sphinx.addnodesdocument)}( rawsourcechildren]( translations LanguagesNode)}(hhh](h pending_xref)}(hhh]docutils.nodesTextChinese (Simplified)}parenthsba attributes}(ids]classes]names]dupnames]backrefs] refdomainstdreftypedoc reftarget*/translations/zh_CN/userspace-api/landlockmodnameN classnameN refexplicitutagnamehhh ubh)}(hhh]hChinese (Traditional)}hh2sbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget*/translations/zh_TW/userspace-api/landlockmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hItalian}hhFsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget*/translations/it_IT/userspace-api/landlockmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hJapanese}hhZsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget*/translations/ja_JP/userspace-api/landlockmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hKorean}hhnsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget*/translations/ko_KR/userspace-api/landlockmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hPortuguese (Brazilian)}hhsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget*/translations/pt_BR/userspace-api/landlockmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hSpanish}hhsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget*/translations/sp_SP/userspace-api/landlockmodnameN classnameN refexplicituh1hhh ubeh}(h]h ]h"]h$]h&]current_languageEnglishuh1h hh _documenthsourceNlineNubhcomment)}(h SPDX-License-Identifier: GPL-2.0h]h SPDX-License-Identifier: GPL-2.0}hhsbah}(h]h ]h"]h$]h&] xml:spacepreserveuh1hhhhhhD/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock.rsthKubh)}(h9Copyright © 2017-2020 Mickaël Salaün h]h9Copyright © 2017-2020 Mickaël Salaün }hhsbah}(h]h ]h"]h$]h&]hhuh1hhhhhhhhKubh)}(hCopyright © 2019-2020 ANSSIh]hCopyright © 2019-2020 ANSSI}hhsbah}(h]h ]h"]h$]h&]hhuh1hhhhhhhhKubh)}(h,Copyright © 2021-2022 Microsoft Corporationh]h,Copyright © 2021-2022 Microsoft Corporation}hhsbah}(h]h ]h"]h$]h&]hhuh1hhhhhhhhKubhsection)}(hhh](htitle)}(h%Landlock: unprivileged access controlh]h%Landlock: unprivileged access control}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhhhhhKubh field_list)}(hhh](hfield)}(hhh](h field_name)}(hAuthorh]hAuthor}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjhhhKubh field_body)}(hMickaël Salaünh]h paragraph)}(hj%h]hMickaël Salaün}(hj)hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhK hj#ubah}(h]h ]h"]h$]h&]uh1j!hjubeh}(h]h ]h"]h$]h&]uh1j hhhK hj hhubj )}(hhh](j)}(hDateh]hDate}(hjEhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjBhhhKubj")}(h October 2026 h]j()}(h October 2026h]h October 2026}(hjWhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhK hjSubah}(h]h ]h"]h$]h&]uh1j!hjBubeh}(h]h ]h"]h$]h&]uh1j hhhK hj hhubeh}(h]h ]h"]h$]h&]uh1jhhhhhhhK ubj()}(hXThe goal of Landlock is to enable restriction of ambient rights (e.g. global filesystem or network access) for a set of processes. Because Landlock is a stackable LSM, it makes it possible to create safe security sandboxes as new security layers in addition to the existing system-wide access-controls. This kind of sandbox is expected to help mitigate the security impact of bugs or unexpected/malicious behaviors in user space applications. Landlock empowers any process, including unprivileged ones, to securely restrict themselves.h]hXThe goal of Landlock is to enable restriction of ambient rights (e.g. global filesystem or network access) for a set of processes. Because Landlock is a stackable LSM, it makes it possible to create safe security sandboxes as new security layers in addition to the existing system-wide access-controls. This kind of sandbox is expected to help mitigate the security impact of bugs or unexpected/malicious behaviors in user space applications. Landlock empowers any process, including unprivileged ones, to securely restrict themselves.}(hjwhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhK hhhhubj()}(hXWe can quickly make sure that Landlock is enabled in the running system by looking for "landlock: Up and running" in kernel logs (as root): ``dmesg | grep landlock || journalctl -kb -g landlock`` . Developers can also easily check for Landlock support with a :ref:`related system call `. If Landlock is not currently supported, we need to :ref:`configure the kernel appropriately `.h](hWe can quickly make sure that Landlock is enabled in the running system by looking for “landlock: Up and running” in kernel logs (as root): }(hjhhhNhNubhliteral)}(h7``dmesg | grep landlock || journalctl -kb -g landlock``h]h3dmesg | grep landlock || journalctl -kb -g landlock}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh@ . Developers can also easily check for Landlock support with a }(hjhhhNhNubh)}(h2:ref:`related system call `h]hinline)}(hjh]hrelated system call}(hjhhhNhNubah}(h]h ](xrefstdstd-refeh"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]refdocuserspace-api/landlock refdomainjreftyperef refexplicitrefwarn reftargetlandlock_abi_versionsuh1hhhhKhjubh5. If Landlock is not currently supported, we need to }(hjhhhNhNubh)}(h::ref:`configure the kernel appropriately `h]j)}(hjh]h"configure the kernel appropriately}(hjhhhNhNubah}(h]h ](jstdstd-refeh"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]refdocj refdomainjreftyperef refexplicitrefwarnjkernel_supportuh1hhhhKhjubh.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhKhhhhubh)}(hhh](h)}(hLandlock rulesh]hLandlock rules}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKubj()}(hA Landlock rule describes the actions a process is allowed to perform on a specific resource. A set of rules is aggregated in a ruleset, which can then restrict the thread enforcing it, and its future children.h]hA Landlock rule describes the actions a process is allowed to perform on a specific resource. A set of rules is aggregated in a ruleset, which can then restrict the thread enforcing it, and its future children.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhK hjhhubj()}(h The existing types of rules are:h]h The existing types of rules are:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhK$hjhhubhdefinition_list)}(hhh](hdefinition_list_item)}(hzFilesystem rules The rule key is a file hierarchy, and the actions it allows are defined with `filesystem access rights`. h](hterm)}(hFilesystem rulesh]hFilesystem rules}(hj.hhhNhNubah}(h]h ]h"]h$]h&]uh1j,hhhK(hj(ubh definition)}(hhh]j()}(hhThe rule key is a file hierarchy, and the actions it allows are defined with `filesystem access rights`.h](hMThe rule key is a file hierarchy, and the actions it allows are defined with }(hjAhhhNhNubhtitle_reference)}(h`filesystem access rights`h]hfilesystem access rights}(hjKhhhNhNubah}(h]h ]h"]h$]h&]uh1jIhjAubh.}(hjAhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhK'hj>ubah}(h]h ]h"]h$]h&]uh1j<hj(ubeh}(h]h ]h"]h$]h&]uh1j&hhhK(hj#ubj')}(hNetwork rules (since ABI v4 for TCP and v10 for UDP) For these rules, the object is a TCP or UDP port, and the related actions are defined with `network access rights`. h](j-)}(h4Network rules (since ABI v4 for TCP and v10 for UDP)h]h4Network rules (since ABI v4 for TCP and v10 for UDP)}(hjshhhNhNubah}(h]h ]h"]h$]h&]uh1j,hhhK,hjoubj=)}(hhh]j()}(hsFor these rules, the object is a TCP or UDP port, and the related actions are defined with `network access rights`.h](h[For these rules, the object is a TCP or UDP port, and the related actions are defined with }(hjhhhNhNubjJ)}(h`network access rights`h]hnetwork access rights}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jIhjubh.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhK+hjubah}(h]h ]h"]h$]h&]uh1j<hjoubeh}(h]h ]h"]h$]h&]uh1j&hhhK,hj#hhubj')}(hCapability rules (since ABI v12) The rule body lists which Linux capabilities (see :manpage:`capabilities(7)`) the process may exercise; the action is defined with `permission flags`. h](j-)}(h Capability rules (since ABI v12)h]h Capability rules (since ABI v12)}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j,hhhK1hjubj=)}(hhh]j()}(hThe rule body lists which Linux capabilities (see :manpage:`capabilities(7)`) the process may exercise; the action is defined with `permission flags`.h](h2The rule body lists which Linux capabilities (see }(hjhhhNhNubhmanpage)}(h:manpage:`capabilities(7)`h]hcapabilities(7)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhƌpathcapabilities(7)page capabilitiessection7uh1jhjubh7) the process may exercise; the action is defined with }(hjhhhNhNubjJ)}(h`permission flags`h]hpermission flags}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jIhjubh.