hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj8ubh)}(hj8hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKlhj4ubah}(h]h ]h"]h$]h&]uh1jhjpubeh}(h]h ]h"]h$]h&]jmjnuh1jhhhKghjubj)}(h Example::h]hExample:}(hjdhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhKnhjubjP)}(hedomain=195ba459b status=allocated mode=enforcing pid=300 uid=0 exe="/root/sandboxer" comm="sandboxer"h]hedomain=195ba459b status=allocated mode=enforcing pid=300 uid=0 exe="/root/sandboxer" comm="sandboxer"}hjrsbah}(h]h ]h"]h$]h&]hhuh1jOhhhKphjubj)}(hXThe ``deallocated`` status is an event on its own and it identifies a Landlock domain release. After such event, it is guarantee that the related domain ID will never be reused during the lifetime of the system. The ``domain`` field indicates the ID of the domain which is released, and the ``denials`` field indicates the total number of denied access request, which might not have been logged according to the audit rules and sys_landlock_restrict_self()'s flags.h](hThe }(hjhhhNhNubj)}(h``deallocated``h]h deallocated}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh status is an event on its own and it identifies a Landlock domain release. After such event, it is guarantee that the related domain ID will never be reused during the lifetime of the system. The }(hjhhhNhNubj)}(h ``domain``h]hdomain}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhA field indicates the ID of the domain which is released, and the }(hjhhhNhNubj)}(h ``denials``h]hdenials}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh field indicates the total number of denied access request, which might not have been logged according to the audit rules and sys_landlock_restrict_self()’s flags.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKrhjubj)}(h Example::h]hExample:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhKzhjubjP)}(h-domain=195ba459b status=deallocated denials=3h]h-domain=195ba459b status=deallocated denials=3}hjsbah}(h]h ]h"]h$]h&]hhuh1jOhhhK|hjubeh}(h]h ]h"]h$]h&]uh1j hjubeh}(h]h ]h"]h$]h&]uh1jhhhK}hjhhubeh}(h]h ]h"]h$]h&]uh1jhjhhhhhNubeh}(h] record-typesah ]h"] record typesah$]h&]uh1hhjhhhhhKubh)}(hhh](h)}(h Event samplesh]h Event samples}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKubj)}(h9Here are two examples of log events (see serial numbers).h]h9Here are two examples of log events (see serial numbers).}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhKhjhhubj)}(hIn this example a sandboxed program (``kill``) tries to send a signal to the init process, which is denied because of the signal scoping restriction (``LL_SCOPED=s``)::h](h%In this example a sandboxed program (}(hj hhhNhNubj)}(h``kill``h]hkill}(hj! hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubhi) tries to send a signal to the init process, which is denied because of the signal scoping restriction (}(hj hhhNhNubj)}(h``LL_SCOPED=s``h]h LL_SCOPED=s}(hj3 hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubh):}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKhjhhubjP)}(hE$ LL_FS_RO=/ LL_FS_RW=/ LL_SCOPED=s LL_FORCE_LOG=1 ./sandboxer kill 1h]hE$ LL_FS_RO=/ LL_FS_RW=/ LL_SCOPED=s LL_FORCE_LOG=1 ./sandboxer kill 1}hjK sbah}(h]h ]h"]h$]h&]hhuh1jOhhhKhjhhubj)}(hXThis command generates two events, each identified with a unique serial number following a timestamp (``msg=audit(1729738800.268:30)``). The first event (serial ``30``) contains 4 records. The first record (``type=LANDLOCK_ACCESS``) shows an access denied by the domain `1a6fdc66f`. The cause of this denial is signal scoping restriction (``blockers=scope.signal``). The process that would have receive this signal is the init process (``opid=1 ocomm="systemd"``).h](hfThis command generates two events, each identified with a unique serial number following a timestamp (}(hjY hhhNhNubj)}(h ``msg=audit(1729738800.268:30)``h]hmsg=audit(1729738800.268:30)}(hja hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjY