sphinx.addnodesdocument)}( rawsourcechildren]( translations LanguagesNode)}(hhh](h pending_xref)}(hhh]docutils.nodesTextChinese (Simplified)}parenthsba attributes}(ids]classes]names]dupnames]backrefs] refdomainstdreftypedoc reftarget,/translations/zh_CN/admin-guide/LSM/landlockmodnameN classnameN refexplicitutagnamehhh ubh)}(hhh]hChinese (Traditional)}hh2sbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget,/translations/zh_TW/admin-guide/LSM/landlockmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hItalian}hhFsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget,/translations/it_IT/admin-guide/LSM/landlockmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hJapanese}hhZsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget,/translations/ja_JP/admin-guide/LSM/landlockmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hKorean}hhnsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget,/translations/ko_KR/admin-guide/LSM/landlockmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hPortuguese (Brazilian)}hhsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget,/translations/pt_BR/admin-guide/LSM/landlockmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hSpanish}hhsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget,/translations/sp_SP/admin-guide/LSM/landlockmodnameN classnameN refexplicituh1hhh ubeh}(h]h ]h"]h$]h&]current_languageEnglishuh1h hh _documenthsourceNlineNubhcomment)}(h SPDX-License-Identifier: GPL-2.0h]h SPDX-License-Identifier: GPL-2.0}hhsbah}(h]h ]h"]h$]h&] xml:spacepreserveuh1hhhhhhF/var/lib/git/docbuild/linux/Documentation/admin-guide/LSM/landlock.rsthKubh)}(h'Copyright © 2025 Microsoft Corporationh]h'Copyright © 2025 Microsoft Corporation}hhsbah}(h]h ]h"]h$]h&]hhuh1hhhhhhhhKubhsection)}(hhh](htitle)}(h Landlock: system-wide managementh]h Landlock: system-wide management}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhhhhhKubh field_list)}(hhh](hfield)}(hhh](h field_name)}(hAuthorh]hAuthor}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhhhKubh field_body)}(hMickaël Salaünh]h paragraph)}(hj h]hMickaël Salaün}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j hhhKhjubah}(h]h ]h"]h$]h&]uh1jhhubeh}(h]h ]h"]h$]h&]uh1hhhhKhhhhubh)}(hhh](h)}(hDateh]hDate}(hj)hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj&hhhKubj)}(h June 2026 h]j )}(h June 2026h]h June 2026}(hj;hhhNhNubah}(h]h ]h"]h$]h&]uh1j hhhK hj7ubah}(h]h ]h"]h$]h&]uh1jhj&ubeh}(h]h ]h"]h$]h&]uh1hhhhK hhhhubeh}(h]h ]h"]h$]h&]uh1hhhhhhhhKubj )}(h8Landlock can leverage the audit framework to log events.h]h8Landlock can leverage the audit framework to log events.}(hj[hhhNhNubah}(h]h ]h"]h$]h&]uh1j hhhK hhhhubj )}(hUUser space documentation can be found here: Documentation/userspace-api/landlock.rst.h]hUUser space documentation can be found here: Documentation/userspace-api/landlock.rst.}(hjihhhNhNubah}(h]h ]h"]h$]h&]uh1j hhhK hhhhubh)}(hhh](h)}(hAudith]hAudit}(hjzhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjwhhhhhKubj )}(hXDenied access requests are logged by default for a sandboxed program if `audit` is enabled. This default behavior can be changed with the sys_landlock_restrict_self() flags (cf. Documentation/userspace-api/landlock.rst), or suppressed on a per-object basis by using ``LANDLOCK_ADD_RULE_QUIET`` (ABI 10+). Landlock logs can also be masked thanks to audit rules. Landlock can generate 2 audit record types.h](hHDenied access requests are logged by default for a sandboxed program if }(hjhhhNhNubhtitle_reference)}(h`audit`h]haudit}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh is enabled. This default behavior can be changed with the sys_landlock_restrict_self() flags (cf. Documentation/userspace-api/landlock.rst), or suppressed on a per-object basis by using }(hjhhhNhNubhliteral)}(h``LANDLOCK_ADD_RULE_QUIET``h]hLANDLOCK_ADD_RULE_QUIET}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhq (ABI 10+). Landlock logs can also be masked thanks to audit rules. Landlock can generate 2 audit record types.