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhK/hjubah}(h]h ]h"]h$]h&]uh1j<hjubeh}(h]h ]h"]h$]h&]uh1j&hhhK1hj#hhubj')}(hNamespace rules (since ABI v12) The rule body lists which namespace types (see :manpage:`namespaces(7)`) the process may use; the action is defined with `permission flags`. h](j-)}(hNamespace rules (since ABI v12)h]hNamespace rules (since ABI v12)}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j,hhhK6hj ubj=)}(hhh]j()}(hThe rule body lists which namespace types (see :manpage:`namespaces(7)`) the process may use; the action is defined with `permission flags`.h](h/The rule body lists which namespace types (see }(hj hhhNhNubj)}(h:manpage:`namespaces(7)`h]h namespaces(7)}(hj(hhhNhNubah}(h]h ]jah"]h$]h&]hhj namespaces(7)j namespacesjjuh1jhj ubh2) the process may use; the action is defined with }(hj hhhNhNubjJ)}(h`permission flags`h]hpermission flags}(hj<hhhNhNubah}(h]h ]h"]h$]h&]uh1jIhj ubh.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhK4hjubah}(h]h ]h"]h$]h&]uh1j<hj ubeh}(h]h ]h"]h$]h&]uh1j&hhhK6hj#hhubeh}(h]h ]h"]h$]h&]uh1j!hjhhhhhNubh)}(hhh](h)}(h(Defining and enforcing a security policyh]h(Defining and enforcing a security policy}(hjihhhNhNubah}(h]h ]h"]h$]h&]uh1hhjfhhhhhK9ubj()}(h@We first need to define the ruleset that will contain our rules.h]h@We first need to define the ruleset that will contain our rules.}(hjwhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhK;hjfhhubj()}(hFor this example, the ruleset will contain rules that only allow some filesystem read actions and some specific UDP and TCP actions. Filesystem write actions and other TCP/UDP actions will be denied.h]hFor this example, the ruleset will contain rules that only allow some filesystem read actions and some specific UDP and TCP actions. Filesystem write actions and other TCP/UDP actions will be denied.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhK=hjfhhubj()}(hXThe ruleset then needs to handle all these kinds of actions. This is required for backward and forward compatibility (i.e. the kernel and user space may not know each other's supported restrictions), hence the need to be explicit about the denied-by-default access rights.h]hXThe ruleset then needs to handle all these kinds of actions. This is required for backward and forward compatibility (i.e. the kernel and user space may not know each other’s supported restrictions), hence the need to be explicit about the denied-by-default access rights.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhKAhjfhhubh literal_block)}(hXjstruct landlock_ruleset_attr ruleset_attr = { .handled_access_fs = LANDLOCK_ACCESS_FS_EXECUTE | LANDLOCK_ACCESS_FS_WRITE_FILE | LANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_READ_DIR | LANDLOCK_ACCESS_FS_REMOVE_DIR | LANDLOCK_ACCESS_FS_REMOVE_FILE | LANDLOCK_ACCESS_FS_MAKE_CHAR | LANDLOCK_ACCESS_FS_MAKE_DIR | LANDLOCK_ACCESS_FS_MAKE_REG | LANDLOCK_ACCESS_FS_MAKE_SOCK | LANDLOCK_ACCESS_FS_MAKE_FIFO | LANDLOCK_ACCESS_FS_MAKE_BLOCK | LANDLOCK_ACCESS_FS_MAKE_SYM | LANDLOCK_ACCESS_FS_REFER | LANDLOCK_ACCESS_FS_TRUNCATE | LANDLOCK_ACCESS_FS_IOCTL_DEV | LANDLOCK_ACCESS_FS_RESOLVE_UNIX, .handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP | LANDLOCK_ACCESS_NET_CONNECT_TCP | LANDLOCK_ACCESS_NET_BIND_UDP | LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP, .scoped = LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET | LANDLOCK_SCOPE_SIGNAL, .handled_permissions = LANDLOCK_PERMISSION_NAMESPACE_USE | LANDLOCK_PERMISSION_CAPABILITY_USE, };h]hXjstruct landlock_ruleset_attr ruleset_attr = { .handled_access_fs = LANDLOCK_ACCESS_FS_EXECUTE | LANDLOCK_ACCESS_FS_WRITE_FILE | LANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_READ_DIR | LANDLOCK_ACCESS_FS_REMOVE_DIR | LANDLOCK_ACCESS_FS_REMOVE_FILE | LANDLOCK_ACCESS_FS_MAKE_CHAR | LANDLOCK_ACCESS_FS_MAKE_DIR | LANDLOCK_ACCESS_FS_MAKE_REG | LANDLOCK_ACCESS_FS_MAKE_SOCK | LANDLOCK_ACCESS_FS_MAKE_FIFO | LANDLOCK_ACCESS_FS_MAKE_BLOCK | LANDLOCK_ACCESS_FS_MAKE_SYM | LANDLOCK_ACCESS_FS_REFER | LANDLOCK_ACCESS_FS_TRUNCATE | LANDLOCK_ACCESS_FS_IOCTL_DEV | LANDLOCK_ACCESS_FS_RESOLVE_UNIX, .handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP | LANDLOCK_ACCESS_NET_CONNECT_TCP | LANDLOCK_ACCESS_NET_BIND_UDP | LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP, .scoped = LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET | LANDLOCK_SCOPE_SIGNAL, .handled_permissions = LANDLOCK_PERMISSION_NAMESPACE_USE | LANDLOCK_PERMISSION_CAPABILITY_USE, };}hjsbah}(h]h ]h"]h$]h&]hhƌforcelanguagechighlight_args}uh1jhhhKFhjfhhubj()}(hBecause we may not know which kernel version an application will be executed on, it is safer to follow a best-effort security approach. Indeed, we should try to protect users as much as possible whatever the kernel they are using.h]hBecause we may not know which kernel version an application will be executed on, it is safer to follow a best-effort security approach. Indeed, we should try to protect users as much as possible whatever the kernel they are using.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhKhhjfhhubj()}(hTo be compatible with older Linux versions, we detect the available Landlock ABI version, and only use the available subset of access rights:h]hTo be compatible with older Linux versions, we detect the available Landlock ABI version, and only use the available subset of access rights:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhKmhjfhhubj)}(hXint abi; abi = landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_VERSION); if (abi < 0) { /* Degrades gracefully if Landlock is not handled. */ perror("The running kernel does not enable to use Landlock"); return 0; } switch (abi) { case 1: /* Removes LANDLOCK_ACCESS_FS_REFER for ABI < 2 */ ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_REFER; __attribute__((fallthrough)); case 2: /* Removes LANDLOCK_ACCESS_FS_TRUNCATE for ABI < 3 */ ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_TRUNCATE; __attribute__((fallthrough)); case 3: /* Removes network support for ABI < 4 */ ruleset_attr.handled_access_net &= ~(LANDLOCK_ACCESS_NET_BIND_TCP | LANDLOCK_ACCESS_NET_CONNECT_TCP); __attribute__((fallthrough)); case 4: /* Removes LANDLOCK_ACCESS_FS_IOCTL_DEV for ABI < 5 */ ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_IOCTL_DEV; __attribute__((fallthrough)); case 5: /* Removes LANDLOCK_SCOPE_* for ABI < 6 */ ruleset_attr.scoped &= ~(LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET | LANDLOCK_SCOPE_SIGNAL); __attribute__((fallthrough)); case 6 ... 8: /* Removes LANDLOCK_ACCESS_FS_RESOLVE_UNIX for ABI < 9 */ ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_RESOLVE_UNIX; __attribute__((fallthrough)); case 9: /* Removes LANDLOCK_ACCESS_NET_*_UDP for ABI < 10 */ ruleset_attr.handled_access_net &= ~(LANDLOCK_ACCESS_NET_BIND_UDP | LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP); __attribute__((fallthrough)); case 10: case 11: /* Removes LANDLOCK_PERMISSION_* for ABI < 12 */ ruleset_attr.handled_permissions &= ~(LANDLOCK_PERMISSION_NAMESPACE_USE | LANDLOCK_PERMISSION_CAPABILITY_USE); }h]hXint abi; abi = landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_VERSION); if (abi < 0) { /* Degrades gracefully if Landlock is not handled. */ perror("The running kernel does not enable to use Landlock"); return 0; } switch (abi) { case 1: /* Removes LANDLOCK_ACCESS_FS_REFER for ABI < 2 */ ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_REFER; __attribute__((fallthrough)); case 2: /* Removes LANDLOCK_ACCESS_FS_TRUNCATE for ABI < 3 */ ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_TRUNCATE; __attribute__((fallthrough)); case 3: /* Removes network support for ABI < 4 */ ruleset_attr.handled_access_net &= ~(LANDLOCK_ACCESS_NET_BIND_TCP | LANDLOCK_ACCESS_NET_CONNECT_TCP); __attribute__((fallthrough)); case 4: /* Removes LANDLOCK_ACCESS_FS_IOCTL_DEV for ABI < 5 */ ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_IOCTL_DEV; __attribute__((fallthrough)); case 5: /* Removes LANDLOCK_SCOPE_* for ABI < 6 */ ruleset_attr.scoped &= ~(LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET | LANDLOCK_SCOPE_SIGNAL); __attribute__((fallthrough)); case 6 ... 