ubh). The first event (serial }(hjY hhhNhNubj)}(h``30``h]h30}(hjs hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjY ubh)) contains 4 records. The first record (}(hjY hhhNhNubj)}(h``type=LANDLOCK_ACCESS``h]htype=LANDLOCK_ACCESS}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjY ubh') shows an access denied by the domain }(hjY hhhNhNubj)}(h `1a6fdc66f`h]h 1a6fdc66f}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjY ubh:. The cause of this denial is signal scoping restriction (}(hjY hhhNhNubj)}(h``blockers=scope.signal``h]hblockers=scope.signal}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjY ubhI). The process that would have receive this signal is the init process (}(hjY hhhNhNubj)}(h``opid=1 ocomm="systemd"``h]hopid=1 ocomm="systemd"}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjY ubh).}(hjY hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKhjhhubj)}(hThe second record (``type=LANDLOCK_DOMAIN``) describes (``status=allocated``) domain `1a6fdc66f`. This domain was created by process ``286`` executing the ``/root/sandboxer`` program launched by the root user.h](hThe second record (}(hj hhhNhNubj)}(h``type=LANDLOCK_DOMAIN``h]htype=LANDLOCK_DOMAIN}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubh ) describes (}(hj hhhNhNubj)}(h``status=allocated``h]hstatus=allocated}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubh ) domain }(hj hhhNhNubj)}(h `1a6fdc66f`h]h 1a6fdc66f}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubh&. This domain was created by process }(hj hhhNhNubj)}(h``286``h]h286}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubh executing the }(hj hhhNhNubj)}(h``/root/sandboxer``h]h/root/sandboxer}(hj# hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubh# program launched by the root user.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKhjhhubj)}(hThe third record (``type=SYSCALL``) describes the syscall, its provided arguments, its result (``success=no exit=-1``), and the process that called it.h](hThe third record (}(hj; hhhNhNubj)}(h``type=SYSCALL``h]h type=SYSCALL}(hjC hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj; ubh=) describes the syscall, its provided arguments, its result (}(hj; hhhNhNubj)}(h``success=no exit=-1``h]hsuccess=no exit=-1}(hjU hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj; ubh"), and the process that called it.}(hj; hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKhjhhubj)}(hThe fourth record (``type=PROCTITLE``) shows the command's name as an hexadecimal value. This can be translated with ``python -c 'print(bytes.fromhex("6B696C6C0031"))'``.h](hThe fourth record (}(hjm hhhNhNubj)}(h``type=PROCTITLE``h]htype=PROCTITLE}(hju hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjm ubhS) shows the command’s name as an hexadecimal value. This can be translated with }(hjm hhhNhNubj)}(h4``python -c 'print(bytes.fromhex("6B696C6C0031"))'``h]h0python -c 'print(bytes.fromhex("6B696C6C0031"))'}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjm ubh.}(hjm hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKhjhhubj)}(hXFinally, the last record (``type=LANDLOCK_DOMAIN``) is also the only one from the second event (serial ``31``). It is not tied to a direct user space action but an asynchronous one to free resources tied to a Landlock domain (``status=deallocated``). This can be useful to know that the following logs will not concern the domain ``1a6fdc66f`` anymore. This record also summarize the number of requests this domain denied (``denials=1``), whether they were logged or not.h](hFinally, the last record (}(hj hhhNhNubj)}(h``type=LANDLOCK_DOMAIN``h]htype=LANDLOCK_DOMAIN}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubh5) is also the only one from the second event (serial }(hj hhhNhNubj)}(h``31``h]h31}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubhv). It is not tied to a direct user space action but an asynchronous one to free resources tied to a Landlock domain (}(hj hhhNhNubj)}(h``status=deallocated``h]hstatus=deallocated}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubhS). This can be useful to know that the following logs will not concern the domain }(hj hhhNhNubj)}(h ``1a6fdc66f``h]h 1a6fdc66f}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubhQ anymore. This record also summarize the number of requests this domain denied (}(hj hhhNhNubj)}(h ``denials=1``h]h denials=1}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubh#), whether they were logged or not.