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j hhhKhjwhhubh)}(hhh](h)}(h Record typesh]h Record types}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKubhdefinition_list)}(hhh](hdefinition_list_item)}(hXAUDIT_LANDLOCK_ACCESS This record type identifies a denied access request to a kernel resource. The ``domain`` field indicates the ID of the domain that blocked the request. The ``blockers`` field indicates the cause(s) of this denial (separated by a comma), and the following fields identify the kernel object (similar to SELinux). There may be more than one of this record type per audit event. Example with a file link request generating two records in the same event:: domain=195ba459b blockers=fs.refer path="/usr/bin" dev="vda2" ino=351 domain=195ba459b blockers=fs.make_reg,fs.refer path="/usr/local" dev="vda2" ino=365 The ``blockers`` field uses dot-separated prefixes to indicate the type of restriction that caused the denial: **fs.*** - Filesystem access rights (ABI 1+): - fs.execute, fs.write_file, fs.read_file, fs.read_dir - fs.remove_dir, fs.remove_file - fs.make_char, fs.make_dir, fs.make_reg, fs.make_sock - fs.make_fifo, fs.make_block, fs.make_sym - fs.refer (ABI 2+) - fs.truncate (ABI 3+) - fs.ioctl_dev (ABI 5+) **net.*** - Network access rights (ABI 4+): - net.bind_tcp - TCP port binding was denied - net.connect_tcp - TCP connection was denied - net.bind_udp - UDP port binding was denied - net.connect_send_udp - UDP connection and send was denied **scope.*** - IPC scoping restrictions (ABI 6+): - scope.abstract_unix_socket - Abstract UNIX socket connection denied - scope.signal - Signal sending denied Multiple blockers can appear in a single event (comma-separated) when multiple access rights are missing. For example, creating a regular file in a directory that lacks both ``make_reg`` and ``refer`` rights would show ``blockers=fs.make_reg,fs.refer``. The object identification fields (path, dev, ino for filesystem; opid, ocomm for signals) depend on the type of access being blocked and provide context about what resource was involved in the denial. h](hterm)}(hAUDIT_LANDLOCK_ACCESSh]hAUDIT_LANDLOCK_ACCESS}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhKJhjubh definition)}(hhh](j )}(hXxThis record type identifies a denied access request to a kernel resource. The ``domain`` field indicates the ID of the domain that blocked the request. The ``blockers`` field indicates the cause(s) of this denial (separated by a comma), and the following fields identify the kernel object (similar to SELinux). There may be more than one of this record type per audit event.h](hNThis record type identifies a denied access request to a kernel resource. The }(hjhhhNhNubj)}(h ``domain``h]hdomain}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhE field indicates the ID of the domain that blocked the request. The }(hjhhhNhNubj)}(h ``blockers``h]hblockers}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh field indicates the cause(s) of this denial (separated by a comma), and the following fields identify the kernel object (similar to SELinux). There may be more than one of this record type per audit event.