8: /* Removes LANDLOCK_ACCESS_FS_RESOLVE_UNIX for ABI < 9 */ ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_RESOLVE_UNIX; __attribute__((fallthrough)); case 9: /* Removes LANDLOCK_ACCESS_NET_*_UDP for ABI < 10 */ ruleset_attr.handled_access_net &= ~(LANDLOCK_ACCESS_NET_BIND_UDP | LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP); __attribute__((fallthrough)); case 10: case 11: /* Removes LANDLOCK_PERMISSION_* for ABI < 12 */ ruleset_attr.handled_permissions &= ~(LANDLOCK_PERMISSION_NAMESPACE_USE | LANDLOCK_PERMISSION_CAPABILITY_USE); }}hjsbah}(h]h ]h"]h$]h&]hhjjjj}uh1jhhhKphjfhhubj()}(hNThis enables the creation of an inclusive ruleset that will contain our rules.h]hNThis enables the creation of an inclusive ruleset that will contain our rules.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhKhjfhhubj)}(hint ruleset_fd; ruleset_fd = landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); if (ruleset_fd < 0) { perror("Failed to create a ruleset"); return 1; }h]hint ruleset_fd; ruleset_fd = landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); if (ruleset_fd < 0) { perror("Failed to create a ruleset"); return 1; }}hjsbah}(h]h ]h"]h$]h&]hhjjjj}uh1jhhhKhjfhhubj()}(hXWe can now add a new rule to this ruleset thanks to the returned file descriptor referring to this ruleset. The rule will allow reading and executing the file hierarchy ``/usr``. Without another rule, write actions would then be denied by the ruleset. To add ``/usr`` to the ruleset, we open it with the ``O_PATH`` flag and fill the &struct landlock_path_beneath_attr with this file descriptor.h](hWe can now add a new rule to this ruleset thanks to the returned file descriptor referring to this ruleset. The rule will allow reading and executing the file hierarchy }(hjhhhNhNubj)}(h``/usr``h]h/usr}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhT. Without another rule, write actions would then be denied by the ruleset. To add }(hjhhhNhNubj)}(h``/usr``h]h/usr}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh% to the ruleset, we open it with the }(hjhhhNhNubj)}(h ``O_PATH``h]hO_PATH}(hj*hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhP flag and fill the &struct landlock_path_beneath_attr with this file descriptor.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhKhjfhhubj)}(hXint err = 0; struct landlock_path_beneath_attr path_beneath = { .allowed_access = LANDLOCK_ACCESS_FS_EXECUTE | LANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_READ_DIR, }; path_beneath.allowed_access &= ruleset_attr.handled_access_fs; if (path_beneath.allowed_access) { path_beneath.parent_fd = open("/usr", O_PATH | O_CLOEXEC); if (path_beneath.parent_fd < 0) { perror("Failed to open file"); close(ruleset_fd); return 1; } err = landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH, &path_beneath, 0); close(path_beneath.parent_fd); if (err) { perror("Failed to update ruleset"); close(ruleset_fd); return 1; } }h]hXint err = 0; struct landlock_path_beneath_attr path_beneath = { .allowed_access = LANDLOCK_ACCESS_FS_EXECUTE | LANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_READ_DIR, }; path_beneath.allowed_access &= ruleset_attr.handled_access_fs; if (path_beneath.allowed_access) { path_beneath.parent_fd = open("/usr", O_PATH | O_CLOEXEC); if (path_beneath.parent_fd < 0) { perror("Failed to open file"); close(ruleset_fd); return 1; } err = landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH, &path_beneath, 0); close(path_beneath.parent_fd); if (err) { perror("Failed to update ruleset"); close(ruleset_fd); return 1; } }}hjBsbah}(h]h ]h"]h$]h&]hhjjjj}uh1jhhhKhjfhhubj()}(hXEAs shown above, masking the rule's ``allowed_access`` against the ruleset's ``handled_access_*`` is the recommended best-effort pattern: rights the running kernel does not support are dropped (the compatibility switch above already cleared them in ``handled_access_*``), and the rule is skipped if no supported right remains.h](h%As shown above, masking the rule’s }(hjQhhhNhNubj)}(h``allowed_access``h]hallowed_access}(hjYhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjQubh against the ruleset’s }(hjQhhhNhNubj)}(h``handled_access_*``h]hhandled_access_*}(hjkhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjQubh is the recommended best-effort pattern: rights the running kernel does not support are dropped (the compatibility switch above already cleared them in }(hjQhhhNhNubj)}(h``handled_access_*``h]hhandled_access_*}(hj}hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjQubh9), and the rule is skipped if no supported right remains.}(hjQhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhKhjfhhubj()}(hFor network access-control, we will add a set of rules to allow DNS queries, which requires both UDP and TCP. For TCP, we need to allow outbound connections to port 53, which can be handled and granted starting with ABI 4:h]hFor network access-control, we will add a set of rules to allow DNS queries, which requires both UDP and TCP. For TCP, we need to allow outbound connections to port 53, which can be handled and granted starting with ABI 4:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhKhjfhhubj)}(hX9struct landlock_net_port_attr tcp_conn = { .allowed_access = LANDLOCK_ACCESS_NET_CONNECT_TCP, .port = 53, }; tcp_conn.allowed_access &= ruleset_attr.handled_access_net; if (tcp_conn.allowed_access) err = landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &tcp_conn, 0);h]hX9struct landlock_net_port_attr tcp_conn = { .allowed_access = LANDLOCK_ACCESS_NET_CONNECT_TCP, .port = 53, }; tcp_conn.allowed_access &= ruleset_attr.handled_access_net; if (tcp_conn.allowed_access) err = landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &tcp_conn, 0);}hjsbah}(h]h ]h"]h$]h&]hhjjjj}uh1jhhhKhjfhhubj()}(hXWe also need to be able to send UDP datagrams to port 53, which requires granting ``LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP``. Since our DNS client will emit datagrams without explicitly binding to a specific source port, its UDP socket will automatically bind an ephemeral port. To allow this behaviour, we also need to grant ``LANDLOCK_ACCESS_NET_BIND_UDP`` on port 0, as if the program explicitly called :manpage:`bind(2)` on port 0.h](hRWe also need to be able to send UDP datagrams to port 53, which requires granting }(hjhhhNhNubj)}(h(``LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP``h]h$LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh. Since our DNS client will emit datagrams without explicitly binding to a specific source port, its UDP socket will automatically bind an ephemeral port. To allow this behaviour, we also need to grant }(hjhhhNhNubj)}(h ``LANDLOCK_ACCESS_NET_BIND_UDP``h]hLANDLOCK_ACCESS_NET_BIND_UDP}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh0 on port 0, as if the program explicitly called }(hjhhhNhNubj)}(h:manpage:`bind(2)`h]hbind(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhjbind(2)jbindj2uh1jhjubh on port 0.