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKhjhhubjP)}(hXFtype=LANDLOCK_ACCESS msg=audit(1729738800.268:30): domain=1a6fdc66f blockers=scope.signal opid=1 ocomm="systemd" type=LANDLOCK_DOMAIN msg=audit(1729738800.268:30): domain=1a6fdc66f status=allocated mode=enforcing pid=286 uid=0 exe="/root/sandboxer" comm="sandboxer" type=SYSCALL msg=audit(1729738800.268:30): arch=c000003e syscall=62 success=no exit=-1 [..] ppid=272 pid=286 auid=0 uid=0 gid=0 [...] comm="kill" [...] type=PROCTITLE msg=audit(1729738800.268:30): proctitle=6B696C6C0031 type=LANDLOCK_DOMAIN msg=audit(1729738800.324:31): domain=1a6fdc66f status=deallocated denials=1h]hXFtype=LANDLOCK_ACCESS msg=audit(1729738800.268:30): domain=1a6fdc66f blockers=scope.signal opid=1 ocomm="systemd" type=LANDLOCK_DOMAIN msg=audit(1729738800.268:30): domain=1a6fdc66f status=allocated mode=enforcing pid=286 uid=0 exe="/root/sandboxer" comm="sandboxer" type=SYSCALL msg=audit(1729738800.268:30): arch=c000003e syscall=62 success=no exit=-1 [..] ppid=272 pid=286 auid=0 uid=0 gid=0 [...] comm="kill" [...] type=PROCTITLE msg=audit(1729738800.268:30): proctitle=6B696C6C0031 type=LANDLOCK_DOMAIN msg=audit(1729738800.324:31): domain=1a6fdc66f status=deallocated denials=1}hj sbah}(h]h ]h"]h$]h&]hhƌforcelanguagenonehighlight_args}uh1jOhhhKhjhhubj)}(h>Here is another example showcasing filesystem access control::h]h=Here is another example showcasing filesystem access control:}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhKhjhhubjP)}(hP$ LL_FS_RO=/ LL_FS_RW=/tmp LL_FORCE_LOG=1 ./sandboxer sh -c "echo > /etc/passwd"h]hP$ LL_FS_RO=/ LL_FS_RW=/tmp LL_FORCE_LOG=1 ./sandboxer sh -c "echo > /etc/passwd"}hj( sbah}(h]h ]h"]h$]h&]hhuh1jOhhhKhjhhubj)}(hThe related audit logs contains 8 records from 3 different events (serials 33, 34 and 35) created by the same domain `1a6fdc679`::h](huThe related audit logs contains 8 records from 3 different events (serials 33, 34 and 35) created by the same domain }(hj6 hhhNhNubj)}(h `1a6fdc679`h]h 1a6fdc679}(hj> hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj6 ubh:}(hj6 hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKhjhhubjP)}(hXtype=LANDLOCK_ACCESS msg=audit(1729738800.221:33): domain=1a6fdc679 blockers=fs.write_file path="/dev/tty" dev="devtmpfs" ino=9 type=LANDLOCK_DOMAIN msg=audit(1729738800.221:33): domain=1a6fdc679 status=allocated mode=enforcing pid=289 uid=0 exe="/root/sandboxer" comm="sandboxer" type=SYSCALL msg=audit(1729738800.221:33): arch=c000003e syscall=257 success=no exit=-13 [...] ppid=272 pid=289 auid=0 uid=0 gid=0 [...] comm="sh" [...] type=PROCTITLE msg=audit(1729738800.221:33): proctitle=7368002D63006563686F203E202F6574632F706173737764 type=LANDLOCK_ACCESS msg=audit(1729738800.221:34): domain=1a6fdc679 blockers=fs.write_file path="/etc/passwd" dev="vda2" ino=143821 type=SYSCALL msg=audit(1729738800.221:34): arch=c000003e syscall=257 success=no exit=-13 [...] ppid=272 pid=289 auid=0 uid=0 gid=0 [...] comm="sh" [...] type=PROCTITLE msg=audit(1729738800.221:34): proctitle=7368002D63006563686F203E202F6574632F706173737764 type=LANDLOCK_DOMAIN msg=audit(1729738800.261:35): domain=1a6fdc679 status=deallocated denials=2h]hXtype=LANDLOCK_ACCESS msg=audit(1729738800.221:33): domain=1a6fdc679 blockers=fs.write_file path="/dev/tty" dev="devtmpfs" ino=9 type=LANDLOCK_DOMAIN msg=audit(1729738800.221:33): domain=1a6fdc679 status=allocated mode=enforcing