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j hhhKhjubj )}(hKExample with a file link request generating two records in the same event::h]hJExample with a file link request generating two records in the same event:}(hj!hhhNhNubah}(h]h ]h"]h$]h&]uh1j hhhK&hjubh literal_block)}(hdomain=195ba459b blockers=fs.refer path="/usr/bin" dev="vda2" ino=351 domain=195ba459b blockers=fs.make_reg,fs.refer path="/usr/local" dev="vda2" ino=365h]hdomain=195ba459b blockers=fs.refer path="/usr/bin" dev="vda2" ino=351 domain=195ba459b blockers=fs.make_reg,fs.refer path="/usr/local" dev="vda2" ino=365}hj1sbah}(h]h ]h"]h$]h&]hhuh1j/hhhK(hjubj )}(hnThe ``blockers`` field uses dot-separated prefixes to indicate the type of restriction that caused the denial:h](hThe }(hj?hhhNhNubj)}(h ``blockers``h]hblockers}(hjGhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj?ubh^ field uses dot-separated prefixes to indicate the type of restriction that caused the denial:}(hj?hhhNhNubeh}(h]h ]h"]h$]h&]uh1j hhhK,hjubj)}(hhh](j)}(hX***fs.*** - Filesystem access rights (ABI 1+): - fs.execute, fs.write_file, fs.read_file, fs.read_dir - fs.remove_dir, fs.remove_file - fs.make_char, fs.make_dir, fs.make_reg, fs.make_sock - fs.make_fifo, fs.make_block, fs.make_sym - fs.refer (ABI 2+) - fs.truncate (ABI 3+) - fs.ioctl_dev (ABI 5+) h](j)}(h-**fs.*** - Filesystem access rights (ABI 1+):h](hstrong)}(h**fs.***h]hfs.*}(hjlhhhNhNubah}(h]h ]h"]h$]h&]uh1jjhjfubh% - Filesystem access rights (ABI 1+):}(hjfhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhK6hjbubj)}(hhh]h bullet_list)}(hhh](h list_item)}(h4fs.execute, fs.write_file, fs.read_file, fs.read_dirh]j )}(hjh]h4fs.execute, fs.write_file, fs.read_file, fs.read_dir}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j hhhK0hjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hfs.remove_dir, fs.remove_fileh]j )}(hjh]hfs.remove_dir, fs.remove_file}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j hhhK1hjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(h4fs.make_char, fs.make_dir, fs.make_reg, fs.make_sockh]j )}(hjh]h4fs.make_char, fs.make_dir, fs.make_reg, fs.make_sock}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j hhhK2hjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(h(fs.make_fifo, fs.make_block, fs.make_symh]j )}(hjh]h(fs.make_fifo, fs.make_block, fs.make_sym}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j hhhK3hjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hfs.refer (ABI 2+)h]j )}(hjh]hfs.refer (ABI 2+)}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j hhhK4hjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hfs.truncate (ABI 3+)h]j )}(hjh]hfs.truncate (ABI 3+)}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j hhhK5hjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hfs.ioctl_dev (ABI 5+) h]j )}(hfs.ioctl_dev (ABI 5+)h]hfs.ioctl_dev (ABI 5+)}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j hhhK6hjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]bullet-uh1jhhhK0hjubah}(h]h ]h"]h$]h&]uh1jhjbubeh}(h]h ]h"]h$]h&]uh1jhhhK6hj_ubj)}(h**net.*** - Network access rights (ABI 4+): - net.bind_tcp - TCP port binding was denied - net.connect_tcp - TCP connection was denied - net.bind_udp - UDP port binding was denied - net.connect_send_udp - UDP connection and send was denied h](j)}(h+**net.*** - Network access rights (ABI 4+):h](jk)}(h **net.***h]hnet.*}(hjLhhhNhNubah}(h]h ]h"]h$]h&]uh1jjhjHubh" - Network access rights (ABI 4+):}(hjHhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKHere is another example showcasing filesystem access control::h]h=Here is another example showcasing filesystem access control:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j hhhKhjhhubj0)}(hP$ LL_FS_RO=/ LL_FS_RW=/tmp LL_FORCE_LOG=1 ./sandboxer sh -c "echo > /etc/passwd"h]hP$ LL_FS_RO=/ LL_FS_RW=/tmp LL_FORCE_LOG=1 ./sandboxer sh -c "echo > /etc/passwd"}hjsbah}(h]h ]h"]h$]h&]hhuh1j/hhhKhjhhubj )}(hThe related audit logs contains 8 records from 3 different events (serials 