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhKhjfhhubj)}(hX{struct landlock_net_port_attr udp_send = { .allowed_access = LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP, .port = 53, }; udp_send.allowed_access &= ruleset_attr.handled_access_net; if (udp_send.allowed_access) err = landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &udp_send, 0); [...] struct landlock_net_port_attr udp_bind = { .allowed_access = LANDLOCK_ACCESS_NET_BIND_UDP, .port = 0, }; udp_bind.allowed_access &= ruleset_attr.handled_access_net; if (udp_bind.allowed_access) err = landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &udp_bind, 0);h]hX{struct landlock_net_port_attr udp_send = { .allowed_access = LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP, .port = 53, }; udp_send.allowed_access &= ruleset_attr.handled_access_net; if (udp_send.allowed_access) err = landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &udp_send, 0); [...] struct landlock_net_port_attr udp_bind = { .allowed_access = LANDLOCK_ACCESS_NET_BIND_UDP, .port = 0, }; udp_bind.allowed_access &= ruleset_attr.handled_access_net; if (udp_bind.allowed_access) err = landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &udp_bind, 0);}hjsbah}(h]h ]h"]h$]h&]hhjjjj}uh1jhhhKhjfhhubj()}(hX"Capability and namespace rules use a different attribute layout: ``permissions`` identifies the permission category (a single ``LANDLOCK_PERMISSION_*`` flag) and a type-specific value field carries the bitmask to allow within it. See `Capability and namespace restrictions`_ for the model.h](hACapability and namespace rules use a different attribute layout: }(hjhhhNhNubj)}(h``permissions``h]h permissions}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh. identifies the permission category (a single }(hjhhhNhNubj)}(h``LANDLOCK_PERMISSION_*``h]hLANDLOCK_PERMISSION_*}(hj"hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhT flag) and a type-specific value field carries the bitmask to allow within it. See }(hjhhhNhNubh reference)}(h(`Capability and namespace restrictions`_h]h%Capability and namespace restrictions}(hj6hhhNhNubah}(h]h ]h"]h$]h&]name%Capability and namespace restrictionsrefid%capability-and-namespace-restrictionsuh1j4hjresolvedKubh for the model.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjfhhubj()}(hXFor capability access-control, we can add rules that allow specific capabilities (see :manpage:`capabilities(7)` for the list of ``CAP_*`` values). For instance, to allow ``CAP_SYS_CHROOT`` (so the sandboxed process can call :manpage:`chroot(2)` inside a user namespace):h](hVFor capability access-control, we can add rules that allow specific capabilities (see }(hjShhhNhNubj)}(h:manpage:`capabilities(7)`h]hcapabilities(7)}(hj[hhhNhNubah}(h]h ]jah"]h$]h&]hhjcapabilities(7)j capabilitiesjjuh1jhjSubh for the list of }(hjShhhNhNubj)}(h ``CAP_*``h]hCAP_*}(hjohhhNhNubah}(h]h ]h"]h$]h&]uh1jhjSubh" values). For instance, to allow }(hjShhhNhNubj)}(h``CAP_SYS_CHROOT``h]hCAP_SYS_CHROOT}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjSubh$ (so the sandboxed process can call }(hjShhhNhNubj)}(h:manpage:`chroot(2)`h]h chroot(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj chroot(2)jchrootjjuh1jhjSubh inside a user namespace):}(hjShhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjfhhubj)}(hX^struct landlock_capability_attr cap_attr = { .permissions = LANDLOCK_PERMISSION_CAPABILITY_USE, .allowed_capabilities = (1ULL << CAP_SYS_CHROOT), }; cap_attr.permissions &= ruleset_attr.handled_permissions; if (cap_attr.permissions) err = landlock_add_rule(ruleset_fd, LANDLOCK_RULE_CAPABILITY, &cap_attr, 0);h]hX^struct landlock_capability_attr cap_attr = { .permissions = LANDLOCK_PERMISSION_CAPABILITY_USE, .allowed_capabilities = (1ULL << CAP_SYS_CHROOT), }; cap_attr.permissions &= ruleset_attr.handled_permissions; if (cap_attr.permissions) err = landlock_add_rule(ruleset_fd, LANDLOCK_RULE_CAPABILITY, &cap_attr, 0);}hjsbah}(h]h ]h"]h$]h&]hhjjjj}uh1jhhhMhjfhhubj()}(hXFor namespace access-control, we can add rules that allow using specific namespace types (see :manpage:`namespaces(7)` for the list of ``CLONE_NEW*`` values): creating them via :manpage:`unshare(2)` / :manpage:`clone(2)` / :manpage:`clone3(2)`, joining them via :manpage:`setns(2)`, or acquiring an fd reference via :manpage:`open_tree(2)` / :manpage:`fsmount(2)`. For instance, to allow creating user namespaces (which grants all capabilities inside the new namespace):h](h^For namespace access-control, we can add rules that allow using specific namespace types (see }(hjhhhNhNubj)}(h:manpage:`namespaces(7)`h]h namespaces(7)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj namespaces(7)j namespacesjjuh1jhjubh for the list of }(hjhhhNhNubj)}(h``CLONE_NEW*``h]h CLONE_NEW*}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh values): creating them via }(hjhhhNhNubj)}(h:manpage:`unshare(2)`h]h unshare(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj unshare(2)junsharejjuh1jhjubh / }(hjhhhNhNubj)}(h:manpage:`clone(2)`h]hclone(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhjclone(2)jclonejjuh1jhjubh / }(hjhhhNhNubj)}(h:manpage:`clone3(2)`h]h clone3(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj clone3(2)jclone3jjuh1jhjubh, joining them via }(hjhhhNhNubj)}(h:manpage:`setns(2)`h]hsetns(2)}(hj&hhhNhNubah}(h]h ]jah"]h$]h&]hhjsetns(2)jsetnsjjuh1jhjubh#, or acquiring an fd reference via }(hjhhhNhNubj)}(h:manpage:`open_tree(2)`h]h open_tree(2)}(hj:hhhNhNubah}(h]h ]jah"]h$]h&]hhj open_tree(2)j open_treejjuh1jhjubh / }hjsbj)}(h:manpage:`fsmount(2)`h]h fsmount(2)}(hjNhhhNhNubah}(h]h ]jah"]h$]h&]hhj fsmount(2)jfsmountjjuh1jhjubhl. For instance, to allow creating user namespaces (which grants all capabilities inside the new namespace):}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjfhhubj)}(hXOstruct landlock_namespace_attr ns_attr = { .permissions = LANDLOCK_PERMISSION_NAMESPACE_USE, .allowed_namespace_types = CLONE_NEWUSER, }; ns_attr.permissions &= ruleset_attr.handled_permissions; if (ns_attr.permissions) err = landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NAMESPACE, &ns_attr, 0);h]hXOstruct landlock_namespace_attr ns_attr = { .permissions = LANDLOCK_PERMISSION_NAMESPACE_USE, .allowed_namespace_types = CLONE_NEWUSER, }; ns_attr.permissions &= ruleset_attr.handled_permissions; if (ns_attr.permissions) err = landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NAMESPACE, &ns_attr, 0);}hjhsbah}(h]h ]h"]h$]h&]hhjjjj}uh1jhhhM'hjfhhubj()}(hXTogether, these two rules allow an unprivileged process to create a user namespace and call :manpage:`chroot(2)` inside it, while denying all other capabilities and namespace types. User namespace creation is the one operation that does not require ``CAP_SYS_ADMIN``, so no capability rule is needed for it. See `Capability and namespace restrictions`_ for details on capability requirements.h](h\Together, these two rules allow an unprivileged process to create a user namespace and call }(hjwhhhNhNubj)}(h:manpage:`chroot(2)`h]h chroot(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj chroot(2)jchrootjjuh1jhjwubh inside it, while denying all other capabilities and namespace types. User namespace creation is the one operation that does not require }(hjwhhhNhNubj)}(h``CAP_SYS_ADMIN``h]h CAP_SYS_ADMIN}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjwubh., so no capability rule is needed for it. See }(hjwhhhNhNubj5)}(h(`Capability and namespace restrictions`_h]h%Capability and namespace restrictions}(hjhhhNhNubah}(h]h ]h"]h$]h&]name%Capability and namespace restrictionsjFjGuh1j4hjwjHKubh( for details on capability requirements.}(hjwhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhM3hjfhhubj()}(hWhen passing a non-zero ``flags`` argument to ``landlock_restrict_self()``, a similar backwards compatibility check is needed for the restrict flags (see sys_landlock_restrict_self() documentation for available flags):h](hWhen passing a non-zero }(hjhhhNhNubj)}(h ``flags``h]hflags}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh argument to }(hjhhhNhNubj)}(h``landlock_restrict_self()``h]hlandlock_restrict_self()}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh, a similar backwards compatibility check is needed for the restrict flags (see sys_landlock_restrict_self() documentation for available flags):}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhM:hjfhhubj)}(hXU__u32 restrict_flags = LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON | LANDLOCK_RESTRICT_SELF_TSYNC | LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS; switch (abi) { case 1 ... 6: /* Removes logging flags for ABI < 7 */ restrict_flags &= ~(LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF | LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON | LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF); __attribute__((fallthrough)); case 7: /* * Removes multithreaded enforcement flag for ABI < 8 * * WARNING: Without this flag, calling landlock_restrict_self(2) is * only equivalent if the calling process is single-threaded. Below * ABI v8 (and as of ABI v8, when not using this flag), a Landlock * policy would only be enforced for the calling thread and its * children (and not for all threads, including parents and siblings). */ restrict_flags &= ~LANDLOCK_RESTRICT_SELF_TSYNC; __attribute__((fallthrough)); case 8 ... 