sphinx.addnodesdocument)}( rawsourcechildren]( translations LanguagesNode)}(hhh](h pending_xref)}(hhh]docutils.nodesTextChinese (Simplified)}parenthsba attributes}(ids]classes]names]dupnames]backrefs] refdomainstdreftypedoc reftarget%/translations/zh_CN/security/landlockmodnameN classnameN refexplicitutagnamehhh ubh)}(hhh]hChinese (Traditional)}hh2sbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget%/translations/zh_TW/security/landlockmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hItalian}hhFsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget%/translations/it_IT/security/landlockmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hJapanese}hhZsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget%/translations/ja_JP/security/landlockmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hKorean}hhnsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget%/translations/ko_KR/security/landlockmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hPortuguese (Brazilian)}hhsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget%/translations/pt_BR/security/landlockmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hSpanish}hhsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget%/translations/sp_SP/security/landlockmodnameN classnameN refexplicituh1hhh ubeh}(h]h ]h"]h$]h&]current_languageEnglishuh1h hh _documenthsourceNlineNubhcomment)}(h SPDX-License-Identifier: GPL-2.0h]h SPDX-License-Identifier: GPL-2.0}hhsbah}(h]h ]h"]h$]h&] xml:spacepreserveuh1hhhhhh?/var/lib/git/docbuild/linux/Documentation/security/landlock.rsthKubh)}(h9Copyright © 2017-2020 Mickaël Salaün h]h9Copyright © 2017-2020 Mickaël Salaün }hhsbah}(h]h ]h"]h$]h&]hhuh1hhhhhhhhKubh)}(hCopyright © 2019-2020 ANSSIh]hCopyright © 2019-2020 ANSSI}hhsbah}(h]h ]h"]h$]h&]hhuh1hhhhhhhhKubhsection)}(hhh](htitle)}(h"Landlock LSM: kernel documentationh]h"Landlock LSM: kernel documentation}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhhhhhKubh field_list)}(hhh](hfield)}(hhh](h field_name)}(hAuthorh]hAuthor}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjhhhKubh field_body)}(hMickaël Salaünh]h paragraph)}(hjh]hMickaël Salaün}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK hjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1hhhhK hhhhubh)}(hhh](j)}(hDateh]hDate}(hj7hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj4hhhKubj)}(h March 2026 h]j)}(h March 2026h]h March 2026}(hjIhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK hjEubah}(h]h ]h"]h$]h&]uh1jhj4ubeh}(h]h ]h"]h$]h&]uh1hhhhK hhhhubeh}(h]h ]h"]h$]h&]uh1hhhhhhhhK ubj)}(hXLandlock's goal is to create scoped access-control (i.e. sandboxing). To harden a whole system, this feature should be available to any process, including unprivileged ones. Because such a process may be compromised or backdoored (i.e. untrusted), Landlock's features must be safe to use from the kernel and other processes point of view. Landlock's interface must therefore expose a minimal attack surface.h]hXLandlock’s goal is to create scoped access-control (i.e. sandboxing). To harden a whole system, this feature should be available to any process, including unprivileged ones. Because such a process may be compromised or backdoored (i.e. untrusted), Landlock’s features must be safe to use from the kernel and other processes point of view. Landlock’s interface must therefore expose a minimal attack surface.}(hjihhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK hhhhubj)}(hXLandlock is designed to be usable by unprivileged processes while following the system security policy enforced by other access control mechanisms (e.g. DAC, LSM). A Landlock rule shall not interfere with other access-controls enforced on the system, only add more restrictions.h]hXLandlock is designed to be usable by unprivileged processes while following the system security policy enforced by other access control mechanisms (e.g. DAC, LSM). A Landlock rule shall not interfere with other access-controls enforced on the system, only add more restrictions.}(hjwhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhKhhhhubj)}(hAny user can enforce Landlock rulesets on their processes. They are merged and evaluated against inherited rulesets in a way that ensures that only more constraints can be added.h]hAny user can enforce Landlock rulesets on their processes. They are merged and evaluated against inherited rulesets in a way that ensures that only more constraints can be added.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhKhhhhubj)}(hUUser space documentation can be found here: Documentation/userspace-api/landlock.rst.h]hUUser space documentation can be found here: Documentation/userspace-api/landlock.rst.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhKhhhhubh)}(hhh](h)}(h+Guiding principles for safe access controlsh]h+Guiding principles for safe access controls}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhK ubh bullet_list)}(hhh](h list_item)}(hA Landlock rule shall be focused on access control on kernel objects instead of syscall filtering (i.e. syscall arguments), which is the purpose of seccomp-bpf.h]j)}(hA Landlock rule shall be focused on access control on kernel objects instead of syscall filtering (i.e. syscall arguments), which is the purpose of seccomp-bpf.h]hA Landlock rule shall be focused on access control on kernel objects instead of syscall filtering (i.e. syscall arguments), which is the purpose of seccomp-bpf.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK"hjubah}(h]h ]h"]h$]h&]uh1jhjhhhhhNubj)}(hTo avoid multiple kinds of side-channel attacks (e.g. leak of security policies, CPU-based attacks), Landlock rules shall not be able to programmatically communicate with user space.h]j)}(hTo avoid multiple kinds of side-channel attacks (e.g. leak of security policies, CPU-based attacks), Landlock rules shall not be able to programmatically communicate with user space.h]hTo avoid multiple kinds of side-channel attacks (e.g. leak of security policies, CPU-based attacks), Landlock rules shall not be able to programmatically communicate with user space.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK%hjubah}(h]h ]h"]h$]h&]uh1jhjhhhhhNubj)}(hRKernel access check shall not slow down access request from unsandboxed processes.h]j)}(hRKernel access check shall not slow down access request from unsandboxed processes.h]hRKernel access check shall not slow down access request from unsandboxed processes.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK(hjubah}(h]h ]h"]h$]h&]uh1jhjhhhhhNubj)}(hvComputation related to Landlock operations (e.g. enforcing a ruleset) shall only impact the processes requesting them.h]j)}(hvComputation related to Landlock operations (e.g. enforcing a ruleset) shall only impact the processes requesting them.h]hvComputation related to Landlock operations (e.g. enforcing a ruleset) shall only impact the processes requesting them.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK*hjubah}(h]h ]h"]h$]h&]uh1jhjhhhhhNubj)}(hResources (e.g. file descriptors) directly obtained from the kernel by a sandboxed process shall retain their scoped accesses (at the time of resource acquisition) whatever process uses them. Cf. `File descriptor access rights`_.h]j)}(hResources (e.g. file descriptors) directly obtained from the kernel by a sandboxed process shall retain their scoped accesses (at the time of resource acquisition) whatever process uses them. Cf. `File descriptor access rights`_.h](hResources (e.g. file descriptors) directly obtained from the kernel by a sandboxed process shall retain their scoped accesses (at the time of resource acquisition) whatever process uses them. Cf. }(hjhhhNhNubh reference)}(h `File descriptor access rights`_h]hFile descriptor access rights}(hj'hhhNhNubah}(h]h ]h"]h$]h&]nameFile descriptor access rightsrefidfile-descriptor-access-rightsuh1j%hjresolvedKubh.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhK,hjubah}(h]h ]h"]h$]h&]uh1jhjhhhhhNubj)}(hX*Access denials shall be logged according to system and Landlock domain configurations. Log entries must contain information about the cause of the denial and the owner of the related security policy. Such log generation should have a negligible performance and memory impact on allowed requests. h]j)}(hX)Access denials shall be logged according to system and Landlock domain configurations. Log entries must contain information about the cause of the denial and the owner of the related security policy. Such log generation should have a negligible performance and memory impact on allowed requests.h]hX)Access denials shall be logged according to system and Landlock domain configurations. Log entries must contain information about the cause of the denial and the owner of the related security policy. Such log generation should have a negligible performance and memory impact on allowed requests.}(hjNhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK0hjJubah}(h]h ]h"]h$]h&]uh1jhjhhhhhNubeh}(h]h ]h"]h$]h&]bullet*uh1jhhhK"hjhhubeh}(h]+guiding-principles-for-safe-access-controlsah ]h"]+guiding principles for safe access controlsah$]h&]uh1hhhhhhhhK ubh)}(hhh](h)}(hDesign choicesh]hDesign choices}(hjuhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjrhhhhhK6ubh)}(hhh](h)}(hInode access rightsh]hInode access rights}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhK9ubj)}(hX/All access rights are tied to an inode and what can be accessed through it. Reading the content of a directory does not imply to be allowed to read the content of a listed inode. Indeed, a file name is local to its parent directory, and an inode can be referenced by multiple file names thanks to (hard) links. Being able to unlink a file only has a direct impact on the directory, not the unlinked inode. This is the reason why ``LANDLOCK_ACCESS_FS_REMOVE_FILE`` or ``LANDLOCK_ACCESS_FS_REFER`` are not allowed to be tied to files but only to directories.h](hXAll access rights are tied to an inode and what can be accessed through it. Reading the content of a directory does not imply to be allowed to read the content of a listed inode. Indeed, a file name is local to its parent directory, and an inode can be referenced by multiple file names thanks to (hard) links. Being able to unlink a file only has a direct impact on the directory, not the unlinked inode. This is the reason why }(hjhhhNhNubhliteral)}(h"``LANDLOCK_ACCESS_FS_REMOVE_FILE``h]hLANDLOCK_ACCESS_FS_REMOVE_FILE}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh or }(hjhhhNhNubj)}(h``LANDLOCK_ACCESS_FS_REFER``h]hLANDLOCK_ACCESS_FS_REFER}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh= are not allowed to be tied to files but only to directories.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhK;hjhhubeh}(h]inode-access-rightsah ]h"]inode access rightsah$]h&]uh1hhjrhhhhhK9ubh)}(hhh](h)}(hFile descriptor access rightsh]hFile descriptor access rights}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKEubj)}(hAccess rights are checked and tied to file descriptors at open time. The underlying principle is that equivalent sequences of operations should lead to the same results, when they are executed under the same Landlock domain.h]hAccess rights are checked and tied to file descriptors at open time. The underlying principle is that equivalent sequences of operations should lead to the same results, when they are executed under the same Landlock domain.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhKGhjhhubj)}(hX[Taking the ``LANDLOCK_ACCESS_FS_TRUNCATE`` right as an example, it may be allowed to open a file for writing without being allowed to :manpage:`ftruncate` the resulting file descriptor if the related file hierarchy doesn't grant that access right. The following sequences of operations have the same semantic and should then have the same result:h](h Taking the }(hjhhhNhNubj)}(h``LANDLOCK_ACCESS_FS_TRUNCATE``h]hLANDLOCK_ACCESS_FS_TRUNCATE}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh\ right as an example, it may be allowed to open a file for writing without being allowed to }(hjhhhNhNubhmanpage)}(h:manpage:`ftruncate`h]h ftruncate}(hj hhhNhNubah}(h]h ]j ah"]h$]h&]hhƌpath ftruncatepagejhhuh1j hjubh the resulting file descriptor if the related file hierarchy doesn’t grant that access right. The following sequences of operations have the same semantic and should then have the same result:}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKKhjhhubj)}(hhh](j)}(h``truncate(path);``h]j)}(hj+h]j)}(hj+h]htruncate(path);}(hj0hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj-ubah}(h]h ]h"]h$]h&]uh1jhhhKQhj)ubah}(h]h ]h"]h$]h&]uh1jhj&hhhhhNubj)}(h=``int fd = open(path, O_WRONLY); ftruncate(fd); close(fd);`` h]j)}(h<``int fd = open(path, O_WRONLY); ftruncate(fd); close(fd);``h]j)}(hjOh]h8int fd = open(path, O_WRONLY); ftruncate(fd); close(fd);}(hjQhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjMubah}(h]h ]h"]h$]h&]uh1jhhhKRhjIubah}(h]h ]h"]h$]h&]uh1jhj&hhhhhNubeh}(h]h ]h"]h$]h&]jhjiuh1jhhhKQhjhhubj)}(hXSimilarly to file access modes (e.g. ``O_RDWR``), Landlock access rights attached to file descriptors are retained even if they are passed between processes (e.g. through a Unix domain socket). Such access rights will then be enforced even if the receiving process is not sandboxed by Landlock. Indeed, this is required to keep access controls consistent over the whole system, and this avoids unattended bypasses through file descriptor passing (i.e. confused deputy attack).h](h%Similarly to file access modes (e.g. }(hjphhhNhNubj)}(h ``O_RDWR``h]hO_RDWR}(hjxhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjpubhX), Landlock access rights attached to file descriptors are retained even if they are passed between processes (e.g. through a Unix domain socket). Such access rights will then be enforced even if the receiving process is not sandboxed by Landlock. Indeed, this is required to keep access controls consistent over the whole system, and this avoids unattended bypasses through file descriptor passing (i.e. confused deputy attack).