33, 34 and 35) created by the same domain `1a6fdc679`::h](huThe related audit logs contains 8 records from 3 different events (serials 33, 34 and 35) created by the same domain }(hjhhhNhNubj)}(h `1a6fdc679`h]h 1a6fdc679}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh:}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j hhhKhjhhubj0)}(hXtype=LANDLOCK_ACCESS msg=audit(1729738800.221:33): domain=1a6fdc679 blockers=fs.write_file path="/dev/tty" dev="devtmpfs" ino=9 type=LANDLOCK_DOMAIN msg=audit(1729738800.221:33): domain=1a6fdc679 status=allocated mode=enforcing pid=289 uid=0 exe="/root/sandboxer" comm="sandboxer" type=SYSCALL msg=audit(1729738800.221:33): arch=c000003e syscall=257 success=no exit=-13 [...] ppid=272 pid=289 auid=0 uid=0 gid=0 [...] comm="sh" [...] type=PROCTITLE msg=audit(1729738800.221:33): proctitle=7368002D63006563686F203E202F6574632F706173737764 type=LANDLOCK_ACCESS msg=audit(1729738800.221:34): domain=1a6fdc679 blockers=fs.write_file path="/etc/passwd" dev="vda2" ino=143821 type=SYSCALL msg=audit(1729738800.221:34): arch=c000003e syscall=257 success=no exit=-13 [...] ppid=272 pid=289 auid=0 uid=0 gid=0 [...] comm="sh" [...] type=PROCTITLE msg=audit(1729738800.221:34): proctitle=7368002D63006563686F203E202F6574632F706173737764 type=LANDLOCK_DOMAIN msg=audit(1729738800.261:35): domain=1a6fdc679 status=deallocated denials=2h]hXtype=LANDLOCK_ACCESS msg=audit(1729738800.221:33): domain=1a6fdc679 blockers=fs.write_file path="/dev/tty" dev="devtmpfs" ino=9 type=LANDLOCK_DOMAIN msg=audit(1729738800.221:33): domain=1a6fdc679 status=allocated mode=enforcing pid=289 uid=0 exe="/root/sandboxer" comm="sandboxer" type=SYSCALL msg=audit(1729738800.221:33): arch=c000003e syscall=257 success=no exit=-13 [...] ppid=272 pid=289 auid=0 uid=0 gid=0 [...] comm="sh" [...] type=PROCTITLE msg=audit(1729738800.221:33): proctitle=7368002D63006563686F203E202F6574632F706173737764 type=LANDLOCK_ACCESS msg=audit(1729738800.221:34): domain=1a6fdc679 blockers=fs.write_file path="/etc/passwd" dev="vda2" ino=143821 type=SYSCALL msg=audit(1729738800.221:34): arch=c000003e syscall=257 success=no exit=-13 [...] ppid=272 pid=289 auid=0 uid=0 gid=0 [...] comm="sh" [...] type=PROCTITLE msg=audit(1729738800.221:34): proctitle=7368002D63006563686F203E202F6574632F706173737764 type=LANDLOCK_DOMAIN msg=audit(1729738800.261:35): domain=1a6fdc679 status=deallocated denials=2}hj sbah}(h]h ]h"]h$]h&]hhuh1j/hhhKhjhhubeh}(h] event-samplesah ]h"] event samplesah$]h&]uh1hhjwhhhhhKnubh)}(hhh](h)}(hEvent filteringh]hEvent filtering}(hj. hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj+ hhhhhKubj )}(hIf you get spammed with audit logs related to Landlock, this is either an attack attempt or a bug in the security policy. We can put in place some filters to limit noise with two complementary ways:h]hIf you get spammed with audit logs related to Landlock, this is either an attack attempt or a bug in the security policy. We can put in place some filters to limit noise with two complementary ways:}(hj< hhhNhNubah}(h]h ]h"]h$]h&]uh1j hhhKhj+ hhubj)}(hhh](j)}(hywith sys_landlock_restrict_self()'s flags, or ``LANDLOCK_ADD_RULE_QUIET`` (ABI 10+) if we can fix the sandboxed programs,h]j )}(hywith sys_landlock_restrict_self()'s flags, or ``LANDLOCK_ADD_RULE_QUIET`` (ABI 10+) if we can fix the sandboxed programs,h](h0with sys_landlock_restrict_self()’s flags, or }(hjQ hhhNhNubj)}(h``LANDLOCK_ADD_RULE_QUIET``h]hLANDLOCK_ADD_RULE_QUIET}(hjY hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjQ ubh0 (ABI 10+) if we can fix the sandboxed programs,}(hjQ hhhNhNubeh}(h]h ]h"]h$]h&]uh1j hhhKhjM ubah}(h]h ]h"]h$]h&]uh1jhjJ hhhhhNubj)}(h2or with audit rules (see :manpage:`auditctl(8)`). h]j )}(h1or with audit rules (see :manpage:`auditctl(8)`).h](hor with audit rules (see }(hj{ hhhNhNubhmanpage)}(h:manpage:`auditctl(8)`h]h auditctl(8)}(hj hhhNhNubah}(h]h ]j ah"]h$]h&]hhƌpath auditctl(8)pageauditctlsection8uh1j hj{ ubh).