10: /* Removes no new privs flag for ABI < 11 */ restrict_flags &= ~LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS; }h]hXU__u32 restrict_flags = LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON | LANDLOCK_RESTRICT_SELF_TSYNC | LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS; switch (abi) { case 1 ... 6: /* Removes logging flags for ABI < 7 */ restrict_flags &= ~(LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF | LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON | LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF); __attribute__((fallthrough)); case 7: /* * Removes multithreaded enforcement flag for ABI < 8 * * WARNING: Without this flag, calling landlock_restrict_self(2) is * only equivalent if the calling process is single-threaded. Below * ABI v8 (and as of ABI v8, when not using this flag), a Landlock * policy would only be enforced for the calling thread and its * children (and not for all threads, including parents and siblings). */ restrict_flags &= ~LANDLOCK_RESTRICT_SELF_TSYNC; __attribute__((fallthrough)); case 8 ... 10: /* Removes no new privs flag for ABI < 11 */ restrict_flags &= ~LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS; }}hjsbah}(h]h ]h"]h$]h&]hhjjjj}uh1jhhhM>hjfhhubj()}(hThe next step is to restrict the current thread from gaining more privileges (e.g. through a SUID binary). For unprivileged processes, setting the no_new_privs attribute is required by Landlock.h]hThe next step is to restrict the current thread from gaining more privileges (e.g. through a SUID binary). For unprivileged processes, setting the no_new_privs attribute is required by Landlock.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhM\hjfhhubj()}(hX Processes with ``CAP_SYS_ADMIN`` in their namespace can enforce a ruleset without setting no_new_privs, but leaving no_new_privs unset is risky even when Landlock does not require this attribute: sandboxed processes could still execute set-user-ID, set-group-ID or file-capability binaries, which would then run with elevated privileges while being restricted by a Landlock domain they may not expect, making them potential confused deputies. no_new_privs should only be left unset if such a privilege transition is expected.h](hProcesses with }(hjhhhNhNubj)}(h``CAP_SYS_ADMIN``h]h CAP_SYS_ADMIN}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhX in their namespace can enforce a ruleset without setting no_new_privs, but leaving no_new_privs unset is risky even when Landlock does not require this attribute: sandboxed processes could still execute set-user-ID, set-group-ID or file-capability binaries, which would then run with elevated privileges while being restricted by a Landlock domain they may not expect, making them potential confused deputies. no_new_privs should only be left unset if such a privilege transition is expected.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhM`hjfhhubj()}(hWe now have a ruleset with the first rule allowing read and execute access to ``/usr`` while denying all other handled accesses for the filesystem, and two more rules allowing DNS queries.h](hNWe now have a ruleset with the first rule allowing read and execute access to }(hj.hhhNhNubj)}(h``/usr``h]h/usr}(hj6hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj.ubhf while denying all other handled accesses for the filesystem, and two more rules allowing DNS queries.}(hj.hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMihjfhhubj)}(hX\/* * If the ABI > 10, we can tie setting no_new_privs with successful ruleset * enforcement and skip the manual prctl(PR_SET_NO_NEW_PRIVS, ...) call. */ if (!(restrict_flags & LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS) && prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { perror("Failed to restrict privileges"); close(ruleset_fd); return 1; }h]hX\/* * If the ABI > 10, we can tie setting no_new_privs with successful ruleset * enforcement and skip the manual prctl(PR_SET_NO_NEW_PRIVS, ...) call. */ if (!(restrict_flags & LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS) && prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { perror("Failed to restrict privileges"); close(ruleset_fd); return 1; }}hjNsbah}(h]h ]h"]h$]h&]hhjjjj}uh1jhhhMmhjfhhubj()}(hCThe current thread is now ready to sandbox itself with the ruleset.h]hCThe current thread is now ready to sandbox itself with the ruleset.}(hj]hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMzhjfhhubj)}(hif (landlock_restrict_self(ruleset_fd, restrict_flags)) { perror("Failed to enforce ruleset"); close(ruleset_fd); return 1; } close(ruleset_fd);h]hif (landlock_restrict_self(ruleset_fd, restrict_flags)) { perror("Failed to enforce ruleset"); close(ruleset_fd); return 1; } close(ruleset_fd);}hjksbah}(h]h ]h"]h$]h&]hhjjjj}uh1jhhhM|hjfhhubj()}(hXIf the ``landlock_restrict_self`` system call succeeds, the current thread is now restricted and this policy will be enforced on all its subsequently created children as well. Once a thread is landlocked, there is no way to remove its security policy; only adding more restrictions is allowed. These threads are now in a new Landlock domain, which is a merger of their parent one (if any) with the new ruleset.h](hIf the }(hjzhhhNhNubj)}(h``landlock_restrict_self``h]hlandlock_restrict_self}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjzubhX{ system call succeeds, the current thread is now restricted and this policy will be enforced on all its subsequently created children as well. Once a thread is landlocked, there is no way to remove its security policy; only adding more restrictions is allowed. These threads are now in a new Landlock domain, which is a merger of their parent one (if any) with the new ruleset.}(hjzhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjfhhubj()}(hBFull working code can be found in `samples/landlock/sandboxer.c`_.h](h"Full working code can be found in }(hjhhhNhNubj5)}(h`samples/landlock/sandboxer.c`_h]hsamples/landlock/sandboxer.c}(hjhhhNhNubah}(h]h ]h"]h$]h&]namesamples/landlock/sandboxer.crefuribhttps://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/samples/landlock/sandboxer.cuh1j4hjjHKubh.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjfhhubeh}(h](defining-and-enforcing-a-security-policyah ]h"](defining and enforcing a security policyah$]h&]uh1hhjhhhhhK9ubh)}(hhh](h)}(hGood practicesh]hGood practices}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhMubj()}(hXIt is recommended to set access rights to file hierarchy leaves as much as possible. For instance, it is better to be able to have ``~/doc/`` as a read-only hierarchy and ``~/tmp/`` as a read-write hierarchy, compared to ``~/`` as a read-only hierarchy and ``~/tmp/`` as a read-write hierarchy. Following this good practice leads to self-sufficient hierarchies that do not depend on their location (i.e. parent directories). This is particularly relevant when we want to allow linking or renaming. Indeed, having consistent access rights per directory enables changing the location of such directories without relying on the destination directory access rights (except those that are required for this operation, see ``LANDLOCK_ACCESS_FS_REFER`` documentation).h](hIt is recommended to set access rights to file hierarchy leaves as much as possible. For instance, it is better to be able to have }(hjhhhNhNubj)}(h ``~/doc/``h]h~/doc/}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh as a read-only hierarchy and }(hjhhhNhNubj)}(h ``~/tmp/``h]h~/tmp/}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh( as a read-write hierarchy, compared to }(hjhhhNhNubj)}(h``~/``h]h~/}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh as a read-only hierarchy and }(hjhhhNhNubj)}(h ``~/tmp/``h]h~/tmp/}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhX as a read-write hierarchy. Following this good practice leads to self-sufficient hierarchies that do not depend on their location (i.e. parent directories). This is particularly relevant when we want to allow linking or renaming. Indeed, having consistent access rights per directory enables changing the location of such directories without relying on the destination directory access rights (except those that are required for this operation, see }(hjhhhNhNubj)}(h``LANDLOCK_ACCESS_FS_REFER``h]hLANDLOCK_ACCESS_FS_REFER}(hj'hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh documentation).