}(hjphhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKThjhhubhtarget)}(h.. _scoped-flags-interaction:h]h}(h]h ]h"]h$]h&]j7scoped-flags-interactionuh1jhK\hjhhhhubeh}(h]j8ah ]h"]file descriptor access rightsah$]h&]uh1hhjrhhhhhKE referencedKubh)}(hhh](h)}(h8Interaction between scoped flags and other access rightsh]h8Interaction between scoped flags and other access rights}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhK_ubj)}(hThe ``scoped`` flags in &struct landlock_ruleset_attr restrict the use of *outgoing* IPC from the created Landlock domain, while they permit reaching out to IPC endpoints *within* the created Landlock domain.h](hThe }(hjhhhNhNubj)}(h ``scoped``h]hscoped}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh< flags in &struct landlock_ruleset_attr restrict the use of }(hjhhhNhNubhemphasis)}(h *outgoing*h]houtgoing}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhW IPC from the created Landlock domain, while they permit reaching out to IPC endpoints }(hjhhhNhNubj)}(h*within*h]hwithin}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh the created Landlock domain.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKahjhhubj)}(hIn the future, scoped flags *may* interact with other access rights, e.g. so that abstract UNIX sockets can be allow-listed by name, or so that signals can be allow-listed by signal number or target process.h](hIn the future, scoped flags }(hjhhhNhNubj)}(h*may*h]hmay}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh interact with other access rights, e.g. so that abstract UNIX sockets can be allow-listed by name, or so that signals can be allow-listed by signal number or target process.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKfhjhhubj)}(hX1When introducing ``LANDLOCK_ACCESS_FS_RESOLVE_UNIX``, we defined it to implicitly have the same scoping semantics as a ``LANDLOCK_SCOPE_PATHNAME_UNIX_SOCKET`` flag would have: connecting to UNIX sockets within the same domain (where ``LANDLOCK_ACCESS_FS_RESOLVE_UNIX`` is used) is unconditionally allowed.h](hWhen introducing }(hjhhhNhNubj)}(h#``LANDLOCK_ACCESS_FS_RESOLVE_UNIX``h]hLANDLOCK_ACCESS_FS_RESOLVE_UNIX}(hj$hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhC, we defined it to implicitly have the same scoping semantics as a }(hjhhhNhNubj)}(h'``LANDLOCK_SCOPE_PATHNAME_UNIX_SOCKET``h]h#LANDLOCK_SCOPE_PATHNAME_UNIX_SOCKET}(hj6hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhK flag would have: connecting to UNIX sockets within the same domain (where }(hjhhhNhNubj)}(h#``LANDLOCK_ACCESS_FS_RESOLVE_UNIX``h]hLANDLOCK_ACCESS_FS_RESOLVE_UNIX}(hjHhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh% is used) is unconditionally allowed.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKjhjhhubj)}(hThe reasoning is:h]hThe reasoning is:}(hj`hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhKqhjhhubj)}(hhh](j)}(hLike other IPC mechanisms, connecting to named UNIX sockets in the same domain should be expected and harmless. (If needed, users can further refine their Landlock policies with nested domains or by restricting ``LANDLOCK_ACCESS_FS_MAKE_SOCK``.)h]j)}(hLike other IPC mechanisms, connecting to named UNIX sockets in the same domain should be expected and harmless. (If needed, users can further refine their Landlock policies with nested domains or by restricting ``LANDLOCK_ACCESS_FS_MAKE_SOCK``.)h](hLike other IPC mechanisms, connecting to named UNIX sockets in the same domain should be expected and harmless. (If needed, users can further refine their Landlock policies with nested domains or by restricting }(hjuhhhNhNubj)}(h ``LANDLOCK_ACCESS_FS_MAKE_SOCK``h]hLANDLOCK_ACCESS_FS_MAKE_SOCK}(hj}hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjuubh.)}(hjuhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKshjqubah}(h]h ]h"]h$]h&]uh1jhjnhhhhhNubj)}(hWe reserve the option to still introduce ``LANDLOCK_SCOPE_PATHNAME_UNIX_SOCKET`` in the future. (This would be useful if we wanted to have a Landlock rule to permit IPC access to other Landlock domains.)h]j)}(hWe reserve the option to still introduce ``LANDLOCK_SCOPE_PATHNAME_UNIX_SOCKET`` in the future. (This would be useful if we wanted to have a Landlock rule to permit IPC access to other Landlock domains.)h](h)We reserve the option to still introduce }(hjhhhNhNubj)}(h'``LANDLOCK_SCOPE_PATHNAME_UNIX_SOCKET``h]h#LANDLOCK_SCOPE_PATHNAME_UNIX_SOCKET}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh| in the future. (This would be useful if we wanted to have a Landlock rule to permit IPC access to other Landlock domains.)}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKwhjubah}(h]h ]h"]h$]h&]uh1jhjnhhhhhNubj)}(hBut we can postpone the point in time when users have to deal with two interacting flags visible in the userspace API. (In particular, it is possible that it won't be needed in practice, in which case we can avoid the second flag altogether.)h]j)}(hBut we can postpone the point in time when users have to deal with two interacting flags visible in the userspace API. (In particular, it is possible that it won't be needed in practice, in which case we can avoid the second flag altogether.)h]hBut we can postpone the point in time when users have to deal with two interacting flags visible in the userspace API. (In particular, it is possible that it won’t be needed in practice, in which case we can avoid the second flag altogether.)}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK{hjubah}(h]h ]h"]h$]h&]uh1jhjnhhhhhNubj)}(hIf we *do* introduce ``LANDLOCK_SCOPE_PATHNAME_UNIX_SOCKET`` in the future, setting this scoped flag in a ruleset does *not reduce* the restrictions, because access within the same scope is already allowed based on ``LANDLOCK_ACCESS_FS_RESOLVE_UNIX``. h]j)}(hIf we *do* introduce ``LANDLOCK_SCOPE_PATHNAME_UNIX_SOCKET`` in the future, setting this scoped flag in a ruleset does *not reduce* the restrictions, because access within the same scope is already allowed based on ``LANDLOCK_ACCESS_FS_RESOLVE_UNIX``.h](hIf we }(hjhhhNhNubj)}(h*do*h]hdo}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh introduce }(hjhhhNhNubj)}(h'``LANDLOCK_SCOPE_PATHNAME_UNIX_SOCKET``h]h#LANDLOCK_SCOPE_PATHNAME_UNIX_SOCKET}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh; in the future, setting this scoped flag in a ruleset does }(hjhhhNhNubj)}(h *not reduce*h]h not reduce}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhT the restrictions, because access within the same scope is already allowed based on }(hjhhhNhNubj)}(h#``LANDLOCK_ACCESS_FS_RESOLVE_UNIX``h]hLANDLOCK_ACCESS_FS_RESOLVE_UNIX}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKhjubah}(h]h ]h"]h$]h&]uh1jhjnhhhhhNubeh}(h]h ]h"]h$]h&]jhjiuh1jhhhKshjhhubeh}(h](8interaction-between-scoped-flags-and-other-access-rightsjeh ]h"](8interaction between scoped flags and other access rightsscoped-flags-interactioneh$]h&]uh1hhjrhhhhhK_expect_referenced_by_name}jIjsexpect_referenced_by_id}jjsubeh}(h]design-choicesah ]h"]design choicesah$]h&]uh1hhhhhhhhK6ubh)}(hhh](h)}(hTestsh]hTests}(hj[hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjXhhhhhKubj)}(hUserspace tests for backward compatibility, ptrace restrictions and filesystem support can be found here: `tools/testing/selftests/landlock/`_.h](hjUserspace tests for backward compatibility, ptrace restrictions and filesystem support can be found here: }(hjihhhNhNubj&)}(h$`tools/testing/selftests/landlock/`_h]h!tools/testing/selftests/landlock/}(hjqhhhNhNubah}(h]h ]h"]h$]h&]name!tools/testing/selftests/landlock/refurighttps://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/tools/testing/selftests/landlock/uh1j%hjij9Kubh.}(hjihhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKhjXhhubeh}(h]testsah ]h"]testsah$]h&]uh1hhhhhhhhKubh)}(hhh](h)}(hKernel structuresh]hKernel structures}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKubh)}(hhh](h)}(hObjecth]hObject}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKubhindex)}(hhh]h}(h]h ]h"]h$]h&]entries](single#landlock_object_underops (C struct)c.landlock_object_underopshNtauh1jhjhhh]/var/lib/git/docbuild/linux/Documentation/security/landlock:144: ./security/landlock/object.hhNubhdesc)}(hhh](hdesc_signature)}(hlandlock_object_underopsh]hdesc_signature_line)}(hstruct landlock_object_underopsh](hdesc_sig_keyword)}(hstructh]hstruct}(hjhhhNhNubah}(h]h ]kah"]h$]h&]uh1jhjhhh]/var/lib/git/docbuild/linux/Documentation/security/landlock:144: ./security/landlock/object.hhKubhdesc_sig_space)}(h h]h }(hjhhhNhNubah}(h]h ]wah"]h$]h&]uh1jhjhhhjhKubh desc_name)}(hlandlock_object_underopsh]h desc_sig_name)}(hjh]hlandlock_object_underops}(hjhhhNhNubah}(h]h ]nah"]h$]h&]uh1jhjubah}(h]h ](sig-namedescnameeh"]h$]h&]hhuh1jhjhhhjhKubeh}(h]h ]h"]h$]h&]hhƌ add_permalinkuh1jsphinx_line_type declaratorhjhhhjhKubah}(h]jah ](sig sig-objecteh"]h$]h&] is_multiline _toc_parts) _toc_namehuh1jhjhKhjhhubh desc_content)}(hhh]j)}(h"Operations on an underlying objecth]h"Operations on an underlying object}(hj4hhhNhNubah}(h]h ]h"]h$]h&]uh1jh]/var/lib/git/docbuild/linux/Documentation/security/landlock:144: ./security/landlock/object.hhKhj1hhubah}(h]h ]h"]h$]h&]uh1j/hjhhhjhKubeh}(h]h ](cstructeh"]h$]h&]domainjLobjtypejMdesctypejMnoindex noindexentrynocontentsentryuh1jhhhjhjhNubh container)}(h**Definition**:: struct landlock_object_underops { void (*release)(struct landlock_object *const object); }; **Members** ``release`` Releases the underlying object (e.g. iput() for an inode).h](j)}(h**Definition**::h](hstrong)}(h**Definition**h]h Definition}(hjchhhNhNubah}(h]h ]h"]h$]h&]uh1jahj]ubh:}(hj]hhhNhNubeh}(h]h ]h"]h$]h&]uh1jh]/var/lib/git/docbuild/linux/Documentation/security/landlock:144: ./security/landlock/object.hhKhjYubh literal_block)}(h_struct landlock_object_underops { void (*release)(struct landlock_object *const object); };h]h_struct landlock_object_underops { void (*release)(struct landlock_object *const object); };}hj~sbah}(h]h ]h"]h$]h&]hhuh1j|h]/var/lib/git/docbuild/linux/Documentation/security/landlock:144: ./security/landlock/object.hhKhjYubj)}(h **Members**h]jb)}(hjh]hMembers}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jahjubah}(h]h ]h"]h$]h&]uh1jh]/var/lib/git/docbuild/linux/Documentation/security/landlock:144: ./security/landlock/object.hhKhjYubhdefinition_list)}(hhh]hdefinition_list_item)}(hF``release`` Releases the underlying object (e.g. iput() for an inode).h](hterm)}(h ``release``h]j)}(hjh]hrelease}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1jh]/var/lib/git/docbuild/linux/Documentation/security/landlock:144: ./security/landlock/object.hhKhjubh definition)}(hhh]j)}(h:Releases the underlying object (e.g. iput() for an inode).h]h:Releases the underlying object (e.g. iput() for an inode).}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jh]/var/lib/git/docbuild/linux/Documentation/security/landlock:144: ./security/landlock/object.hhKhjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjhKhjubah}(h]h ]h"]h$]h&]uh1jhjYubeh}(h]h ] kernelindentah"]h$]h&]uh1jWhjhhhjhNubj)}(hhh]h}(h]h ]h"]h$]h&]entries](jlandlock_object (C struct)c.landlock_objecthNtauh1jhjhhhjhNubj)}(hhh](j)}(hlandlock_objecth]j)}(hstruct landlock_objecth](j)}(hjh]hstruct}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj hhh]/var/lib/git/docbuild/linux/Documentation/security/landlock:144: ./security/landlock/object.hhKubj)}(h h]h }(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj hhhjhKubj)}(hlandlock_objecth]j)}(hj h]hlandlock_object}(hj0hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj,ubah}(h]h ](jjeh"]h$]h&]hhuh1jhj hhhjhKubeh}(h]h ]h"]h$]h&]hhj!uh1jj"j#hjhhhjhKubah}(h]jah ](j'j(eh"]h$]h&]j,j-)j.huh1jhjhKhjhhubj0)}(hhh]j)}(h%Security blob tied to a kernel objecth]h%Security blob tied to a kernel object}(hjRhhhNhNubah}(h]h ]h"]h$]h&]uh1jh]/var/lib/git/docbuild/linux/Documentation/security/landlock:144: ./security/landlock/object.hhKhjOhhubah}(h]h ]h"]h$]h&]uh1j/hjhhhjhKubeh}(h]h ](jLstructeh"]h$]h&]jQjLjRjjjSjjjTjUjVuh1jhhhjhjhNubjX)}(hX**Definition**:: struct landlock_object { refcount_t usage; spinlock_t lock; void *underobj; union { struct rcu_head rcu_free; const struct landlock_object_underops *underops; }; }; **Members** ``usage`` This counter is used to tie an object to the rules matching it or to keep it alive while adding a new rule. If this counter reaches zero, this struct must not be modified, but this counter can still be read from within an RCU read-side critical section. When adding a new rule to an object with a usage counter of zero, we must wait until the pointer to this object is set to NULL (or recycled). ``lock`` Protects against concurrent modifications. This lock must be held from the time **usage** drops to zero until any weak references from **underobj** to this object have been cleaned up. Lock ordering: inode->i_lock nests inside this. ``underobj`` Used when cleaning up an object and to mark an object as tied to its underlying kernel structure. This pointer is protected by **lock**. Cf. landlock_release_inodes() and release_inode(). ``{unnamed_union}`` anonymous ``rcu_free`` Enables lockless use of **usage**, **lock** and **underobj** from within an RCU read-side critical section. **rcu_free** and **underops** are only used by landlock_put_object(). ``underops`` Enables landlock_put_object() to release the underlying object (e.g. inode).h](j)}(h**Definition**::h](jb)}(h**Definition**h]h Definition}(hjvhhhNhNubah}(h]h ]h"]h$]h&]uh1jahjrubh:}(hjrhhhNhNubeh}(h]h ]h"]h$]h&]uh1jh]/var/lib/git/docbuild/linux/Documentation/security/landlock:144: ./security/landlock/object.hhK"hjnubj})}(hstruct landlock_object { refcount_t usage; spinlock_t lock; void *underobj; union { struct rcu_head rcu_free; const struct landlock_object_underops *underops; }; };h]hstruct landlock_object { refcount_t usage; spinlock_t lock; void *underobj; union { struct rcu_head rcu_free; const struct landlock_object_underops *underops; }; };}hjsbah}(h]h ]h"]h$]h&]hhuh1j|h]/var/lib/git/docbuild/linux/Documentation/security/landlock:144: ./security/landlock/object.hhK$hjnubj)}(h **Members**h]jb)}(hjh]hMembers}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jahjubah}(h]h ]h"]h$]h&]uh1jh]/var/lib/git/docbuild/linux/Documentation/security/landlock:144: ./security/landlock/object.hhK.hjnubj)}(hhh](j)}(hX``usage`` This counter is used to tie an object to the rules matching it or to keep it alive while adding a new rule. If this counter reaches zero, this struct must not be modified, but this counter can still be read from within an RCU read-side critical section. When adding a new rule to an object with a usage counter of zero, we must wait until the pointer to this object is set to NULL (or recycled). h](j)}(h ``usage``h]j)}(hjh]husage}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1jh]/var/lib/git/docbuild/linux/Documentation/security/landlock:144: ./security/landlock/object.hhK/hjubj)}(hhh]j)}(hXThis counter is used to tie an object to the rules matching it or to keep it alive while adding a new rule. If this counter reaches zero, this struct must not be modified, but this counter can still be read from within an RCU read-side critical section. When adding a new rule to an object with a usage counter of zero, we must wait until the pointer to this object is set to NULL (or recycled).h]hXThis counter is used to tie an object to the rules matching it or to keep it alive while adding a new rule. If this counter reaches zero, this struct must not be modified, but this counter can still be read from within an RCU read-side critical section. When adding a new rule to an object with a usage counter of zero, we must wait until the pointer to this object is set to NULL (or recycled).