pid=289 uid=0 exe="/root/sandboxer" comm="sandboxer" type=SYSCALL msg=audit(1729738800.221:33): arch=c000003e syscall=257 success=no exit=-13 [...] ppid=272 pid=289 auid=0 uid=0 gid=0 [...] comm="sh" [...] type=PROCTITLE msg=audit(1729738800.221:33): proctitle=7368002D63006563686F203E202F6574632F706173737764 type=LANDLOCK_ACCESS msg=audit(1729738800.221:34): domain=1a6fdc679 blockers=fs.write_file path="/etc/passwd" dev="vda2" ino=143821 type=SYSCALL msg=audit(1729738800.221:34): arch=c000003e syscall=257 success=no exit=-13 [...] ppid=272 pid=289 auid=0 uid=0 gid=0 [...] comm="sh" [...] type=PROCTITLE msg=audit(1729738800.221:34): proctitle=7368002D63006563686F203E202F6574632F706173737764 type=LANDLOCK_DOMAIN msg=audit(1729738800.261:35): domain=1a6fdc679 status=deallocated denials=2}hjV sbah}(h]h ]h"]h$]h&]hhuh1jOhhhKhjhhubeh}(h] event-samplesah ]h"] event samplesah$]h&]uh1hhjhhhhhKubh)}(hhh](h)}(hEvent filteringh]hEvent filtering}(hjo hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjl hhhhhKubj)}(hIf you get spammed with audit logs related to Landlock, this is either an attack attempt or a bug in the security policy. We can put in place some filters to limit noise with two complementary ways:h]hIf you get spammed with audit logs related to Landlock, this is either an attack attempt or a bug in the security policy. We can put in place some filters to limit noise with two complementary ways:}(hj} hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhKhjl hhubj)}(hhh](j)}(hwith sys_landlock_restrict_self()'s flags, ``LANDLOCK_ADD_RULE_QUIET`` (ABI 10+), or the permission rules' per-member ``quiet_*`` fields (ABI 12+) if we can fix the sandboxed programs,h]j)}(hwith sys_landlock_restrict_self()'s flags, ``LANDLOCK_ADD_RULE_QUIET`` (ABI 10+), or the permission rules' per-member ``quiet_*`` fields (ABI 12+) if we can fix the sandboxed programs,h](h-with sys_landlock_restrict_self()’s flags, }(hj hhhNhNubj)}(h``LANDLOCK_ADD_RULE_QUIET``h]hLANDLOCK_ADD_RULE_QUIET}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubh2 (ABI 10+), or the permission rules’ per-member }(hj hhhNhNubj)}(h ``quiet_*``h]hquiet_*}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubh7 fields (ABI 12+) if we can fix the sandboxed programs,}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj hhhhhNubj)}(h2or with audit rules (see :manpage:`auditctl(8)`). h]j)}(h1or with audit rules (see :manpage:`auditctl(8)`).h](hor with audit rules (see }(hj hhhNhNubj)}(h:manpage:`auditctl(8)`h]h auditctl(8)}(hj hhhNhNubah}(h]h ]jah"]h$]h&]hhj auditctl(8)jauditctlj8uh1jhj ubh).}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj hhhhhNubeh}(h]h ]h"]h$]h&]jmjnuh1jhhhKhjl hhubeh}(h]event-filteringah ]h"]event filteringah$]h&]uh1hhjhhhhhKubeh}(h]auditah ]h"]auditah$]h&]uh1hhhhhhhhKubh)}(hhh](h)}(h Tracepointsh]h Tracepoints}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj hhhhhKubj)}(hX8Landlock also provides tracepoints as an alternative to audit for debugging and observability. Tracepoints fire unconditionally, independent of audit configuration, ``audit_enabled``, and domain log flags. This makes them suitable for always-on monitoring with eBPF or for ad-hoc debugging with ``trace-pipe``.h](hLandlock also provides tracepoints as an alternative to audit for debugging and observability. Tracepoints fire unconditionally, independent of audit configuration, }(hj hhhNhNubj)}(h``audit_enabled``h]h audit_enabled}(hj& hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubhr, and domain log flags. This makes them suitable for always-on monitoring with eBPF or for ad-hoc debugging with }(hj hhhNhNubj)}(h``trace-pipe``h]h trace-pipe}(hj8 hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubh.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKhj hhubj)}(hXSee Documentation/trace/events-landlock.rst for the complete event reference: the full event list, how to enable events and read their output, the field formats, the ``check_rule`` interpretation guide, worked event samples, ftrace filtering, and eBPF access.h](hSee Documentation/trace/events-landlock.rst for the complete event reference: the full event list, how to enable events and read their output, the field formats, the }(hjP hhhNhNubj)}(h``check_rule``h]h check_rule}(hjX hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjP ubhO interpretation guide, worked event samples, ftrace filtering, and eBPF access.}(hjP hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKhj hhubhtarget)}(h.. _landlock_observability:h]h}(h]h ]h"]h$]h&]refidlandlock-observabilityuh1jp hKhj hhhhubh)}(hhh](h)}(hWhen to use tracing vs audith]hWhen to use tracing vs audit}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj~ hhhhhKubj)}(h/status`` uses ``PTRACE_MODE_NOAUDIT``, and :manpage:`listxattr(2)` probes ``CAP_SYS_ADMIN`` with ``CAP_OPT_NOAUDIT`` to decide whether to list ``trusted.*`` extended attributes). When NOAUDIT is set, neither audit records nor trace events are emitted, and the denial is not counted in ``denials``. The denial is still enforced. This avoids performance overhead and noise from speculative probes that test permissions without performing an actual access. h]j)}(hX:**NOAUDIT hooks**: Some LSM hooks suppress logging for speculative permission probes (e.g., reading ``/proc//status`` uses ``PTRACE_MODE_NOAUDIT``, and :manpage:`listxattr(2)` probes ``CAP_SYS_ADMIN`` with ``CAP_OPT_NOAUDIT`` to decide whether to list ``trusted.*`` extended attributes). When NOAUDIT is set, neither audit records nor trace events are emitted, and the denial is not counted in ``denials``. The denial is still enforced. This avoids performance overhead and noise from speculative probes that test permissions without performing an actual access.h](j)}(h**NOAUDIT hooks**h]h NOAUDIT hooks}(hjz hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjv ubhS: Some LSM hooks suppress logging for speculative permission probes (e.g., reading }(hjv hhhNhNubj)}(h``/proc//status``h]h/proc//status}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjv ubh uses }(hjv hhhNhNubj)}(h``PTRACE_MODE_NOAUDIT``h]hPTRACE_MODE_NOAUDIT}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjv ubh, and }(hjv hhhNhNubj)}(h:manpage:`listxattr(2)`h]h listxattr(2)}(hj hhhNhNubah}(h]h ]jah"]h$]h&]hhj listxattr(2)j listxattrjjuh1jhjv ubh probes }(hjv hhhNhNubj)}(h``CAP_SYS_ADMIN``h]h CAP_SYS_ADMIN}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjv ubh with }(hjv hhhNhNubj)}(h``CAP_OPT_NOAUDIT``h]hCAP_OPT_NOAUDIT}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjv ubh to decide whether to list }(hjv hhhNhNubj)}(h ``trusted.*``h]h trusted.*}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjv ubh extended attributes). When NOAUDIT is set, neither audit records nor trace events are emitted, and the denial is not counted in }(hjv hhhNhNubj)}(h ``denials``h]hdenials}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjv ubh. The denial is still enforced. This avoids performance overhead and noise from speculative probes that test permissions without performing an actual access.}(hjv hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhMhjr ubah}(h]h ]h"]h$]h&]uh1jhj hhhhhNubj)}(h**Audit rate limiting**: The audit subsystem may silently drop records when the audit queue is full. Trace events are not rate-limited. h]j)}(h**Audit rate limiting**: The audit subsystem may silently drop records when the audit queue is full. Trace events are not rate-limited.h](j)}(h**Audit rate limiting**h]hAudit rate limiting}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhq: The audit subsystem may silently drop records when the audit queue is full. Trace events are not rate-limited.