}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjhhubj()}(hXHaving self-sufficient hierarchies also helps to tighten the required access rights to the minimal set of data. This also helps avoid sinkhole directories, i.e. directories where data can be linked to but not linked from. However, this depends on data organization, which might not be controlled by developers. In this case, granting read-write access to ``~/tmp/``, instead of write-only access, would potentially allow moving ``~/tmp/`` to a non-readable directory and still keep the ability to list the content of ``~/tmp/``.h](hXeHaving self-sufficient hierarchies also helps to tighten the required access rights to the minimal set of data. This also helps avoid sinkhole directories, i.e. directories where data can be linked to but not linked from. However, this depends on data organization, which might not be controlled by developers. In this case, granting read-write access to }(hj?hhhNhNubj)}(h ``~/tmp/``h]h~/tmp/}(hjGhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj?ubh?, instead of write-only access, would potentially allow moving }(hj?hhhNhNubj)}(h ``~/tmp/``h]h~/tmp/}(hjYhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj?ubhO to a non-readable directory and still keep the ability to list the content of }(hj?hhhNhNubj)}(h ``~/tmp/``h]h~/tmp/}(hjkhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj?ubh.}(hj?hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjhhubeh}(h]good-practicesah ]h"]good practicesah$]h&]uh1hhjhhhhhMubh)}(hhh](h)}(h!Layers of file path access rightsh]h!Layers of file path access rights}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhMubj()}(hX6Each time a thread enforces a ruleset on itself, it updates its Landlock domain with a new layer of policy. This complementary policy is stacked with any other rulesets potentially already restricting this thread. A sandboxed thread can then safely add more constraints to itself with a new enforced ruleset.h]hX6Each time a thread enforces a ruleset on itself, it updates its Landlock domain with a new layer of policy. This complementary policy is stacked with any other rulesets potentially already restricting this thread. A sandboxed thread can then safely add more constraints to itself with a new enforced ruleset.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMhjhhubj()}(hX9One policy layer grants access to a file path if at least one of its rules encountered on the path grants the access. A sandboxed thread can only access a file path if all its enforced policy layers grant the access as well as all the other system access controls (e.g. filesystem DAC, other LSM policies, etc.).h]hX9One policy layer grants access to a file path if at least one of its rules encountered on the path grants the access. A sandboxed thread can only access a file path if all its enforced policy layers grant the access as well as all the other system access controls (e.g. filesystem DAC, other LSM policies, etc.).}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMhjhhubeh}(h]!layers-of-file-path-access-rightsah ]h"]!layers of file path access rightsah$]h&]uh1hhjhhhhhMubh)}(hhh](h)}(hBind mounts and OverlayFSh]hBind mounts and OverlayFS}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhMubj()}(hLandlock enables restricting access to file hierarchies, which means that these access rights can be propagated with bind mounts (cf. Documentation/filesystems/sharedsubtree.rst) but not with Documentation/filesystems/overlayfs.rst.h]hLandlock enables restricting access to file hierarchies, which means that these access rights can be propagated with bind mounts (cf. Documentation/filesystems/sharedsubtree.rst) but not with Documentation/filesystems/overlayfs.rst.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMhjhhubj()}(hXA bind mount mirrors a source file hierarchy to a destination. The destination hierarchy is then composed of the exact same files, on which Landlock rules can be tied, either via the source or the destination path. These rules restrict access when they are encountered on a path, which means that they can restrict access to multiple file hierarchies at the same time, whether these hierarchies are the result of bind mounts or not.h]hXA bind mount mirrors a source file hierarchy to a destination. The destination hierarchy is then composed of the exact same files, on which Landlock rules can be tied, either via the source or the destination path. These rules restrict access when they are encountered on a path, which means that they can restrict access to multiple file hierarchies at the same time, whether these hierarchies are the result of bind mounts or not.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMhjhhubj()}(hXAn OverlayFS mount point consists of upper and lower layers. These layers are combined in a merge directory, and that merged directory becomes available at the mount point. This merge hierarchy may include files from the upper and lower layers, but modifications performed on the merge hierarchy only reflect on the upper layer. From a Landlock policy point of view, all OverlayFS layers and merge hierarchies are standalone and each contains their own set of files and directories, which is different from bind mounts. A policy restricting an OverlayFS layer will not restrict the resulted merged hierarchy, and vice versa. Landlock users should then only think about file hierarchies they want to allow access to, regardless of the underlying filesystem.h]hXAn OverlayFS mount point consists of upper and lower layers. These layers are combined in a merge directory, and that merged directory becomes available at the mount point. This merge hierarchy may include files from the upper and lower layers, but modifications performed on the merge hierarchy only reflect on the upper layer. From a Landlock policy point of view, all OverlayFS layers and merge hierarchies are standalone and each contains their own set of files and directories, which is different from bind mounts. A policy restricting an OverlayFS layer will not restrict the resulted merged hierarchy, and vice versa. Landlock users should then only think about file hierarchies they want to allow access to, regardless of the underlying filesystem.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMhjhhubeh}(h]bind-mounts-and-overlayfsah ]h"]bind mounts and overlayfsah$]h&]uh1hhjhhhhhMubh)}(hhh](h)}(h Inheritanceh]h Inheritance}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj hhhhhMubj()}(hXEvery new thread resulting from a :manpage:`clone(2)` inherits Landlock domain restrictions from its parent. This is similar to seccomp inheritance (cf. Documentation/userspace-api/seccomp_filter.rst) or any other LSM dealing with task's :manpage:`credentials(7)`. For instance, one process's thread may apply Landlock rules to itself, but they will not be automatically applied to other sibling threads (unlike POSIX thread credential changes, cf. :manpage:`nptl(7)`).h](h"Every new thread resulting from a }(hj hhhNhNubj)}(h:manpage:`clone(2)`h]hclone(2)}(hj hhhNhNubah}(h]h ]jah"]h$]h&]hhjclone(2)jclonejjuh1jhj ubh inherits Landlock domain restrictions from its parent. This is similar to seccomp inheritance (cf. Documentation/userspace-api/seccomp_filter.rst) or any other LSM dealing with task’s }(hj hhhNhNubj)}(h:manpage:`credentials(7)`h]hcredentials(7)}(hj0 hhhNhNubah}(h]h ]jah"]h$]h&]hhjcredentials(7)j credentialsjjuh1jhj ubh. For instance, one process’s thread may apply Landlock rules to itself, but they will not be automatically applied to other sibling threads (unlike POSIX thread credential changes, cf. }(hj hhhNhNubj)}(h:manpage:`nptl(7)`h]hnptl(7)}(hjD hhhNhNubah}(h]h ]jah"]h$]h&]hhjnptl(7)jnptljjuh1jhj ubh).