}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jh]/var/lib/git/docbuild/linux/Documentation/security/landlock:144: ./security/landlock/object.hhK*hjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjhK/hjubj)}(h``lock`` Protects against concurrent modifications. This lock must be held from the time **usage** drops to zero until any weak references from **underobj** to this object have been cleaned up. Lock ordering: inode->i_lock nests inside this. h](j)}(h``lock``h]j)}(hjh]hlock}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1jh]/var/lib/git/docbuild/linux/Documentation/security/landlock:144: ./security/landlock/object.hhK7hjubj)}(hhh](j)}(hProtects against concurrent modifications. This lock must be held from the time **usage** drops to zero until any weak references from **underobj** to this object have been cleaned up.h](hQProtects against concurrent modifications. This lock must be held from the time }(hjhhhNhNubjb)}(h **usage**h]husage}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jahjubh. drops to zero until any weak references from }(hjhhhNhNubjb)}(h **underobj**h]hunderobj}(hj,hhhNhNubah}(h]h ]h"]h$]h&]uh1jahjubh% to this object have been cleaned up.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jh]/var/lib/git/docbuild/linux/Documentation/security/landlock:144: ./security/landlock/object.hhK3hjubj)}(h/Lock ordering: inode->i_lock nests inside this.h]h/Lock ordering: inode->i_lock nests inside this.}(hjEhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjhK7hjubeh}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjhK7hjubj)}(h``underobj`` Used when cleaning up an object and to mark an object as tied to its underlying kernel structure. This pointer is protected by **lock**. Cf. landlock_release_inodes() and release_inode(). h](j)}(h ``underobj``h]j)}(hjeh]hunderobj}(hjghhhNhNubah}(h]h ]h"]h$]h&]uh1jhjcubah}(h]h ]h"]h$]h&]uh1jh]/var/lib/git/docbuild/linux/Documentation/security/landlock:144: ./security/landlock/object.hhK=hj_ubj)}(hhh]j)}(hUsed when cleaning up an object and to mark an object as tied to its underlying kernel structure. This pointer is protected by **lock**. Cf. landlock_release_inodes() and release_inode().h](hUsed when cleaning up an object and to mark an object as tied to its underlying kernel structure. This pointer is protected by }(hj~hhhNhNubjb)}(h**lock**h]hlock}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jahj~ubh5. Cf. landlock_release_inodes() and release_inode().}(hj~hhhNhNubeh}(h]h ]h"]h$]h&]uh1jh]/var/lib/git/docbuild/linux/Documentation/security/landlock:144: ./security/landlock/object.hhK;hj{ubah}(h]h ]h"]h$]h&]uh1jhj_ubeh}(h]h ]h"]h$]h&]uh1jhjzhK=hjubj)}(h``{unnamed_union}`` anonymous h](j)}(h``{unnamed_union}``h]j)}(hjh]h{unnamed_union}}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1jh]/var/lib/git/docbuild/linux/Documentation/security/landlock:144: ./security/landlock/object.hhKhjubj)}(hhh]j)}(h anonymoush]h anonymous}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjhKhjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjhKhjubj)}(h``rcu_free`` Enables lockless use of **usage**, **lock** and **underobj** from within an RCU read-side critical section. **rcu_free** and **underops** are only used by landlock_put_object(). h](j)}(h ``rcu_free``h]j)}(hjh]hrcu_free}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1jh]/var/lib/git/docbuild/linux/Documentation/security/landlock:144: ./security/landlock/object.hhKEhjubj)}(hhh]j)}(hEnables lockless use of **usage**, **lock** and **underobj** from within an RCU read-side critical section. **rcu_free** and **underops** are only used by landlock_put_object().h](hEnables lockless use of }(hj hhhNhNubjb)}(h **usage**h]husage}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jahj ubh, }(hj hhhNhNubjb)}(h**lock**h]hlock}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jahj ubh and }(hj hhhNhNubjb)}(h **underobj**h]hunderobj}(hj/ hhhNhNubah}(h]h ]h"]h$]h&]uh1jahj ubh0 from within an RCU read-side critical section. }(hj hhhNhNubjb)}(h **rcu_free**h]hrcu_free}(hjA hhhNhNubah}(h]h ]h"]h$]h&]uh1jahj ubh and }(hj hhhNhNubjb)}(h **underops**h]hunderops}(hjS hhhNhNubah}(h]h ]h"]h$]h&]uh1jahj ubh( are only used by landlock_put_object().}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1jh]/var/lib/git/docbuild/linux/Documentation/security/landlock:144: ./security/landlock/object.hhKBhj ubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjhKEhjubj)}(hY``underops`` Enables landlock_put_object() to release the underlying object (e.g. inode).h](j)}(h ``underops``h]j)}(hj~ h]hunderops}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj| ubah}(h]h ]h"]h$]h&]uh1jh]/var/lib/git/docbuild/linux/Documentation/security/landlock:144: ./security/landlock/object.hhKIhjx ubj)}(hhh]j)}(hLEnables landlock_put_object() to release the underlying object (e.g. inode).h]hLEnables landlock_put_object() to release the underlying object (e.g. inode).}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj hKIhj ubah}(h]h ]h"]h$]h&]uh1jhjx ubeh}(h]h ]h"]h$]h&]uh1jhj hKIhjubeh}(h]h ]h"]h$]h&]uh1jhjnubeh}(h]h ] kernelindentah"]h$]h&]uh1jWhjhhhjhNubj)}(h**Description**h]jb)}(hj h]h Description}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jahj ubah}(h]h ]h"]h$]h&]uh1jh]/var/lib/git/docbuild/linux/Documentation/security/landlock:144: ./security/landlock/object.hhKMhjhhubj)}(hThe goal of this structure is to enable to tie a set of ephemeral access rights (pertaining to different domains) to a kernel object (e.g an inode) in a safe way. This implies to handle concurrent use and modification.h]hThe goal of this structure is to enable to tie a set of ephemeral access rights (pertaining to different domains) to a kernel object (e.g an inode) in a safe way. This implies to handle concurrent use and modification.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jh]/var/lib/git/docbuild/linux/Documentation/security/landlock:144: ./security/landlock/object.hhKhjhhubj)}(hjThe lifetime of a :c:type:`struct landlock_object ` depends on the rules referring to it.h](hThe lifetime of a }(hj hhhNhNubh)}(h2:c:type:`struct landlock_object `h]j)}(hj h]hstruct landlock_object}(hj hhhNhNubah}(h]h ](xrefjLc-typeeh"]h$]h&]uh1jhj ubah}(h]h ]h"]h$]h&]refdocsecurity/landlock refdomainjLreftypetype refexplicitrefwarn c:parent_keysphinx.domains.c LookupKey)}data]sb reftargetlandlock_objectuh1hh]/var/lib/git/docbuild/linux/Documentation/security/landlock:144: ./security/landlock/object.hhK#hj ubh& depends on the rules referring to it.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhj hK#hjhhubeh}(h]objectah ]h"]objectah$]h&]uh1hhjhhhhhKubh)}(hhh](h)}(h Filesystemh]h Filesystem}(hj- hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj* hhhhhKubj)}(hhh]h}(h]h ]h"]h$]h&]entries](j"landlock_inode_security (C struct)c.landlock_inode_securityhNtauh1jhj* hhhY/var/lib/git/docbuild/linux/Documentation/security/landlock:150: ./security/landlock/fs.hhNubj)}(hhh](j)}(hlandlock_inode_securityh]j)}(hstruct landlock_inode_securityh](j)}(hjh]hstruct}(hjU hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjQ hhhY/var/lib/git/docbuild/linux/Documentation/security/landlock:150: ./security/landlock/fs.hhKubj)}(h h]h }(hjc hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjQ hhhjb hKubj)}(hlandlock_inode_securityh]j)}(hjO h]hlandlock_inode_security}(hju hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjq ubah}(h]h ](jjeh"]h$]h&]hhuh1jhjQ hhhjb hKubeh}(h]h ]h"]h$]h&]hhj!uh1jj"j#hjM hhhjb hKubah}(h]jG ah ](j'j(eh"]h$]h&]j,j-)j.huh1jhjb hKhjJ hhubj0)}(hhh]j)}(hInode security blobh]hInode security blob}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhY/var/lib/git/docbuild/linux/Documentation/security/landlock:150: ./security/landlock/fs.hhKhj hhubah}(h]h ]h"]h$]h&]uh1j/hjJ hhhjb hKubeh}(h]h ](jLstructeh"]h$]h&]jQjLjRj jSj jTjUjVuh1jhhhj* hjI hNubjX)}(hXz**Definition**:: struct landlock_inode_security { struct landlock_object *object; }; **Members** ``object`` Weak pointer to an allocated object. All assignments of a new object are protected by the underlying inode->i_lock. However, atomically disassociating **object** from the inode is only protected by **object->lock**, from the time **object**'s usage refcount drops to zero to the time this pointer is nulled out (cf. release_inode() and hook_sb_delete()). Indeed, such disassociation doesn't require inode->i_lock thanks to the careful rcu_access_pointer() check performed by get_inode_object().h](j)}(h**Definition**::h](jb)}(h**Definition**h]h Definition}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jahj ubh:}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhY/var/lib/git/docbuild/linux/Documentation/security/landlock:150: ./security/landlock/fs.hhKhj ubj})}(hGstruct landlock_inode_security { struct landlock_object *object; };h]hGstruct landlock_inode_security { struct landlock_object *object; };}hj sbah}(h]h ]h"]h$]h&]hhuh1j|hY/var/lib/git/docbuild/linux/Documentation/security/landlock:150: ./security/landlock/fs.hhKhj ubj)}(h **Members**h]jb)}(hj h]hMembers}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jahj ubah}(h]h ]h"]h$]h&]uh1jhY/var/lib/git/docbuild/linux/Documentation/security/landlock:150: ./security/landlock/fs.hhK"hj ubj)}(hhh]j)}(hX``object`` Weak pointer to an allocated object. All assignments of a new object are protected by the underlying inode->i_lock. However, atomically disassociating **object** from the inode is only protected by **object->lock**, from the time **object**'s usage refcount drops to zero to the time this pointer is nulled out (cf. release_inode() and hook_sb_delete()). Indeed, such disassociation doesn't require inode->i_lock thanks to the careful rcu_access_pointer() check performed by get_inode_object().h](j)}(h ``object``h]j)}(hj h]hobject}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubah}(h]h ]h"]h$]h&]uh1jhY/var/lib/git/docbuild/linux/Documentation/security/landlock:150: ./security/landlock/fs.hhK&hj ubj)}(hhh]j)}(hXWeak pointer to an allocated object. All assignments of a new object are protected by the underlying inode->i_lock. However, atomically disassociating **object** from the inode is only protected by **object->lock**, from the time **object**'s usage refcount drops to zero to the time this pointer is nulled out (cf. release_inode() and hook_sb_delete()). Indeed, such disassociation doesn't require inode->i_lock thanks to the careful rcu_access_pointer() check performed by get_inode_object().h](hWeak pointer to an allocated object. All assignments of a new object are protected by the underlying inode->i_lock. However, atomically disassociating }(hj hhhNhNubjb)}(h **object**h]hobject}(hj% hhhNhNubah}(h]h ]h"]h$]h&]uh1jahj ubh% from the inode is only protected by }(hj hhhNhNubjb)}(h**object->lock**h]h object->lock}(hj7 hhhNhNubah}(h]h ]h"]h$]h&]uh1jahj ubh, from the time }(hj hhhNhNubjb)}(h **object**h]hobject}(hjI hhhNhNubah}(h]h ]h"]h$]h&]uh1jahj ubhX’s usage refcount drops to zero to the time this pointer is nulled out (cf. release_inode() and hook_sb_delete()). Indeed, such disassociation doesn’t require inode->i_lock thanks to the careful rcu_access_pointer() check performed by get_inode_object().}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhY/var/lib/git/docbuild/linux/Documentation/security/landlock:150: ./security/landlock/fs.hhK hj ubah}(h]h ]h"]h$]h&]uh1jhj ubeh}(h]h ]h"]h$]h&]uh1jhj hK&hj ubah}(h]h ]h"]h$]h&]uh1jhj ubeh}(h]h ] kernelindentah"]h$]h&]uh1jWhj* hhhjI hNubj)}(h**Description**h]jb)}(hj} h]h Description}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jahj{ ubah}(h]h ]h"]h$]h&]uh1jhY/var/lib/git/docbuild/linux/Documentation/security/landlock:150: ./security/landlock/fs.hhK*hj* hhubj)}(hsEnable to reference a :c:type:`struct landlock_object ` tied to an inode (i.e. underlying object).h](hEnable to reference a }(hj hhhNhNubh)}(h2:c:type:`struct landlock_object `h]j)}(hj h]hstruct landlock_object}(hj hhhNhNubah}(h]h ](j jLc-typeeh"]h$]h&]uh1jhj ubah}(h]h ]h"]h$]h&]refdocj refdomainjLreftypetype refexplicitrefwarnj j j landlock_objectuh1hhY/var/lib/git/docbuild/linux/Documentation/security/landlock:150: ./security/landlock/fs.hhKhj ubh+ tied to an inode (i.e. underlying object).