}(hj{ hhhNhNubeh}(h]h ]h"]h$]h&]uh1j hhhKhjw ubah}(h]h ]h"]h$]h&]uh1jhjJ hhhhhNubeh}(h]h ]h"]h$]h&]j6j7uh1jhhhKhj+ hhubeh}(h]event-filteringah ]h"]event filteringah$]h&]uh1hhjwhhhhhKubeh}(h]auditah ]h"]auditah$]h&]uh1hhhhhhhhKubh)}(hhh](h)}(hAdditional documentationh]hAdditional documentation}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj hhhhhKubj)}(hhh](j)}(h`Linux Audit Documentation`_h]j )}(hj h]h reference)}(hj h]hLinux Audit Documentation}(hj hhhNhNubah}(h]h ]h"]h$]h&]nameLinux Audit Documentationrefuri7https://github.com/linux-audit/audit-documentation/wikiuh1j hj resolvedKubah}(h]h ]h"]h$]h&]uh1j hhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj hhhhhNubj)}(h(Documentation/userspace-api/landlock.rsth]j )}(hj h]h(Documentation/userspace-api/landlock.rst}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j hhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj hhhhhNubj)}(h#Documentation/security/landlock.rsth]j )}(hj h]h#Documentation/security/landlock.rst}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j hhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj hhhhhNubj)}(hhttps://landlock.io h]j )}(hhttps://landlock.ioh]j )}(hj. h]hhttps://landlock.io}(hj0 hhhNhNubah}(h]h ]h"]h$]h&]refurij. uh1j hj, ubah}(h]h ]h"]h$]h&]uh1j hhhKhj( ubah}(h]h ]h"]h$]h&]uh1jhj hhhhhNubeh}(h]h ]h"]h$]h&]j6*uh1jhhhKhj hhubh)}(hLinksh]hLinks}hjQ sbah}(h]h ]h"]h$]h&]hhuh1hhj hhhhhKubhtarget)}(hY.. _Linux Audit Documentation: https://github.com/linux-audit/audit-documentation/wikih]h}(h]linux-audit-documentationah ]h"]linux audit documentationah$]h&]j j uh1j_ hKhj hhhhnj referencedKubeh}(h]additional-documentationah ]h"]additional documentationah$]h&]uh1hhhhhhhhKubeh}(h]landlock-system-wide-managementah ]h"] landlock: system-wide managementah$]h&]uh1hhhhhhhhKubeh}(h]h ]h"]h$]h&]sourcehuh1hcurrent_sourceN current_lineNsettingsdocutils.frontendValues)}(hN generatorN datestampN source_linkN source_urlN toc_backlinksentryfootnote_backlinksK sectnum_xformKstrip_commentsNstrip_elements_with_classesN strip_classesN report_levelK halt_levelKexit_status_levelKdebugNwarning_streamN tracebackinput_encoding utf-8-siginput_encoding_error_handlerstrictoutput_encodingutf-8output_encoding_error_handlerj error_encodingutf-8error_encoding_error_handlerbackslashreplace language_codeenrecord_dependenciesNconfigN id_prefixhauto_id_prefixid dump_settingsNdump_internalsNdump_transformsNdump_pseudo_xmlNexpose_internalsNstrict_visitorN_disable_configN_sourcehnj _destinationN _config_files]7/var/lib/git/docbuild/linux/Documentation/docutils.confafile_insertion_enabled raw_enabledKline_length_limitM'pep_referencesN pep_base_urlhttps://peps.python.org/pep_file_url_templatepep-%04drfc_referencesN rfc_base_url&https://datatracker.ietf.org/doc/html/ tab_widthKtrim_footnote_reference_spacesyntax_highlightlong smart_quotessmartquotes_locales]character_level_inline_markupdoctitle_xform docinfo_xformKsectsubtitle_xform image_loadinglinkembed_stylesheetcloak_email_addressessection_self_linkenvNubreporterNindirect_targets]substitution_defs}substitution_names}refnames}linux audit documentation]j asrefids}nameids}(j{ jx j j jjj( j% j j js jp jj jg u nametypes}(j{ j jj( j js jj uh}(jx hj jwjjj% jj j+ jp j jg ja u footnote_refs} citation_refs} autofootnotes]autofootnote_refs]symbol_footnotes]symbol_footnote_refs] footnotes] citations]autofootnote_startKsymbol_footnote_startK id_counter collectionsCounter}Rparse_messages]transform_messages] transformerN include_log] decorationNhhub.