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhMhjubah}(h]h ]h"]h$]h&]uh1jhj hhhhhNubj)}(h{**Tracepoint disabled**: When a trace event is disabled (the default state), the tracepoint is a no-op with zero overhead. h]j)}(hz**Tracepoint disabled**: When a trace event is disabled (the default state), the tracepoint is a no-op with zero overhead.h](j)}(h**Tracepoint disabled**h]hTracepoint disabled}(hjFhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjBubhc: When a trace event is disabled (the default state), the tracepoint is a no-op with zero overhead.}(hjBhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhMhj>ubah}(h]h ]h"]h$]h&]uh1jhj hhhhhNubeh}(h]h ]h"]h$]h&]jmjnuh1jhhhMhj hhubj)}(hXWhen both audit and tracing are active, every denial emits a trace event, and a denial that the domain's log policy selects additionally produces an audit record (subject to the Landlock log flags). The ``denials`` count in ``free_domain`` events is incremented for every denial regardless of the log flags, so it can exceed the number of audit records (which the log flags and audit-side rate-limiting or exclude rules may suppress).h](hWhen both audit and tracing are active, every denial emits a trace event, and a denial that the domain’s log policy selects additionally produces an audit record (subject to the Landlock log flags). The }(hjjhhhNhNubj)}(h ``denials``h]hdenials}(hjrhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjjubh count in }(hjjhhhNhNubj)}(h``free_domain``h]h free_domain}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjjubh events is incremented for every denial regardless of the log flags, so it can exceed the number of audit records (which the log flags and audit-side rate-limiting or exclude rules may suppress).}(hjjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhMhj hhubjq )}(h$.. _landlock_observability_security:h]h}(h]h ]h"]h$]h&]j| landlock-observability-securityuh1jp hMhj hhhhubeh}(h](observability-guarantees-and-limitationsah ]h"](observability guarantees and limitationsah$]h&]uh1hhj hhhhhKubh)}(hhh](h)}(h%Observability security considerationsh]h%Observability security considerations}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhMubj)}(hXBoth audit records and trace events expose information about all Landlock-sandboxed processes on the system, including filesystem paths being accessed, network ports, capability numbers, namespace types and IDs, and process identities. System administrators must ensure that access to audit logs (controlled by the audit subsystem configuration) and to trace events (requiring ``CAP_SYS_ADMIN`` or ``CAP_BPF`` + ``CAP_PERFMON``) is restricted to trusted users.h](hXzBoth audit records and trace events expose information about all Landlock-sandboxed processes on the system, including filesystem paths being accessed, network ports, capability numbers, namespace types and IDs, and process identities. System administrators must ensure that access to audit logs (controlled by the audit subsystem configuration) and to trace events (requiring }(hjhhhNhNubj)}(h``CAP_SYS_ADMIN``h]h CAP_SYS_ADMIN}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh or }(hjhhhNhNubj)}(h ``CAP_BPF``h]hCAP_BPF}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh + }(hjhhhNhNubj)}(h``CAP_PERFMON``h]h CAP_PERFMON}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh!) is restricted to trusted users.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhM!hjhhubj)}(hXeBPF programs attached to Landlock trace events have access to the full kernel context of each event (ruleset rules, domain hierarchy, process credentials) via BTF, exposing sensitive state about every sandboxed process. Restrict this access to trusted users, as for the audit logs.h]hXeBPF programs attached to Landlock trace events have access to the full kernel context of each event (ruleset rules, domain hierarchy, process credentials) via BTF, exposing sensitive state about every sandboxed process. Restrict this access to trusted users, as for the audit logs.