}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhj hKhj* hhubj)}(hhh]h}(h]h ]h"]h$]h&]entries](j!landlock_file_security (C struct)c.landlock_file_securityhNtauh1jhj* hhhjI hNubj)}(hhh](j)}(hlandlock_file_securityh]j)}(hstruct landlock_file_securityh](j)}(hjh]hstruct}(hj hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj hhhY/var/lib/git/docbuild/linux/Documentation/security/landlock:150: ./security/landlock/fs.hhKubj)}(h h]h }(hj hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj hhhj hKubj)}(hlandlock_file_securityh]j)}(hj h]hlandlock_file_security}(hj hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj ubah}(h]h ](jjeh"]h$]h&]hhuh1jhj hhhj hKubeh}(h]h ]h"]h$]h&]hhj!uh1jj"j#hj hhhj hKubah}(h]j ah ](j'j(eh"]h$]h&]j,j-)j.huh1jhj hKhj hhubj0)}(hhh]j)}(hFile security blobh]hFile security blob}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhY/var/lib/git/docbuild/linux/Documentation/security/landlock:150: ./security/landlock/fs.hhK,hj hhubah}(h]h ]h"]h$]h&]uh1j/hj hhhj hKubeh}(h]h ](jLstructeh"]h$]h&]jQjLjRj8 jSj8 jTjUjVuh1jhhhj* hjI hNubjX)}(hX**Definition**:: struct landlock_file_security { access_mask_t allowed_access; #ifdef CONFIG_AUDIT; deny_masks_t deny_masks; u8 fown_layer; #endif ; struct landlock_cred_security fown_subject; }; **Members** ``allowed_access`` Access rights that were available at the time of opening the file. This is not necessarily the full set of access rights available at that time, but it's the necessary subset as needed to authorize later operations on the open file. ``deny_masks`` Domain layer levels that deny an optional access (see _LANDLOCK_ACCESS_FS_OPTIONAL). ``fown_layer`` Layer level of **fown_subject->domain** with LANDLOCK_SCOPE_SIGNAL. ``fown_subject`` Landlock credential of the task that set the PID that may receive a signal e.g., SIGURG when writing MSG_OOB to the related socket. This pointer is protected by the related file->f_owner->lock, as for fown_struct's members: pid, uid, and euid.h](j)}(h**Definition**::h](jb)}(h**Definition**h]h Definition}(hjD hhhNhNubah}(h]h ]h"]h$]h&]uh1jahj@ ubh:}(hj@ hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhY/var/lib/git/docbuild/linux/Documentation/security/landlock:150: ./security/landlock/fs.hhK0hj< ubj})}(hstruct landlock_file_security { access_mask_t allowed_access; #ifdef CONFIG_AUDIT; deny_masks_t deny_masks; u8 fown_layer; #endif ; struct landlock_cred_security fown_subject; };h]hstruct landlock_file_security { access_mask_t allowed_access; #ifdef CONFIG_AUDIT; deny_masks_t deny_masks; u8 fown_layer; #endif ; struct landlock_cred_security fown_subject; };}hj] sbah}(h]h ]h"]h$]h&]hhuh1j|hY/var/lib/git/docbuild/linux/Documentation/security/landlock:150: ./security/landlock/fs.hhK2hj< ubj)}(h **Members**h]jb)}(hjn h]hMembers}(hjp hhhNhNubah}(h]h ]h"]h$]h&]uh1jahjl ubah}(h]h ]h"]h$]h&]uh1jhY/var/lib/git/docbuild/linux/Documentation/security/landlock:150: ./security/landlock/fs.hhK;hj< ubj)}(hhh](j)}(h``allowed_access`` Access rights that were available at the time of opening the file. This is not necessarily the full set of access rights available at that time, but it's the necessary subset as needed to authorize later operations on the open file. h](j)}(h``allowed_access``h]j)}(hj h]hallowed_access}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubah}(h]h ]h"]h$]h&]uh1jhY/var/lib/git/docbuild/linux/Documentation/security/landlock:150: ./security/landlock/fs.hhK9hj ubj)}(hhh]j)}(hAccess rights that were available at the time of opening the file. This is not necessarily the full set of access rights available at that time, but it's the necessary subset as needed to authorize later operations on the open file.h]hAccess rights that were available at the time of opening the file. This is not necessarily the full set of access rights available at that time, but it’s the necessary subset as needed to authorize later operations on the open file.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhY/var/lib/git/docbuild/linux/Documentation/security/landlock:150: ./security/landlock/fs.hhK6hj ubah}(h]h ]h"]h$]h&]uh1jhj ubeh}(h]h ]h"]h$]h&]uh1jhj hK9hj ubj)}(hd``deny_masks`` Domain layer levels that deny an optional access (see _LANDLOCK_ACCESS_FS_OPTIONAL). h](j)}(h``deny_masks``h]j)}(hj h]h deny_masks}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubah}(h]h ]h"]h$]h&]uh1jhY/var/lib/git/docbuild/linux/Documentation/security/landlock:150: ./security/landlock/fs.hhK@hj ubj)}(hhh]j)}(hTDomain layer levels that deny an optional access (see _LANDLOCK_ACCESS_FS_OPTIONAL).h]hTDomain layer levels that deny an optional access (see _LANDLOCK_ACCESS_FS_OPTIONAL).}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhY/var/lib/git/docbuild/linux/Documentation/security/landlock:150: ./security/landlock/fs.hhK?hj ubah}(h]h ]h"]h$]h&]uh1jhj ubeh}(h]h ]h"]h$]h&]uh1jhj hK@hj ubj)}(hS``fown_layer`` Layer level of **fown_subject->domain** with LANDLOCK_SCOPE_SIGNAL. h](j)}(h``fown_layer``h]j)}(hj h]h fown_layer}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubah}(h]h ]h"]h$]h&]uh1jhY/var/lib/git/docbuild/linux/Documentation/security/landlock:150: ./security/landlock/fs.hhKEhj ubj)}(hhh]j)}(hCLayer level of **fown_subject->domain** with LANDLOCK_SCOPE_SIGNAL.h](hLayer level of }(hj hhhNhNubjb)}(h**fown_subject->domain**h]hfown_subject->domain}(hj" hhhNhNubah}(h]h ]h"]h$]h&]uh1jahj ubh with LANDLOCK_SCOPE_SIGNAL.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhY/var/lib/git/docbuild/linux/Documentation/security/landlock:150: ./security/landlock/fs.hhKDhj ubah}(h]h ]h"]h$]h&]uh1jhj ubeh}(h]h ]h"]h$]h&]uh1jhj hKEhj ubj)}(hX``fown_subject`` Landlock credential of the task that set the PID that may receive a signal e.g., SIGURG when writing MSG_OOB to the related socket. This pointer is protected by the related file->f_owner->lock, as for fown_struct's members: pid, uid, and euid.h](j)}(h``fown_subject``h]j)}(hjM h]h fown_subject}(hjO hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjK ubah}(h]h ]h"]h$]h&]uh1jhY/var/lib/git/docbuild/linux/Documentation/security/landlock:150: ./security/landlock/fs.hhKNhjG ubj)}(hhh]j)}(hLandlock credential of the task that set the PID that may receive a signal e.g., SIGURG when writing MSG_OOB to the related socket. This pointer is protected by the related file->f_owner->lock, as for fown_struct's members: pid, uid, and euid.h]hLandlock credential of the task that set the PID that may receive a signal e.g., SIGURG when writing MSG_OOB to the related socket. This pointer is protected by the related file->f_owner->lock, as for fown_struct’s members: pid, uid, and euid.}(hjf hhhNhNubah}(h]h ]h"]h$]h&]uh1jhY/var/lib/git/docbuild/linux/Documentation/security/landlock:150: ./security/landlock/fs.hhKKhjc ubah}(h]h ]h"]h$]h&]uh1jhjG ubeh}(h]h ]h"]h$]h&]uh1jhjb hKNhj ubeh}(h]h ]h"]h$]h&]uh1jhj< ubeh}(h]h ] kernelindentah"]h$]h&]uh1jWhj* hhhjI hNubj)}(h**Description**h]jb)}(hj h]h Description}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jahj ubah}(h]h ]h"]h$]h&]uh1jhY/var/lib/git/docbuild/linux/Documentation/security/landlock:150: ./security/landlock/fs.hhKRhj* hhubj)}(hXThis information is populated when opening a file in hook_file_open, and tracks the relevant Landlock access rights that were available at the time of opening the file. Other LSM hooks use these rights in order to authorize operations on already opened files.h]hXThis information is populated when opening a file in hook_file_open, and tracks the relevant Landlock access rights that were available at the time of opening the file. Other LSM hooks use these rights in order to authorize operations on already opened files.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhY/var/lib/git/docbuild/linux/Documentation/security/landlock:150: ./security/landlock/fs.hhK-hj* hhubj)}(hhh]h}(h]h ]h"]h$]h&]entries](j'landlock_superblock_security (C struct)c.landlock_superblock_securityhNtauh1jhj* hhhjI hNubj)}(hhh](j)}(hlandlock_superblock_securityh]j)}(h#struct landlock_superblock_securityh](j)}(hjh]hstruct}(hj hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj hhhY/var/lib/git/docbuild/linux/Documentation/security/landlock:150: ./security/landlock/fs.hhK5ubj)}(h h]h }(hj hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj hhhj hK5ubj)}(hlandlock_superblock_securityh]j)}(hj h]hlandlock_superblock_security}(hj hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj ubah}(h]h ](jjeh"]h$]h&]hhuh1jhj hhhj hK5ubeh}(h]h ]h"]h$]h&]hhj!uh1jj"j#hj hhhj hK5ubah}(h]j ah ](j'j(eh"]h$]h&]j,j-)j.huh1jhj hK5hj hhubj0)}(hhh]j)}(hSuperblock security blobh]hSuperblock security blob}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhY/var/lib/git/docbuild/linux/Documentation/security/landlock:150: ./security/landlock/fs.hhK^hj hhubah}(h]h ]h"]h$]h&]uh1j/hj hhhj hK5ubeh}(h]h ](jLstructeh"]h$]h&]jQjLjRj(jSj(jTjUjVuh1jhhhj* hjI hNubjX)}(hX **Definition**:: struct landlock_superblock_security { atomic_long_t inode_refs; }; **Members** ``inode_refs`` Number of pending inodes (from this superblock) that are being released by release_inode(). Cf. struct super_block->s_fsnotify_inode_refs .h](j)}(h**Definition**::h](jb)}(h**Definition**h]h Definition}(hj4hhhNhNubah}(h]h ]h"]h$]h&]uh1jahj0ubh:}(hj0hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhY/var/lib/git/docbuild/linux/Documentation/security/landlock:150: ./security/landlock/fs.hhKbhj,ubj})}(hFstruct landlock_superblock_security { atomic_long_t inode_refs; };h]hFstruct landlock_superblock_security { atomic_long_t inode_refs; };}hjMsbah}(h]h ]h"]h$]h&]hhuh1j|hY/var/lib/git/docbuild/linux/Documentation/security/landlock:150: ./security/landlock/fs.hhKdhj,ubj)}(h **Members**h]jb)}(hj^h]hMembers}(hj`hhhNhNubah}(h]h ]h"]h$]h&]uh1jahj\ubah}(h]h ]h"]h$]h&]uh1jhY/var/lib/git/docbuild/linux/Documentation/security/landlock:150: ./security/landlock/fs.hhKhhj,ubj)}(hhh]j)}(h``inode_refs`` Number of pending inodes (from this superblock) that are being released by release_inode(). Cf. struct super_block->s_fsnotify_inode_refs .h](j)}(h``inode_refs``h]j)}(hj}h]h inode_refs}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj{ubah}(h]h ]h"]h$]h&]uh1jhY/var/lib/git/docbuild/linux/Documentation/security/landlock:150: ./security/landlock/fs.hhKfhjwubj)}(hhh]j)}(hNumber of pending inodes (from this superblock) that are being released by release_inode(). Cf. struct super_block->s_fsnotify_inode_refs .h]hNumber of pending inodes (from this superblock) that are being released by release_inode(). Cf. struct super_block->s_fsnotify_inode_refs .}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhY/var/lib/git/docbuild/linux/Documentation/security/landlock:150: ./security/landlock/fs.hhKehjubah}(h]h ]h"]h$]h&]uh1jhjwubeh}(h]h ]h"]h$]h&]uh1jhjhKfhjtubah}(h]h ]h"]h$]h&]uh1jhj,ubeh}(h]h ] kernelindentah"]h$]h&]uh1jWhj* hhhjI hNubj)}(h**Description**h]jb)}(hjh]h Description}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jahjubah}(h]h ]h"]h$]h&]uh1jhY/var/lib/git/docbuild/linux/Documentation/security/landlock:150: ./security/landlock/fs.hhKjhj* hhubj)}(hHEnable hook_sb_delete() to wait for concurrent calls to release_inode().h]hHEnable hook_sb_delete() to wait for concurrent calls to release_inode().}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhY/var/lib/git/docbuild/linux/Documentation/security/landlock:150: ./security/landlock/fs.hhK_hj* hhubeh}(h] filesystemah ]h"] filesystemah$]h&]uh1hhjhhhhhKubh)}(hhh](h)}(hProcess credentialh]hProcess credential}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKubj)}(hhh]h}(h]h ]h"]h$]h&]entries](j!landlock_cred_security (C struct)c.landlock_cred_securityhNtauh1jhjhhhNhNubj)}(hhh](j)}(hlandlock_cred_securityh]j)}(hstruct landlock_cred_securityh](j)}(hjh]hstruct}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjhhh[/var/lib/git/docbuild/linux/Documentation/security/landlock:156: ./security/landlock/cred.hhKubj)}(h h]h }(hj%hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjhhhj$hKubj)}(hlandlock_cred_securityh]j)}(hjh]hlandlock_cred_security}(hj7hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj3ubah}(h]h ](jjeh"]h$]h&]hhuh1jhjhhhj$hKubeh}(h]h ]h"]h$]h&]hhj!uh1jj"j#hjhhhj$hKubah}(h]j ah ](j'j(eh"]h$]h&]j,j-)j.huh1jhj$hKhj hhubj0)}(hhh]j)}(hCredential security blobh]hCredential security blob}(hjYhhhNhNubah}(h]h ]h"]h$]h&]uh1jh[/var/lib/git/docbuild/linux/Documentation/security/landlock:156: ./security/landlock/cred.hhKhjVhhubah}(h]h ]h"]h$]h&]uh1j/hj hhhj$hKubeh}(h]h ](jLstructeh"]h$]h&]jQjLjRjqjSjqjTjUjVuh1jhhhjhNhNubjX)}(hX**Definition**:: struct landlock_cred_security { struct landlock_ruleset *domain; #ifdef CONFIG_AUDIT; u16 domain_exec; u8 log_subdomains_off : 1; #endif ; }; **Members** ``domain`` Immutable ruleset enforced on a task. ``domain_exec`` Bitmask identifying the domain layers that were enforced by the current task's executed file (i.e. no new execve(2) since landlock_restrict_self(2)). ``log_subdomains_off`` Set if the domain descendants's log_status should be set to ``LANDLOCK_LOG_DISABLED``. This is not a landlock_hierarchy configuration because it applies to future descendant domains and it does not require a current domain.h](j)}(h**Definition**::h](jb)}(h**Definition**h]h Definition}(hj}hhhNhNubah}(h]h ]h"]h$]h&]uh1jahjyubh:}(hjyhhhNhNubeh}(h]h ]h"]h$]h&]uh1jh[/var/lib/git/docbuild/linux/Documentation/security/landlock:156: ./security/landlock/cred.hhKhjuubj})}(hstruct landlock_cred_security { struct landlock_ruleset *domain; #ifdef CONFIG_AUDIT; u16 domain_exec; u8 log_subdomains_off : 1; #endif ; };h]hstruct landlock_cred_security { struct landlock_ruleset *domain; #ifdef CONFIG_AUDIT; u16 domain_exec; u8 log_subdomains_off : 1; #endif ; };}hjsbah}(h]h ]h"]h$]h&]hhuh1j|h[/var/lib/git/docbuild/linux/Documentation/security/landlock:156: ./security/landlock/cred.hhKhjuubj)}(h **Members**h]jb)}(hjh]hMembers}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jahjubah}(h]h ]h"]h$]h&]uh1jh[/var/lib/git/docbuild/linux/Documentation/security/landlock:156: ./security/landlock/cred.hhK&hjuubj)}(hhh](j)}(h1``domain`` Immutable ruleset enforced on a task. h](j)}(h ``domain``h]j)}(hjh]hdomain}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1jh[/var/lib/git/docbuild/linux/Documentation/security/landlock:156: ./security/landlock/cred.hhK#hjubj)}(hhh]j)}(h%Immutable ruleset enforced on a task.h]h%Immutable ruleset enforced on a task.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjhK#hjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjhK#hjubj)}(h``domain_exec`` Bitmask identifying the domain layers that were enforced by the current task's executed file (i.e. no new execve(2) since landlock_restrict_self(2)). h](j)}(h``domain_exec``h]j)}(hjh]h domain_exec}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1jh[/var/lib/git/docbuild/linux/Documentation/security/landlock:156: ./security/landlock/cred.hhK+hjubj)}(hhh]j)}(hBitmask identifying the domain layers that were enforced by the current task's executed file (i.e. no new execve(2) since landlock_restrict_self(2)).h]hBitmask identifying the domain layers that were enforced by the current task’s executed file (i.e. no new execve(2) since landlock_restrict_self(2)).}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jh[/var/lib/git/docbuild/linux/Documentation/security/landlock:156: ./security/landlock/cred.hhK)hjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjhK+hjubj)}(h``log_subdomains_off`` Set if the domain descendants's log_status should be set to ``LANDLOCK_LOG_DISABLED``. This is not a landlock_hierarchy configuration because it applies to future descendant domains and it does not require a current domain.h](j)}(h``log_subdomains_off``h]j)}(hj9h]hlog_subdomains_off}(hj;hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj7ubah}(h]h ]h"]h$]h&]uh1jh[/var/lib/git/docbuild/linux/Documentation/security/landlock:156: ./security/landlock/cred.hhK1hj3ubj)}(hhh]j)}(hSet if the domain descendants's log_status should be set to ``LANDLOCK_LOG_DISABLED``. This is not a landlock_hierarchy configuration because it applies to future descendant domains and it does not require a current domain.h](h>Set if the domain descendants’s log_status should be set to }(hjRhhhNhNubj)}(h``LANDLOCK_LOG_DISABLED``h]hLANDLOCK_LOG_DISABLED}(hjZhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjRubh. This is not a landlock_hierarchy configuration because it applies to future descendant domains and it does not require a current domain.