}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhj hhubj()}(hX?When a thread sandboxes itself, we have the guarantee that the related security policy will stay enforced on all this thread's descendants. This allows creating standalone and modular security policies per application, which will automatically be composed between themselves according to their runtime parent policies.h]hXAWhen a thread sandboxes itself, we have the guarantee that the related security policy will stay enforced on all this thread’s descendants. This allows creating standalone and modular security policies per application, which will automatically be composed between themselves according to their runtime parent policies.}(hj^ hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMhj hhubeh}(h] inheritanceah ]h"] inheritanceah$]h&]uh1hhjhhhhhMubh)}(hhh](h)}(hPtrace restrictionsh]hPtrace restrictions}(hjw hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjt hhhhhMubj()}(hXA sandboxed process has less privileges than a non-sandboxed process and must then be subject to additional restrictions when manipulating another process. To be allowed to use :manpage:`ptrace(2)` and related syscalls on a target process, a sandboxed process should have a superset of the target process's access rights, which means the tracee must be in a sub-domain of the tracer.h](hA sandboxed process has less privileges than a non-sandboxed process and must then be subject to additional restrictions when manipulating another process. To be allowed to use }(hj hhhNhNubj)}(h:manpage:`ptrace(2)`h]h ptrace(2)}(hj hhhNhNubah}(h]h ]jah"]h$]h&]hhj ptrace(2)jptracejjuh1jhj ubh and related syscalls on a target process, a sandboxed process should have a superset of the target process’s access rights, which means the tracee must be in a sub-domain of the tracer.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjt hhubeh}(h]ptrace-restrictionsah ]h"]ptrace restrictionsah$]h&]uh1hhjhhhhhM referencedKubh)}(hhh](h)}(h IPC scopingh]h IPC scoping}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj hhhhhMubj()}(hX`Similar to the implicit `Ptrace restrictions`_, we may want to further restrict interactions between sandboxes. Therefore, at ruleset creation time, each Landlock domain can restrict the scope for certain operations, so that these operations can only reach out to processes within the same Landlock domain or in a nested Landlock domain (the "scope").h](hSimilar to the implicit }(hj hhhNhNubj5)}(h`Ptrace restrictions`_h]hPtrace restrictions}(hj hhhNhNubah}(h]h ]h"]h$]h&]namePtrace restrictionsjFj uh1j4hj jHKubhX6, we may want to further restrict interactions between sandboxes. Therefore, at ruleset creation time, each Landlock domain can restrict the scope for certain operations, so that these operations can only reach out to processes within the same Landlock domain or in a nested Landlock domain (the “scope”).}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhj hhubj()}(h'The operations which can be scoped are:h]h'The operations which can be scoped are:}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMhj hhubj")}(hhh](j')}(h``LANDLOCK_SCOPE_SIGNAL`` This limits the sending of signals to target processes which run within the same or a nested Landlock domain. h](j-)}(h``LANDLOCK_SCOPE_SIGNAL``h]j)}(hj h]hLANDLOCK_SCOPE_SIGNAL}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubah}(h]h ]h"]h$]h&]uh1j,hhhMhj ubj=)}(hhh]j()}(hmThis limits the sending of signals to target processes which run within the same or a nested Landlock domain.h]hmThis limits the sending of signals to target processes which run within the same or a nested Landlock domain.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMhj ubah}(h]h ]h"]h$]h&]uh1j<hj ubeh}(h]h ]h"]h$]h&]uh1j&hhhMhj ubj')}(hXN``LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET`` This limits the set of abstract :manpage:`unix(7)` sockets to which we can :manpage:`connect(2)` to socket addresses which were created by a process in the same or a nested Landlock domain. A :manpage:`sendto(2)` on a non-connected datagram socket is treated as if it were doing an implicit :manpage:`connect(2)` and will be blocked if the remote end does not stem from the same or a nested Landlock domain. A :manpage:`sendto(2)` on a socket which was previously connected will not be restricted. This works for both datagram and stream sockets. h](j-)}(h'``LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET``h]j)}(hj2 h]h#LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET}(hj4 hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj0 ubah}(h]h ]h"]h$]h&]uh1j,hhhMhj, ubj=)}(hhh](j()}(hThis limits the set of abstract :manpage:`unix(7)` sockets to which we can :manpage:`connect(2)` to socket addresses which were created by a process in the same or a nested Landlock domain.h](h This limits the set of abstract }(hjJ hhhNhNubj)}(h:manpage:`unix(7)`h]hunix(7)}(hjR hhhNhNubah}(h]h ]jah"]h$]h&]hhjunix(7)junixjjuh1jhjJ ubh sockets to which we can }(hjJ hhhNhNubj)}(h:manpage:`connect(2)`h]h connect(2)}(hjf hhhNhNubah}(h]h ]jah"]h$]h&]hhj connect(2)jconnectjjuh1jhjJ ubh] to socket addresses which were created by a process in the same or a nested Landlock domain.}(hjJ hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjG ubj()}(hA :manpage:`sendto(2)` on a non-connected datagram socket is treated as if it were doing an implicit :manpage:`connect(2)` and will be blocked if the remote end does not stem from the same or a nested Landlock domain.h](hA }(hj hhhNhNubj)}(h:manpage:`sendto(2)`h]h sendto(2)}(hj hhhNhNubah}(h]h ]jah"]h$]h&]hhj sendto(2)jsendtojjuh1jhj ubhO on a non-connected datagram socket is treated as if it were doing an implicit }(hj hhhNhNubj)}(h:manpage:`connect(2)`h]h connect(2)}(hj hhhNhNubah}(h]h ]jah"]h$]h&]hhj connect(2)jconnectjjuh1jhj ubh_ and will be blocked if the remote end does not stem from the same or a nested Landlock domain.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjG ubj()}(hA :manpage:`sendto(2)` on a socket which was previously connected will not be restricted. This works for both datagram and stream sockets.h](hA }(hj hhhNhNubj)}(h:manpage:`sendto(2)`h]h sendto(2)}(hj hhhNhNubah}(h]h ]jah"]h$]h&]hhj sendto(2)jsendtojjuh1jhj ubhu on a socket which was previously connected will not be restricted. This works for both datagram and stream sockets.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjG ubeh}(h]h ]h"]h$]h&]uh1j<hj, ubeh}(h]h ]h"]h$]h&]uh1j&hhhMhj hhubeh}(h]h ]h"]h$]h&]uh1j!hj hhhhhNubj()}(hScoping does not support exceptions via :manpage:`landlock_add_rule(2)`. If an operation is scoped within a domain, no rules can be added to allow access to resources or processes outside of the scope.h](h(Scoping does not support exceptions via }(hj hhhNhNubj)}(h:manpage:`landlock_add_rule(2)`h]hlandlock_add_rule(2)}(hj hhhNhNubah}(h]h ]jah"]h$]h&]hhjlandlock_add_rule(2)jlandlock_add_rulejjuh1jhj ubh. If an operation is scoped within a domain, no rules can be added to allow access to resources or processes outside of the scope.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhj hhubeh}(h] ipc-scopingah ]h"] ipc scopingah$]h&]uh1hhjhhhhhMubh)}(hhh](h)}(h%Capability and namespace restrictionsh]h%Capability and namespace restrictions}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj hhhhhMubj()}(hX``handled_permissions`` declares per-category permissions: each permission selects which members of a kernel-defined category (CAP_* capabilities, CLONE_NEW* namespace types) the process may use. Unlike per-object access rights (``handled_access_*``) or cross-domain scopes (``scoped``), per-category permissions constrain the sandboxed process's own use of these enums; members not allowed by a rule are denied by default.h](j)}(h``handled_permissions``h]hhandled_permissions}(hj) hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj% ubh declares per-category permissions: each permission selects which members of a kernel-defined category (CAP_* capabilities, CLONE_NEW* namespace types) the process may use. Unlike per-object access rights (}(hj% hhhNhNubj)}(h``handled_access_*``h]hhandled_access_*}(hj; hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj% ubh) or cross-domain scopes (}(hj% hhhNhNubj)}(h ``scoped``h]hscoped}(hjM hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj% ubh), per-category permissions constrain the sandboxed process’s own use of these enums; members not allowed by a rule are denied by default.