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhM*hjhhubj)}(hAudit logs and kernel trace events require elevated privileges and are system-wide; they are not designed for per-sandbox unprivileged monitoring.h]hAudit logs and kernel trace events require elevated privileges and are system-wide; they are not designed for per-sandbox unprivileged monitoring.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhM/hjhhubeh}(h](%observability-security-considerationsjeh ]h"](%observability security considerationslandlock_observability_securityeh$]h&]uh1hhj hhhhhMj }j&jsj }jjsubeh}(h] tracepointsah ]h"] tracepointsah$]h&]uh1hhhhhhhhKubh)}(hhh](h)}(hAdditional documentationh]hAdditional documentation}(hj6hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj3hhhhhM4ubj)}(hhh](j)}(h`Linux Audit Documentation`_h]j)}(hjIh]h reference)}(hjIh]hLinux Audit Documentation}(hjPhhhNhNubah}(h]h ]h"]h$]h&]nameLinux Audit Documentationrefuri7https://github.com/linux-audit/audit-documentation/wikiuh1jNhjKresolvedKubah}(h]h ]h"]h$]h&]uh1jhhhM6hjGubah}(h]h ]h"]h$]h&]uh1jhjDhhhhhNubj)}(h(Documentation/userspace-api/landlock.rsth]j)}(hjph]h(Documentation/userspace-api/landlock.rst}(hjrhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhM7hjnubah}(h]h ]h"]h$]h&]uh1jhjDhhhhhNubj)}(h'Documentation/trace/events-landlock.rsth]j)}(hjh]h'Documentation/trace/events-landlock.rst}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhM8hjubah}(h]h ]h"]h$]h&]uh1jhjDhhhhhNubj)}(h#Documentation/security/landlock.rsth]j)}(hjh]h#Documentation/security/landlock.rst}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhM9hjubah}(h]h ]h"]h$]h&]uh1jhjDhhhhhNubj)}(hhttps://landlock.io h]j)}(hhttps://landlock.ioh]jO)}(hjh]hhttps://landlock.io}(hjhhhNhNubah}(h]h ]h"]h$]h&]refurijuh1jNhjubah}(h]h ]h"]h$]h&]uh1jhhhM:hjubah}(h]h ]h"]h$]h&]uh1jhjDhhhhhNubeh}(h]h ]h"]h$]h&]jm*uh1jhhhM6hj3hhubh)}(hLinksh]hLinks}hjsbah}(h]h ]h"]h$]h&]hhuh1hhj3hhhhhM<ubjq )}(hY.. _Linux Audit Documentation: https://github.com/linux-audit/audit-documentation/wikih]h}(h]linux-audit-documentationah ]h"]linux audit documentationah$]h&]j_j`uh1jp hM=hj3hhhhnj referencedKubeh}(h]additional-documentationah ]h"]additional documentationah$]h&]uh1hhhhhhhhM4ubeh}(h]landlock-system-wide-managementah ]h"] landlock: system-wide managementah$]h&]uh1hhhhhhhhKubeh}(h]h ]h"]h$]h&]sourcehuh1hcurrent_sourceN current_lineNsettingsdocutils.frontendValues)}(hN generatorN datestampN source_linkN source_urlN toc_backlinksentryfootnote_backlinksK sectnum_xformKstrip_commentsNstrip_elements_with_classesN strip_classesN report_levelK halt_levelKexit_status_levelKdebugNwarning_streamN tracebackinput_encoding utf-8-siginput_encoding_error_handlerstrictoutput_encodingutf-8output_encoding_error_handlerj*error_encodingutf-8error_encoding_error_handlerbackslashreplace language_codeenrecord_dependenciesNconfigN id_prefixhauto_id_prefixid dump_settingsNdump_internalsNdump_transformsNdump_pseudo_xmlNexpose_internalsNstrict_visitorN_disable_configN_sourcehnj _destinationN _config_files]7/var/lib/git/docbuild/linux/Documentation/docutils.confafile_insertion_enabled raw_enabledKline_length_limitM'pep_referencesN pep_base_urlhttps://peps.python.org/pep_file_url_templatepep-%04drfc_referencesN rfc_base_url&https://datatracker.ietf.org/doc/html/ tab_widthKtrim_footnote_reference_spacesyntax_highlightlong smart_quotessmartquotes_locales]character_level_inline_markupdoctitle_xform docinfo_xformKsectsubtitle_xform image_loadinglinkembed_stylesheetcloak_email_addressessection_self_linkenvNubreporterNindirect_targets]substitution_defs}substitution_names}refnames}linux audit documentation]jPasrefids}(j} ]jr aj]jaunameids}(jjj j jjji jf j j j0j-j j} j j jjj&jj%j"jjjju nametypes}(jj jji j j0j j jj&j%jjuh}(jhj jjjjf jj jl j-j j} j~ j j~ jj jjj"jjj3jju footnote_refs} citation_refs} autofootnotes]autofootnote_refs]symbol_footnotes]symbol_footnote_refs] footnotes] citations]autofootnote_startKsymbol_footnote_startK id_counter collectionsCounter}Rparse_messages]transform_messages](hsystem_message)}(hhh]j)}(hhh]h