}(hjRhhhNhNubeh}(h]h ]h"]h$]h&]uh1jh[/var/lib/git/docbuild/linux/Documentation/security/landlock:156: ./security/landlock/cred.hhK/hjOubah}(h]h ]h"]h$]h&]uh1jhj3ubeh}(h]h ]h"]h$]h&]uh1jhjNhK1hjubeh}(h]h ]h"]h$]h&]uh1jhjuubeh}(h]h ] kernelindentah"]h$]h&]uh1jWhjhhhNhNubj)}(h**Description**h]jb)}(hjh]h Description}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jahjubah}(h]h ]h"]h$]h&]uh1jh[/var/lib/git/docbuild/linux/Documentation/security/landlock:156: ./security/landlock/cred.hhK5hjhhubj)}(hThis structure is packed to minimize the size of struct landlock_file_security. However, it is always aligned in the LSM cred blob, see lsm_set_blob_size().h]hThis structure is packed to minimize the size of struct landlock_file_security. However, it is always aligned in the LSM cred blob, see lsm_set_blob_size().}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jh[/var/lib/git/docbuild/linux/Documentation/security/landlock:156: ./security/landlock/cred.hhKhjhhubj)}(h?When updating this, also update landlock_cred_copy() if needed.h]h?When updating this, also update landlock_cred_copy() if needed.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jh[/var/lib/git/docbuild/linux/Documentation/security/landlock:156: ./security/landlock/cred.hhKhjhhubj)}(hhh]h}(h]h ]h"]h$]h&]entries](j,landlock_get_applicable_subject (C function)!c.landlock_get_applicable_subjecthNtauh1jhjhhhNhNubj)}(hhh](j)}(hconst struct landlock_cred_security * landlock_get_applicable_subject (const struct cred *const cred, const struct access_masks masks, size_t *const handle_layer)h]j)}(hconst struct landlock_cred_security *landlock_get_applicable_subject(const struct cred *const cred, const struct access_masks masks, size_t *const handle_layer)h](j)}(hconsth]hconst}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjhhh[/var/lib/git/docbuild/linux/Documentation/security/landlock:156: ./security/landlock/cred.hhKlubj)}(h h]h }(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjhhhjhKlubj)}(hjh]hstruct}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjhhhjhKlubj)}(h h]h }(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjhhhjhKlubh)}(hhh]j)}(hlandlock_cred_securityh]hlandlock_cred_security}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&] refdomainjLreftype identifier reftargetjmodnameN classnameNj j )}j ]j ASTIdentifier)}j,landlock_get_applicable_subjectsb!c.landlock_get_applicable_subjectasbuh1hhjhhhjhKlubj)}(h h]h }(hj:hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjhhhjhKlubhdesc_sig_punctuation)}(hjih]h*}(hjJhhhNhNubah}(h]h ]pah"]h$]h&]uh1jHhjhhhjhKlubj)}(hlandlock_get_applicable_subjecth]j)}(hj7h]hlandlock_get_applicable_subject}(hj\hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjXubah}(h]h ](jjeh"]h$]h&]hhuh1jhjhhhjhKlubhdesc_parameterlist)}(h\(const struct cred *const cred, const struct access_masks masks, size_t *const handle_layer)h](hdesc_parameter)}(hconst struct cred *const credh](j)}(hjh]hconst}(hj{hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjwubj)}(h h]h }(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjwubj)}(hjh]hstruct}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjwubj)}(h h]h }(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjwubh)}(hhh]j)}(hcredh]hcred}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&] refdomainjLreftypej, reftargetjmodnameN classnameNj j )}j ]j5!c.landlock_get_applicable_subjectasbuh1hhjwubj)}(h h]h }(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjwubjI)}(hjih]h*}(hjhhhNhNubah}(h]h ]jTah"]h$]h&]uh1jHhjwubj)}(hjh]hconst}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjwubj)}(h h]h }(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjwubj)}(hcredh]hcred}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjwubeh}(h]h ]h"]h$]h&]noemphhhuh1juhjqubjv)}(hconst struct access_masks masksh](j)}(hjh]hconst}(hj!hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubj)}(h h]h }(hj.hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubj)}(hjh]hstruct}(hj<hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubj)}(h h]h }(hjIhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubh)}(hhh]j)}(h access_masksh]h access_masks}(hjZhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjWubah}(h]h ]h"]h$]h&] refdomainjLreftypej, reftargetj\modnameN classnameNj j )}j ]j5!c.landlock_get_applicable_subjectasbuh1hhjubj)}(h h]h }(hjxhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubj)}(hmasksh]hmasks}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]noemphhhuh1juhjqubjv)}(hsize_t *const handle_layerh](h)}(hhh]j)}(hsize_th]hsize_t}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&] refdomainjLreftypej, reftargetjmodnameN classnameNj j )}j ]j5!c.landlock_get_applicable_subjectasbuh1hhjubj)}(h h]h }(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubjI)}(hjih]h*}(hjhhhNhNubah}(h]h ]jTah"]h$]h&]uh1jHhjubj)}(hjh]hconst}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubj)}(h h]h }(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubj)}(h handle_layerh]h handle_layer}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]noemphhhuh1juhjqubeh}(h]h ]h"]h$]h&]hhuh1johjhhhjhKlubeh}(h]h ]h"]h$]h&]hhj!uh1jj"j#hjhhhjhKlubah}(h]jah ](j'j(eh"]h$]h&]j,j-)j.huh1jhjhKlhjhhubj0)}(hhh]j)}(hReturn the subject's Landlock credential if its enforced domain applies to (i.e. handles) at least one of the access rights specified in **masks**h](hReturn the subject’s Landlock credential if its enforced domain applies to (i.e. handles) at least one of the access rights specified in }(hj hhhNhNubjb)}(h **masks**h]hmasks}(hj(hhhNhNubah}(h]h ]h"]h$]h&]uh1jahj ubeh}(h]h ]h"]h$]h&]uh1jh[/var/lib/git/docbuild/linux/Documentation/security/landlock:156: ./security/landlock/cred.hhKlhjhhubah}(h]h ]h"]h$]h&]uh1j/hjhhhjhKlubeh}(h]h ](jLfunctioneh"]h$]h&]jQjLjRjFjSjFjTjUjVuh1jhhhjhNhNubjX)}(hXe**Parameters** ``const struct cred *const cred`` credential ``const struct access_masks masks`` access masks ``size_t *const handle_layer`` returned youngest layer handling a subset of **masks**. Not set if the function returns NULL. **Return** landlock_cred(**cred**) if any access rights specified in **masks** is handled, or NULL otherwise.h](j)}(h**Parameters**h]jb)}(hjPh]h Parameters}(hjRhhhNhNubah}(h]h ]h"]h$]h&]uh1jahjNubah}(h]h ]h"]h$]h&]uh1jh[/var/lib/git/docbuild/linux/Documentation/security/landlock:156: ./security/landlock/cred.hhKphjJubj)}(hhh](j)}(h-``const struct cred *const cred`` credential h](j)}(h!``const struct cred *const cred``h]j)}(hjoh]hconst struct cred *const cred}(hjqhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjmubah}(h]h ]h"]h$]h&]uh1jh[/var/lib/git/docbuild/linux/Documentation/security/landlock:156: ./security/landlock/cred.hhKqhjiubj)}(hhh]j)}(h credentialh]h credential}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjhKqhjubah}(h]h ]h"]h$]h&]uh1jhjiubeh}(h]h ]h"]h$]h&]uh1jhjhKqhjfubj)}(h1``const struct access_masks masks`` access masks h](j)}(h#``const struct access_masks masks``h]j)}(hjh]hconst struct access_masks masks}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1jh[/var/lib/git/docbuild/linux/Documentation/security/landlock:156: ./security/landlock/cred.hhKrhjubj)}(hhh]j)}(h access masksh]h access masks}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjhKrhjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjhKrhjfubj)}(h~``size_t *const handle_layer`` returned youngest layer handling a subset of **masks**. Not set if the function returns NULL. h](j)}(h``size_t *const handle_layer``h]j)}(hjh]hsize_t *const handle_layer}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1jh[/var/lib/git/docbuild/linux/Documentation/security/landlock:156: ./security/landlock/cred.hhKthjubj)}(hhh]j)}(h^returned youngest layer handling a subset of **masks**. Not set if the function returns NULL.h](h-returned youngest layer handling a subset of }(hjhhhNhNubjb)}(h **masks**h]hmasks}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jahjubh(. Not set if the function returns NULL.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jh[/var/lib/git/docbuild/linux/Documentation/security/landlock:156: ./security/landlock/cred.hhKshjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjhKthjfubeh}(h]h ]h"]h$]h&]uh1jhjJubj)}(h **Return**h]jb)}(hj/h]hReturn}(hj1hhhNhNubah}(h]h ]h"]h$]h&]uh1jahj-ubah}(h]h ]h"]h$]h&]uh1jh[/var/lib/git/docbuild/linux/Documentation/security/landlock:156: ./security/landlock/cred.hhKvhjJubj)}(hblandlock_cred(**cred**) if any access rights specified in **masks** is handled, or NULL otherwise.h](hlandlock_cred(}(hjEhhhNhNubjb)}(h**cred**h]hcred}(hjMhhhNhNubah}(h]h ]h"]h$]h&]uh1jahjEubh$) if any access rights specified in }(hjEhhhNhNubjb)}(h **masks**h]hmasks}(hj_hhhNhNubah}(h]h ]h"]h$]h&]uh1jahjEubh is handled, or NULL otherwise.}(hjEhhhNhNubeh}(h]h ]h"]h$]h&]uh1jh[/var/lib/git/docbuild/linux/Documentation/security/landlock:156: ./security/landlock/cred.hhKvhjJubeh}(h]h ] kernelindentah"]h$]h&]uh1jWhjhhhNhNubeh}(h]process-credentialah ]h"]process credentialah$]h&]uh1hhjhhhhhKubh)}(hhh](h)}(hRuleset and domainh]hRuleset and domain}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKubj)}(hX4A domain is a read-only ruleset tied to a set of subjects (i.e. tasks' credentials). Each time a ruleset is enforced on a task, the current domain is duplicated and the ruleset is imported as a new layer of rules in the new domain. Indeed, once in a domain, each rule is tied to a layer level. To grant access to an object, at least one rule of each layer must allow the requested action on the object. A task can then only transit to a new domain that is the intersection of the constraints from the current domain and those of a ruleset provided by the task.h]hX6A domain is a read-only ruleset tied to a set of subjects (i.e. tasks’ credentials). Each time a ruleset is enforced on a task, the current domain is duplicated and the ruleset is imported as a new layer of rules in the new domain. Indeed, once in a domain, each rule is tied to a layer level. To grant access to an object, at least one rule of each layer must allow the requested action on the object. A task can then only transit to a new domain that is the intersection of the constraints from the current domain and those of a ruleset provided by the task.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhKhjhhubj)}(hThe definition of a subject is implicit for a task sandboxing itself, which makes the reasoning much easier and helps avoid pitfalls.h]hThe definition of a subject is implicit for a task sandboxing itself, which makes the reasoning much easier and helps avoid pitfalls.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhKhjhhubj)}(hhh]h}(h]h ]h"]h$]h&]entries](jlandlock_layer (C struct)c.landlock_layerhNtauh1jhjhhhNhNubj)}(hhh](j)}(hlandlock_layerh]j)}(hstruct landlock_layerh](j)}(hjh]hstruct}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjhhh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKubj)}(h h]h }(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjhhhjhKubj)}(hlandlock_layerh]j)}(hjh]hlandlock_layer}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubah}(h]h ](jjeh"]h$]h&]hhuh1jhjhhhjhKubeh}(h]h ]h"]h$]h&]hhj!uh1jj"j#hjhhhjhKubah}(h]jah ](j'j(eh"]h$]h&]j,j-)j.huh1jhjhKhjhhubj0)}(hhh]j)}(hAccess rights for a given layerh]hAccess rights for a given layer}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKhj hhubah}(h]h ]h"]h$]h&]uh1j/hjhhhjhKubeh}(h]h ](jLstructeh"]h$]h&]jQjLjRj'jSj'jTjUjVuh1jhhhjhNhNubjX)}(hX>**Definition**:: struct landlock_layer { u16 level; access_mask_t access; }; **Members** ``level`` Position of this layer in the layer stack. Starts from 1. ``access`` Bitfield of allowed actions on the kernel object. They are relative to the object type (e.g. ``LANDLOCK_ACTION_FS_READ``).h](j)}(h**Definition**::h](jb)}(h**Definition**h]h Definition}(hj3hhhNhNubah}(h]h ]h"]h$]h&]uh1jahj/ubh:}(hj/hhhNhNubeh}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKhj+ubj})}(hCstruct landlock_layer { u16 level; access_mask_t access; };h]hCstruct landlock_layer { u16 level; access_mask_t access; };}hjLsbah}(h]h ]h"]h$]h&]hhuh1j|h^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhK hj+ubj)}(h **Members**h]jb)}(hj]h]hMembers}(hj_hhhNhNubah}(h]h ]h"]h$]h&]uh1jahj[ubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhK%hj+ubj)}(hhh](j)}(hE``level`` Position of this layer in the layer stack. Starts from 1. h](j)}(h ``level``h]j)}(hj|h]hlevel}(hj~hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjzubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKhjvubj)}(hhh]j)}(h:Position of this layer in the layer stack. Starts from 1.h]h:Position of this layer in the layer stack. Starts from 1.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjhKhjubah}(h]h ]h"]h$]h&]uh1jhjvubeh}(h]h ]h"]h$]h&]uh1jhjhKhjsubj)}(h``access`` Bitfield of allowed actions on the kernel object. They are relative to the object type (e.g. ``LANDLOCK_ACTION_FS_READ``).h](j)}(h ``access``h]j)}(hjh]haccess}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhK#hjubj)}(hhh]j)}(h{Bitfield of allowed actions on the kernel object. They are relative to the object type (e.g. ``LANDLOCK_ACTION_FS_READ``).h](h^Bitfield of allowed actions on the kernel object. They are relative to the object type (e.g. }(hjhhhNhNubj)}(h``LANDLOCK_ACTION_FS_READ``h]hLANDLOCK_ACTION_FS_READ}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh).}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhjhK#hjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjhK#hjsubeh}(h]h ]h"]h$]h&]uh1jhj+ubeh}(h]h ] kernelindentah"]h$]h&]uh1jWhjhhhNhNubj)}(hhh]h}(h]h ]h"]h$]h&]entries](jlandlock_key (C union)c.landlock_keyhNtauh1jhjhhhNhNubj)}(hhh](j)}(h landlock_keyh]j)}(hunion landlock_keyh](j)}(hunionh]hunion}(hj hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjhhh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhK*ubj)}(h h]h }(hj/hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjhhhj.hK*ubj)}(h landlock_keyh]j)}(hjh]h landlock_key}(hjAhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj=ubah}(h]h ](jjeh"]h$]h&]hhuh1jhjhhhj.hK*ubeh}(h]h ]h"]h$]h&]hhj!uh1jj"j#hjhhhj.hK*ubah}(h]jah ](j'j(eh"]h$]h&]j,j-)j.huh1jhj.hK*hjhhubj0)}(hhh]j)}(h!Key of a ruleset's red-black treeh]h#Key of a ruleset’s red-black tree}(hjchhhNhNubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhK)hj`hhubah}(h]h ]h"]h$]h&]uh1j/hjhhhj.hK*ubeh}(h]h ](jLunioneh"]h$]h&]jQjLjRj{jSj{jTjUjVuh1jhhhjhNhNubjX)}(hX **Definition**:: union landlock_key { struct landlock_object *object; uintptr_t data; }; **Members** ``object`` Pointer to identify a kernel object (e.g. an inode). ``data`` Raw data to identify an arbitrary 32-bit value (e.g. a TCP port).h](j)}(h**Definition**::h](jb)}(h**Definition**h]h Definition}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jahjubh:}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhK-hjubj})}(hOunion landlock_key { struct landlock_object *object; uintptr_t data; };h]hOunion landlock_key { struct landlock_object *object; uintptr_t data; };}hjsbah}(h]h ]h"]h$]h&]hhuh1j|h^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhK/hjubj)}(h **Members**h]jb)}(hjh]hMembers}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jahjubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhK4hjubj)}(hhh](j)}(h@``object`` Pointer to identify a kernel object (e.g. an inode). h](j)}(h ``object``h]j)}(hjh]hobject}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhK.hjubj)}(hhh]j)}(h4Pointer to identify a kernel object (e.g. an inode).h]h4Pointer to identify a kernel object (e.g. an inode).}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjhK.hjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjhK.hjubj)}(hJ``data`` Raw data to identify an arbitrary 32-bit value (e.g. a TCP port).h](j)}(h``data``h]j)}(hj h]hdata}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhK2hjubj)}(hhh]j)}(hARaw data to identify an arbitrary 32-bit value (e.g. a TCP port).h]hARaw data to identify an arbitrary 32-bit value (e.g. a TCP port).}(hj"hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjhK2hjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjhK2hjubeh}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ] kernelindentah"]h$]h&]uh1jWhjhhhNhNubj)}(hhh]h}(h]h ]h"]h$]h&]entries](jlandlock_key_type (C enum)c.landlock_key_typehNtauh1jhjhhhNhNubj)}(hhh](j)}(hlandlock_key_typeh]j)}(henum landlock_key_typeh](j)}(henumh]henum}(hjbhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj^hhh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhK9ubj)}(h h]h }(hjqhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj^hhhjphK9ubj)}(hlandlock_key_typeh]j)}(hj\h]hlandlock_key_type}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubah}(h]h ](jjeh"]h$]h&]hhuh1jhj^hhhjphK9ubeh}(h]h ]h"]h$]h&]hhj!uh1jj"j#hjZhhhjphK9ubah}(h]jUah ](j'j(eh"]h$]h&]j,j-)j.huh1jhjphK9hjWhhubj0)}(hhh]j)}(h3Type of :c:type:`union landlock_key `h](hType of }(hjhhhNhNubh)}(h+:c:type:`union landlock_key `h]j)}(hjh]hunion landlock_key}(hjhhhNhNubah}(h]h ](j jLc-typeeh"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]refdocj refdomainjLreftypetype refexplicitrefwarnj j )}j ]j4)}j,j\sbc.landlock_key_typeasbj landlock_keyuh1hh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKhjubeh}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhK8hjhhubah}(h]h ]h"]h$]h&]uh1j/hjWhhhjphK9ubeh}(h]h ](jLenumeh"]h$]h&]jQjLjRjjSjjTjUjVuh1jhhhjhNhNubjX)}(h**Constants** ``LANDLOCK_KEY_INODE`` Type of :c:type:`landlock_ruleset.root_inode `'s node keys. ``LANDLOCK_KEY_NET_PORT`` Type of :c:type:`landlock_ruleset.root_net_port `'s node keys.h](j)}(h **Constants**h]jb)}(hjh]h Constants}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jahjubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhK`'s node keys. h](j)}(h``LANDLOCK_KEY_INODE``h]j)}(hj h]hLANDLOCK_KEY_INODE}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhK@hjubj)}(hhh]j)}(hMType of :c:type:`landlock_ruleset.root_inode `'s node keys.h](hType of }(hj&hhhNhNubh)}(h8:c:type:`landlock_ruleset.root_inode `h]j)}(hj0h]hlandlock_ruleset.root_inode}(hj2hhhNhNubah}(h]h ](j jLc-typeeh"]h$]h&]uh1jhj.ubah}(h]h ]h"]h$]h&]refdocj refdomainjLreftypetype refexplicitrefwarnj j j landlock_rulesetuh1hh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhK?hj&ubh’s node keys.}(hj&hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhjMhK?hj#ubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhj"hK@hjubj)}(hj``LANDLOCK_KEY_NET_PORT`` Type of :c:type:`landlock_ruleset.root_net_port `'s node keys.h](j)}(h``LANDLOCK_KEY_NET_PORT``h]j)}(hjjh]hLANDLOCK_KEY_NET_PORT}(hjlhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjhubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKChjdubj)}(hhh]j)}(hPType of :c:type:`landlock_ruleset.root_net_port `'s node keys.h](hType of }(hjhhhNhNubh)}(h;:c:type:`landlock_ruleset.root_net_port `h]j)}(hjh]hlandlock_ruleset.root_net_port}(hjhhhNhNubah}(h]h ](j jLc-typeeh"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]refdocj refdomainjLreftypetype refexplicitrefwarnj j j landlock_rulesetuh1hhjhKChjubh’s node keys.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhjhKChjubah}(h]h ]h"]h$]h&]uh1jhjdubeh}(h]h ]h"]h$]h&]uh1jhjhKChjubeh}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ] kernelindentah"]h$]h&]uh1jWhjhhhNhNubj)}(hhh]h}(h]h ]h"]h$]h&]entries](jlandlock_id (C struct) c.landlock_idhNtauh1jhjhhhNhNubj)}(hhh](j)}(h landlock_idh]j)}(hstruct landlock_idh](j)}(hjh]hstruct}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjhhh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKIubj)}(h h]h }(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjhhhjhKIubj)}(h landlock_idh]j)}(hjh]h landlock_id}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubah}(h]h ](jjeh"]h$]h&]hhuh1jhjhhhjhKIubeh}(h]h ]h"]h$]h&]hhj!uh1jj"j#hjhhhjhKIubah}(h]jah ](j'j(eh"]h$]h&]j,j-)j.huh1jhjhKIhjhhubj0)}(hhh]j)}(h$Unique rule identifier for a ruleseth]h$Unique rule identifier for a ruleset}(hj(hhhNhNubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKHhj%hhubah}(h]h ]h"]h$]h&]uh1j/hjhhhjhKIubeh}(h]h ](jLstructeh"]h$]h&]jQjLjRj@jSj@jTjUjVuh1jhhhjhNhNubjX)}(hX**Definition**:: struct landlock_id { union landlock_key key; const enum landlock_key_type type; }; **Members** ``key`` Identifies either a kernel object (e.g. an inode) or a raw value (e.g. a TCP port). ``type`` Type of a landlock_ruleset's root tree.h](j)}(h**Definition**::h](jb)}(h**Definition**h]h Definition}(hjLhhhNhNubah}(h]h ]h"]h$]h&]uh1jahjHubh:}(hjHhhhNhNubeh}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKLhjDubj})}(hZstruct landlock_id { union landlock_key key; const enum landlock_key_type type; };h]hZstruct landlock_id { union landlock_key key; const enum landlock_key_type type; };}hjesbah}(h]h ]h"]h$]h&]hhuh1j|h^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKNhjDubj)}(h **Members**h]jb)}(hjvh]hMembers}(hjxhhhNhNubah}(h]h ]h"]h$]h&]uh1jahjtubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKShjDubj)}(hhh](j)}(h\``key`` Identifies either a kernel object (e.g. an inode) or a raw value (e.g. a TCP port). h](j)}(h``key``h]j)}(hjh]hkey}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKNhjubj)}(hhh]j)}(hSIdentifies either a kernel object (e.g. an inode) or a raw value (e.g. a TCP port).h]hSIdentifies either a kernel object (e.g. an inode) or a raw value (e.g. a TCP port).}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKMhjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjhKNhjubj)}(h0``type`` Type of a landlock_ruleset's root tree.h](j)}(h``type``h]j)}(hjh]htype}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKQhjubj)}(hhh]j)}(h'Type of a landlock_ruleset's root tree.h]h)Type of a landlock_ruleset’s root tree.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKRhjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjhKQhjubeh}(h]h ]h"]h$]h&]uh1jhjDubeh}(h]h ] kernelindentah"]h$]h&]uh1jWhjhhhNhNubj)}(hhh]h}(h]h ]h"]h$]h&]entries](jlandlock_rule (C struct)c.landlock_rulehNtauh1jhjhhhNhNubj)}(hhh](j)}(h landlock_ruleh]j)}(hstruct landlock_ruleh](j)}(hjh]hstruct}(hj)hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj%hhh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKXubj)}(h h]h }(hj7hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj%hhhj6hKXubj)}(h landlock_ruleh]j)}(hj#h]h landlock_rule}(hjIhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjEubah}(h]h ](jjeh"]h$]h&]hhuh1jhj%hhhj6hKXubeh}(h]h ]h"]h$]h&]hhj!uh1jj"j#hj!hhhj6hKXubah}(h]jah ](j'j(eh"]h$]h&]j,j-)j.huh1jhj6hKXhjhhubj0)}(hhh]j)}(hAccess rights tied to an objecth]hAccess rights tied to an object}(hjkhhhNhNubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKWhjhhhubah}(h]h ]h"]h$]h&]uh1j/hjhhhj6hKXubeh}(h]h ](jLstructeh"]h$]h&]jQjLjRjjSjjTjUjVuh1jhhhjhNhNubjX)}(hX**Definition**:: struct landlock_rule { struct rb_node node; union landlock_key key; u32 num_layers; struct landlock_layer layers[]; }; **Members** ``node`` Node in the ruleset's red-black tree. ``key`` A union to identify either a kernel object (e.g. an inode) or a raw data value (e.g. a network socket port). This is used as a key for this ruleset element. The pointer is set once and never modified. It always points to an allocated object because each rule increments the refcount of its object. ``num_layers`` Number of entries in **layers**. ``layers`` Stack of layers, from the latest to the newest, implemented as a flexible array member (FAM).h](j)}(h**Definition**::h](jb)}(h**Definition**h]h Definition}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jahjubh:}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhK[hjubj})}(hstruct landlock_rule { struct rb_node node; union landlock_key key; u32 num_layers; struct landlock_layer layers[]; };h]hstruct landlock_rule { struct rb_node node; union landlock_key key; u32 num_layers; struct landlock_layer layers[]; };}hjsbah}(h]h ]h"]h$]h&]hhuh1j|h^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhK]hjubj)}(h **Members**h]jb)}(hjh]hMembers}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jahjubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKdhjubj)}(hhh](j)}(h/``node`` Node in the ruleset's red-black tree. h](j)}(h``node``h]j)}(hjh]hnode}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhK\hjubj)}(hhh]j)}(h%Node in the ruleset's red-black tree.h]h'Node in the ruleset’s red-black tree.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjhK\hjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjhK\hjubj)}(hX4``key`` A union to identify either a kernel object (e.g. an inode) or a raw data value (e.g. a network socket port). This is used as a key for this ruleset element. The pointer is set once and never modified. It always points to an allocated object because each rule increments the refcount of its object. h](j)}(h``key``h]j)}(hjh]hkey}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKdhj ubj)}(hhh]j)}(hX+A union to identify either a kernel object (e.g. an inode) or a raw data value (e.g. a network socket port). This is used as a key for this ruleset element. The pointer is set once and never modified. It always points to an allocated object because each rule increments the refcount of its object.h]hX+A union to identify either a kernel object (e.g. an inode) or a raw data value (e.g. a network socket port). This is used as a key for this ruleset element. The pointer is set once and never modified. It always points to an allocated object because each rule increments the refcount of its object.}(hj*hhhNhNubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhK`hj'ubah}(h]h ]h"]h$]h&]uh1jhj ubeh}(h]h ]h"]h$]h&]uh1jhj&hKdhjubj)}(h0``num_layers`` Number of entries in **layers**. h](j)}(h``num_layers``h]j)}(hjKh]h num_layers}(hjMhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjIubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKhhjEubj)}(hhh]j)}(h Number of entries in **layers**.h](hNumber of entries in }(hjdhhhNhNubjb)}(h **layers**h]hlayers}(hjlhhhNhNubah}(h]h ]h"]h$]h&]uh1jahjdubh.}(hjdhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhj`hKhhjaubah}(h]h ]h"]h$]h&]uh1jhjEubeh}(h]h ]h"]h$]h&]uh1jhj`hKhhjubj)}(hh``layers`` Stack of layers, from the latest to the newest, implemented as a flexible array member (FAM).h](j)}(h ``layers``h]j)}(hjh]hlayers}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKlhjubj)}(hhh]j)}(h]Stack of layers, from the latest to the newest, implemented as a flexible array member (FAM).h]h]Stack of layers, from the latest to the newest, implemented as a flexible array member (FAM).}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjhKlhjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjhKlhjubeh}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ] kernelindentah"]h$]h&]uh1jWhjhhhNhNubj)}(hhh]h}(h]h ]h"]h$]h&]entries](jlandlock_ruleset (C struct)c.landlock_rulesethNtauh1jhjhhhNhNubj)}(hhh](j)}(hlandlock_ruleseth]j)}(hstruct landlock_ruleseth](j)}(hjh]hstruct}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjhhh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKsubj)}(h h]h }(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjhhhjhKsubj)}(hlandlock_ruleseth]j)}(hjh]hlandlock_ruleset}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj ubah}(h]h ](jjeh"]h$]h&]hhuh1jhjhhhjhKsubeh}(h]h ]h"]h$]h&]hhj!uh1jj"j#hjhhhjhKsubah}(h]jah ](j'j(eh"]h$]h&]j,j-)j.huh1jhjhKshjhhubj0)}(hhh]j)}(hLandlock ruleseth]hLandlock ruleset}(hj1hhhNhNubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKrhj.hhubah}(h]h ]h"]h$]h&]uh1j/hjhhhjhKsubeh}(h]h ](jLstructeh"]h$]h&]jQjLjRjIjSjIjTjUjVuh1jhhhjhNhNubjX)}(hX **Definition**:: struct landlock_ruleset { struct rb_root root_inode; #if IS_ENABLED(CONFIG_INET); struct rb_root root_net_port; #endif ; struct landlock_hierarchy *hierarchy; union { struct work_struct work_free; struct { struct mutex lock; refcount_t usage; u32 num_rules; u32 num_layers; struct access_masks access_masks[]; }; }; }; **Members** ``root_inode`` Root of a red-black tree containing :c:type:`struct landlock_rule ` nodes with inode object. Once a ruleset is tied to a process (i.e. as a domain), this tree is immutable until **usage** reaches zero. ``root_net_port`` Root of a red-black tree containing :c:type:`struct landlock_rule ` nodes with network port. Once a ruleset is tied to a process (i.e. as a domain), this tree is immutable until **usage** reaches zero. ``hierarchy`` Enables hierarchy identification even when a parent domain vanishes. This is needed for the ptrace protection. ``{unnamed_union}`` anonymous ``work_free`` Enables to free a ruleset within a lockless section. This is only used by landlock_put_ruleset_deferred() when **usage** reaches zero. The fields **lock**, **usage**, **num_rules**, **num_layers** and **access_masks** are then unused. ``{unnamed_struct}`` anonymous ``lock`` Protects against concurrent modifications of **root**, if **usage** is greater than zero. ``usage`` Number of processes (i.e. domains) or file descriptors referencing this ruleset. ``num_rules`` Number of non-overlapping (i.e. not for the same object) rules in this ruleset. ``num_layers`` Number of layers that are used in this ruleset. This enables to check that all the layers allow an access request. A value of 0 identifies a non-merged ruleset (i.e. not a domain). ``access_masks`` Contains the subset of filesystem and network actions that are restricted by a ruleset. A domain saves all layers of merged rulesets in a stack (FAM), starting from the first layer to the last one. These layers are used when merging rulesets, for user space backward compatibility (i.e. future-proof), and to properly handle merged rulesets without overlapping access rights. These layers are set once and never changed for the lifetime of the ruleset.h](j)}(h**Definition**::h](jb)}(h**Definition**h]h Definition}(hjUhhhNhNubah}(h]h ]h"]h$]h&]uh1jahjQubh:}(hjQhhhNhNubeh}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKvhjMubj})}(hXstruct landlock_ruleset { struct rb_root root_inode; #if IS_ENABLED(CONFIG_INET); struct rb_root root_net_port; #endif ; struct landlock_hierarchy *hierarchy; union { struct work_struct work_free; struct { struct mutex lock; refcount_t usage; u32 num_rules; u32 num_layers; struct access_masks access_masks[]; }; }; };h]hXstruct landlock_ruleset { struct rb_root root_inode; #if IS_ENABLED(CONFIG_INET); struct rb_root root_net_port; #endif ; struct landlock_hierarchy *hierarchy; union { struct work_struct work_free; struct { struct mutex lock; refcount_t usage; u32 num_rules; u32 num_layers; struct access_masks access_masks[]; }; }; };}hjnsbah}(h]h ]h"]h$]h&]hhuh1j|h^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKxhjMubj)}(h **Members**h]jb)}(hjh]hMembers}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jahj}ubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKhjMubj)}(hhh](j)}(h``root_inode`` Root of a red-black tree containing :c:type:`struct landlock_rule ` nodes with inode object. Once a ruleset is tied to a process (i.e. as a domain), this tree is immutable until **usage** reaches zero. h](j)}(h``root_inode``h]j)}(hjh]h root_inode}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhK}hjubj)}(hhh]j)}(hRoot of a red-black tree containing :c:type:`struct landlock_rule ` nodes with inode object. Once a ruleset is tied to a process (i.e. as a domain), this tree is immutable until **usage** reaches zero.h](h$Root of a red-black tree containing }(hjhhhNhNubh)}(h.:c:type:`struct landlock_rule `h]j)}(hjh]hstruct landlock_rule}(hjhhhNhNubah}(h]h ](j jLc-typeeh"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]refdocj refdomainjLreftypetype refexplicitrefwarnj j j landlock_ruleuh1hh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKzhjubhp nodes with inode object. Once a ruleset is tied to a process (i.e. as a domain), this tree is immutable until }(hjhhhNhNubjb)}(h **usage**h]husage}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jahjubh reaches zero.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhjhKzhjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjhK}hjubj)}(h``root_net_port`` Root of a red-black tree containing :c:type:`struct landlock_rule ` nodes with network port. Once a ruleset is tied to a process (i.e. as a domain), this tree is immutable until **usage** reaches zero. h](j)}(h``root_net_port``h]j)}(hj h]h root_net_port}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKhjubj)}(hhh]j)}(hRoot of a red-black tree containing :c:type:`struct landlock_rule ` nodes with network port. Once a ruleset is tied to a process (i.e. as a domain), this tree is immutable until **usage** reaches zero.h](h$Root of a red-black tree containing }(hj&hhhNhNubh)}(h.:c:type:`struct landlock_rule `h]j)}(hj0h]hstruct landlock_rule}(hj2hhhNhNubah}(h]h ](j jLc-typeeh"]h$]h&]uh1jhj.ubah}(h]h ]h"]h$]h&]refdocj refdomainjLreftypetype refexplicitrefwarnj j j landlock_ruleuh1hh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKhj&ubho nodes with network port. Once a ruleset is tied to a process (i.e. as a domain), this tree is immutable until }(hj&hhhNhNubjb)}(h **usage**h]husage}(hjRhhhNhNubah}(h]h ]h"]h$]h&]uh1jahj&ubh reaches zero.}(hj&hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhjMhKhj#ubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhj"hKhjubj)}(h~``hierarchy`` Enables hierarchy identification even when a parent domain vanishes. This is needed for the ptrace protection. h](j)}(h ``hierarchy``h]j)}(hj|h]h hierarchy}(hj~hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjzubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKhjvubj)}(hhh]j)}(hoEnables hierarchy identification even when a parent domain vanishes. This is needed for the ptrace protection.h]hoEnables hierarchy identification even when a parent domain vanishes. This is needed for the ptrace protection.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKhjubah}(h]h ]h"]h$]h&]uh1jhjvubeh}(h]h ]h"]h$]h&]uh1jhjhKhjubj)}(h``{unnamed_union}`` anonymous h](j)}(h``{unnamed_union}``h]j)}(hjh]h{unnamed_union}}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKhjubj)}(hhh]j)}(h anonymoush]h anonymous}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjhKhjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjhKhjubj)}(h``work_free`` Enables to free a ruleset within a lockless section. This is only used by landlock_put_ruleset_deferred() when **usage** reaches zero. The fields **lock**, **usage**, **num_rules**, **num_layers** and **access_masks** are then unused. h](j)}(h ``work_free``h]j)}(hjh]h work_free}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKhjubj)}(hhh]j)}(hEnables to free a ruleset within a lockless section. This is only used by landlock_put_ruleset_deferred() when **usage** reaches zero. The fields **lock**, **usage**, **num_rules**, **num_layers** and **access_masks** are then unused.h](hpEnables to free a ruleset within a lockless section. This is only used by landlock_put_ruleset_deferred() when }(hjhhhNhNubjb)}(h **usage**h]husage}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jahjubh reaches zero. The fields }(hjhhhNhNubjb)}(h**lock**h]hlock}(hj"hhhNhNubah}(h]h ]h"]h$]h&]uh1jahjubh, }(hjhhhNhNubjb)}(h **usage**h]husage}(hj4hhhNhNubah}(h]h ]h"]h$]h&]uh1jahjubh, }hjsbjb)}(h **num_rules**h]h num_rules}(hjFhhhNhNubah}(h]h ]h"]h$]h&]uh1jahjubh, }hjsbjb)}(h**num_layers**h]h num_layers}(hjXhhhNhNubah}(h]h ]h"]h$]h&]uh1jahjubh and }(hjhhhNhNubjb)}(h**access_masks**h]h access_masks}(hjjhhhNhNubah}(h]h ]h"]h$]h&]uh1jahjubh are then unused.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKhjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjhKhjubj)}(h``{unnamed_struct}`` anonymous h](j)}(h``{unnamed_struct}``h]j)}(hjh]h{unnamed_struct}}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKhjubj)}(hhh]j)}(h anonymoush]h anonymous}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjhKhjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjhKhjubj)}(hc``lock`` Protects against concurrent modifications of **root**, if **usage** is greater than zero. h](j)}(h``lock``h]j)}(hjh]hlock}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKhjubj)}(hhh]j)}(hYProtects against concurrent modifications of **root**, if **usage** is greater than zero.h](h-Protects against concurrent modifications of }(hjhhhNhNubjb)}(h**root**h]hroot}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jahjubh, if }(hjhhhNhNubjb)}(h **usage**h]husage}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jahjubh is greater than zero.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKhjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjhKhjubj)}(h[``usage`` Number of processes (i.e. domains) or file descriptors referencing this ruleset. h](j)}(h ``usage``h]j)}(hj,h]husage}(hj.hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj*ubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKhj&ubj)}(hhh]j)}(hPNumber of processes (i.e. domains) or file descriptors referencing this ruleset.h]hPNumber of processes (i.e. domains) or file descriptors referencing this ruleset.}(hjEhhhNhNubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKhjBubah}(h]h ]h"]h$]h&]uh1jhj&ubeh}(h]h ]h"]h$]h&]uh1jhjAhKhjubj)}(h^``num_rules`` Number of non-overlapping (i.e. not for the same object) rules in this ruleset. h](j)}(h ``num_rules``h]j)}(hjfh]h num_rules}(hjhhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjdubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKhj`ubj)}(hhh]j)}(hONumber of non-overlapping (i.e. not for the same object) rules in this ruleset.h]hONumber of non-overlapping (i.e. not for the same object) rules in this ruleset.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKhj|ubah}(h]h ]h"]h$]h&]uh1jhj`ubeh}(h]h ]h"]h$]h&]uh1jhj{hKhjubj)}(h``num_layers`` Number of layers that are used in this ruleset. This enables to check that all the layers allow an access request. A value of 0 identifies a non-merged ruleset (i.e. not a domain). h](j)}(h``num_layers``h]j)}(hjh]h num_layers}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKhjubj)}(hhh]j)}(hNumber of layers that are used in this ruleset. This enables to check that all the layers allow an access request. A value of 0 identifies a non-merged ruleset (i.e. not a domain).h]hNumber of layers that are used in this ruleset. This enables to check that all the layers allow an access request. A value of 0 identifies a non-merged ruleset (i.e. not a domain).}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKhjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjhKhjubj)}(hX``access_masks`` Contains the subset of filesystem and network actions that are restricted by a ruleset. A domain saves all layers of merged rulesets in a stack (FAM), starting from the first layer to the last one. These layers are used when merging rulesets, for user space backward compatibility (i.e. future-proof), and to properly handle merged rulesets without overlapping access rights. These layers are set once and never changed for the lifetime of the ruleset.h](j)}(h``access_masks``h]j)}(hjh]h access_masks}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKhjubj)}(hhh]j)}(hXContains the subset of filesystem and network actions that are restricted by a ruleset. A domain saves all layers of merged rulesets in a stack (FAM), starting from the first layer to the last one. These layers are used when merging rulesets, for user space backward compatibility (i.e. future-proof), and to properly handle merged rulesets without overlapping access rights. These layers are set once and never changed for the lifetime of the ruleset.h]hXContains the subset of filesystem and network actions that are restricted by a ruleset. A domain saves all layers of merged rulesets in a stack (FAM), starting from the first layer to the last one. These layers are used when merging rulesets, for user space backward compatibility (i.e. future-proof), and to properly handle merged rulesets without overlapping access rights. These layers are set once and never changed for the lifetime of the ruleset.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKhjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjhKhjubeh}(h]h ]h"]h$]h&]uh1jhjMubeh}(h]h ] kernelindentah"]h$]h&]uh1jWhjhhhNhNubj)}(h**Description**h]jb)}(hj h]h Description}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jahj ubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKhjhhubj)}(h\This data structure must contain unique entries, be updatable, and quick to match an object.h]h\This data structure must contain unique entries, be updatable, and quick to match an object.}(hj3 hhhNhNubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKshjhhubj)}(hhh]h}(h]h ]h"]h$]h&]entries](j(landlock_union_access_masks (C function)c.landlock_union_access_masksvhNtauh1jhjhhhNhNubj)}(hhh](j)}(h]struct access_masks landlock_union_access_masks (const struct landlock_ruleset *const domain)h]j)}(h\struct access_masks landlock_union_access_masks(const struct landlock_ruleset *const domain)h](j)}(hjh]hstruct}(hj[ hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjW hhh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKubj)}(h h]h }(hji hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjW hhhjh hKubh)}(hhh]j)}(h access_masksh]h access_masks}(hjz hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjw ubah}(h]h ]h"]h$]h&] refdomainjLreftypej, reftargetj| modnameN classnameNj j )}j ]j4)}j,landlock_union_access_maskssbc.landlock_union_access_masksasbuh1hhjW hhhjh hKubj)}(h h]h }(hj hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjW hhhjh hKubj)}(hlandlock_union_access_masksh]j)}(hj h]hlandlock_union_access_masks}(hj hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj ubah}(h]h ](jjeh"]h$]h&]hhuh1jhjW hhhjh hKubjp)}(h-(const struct landlock_ruleset *const domain)h]jv)}(h+const struct landlock_ruleset *const domainh](j)}(hjh]hconst}(hj hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj ubj)}(h h]h }(hj hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj ubj)}(hjh]hstruct}(hj hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj ubj)}(h h]h }(hj hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj ubh)}(hhh]j)}(hlandlock_ruleseth]hlandlock_ruleset}(hj!hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj ubah}(h]h ]h"]h$]h&] refdomainjLreftypej, reftargetj!modnameN classnameNj j )}j ]j c.landlock_union_access_masksasbuh1hhj ubj)}(h h]h }(hj!hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj ubjI)}(hjih]h*}(hj-!hhhNhNubah}(h]h ]jTah"]h$]h&]uh1jHhj ubj)}(hjh]hconst}(hj:!hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj ubj)}(h h]h }(hjG!hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj ubj)}(hdomainh]hdomain}(hjU!hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj ubeh}(h]h ]h"]h$]h&]noemphhhuh1juhj ubah}(h]h ]h"]h$]h&]hhuh1johjW hhhjh hKubeh}(h]h ]h"]h$]h&]hhj!uh1jj"j#hjS hhhjh hKubah}(h]jN ah ](j'j(eh"]h$]h&]j,j-)j.huh1jhjh hKhjP hhubj0)}(hhh]j)}(h.Return all access rights handled in the domainh]h.Return all access rights handled in the domain}(hj!hhhNhNubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKhj|!hhubah}(h]h ]h"]h$]h&]uh1j/hjP hhhjh hKubeh}(h]h ](jLfunctioneh"]h$]h&]jQjLjRj!jSj!jTjUjVuh1jhhhjhNhNubjX)}(h**Parameters** ``const struct landlock_ruleset *const domain`` Landlock ruleset (used as a domain) **Return** An access_masks result of the OR of all the domain's access masks.h](j)}(h**Parameters**h]jb)}(hj!h]h Parameters}(hj!hhhNhNubah}(h]h ]h"]h$]h&]uh1jahj!ubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKhj!ubj)}(hhh]j)}(hT``const struct landlock_ruleset *const domain`` Landlock ruleset (used as a domain) h](j)}(h/``const struct landlock_ruleset *const domain``h]j)}(hj!h]h+const struct landlock_ruleset *const domain}(hj!hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj!ubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKhj!ubj)}(hhh]j)}(h#Landlock ruleset (used as a domain)h]h#Landlock ruleset (used as a domain)}(hj!hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj!hKhj!ubah}(h]h ]h"]h$]h&]uh1jhj!ubeh}(h]h ]h"]h$]h&]uh1jhj!hKhj!ubah}(h]h ]h"]h$]h&]uh1jhj!ubj)}(h **Return**h]jb)}(hj!h]hReturn}(hj!hhhNhNubah}(h]h ]h"]h$]h&]uh1jahj!ubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKhj!ubj)}(hBAn access_masks result of the OR of all the domain's access masks.h]hDAn access_masks result of the OR of all the domain’s access masks.}(hj"hhhNhNubah}(h]h ]h"]h$]h&]uh1jh^/var/lib/git/docbuild/linux/Documentation/security/landlock:174: ./security/landlock/ruleset.hhKhj!ubeh}(h]h ] kernelindentah"]h$]h&]uh1jWhjhhhNhNubj)}(hhh]h}(h]h ]h"]h$]h&]entries](jlandlock_details (C struct)c.landlock_detailshNtauh1jhjhhhNhNubj)}(hhh](j)}(hlandlock_detailsh]j)}(hstruct landlock_detailsh](j)}(hjh]hstruct}(hj@"hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj<"hhh]/var/lib/git/docbuild/linux/Documentation/security/landlock:177: ./security/landlock/domain.hhKubj)}(h h]h }(hjN"hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj<"hhhjM"hKubj)}(hlandlock_detailsh]j)}(hj:"h]hlandlock_details}(hj`"hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj\"ubah}(h]h ](jjeh"]h$]h&]hhuh1jhj<"hhhjM"hKubeh}(h]h ]h"]h$]h&]hhj!uh1jj"j#hj8"hhhjM"hKubah}(h]j3"ah ](j'j(eh"]h$]h&]j,j-)j.huh1jhjM"hKhj5"hhubj0)}(hhh]j)}(hDomain's creation informationh]hDomain’s creation information}(hj"hhhNhNubah}(h]h ]h"]h$]h&]uh1jh]/var/lib/git/docbuild/linux/Documentation/security/landlock:177: ./security/landlock/domain.hhKhj"hhubah}(h]h ]h"]h$]h&]uh1j/hj5"hhhjM"hKubeh}(h]h ](jLstructeh"]h$]h&]jQjLjRj"jSj"jTjUjVuh1jhhhjhNhNubjX)}(hX**Definition**:: struct landlock_details { struct pid *pid; uid_t uid; char comm[TASK_COMM_LEN]; char exe_path[]; }; **Members** ``pid`` PID of the task that initially restricted itself. It still identifies the same task. Keeping a reference to this PID ensures that it will not be recycled. ``uid`` UID of the task that initially restricted itself, at creation time. ``comm`` Command line of the task that initially restricted itself, at creation time. Always NULL terminated. ``exe_path`` Executable path of the task that initially restricted itself, at creation time. Always NULL terminated, and never greater than LANDLOCK_PATH_MAX_SIZE.h](j)}(h**Definition**::h](jb)}(h**Definition**h]h Definition}(hj"hhhNhNubah}(h]h ]h"]h$]h&]uh1jahj"ubh:}(hj"hhhNhNubeh}(h]h ]h"]h$]h&]uh1jh]/var/lib/git/docbuild/linux/Documentation/security/landlock:177: ./security/landlock/domain.hhK#hj"ubj})}(hsstruct landlock_details { struct pid *pid; uid_t uid; char comm[TASK_COMM_LEN]; char exe_path[]; };h]hsstruct landlock_details { struct pid *pid; uid_t uid; char comm[TASK_COMM_LEN]; char exe_path[]; };}hj"sbah}(h]h ]h"]h$]h&]hhuh1j|h]/var/lib/git/docbuild/linux/Documentation/security/landlock:177: ./security/landlock/domain.hhK%hj"ubj)}(h **Members**h]jb)}(hj"h]hMembers}(hj"hhhNhNubah}(h]h ]h"]h$]h&]uh1jahj"ubah}(h]h ]h"]h$]h&]uh1jh]/var/lib/git/docbuild/linux/Documentation/security/landlock:177: ./security/landlock/domain.hhK,hj"ubj)}(hhh](j)}(h``pid`` PID of the task that initially restricted itself. It still identifies the same task. Keeping a reference to this PID ensures that it will not be recycled. h](j)}(h``pid``h]j)}(hj"h]hpid}(hj"hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj"ubah}(h]h ]h"]h$]h&]uh1jh]/var/lib/git/docbuild/linux/Documentation/security/landlock:177: ./security/landlock/domain.hhK.hj"ubj)}(hhh]j)}(hPID of the task that initially restricted itself. It still identifies the same task. Keeping a reference to this PID ensures that it will not be recycled.h]hPID of the task that initially restricted itself. It still identifies the same task. Keeping a reference to this PID ensures that it will not be recycled.}(hj#hhhNhNubah}(h]h ]h"]h$]h&]uh1jh]/var/lib/git/docbuild/linux/Documentation/security/landlock:177: ./security/landlock/domain.hhK,hj#ubah}(h]h ]h"]h$]h&]uh1jhj"ubeh}(h]h ]h"]h$]h&]uh1jhj#hK.hj"ubj)}(hL``uid`` UID of the task that initially restricted itself, at creation time. h](j)}(h``uid``h]j)}(hj)#h]huid}(hj+#hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj'#ubah}(h]h ]h"]h$]h&]uh1jh]/var/lib/git/docbuild/linux/Documentation/security/landlock:177: ./security/landlock/domain.hhK2hj##ubj)}(hhh]j)}(hCUID of the task that initially restricted itself, at creation time.h]hCUID of the task that initially restricted itself, at creation time.}(hjB#hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj>#hK2hj?#ubah}(h]h ]h"]h$]h&]uh1jhj##ubeh}(h]h ]h"]h$]h&]uh1jhj>#hK2hj"ubj)}(ho``comm`` Command line of the task that initially restricted itself, at creation time. Always NULL terminated. h](j)}(h``comm``h]j)}(hjb#h]hcomm}(hjd#hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj`#ubah}(h]h ]h"]h$]h&]uh1jh]/var/lib/git/docbuild/linux/Documentation/security/landlock:177: ./security/landlock/domain.hhK7hj\#ubj)}(hhh]j)}(heCommand line of the task that initially restricted itself, at creation time. Always NULL terminated.h]heCommand line of the task that initially restricted itself, at creation time. Always NULL terminated.}(hj{#hhhNhNubah}(h]h ]h"]h$]h&]uh1jh]/var/lib/git/docbuild/linux/Documentation/security/landlock:177: ./security/landlock/domain.hhK6hjx#ubah}(h]h ]h"]h$]h&]uh1jhj\#ubeh}(h]h ]h"]h$]h&]uh1jhjw#hK7hj"ubj)}(h``exe_path`` Executable path of the task that initially restricted itself, at creation time. Always NULL terminated, and never greater than LANDLOCK_PATH_MAX_SIZE.h](j)}(h ``exe_path``h]j)}(hj#h]hexe_path}(hj#hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj#ubah}(h]h ]h"]h$]h&]uh1jh]/var/lib/git/docbuild/linux/Documentation/security/landlock:177: ./security/landlock/domain.hhKNumber of potential children domains plus their parent domain.h]h>Number of potential children domains plus their parent domain.}(hj.%hhhNhNubah}(h]h ]h"]h$]h&]uh1jh]/var/lib/git/docbuild/linux/Documentation/security/landlock:177: ./security/landlock/domain.hhKShj+%ubah}(h]h ]h"]h$]h&]uh1jhj%ubeh}(h]h ]h"]h$]h&]uh1jhj*%hKThj$ubj)}(h``log_status`` Whether this domain should be logged or not. Because concurrent log entries may be created at the same time, it is still possible to have several domain records of the same domain. h](j)}(h``log_status``h]j)}(hjO%h]h log_status}(hjQ%hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjM%ubah}(h]h ]h"]h$]h&]uh1jh]/var/lib/git/docbuild/linux/Documentation/security/landlock:177: ./security/landlock/domain.hhK\hjI%ubj)}(hhh]j)}(hWhether this domain should be logged or not. Because concurrent log entries may be created at the same time, it is still possible to have several domain records of the same domain.h]hWhether this domain should be logged or not. Because concurrent log entries may be created at the same time, it is still possible to have several domain records of the same domain.}(hjh%hhhNhNubah}(h]h ]h"]h$]h&]uh1jh]/var/lib/git/docbuild/linux/Documentation/security/landlock:177: ./security/landlock/domain.hhKZhje%ubah}(h]h ]h"]h$]h&]uh1jhjI%ubeh}(h]h ]h"]h$]h&]uh1jhjd%hK\hj$ubj)}(hw``num_denials`` Number of access requests denied by this domain. Masked (i.e. never logged) denials are still counted. h](j)}(h``num_denials``h]j)}(hj%h]h num_denials}(hj%hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj%ubah}(h]h ]h"]h$]h&]uh1jh]/var/lib/git/docbuild/linux/Documentation/security/landlock:177: ./security/landlock/domain.hhKahj%ubj)}(hhh]j)}(hfNumber of access requests denied by this domain. Masked (i.e. never logged) denials are still counted.h]hfNumber of access requests denied by this domain. Masked (i.e. never logged) denials are still counted.}(hj%hhhNhNubah}(h]h ]h"]h$]h&]uh1jh]/var/lib/git/docbuild/linux/Documentation/security/landlock:177: ./security/landlock/domain.hhK`hj%ubah}(h]h ]h"]h$]h&]uh1jhj%ubeh}(h]h ]h"]h$]h&]uh1jhj%hKahj$ubj)}(h=``id`` Landlock domain ID, set once at domain creation time. h](j)}(h``id``h]j)}(hj%h]hid}(hj%hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj%ubah}(h]h ]h"]h$]h&]uh1jh]/var/lib/git/docbuild/linux/Documentation/security/landlock:177: ./security/landlock/domain.hhKehj%ubj)}(hhh]j)}(h5Landlock domain ID, set once at domain creation time.h]h5Landlock domain ID, set once at domain creation time.}(hj%hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj%hKehj%ubah}(h]h ]h"]h$]h&]uh1jhj%ubeh}(h]h ]h"]h$]h&]uh1jhj%hKehj$ubj)}(h2``details`` Information about the related domain. h](j)}(h ``details``h]j)}(hj%h]hdetails}(hj%hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj%ubah}(h]h ]h"]h$]h&]uh1jh]/var/lib/git/docbuild/linux/Documentation/security/landlock:177: ./security/landlock/domain.hhKihj%ubj)}(hhh]j)}(h%Information about the related domain.h]h%Information about the related domain.}(hj&hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj&hKihj&ubah}(h]h ]h"]h$]h&]uh1jhj%ubeh}(h]h ]h"]h$]h&]uh1jhj&hKihj$ubj)}(h``log_same_exec`` Set if the domain is *not* configured with ``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF``. Set to true by default. h](j)}(h``log_same_exec``h]j)}(hj5&h]h log_same_exec}(hj7&hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj3&ubah}(h]h ]h"]h$]h&]uh1jh]/var/lib/git/docbuild/linux/Documentation/security/landlock:177: ./security/landlock/domain.hhKnhj/&ubj)}(hhh]j)}(hqSet if the domain is *not* configured with ``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF``. Set to true by default.h](hSet if the domain is }(hjN&hhhNhNubj)}(h*not*h]hnot}(hjV&hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjN&ubh configured with }(hjN&hhhNhNubj)}(h,``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF``h]h(LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF}(hjh&hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjN&ubh. Set to true by default.}(hjN&hhhNhNubeh}(h]h ]h"]h$]h&]uh1jh]/var/lib/git/docbuild/linux/Documentation/security/landlock:177: ./security/landlock/domain.hhKmhjK&ubah}(h]h ]h"]h$]h&]uh1jhj/&ubeh}(h]h ]h"]h$]h&]uh1jhjJ&hKnhj$ubj)}(h{``log_new_exec`` Set if the domain is configured with ``LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON``. Set to false by default.h](j)}(h``log_new_exec``h]j)}(hj&h]h log_new_exec}(hj&hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj&ubah}(h]h ]h"]h$]h&]uh1jh]/var/lib/git/docbuild/linux/Documentation/security/landlock:177: ./security/landlock/domain.hhKrhj&ubj)}(hhh]j)}(hjSet if the domain is configured with ``LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON``. Set to false by default.h](h%Set if the domain is configured with }(hj&hhhNhNubj)}(h*``LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON``h]h&LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON}(hj&hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj&ubh. Set to false by default.}(hj&hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhj&hKrhj&ubah}(h]h ]h"]h$]h&]uh1jhj&ubeh}(h]h ]h"]h$]h&]uh1jhj&hKrhj$ubeh}(h]h ]h"]h$]h&]uh1jhj$ubeh}(h]h ] kernelindentah"]h$]h&]uh1jWhjhhhNhNubeh}(h]ruleset-and-domainah ]h"]ruleset and domainah$]h&]uh1hhjhhhhhKubeh}(h]kernel-structuresah ]h"]kernel structuresah$]h&]uh1hhhhhhhhKubh)}(hhh](h)}(hAdditional documentationh]hAdditional documentation}(hj&hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj&hhhhhKubj)}(hhh](j)}(h(Documentation/userspace-api/landlock.rsth]j)}(hj 'h]h(Documentation/userspace-api/landlock.rst}(hj 'hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhKhj 'ubah}(h]h ]h"]h$]h&]uh1jhj'hhhhhNubj)}(h*Documentation/admin-guide/LSM/landlock.rsth]j)}(hj"'h]h*Documentation/admin-guide/LSM/landlock.rst}(hj$'hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhKhj 'ubah}(h]h ]h"]h$]h&]uh1jhj'hhhhhNubj)}(hhttps://landlock.io h]j)}(hhttps://landlock.ioh]j&)}(hj='h]hhttps://landlock.io}(hj?'hhhNhNubah}(h]h ]h"]h$]h&]refurij='uh1j%hj;'ubah}(h]h ]h"]h$]h&]uh1jhhhKhj7'ubah}(h]h ]h"]h$]h&]uh1jhj'hhhhhNubeh}(h]h ]h"]h$]h&]jhjiuh1jhhhKhj&hhubh)}(hLinksh]hLinks}hj_'sbah}(h]h ]h"]h$]h&]hhuh1hhj&hhhhhKubj)}(h.. _tools/testing/selftests/landlock/: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/tools/testing/selftests/landlock/h]h}(h] tools-testing-selftests-landlockah ]h"]!tools/testing/selftests/landlock/ah$]h&]jjuh1jhKhj&hhhhjKubeh}(h]additional-documentationah ]h"]additional documentationah$]h&]uh1hhhhhhhhKubeh}(h]!landlock-lsm-kernel-documentationah ]h"]"landlock lsm: kernel documentationah$]h&]uh1hhhhhhhhKubeh}(h]h ]h"]h$]h&]sourcehuh1hcurrent_sourceN current_lineNsettingsdocutils.frontendValues)}(hN generatorN datestampN source_linkN source_urlN toc_backlinksentryfootnote_backlinksK sectnum_xformKstrip_commentsNstrip_elements_with_classesN strip_classesN report_levelK halt_levelKexit_status_levelKdebugNwarning_streamN tracebackinput_encoding utf-8-siginput_encoding_error_handlerstrictoutput_encodingutf-8output_encoding_error_handlerj'error_encodingutf-8error_encoding_error_handlerbackslashreplace language_codeenrecord_dependenciesNconfigN id_prefixhauto_id_prefixid dump_settingsNdump_internalsNdump_transformsNdump_pseudo_xmlNexpose_internalsNstrict_visitorN_disable_configN_sourcehnj _destinationN _config_files]7/var/lib/git/docbuild/linux/Documentation/docutils.confafile_insertion_enabled raw_enabledKline_length_limitM'pep_referencesN pep_base_urlhttps://peps.python.org/pep_file_url_templatepep-%04drfc_referencesN rfc_base_url&https://datatracker.ietf.org/doc/html/ tab_widthKtrim_footnote_reference_spacesyntax_highlightlong smart_quotessmartquotes_locales]character_level_inline_markupdoctitle_xform docinfo_xformKsectsubtitle_xform image_loadinglinkembed_stylesheetcloak_email_addressessection_self_linkenvNubreporterNindirect_targets]substitution_defs}substitution_names}refnames}(file descriptor access rights]j'a!tools/testing/selftests/landlock/]jqaurefids}j]jasnameids}(j'j'jojljUjRjjjj8jIjjHjEjjj&j&j' j$ jjjjj&j&j~'j{'jv'js'u nametypes}(j'jojUjjjIjHjj&j' jjj&j~'jv'uh}(j'hjljjRjrjjj8jjjjEjjjXj&jj$ jjjjjjj* jG jM j j j j jjj jjjj&jjjjjjUjZjjjj!jjjN jS j3"j8"j$j$$j{'j&js'jm'u footnote_refs} citation_refs} autofootnotes]autofootnote_refs]symbol_footnotes]symbol_footnote_refs] footnotes] citations]autofootnote_startKsymbol_footnote_startK id_counter collectionsCounter}Rparse_messages]transform_messages]hsystem_message)}(hhh]j)}(hhh]h>Hyperlink target "scoped-flags-interaction" is not referenced.}hj(sbah}(h]h ]h"]h$]h&]uh1jhj(ubah}(h]h ]h"]h$]h&]levelKtypeINFOsourcehnjlineK\uh1j(uba transformerN include_log] decorationNhhub.