}(hj% hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhM hj hhubj()}(hX``LANDLOCK_PERMISSION_NAMESPACE_USE`` gates *acquisition of access* to namespaces: creation via :manpage:`unshare(2)` / :manpage:`clone(2)` / :manpage:`clone3(2)`, entry via :manpage:`setns(2)`, and fd-reference acquisition via :manpage:`open_tree(2)` / :manpage:`fsmount(2)`. Namespaces the process is already a member of when the domain is enforced are implicitly allowed (the process could not continue running otherwise); rules describe which new namespace types the process may acquire. ``LANDLOCK_PERMISSION_CAPABILITY_USE`` gates every exercise of a capability after the domain is enforced, regardless of how the capability was obtained (inherited credentials, ``CLONE_NEWUSER`` grant, ``setuid``/file-cap-bearing :manpage:`execve(2)`, etc.). Configuring both together restricts what privileges are available *and* the namespaces in which they take effect, which matters because user namespace creation has no capability check and grants all capabilities within the new namespace: gating only one of the two leaves a kernel attack-surface widening path open. When a domain handles both permissions, an operation is allowed only if each independently allows it: :manpage:`unshare(2)` with ``CLONE_NEWNET`` then requires both a rule allowing ``CLONE_NEWNET`` and a rule allowing ``CAP_SYS_ADMIN``.h](j)}(h%``LANDLOCK_PERMISSION_NAMESPACE_USE``h]h!LANDLOCK_PERMISSION_NAMESPACE_USE}(hji hhhNhNubah}(h]h ]h"]h$]h&]uh1jhje ubh gates }(hje hhhNhNubhemphasis)}(h*acquisition of access*h]hacquisition of access}(hj} hhhNhNubah}(h]h ]h"]h$]h&]uh1j{ hje ubh to namespaces: creation via }(hje hhhNhNubj)}(h:manpage:`unshare(2)`h]h unshare(2)}(hj hhhNhNubah}(h]h ]jah"]h$]h&]hhj unshare(2)junsharejjuh1jhje ubh / }(hje hhhNhNubj)}(h:manpage:`clone(2)`h]hclone(2)}(hj hhhNhNubah}(h]h ]jah"]h$]h&]hhjclone(2)jclonejjuh1jhje ubh / }(hje hhhNhNubj)}(h:manpage:`clone3(2)`h]h clone3(2)}(hj hhhNhNubah}(h]h ]jah"]h$]h&]hhj clone3(2)jclone3jjuh1jhje ubh , entry via }(hje hhhNhNubj)}(h:manpage:`setns(2)`h]hsetns(2)}(hj hhhNhNubah}(h]h ]jah"]h$]h&]hhjsetns(2)jsetnsjjuh1jhje ubh#, and fd-reference acquisition via }(hje hhhNhNubj)}(h:manpage:`open_tree(2)`h]h open_tree(2)}(hj hhhNhNubah}(h]h ]jah"]h$]h&]hhj open_tree(2)j open_treejjuh1jhje ubh / }hje sbj)}(h:manpage:`fsmount(2)`h]h fsmount(2)}(hj hhhNhNubah}(h]h ]jah"]h$]h&]hhj fsmount(2)jfsmountjjuh1jhje ubh. Namespaces the process is already a member of when the domain is enforced are implicitly allowed (the process could not continue running otherwise); rules describe which new namespace types the process may acquire. }(hje hhhNhNubj)}(h&``LANDLOCK_PERMISSION_CAPABILITY_USE``h]h"LANDLOCK_PERMISSION_CAPABILITY_USE}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhje ubh gates every exercise of a capability after the domain is enforced, regardless of how the capability was obtained (inherited credentials, }(hje hhhNhNubj)}(h``CLONE_NEWUSER``h]h CLONE_NEWUSER}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhje ubh grant, }(hje hhhNhNubj)}(h ``setuid``h]hsetuid}(hj+ hhhNhNubah}(h]h ]h"]h$]h&]uh1jhje ubh/file-cap-bearing }(hje hhhNhNubj)}(h:manpage:`execve(2)`h]h execve(2)}(hj= hhhNhNubah}(h]h ]jah"]h$]h&]hhj execve(2)jexecvejjuh1jhje ubhL, etc.). Configuring both together restricts what privileges are available }(hje hhhNhNubj| )}(h*and*h]hand}(hjQ hhhNhNubah}(h]h ]h"]h$]h&]uh1j{ hje ubhX\ the namespaces in which they take effect, which matters because user namespace creation has no capability check and grants all capabilities within the new namespace: gating only one of the two leaves a kernel attack-surface widening path open. When a domain handles both permissions, an operation is allowed only if each independently allows it: }(hje hhhNhNubj)}(h:manpage:`unshare(2)`h]h unshare(2)}(hjc hhhNhNubah}(h]h ]jah"]h$]h&]hhj unshare(2)junsharejjuh1jhje ubh with }(hje hhhNhNubj)}(h``CLONE_NEWNET``h]h CLONE_NEWNET}(hjw hhhNhNubah}(h]h ]h"]h$]h&]uh1jhje ubh$ then requires both a rule allowing }(hje hhhNhNubj)}(h``CLONE_NEWNET``h]h CLONE_NEWNET}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhje ubh and a rule allowing }(hje hhhNhNubj)}(h``CAP_SYS_ADMIN``h]h CAP_SYS_ADMIN}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhje ubh.}(hje hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhj hhubj()}(hX1``LANDLOCK_PERMISSION_CAPABILITY_USE`` complements :manpage:`prctl(2)` ``PR_SET_NO_NEW_PRIVS`` but does not replace it. ``PR_SET_NO_NEW_PRIVS`` prevents privilege *acquisition* via :manpage:`execve(2)` (setuid, file capability xattrs, privilege-elevating LSM transitions) and is a prerequisite for unprivileged Landlock self-sandboxing. ``LANDLOCK_PERMISSION_CAPABILITY_USE`` restricts *exercise* of capabilities the process already holds, including those gained via ``CLONE_NEWUSER`` which ``PR_SET_NO_NEW_PRIVS`` does not block. Sandboxes typically set both.h](j)}(h&``LANDLOCK_PERMISSION_CAPABILITY_USE``h]h"LANDLOCK_PERMISSION_CAPABILITY_USE}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubh complements }(hj hhhNhNubj)}(h:manpage:`prctl(2)`h]hprctl(2)}(hj hhhNhNubah}(h]h ]jah"]h$]h&]hhjprctl(2)jprctljjuh1jhj ubh }(hj hhhNhNubj)}(h``PR_SET_NO_NEW_PRIVS``h]hPR_SET_NO_NEW_PRIVS}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubh but does not replace it. }(hj hhhNhNubj)}(h``PR_SET_NO_NEW_PRIVS``h]hPR_SET_NO_NEW_PRIVS}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubh prevents privilege }(hj hhhNhNubj| )}(h *acquisition*h]h acquisition}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j{ hj ubh via }(hj hhhNhNubj)}(h:manpage:`execve(2)`h]h execve(2)}(hj hhhNhNubah}(h]h ]jah"]h$]h&]hhj execve(2)jexecvejjuh1jhj ubh (setuid, file capability xattrs, privilege-elevating LSM transitions) and is a prerequisite for unprivileged Landlock self-sandboxing. }(hj hhhNhNubj)}(h&``LANDLOCK_PERMISSION_CAPABILITY_USE``h]h"LANDLOCK_PERMISSION_CAPABILITY_USE}(hj' hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubh restricts }(hj hhhNhNubj| )}(h *exercise*h]hexercise}(hj9 hhhNhNubah}(h]h ]h"]h$]h&]uh1j{ hj ubhG of capabilities the process already holds, including those gained via }(hj hhhNhNubj)}(h``CLONE_NEWUSER``h]h CLONE_NEWUSER}(hjK hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubh which }(hj hhhNhNubj)}(h``PR_SET_NO_NEW_PRIVS``h]hPR_SET_NO_NEW_PRIVS}(hj] hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubh. does not block. Sandboxes typically set both.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhM$hj hhubj()}(hXRules are added with ``LANDLOCK_RULE_CAPABILITY`` and &struct landlock_capability_attr (each rule lists ``CAP_*`` values to allow), and with ``LANDLOCK_RULE_NAMESPACE`` and &struct landlock_namespace_attr (each rule lists ``CLONE_NEW*`` flags to allow). Landlock is purely restrictive: it can only deny what the traditional check would have allowed, never grant additional privileges.h](hRules are added with }(hju hhhNhNubj)}(h``LANDLOCK_RULE_CAPABILITY``h]hLANDLOCK_RULE_CAPABILITY}(hj} hhhNhNubah}(h]h ]h"]h$]h&]uh1jhju ubh7 and &struct landlock_capability_attr (each rule lists }(hju hhhNhNubj)}(h ``CAP_*``h]hCAP_*}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhju ubh values to allow), and with }(hju hhhNhNubj)}(h``LANDLOCK_RULE_NAMESPACE``h]hLANDLOCK_RULE_NAMESPACE}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhju ubh6 and &struct landlock_namespace_attr (each rule lists }(hju hhhNhNubj)}(h``CLONE_NEW*``h]h CLONE_NEW*}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhju ubh flags to allow). Landlock is purely restrictive: it can only deny what the traditional check would have allowed, never grant additional privileges.}(hju hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhM.hj hhubj()}(hXDenials of specific capabilities or namespace types can be excluded from audit logging per rule, by listing them in the ``quiet_capabilities`` or ``quiet_namespace_types`` field of the rule (independently of the allowed members). Quieting requires the permission to be handled, is member-granular, and only suppresses the audit record of a denial attributed to the rule's own layer; it never changes the denial itself or suppresses its trace event, which reports ``logged=0``. Sandboxes should quiet only specific members known to be requested but expected to be denied (for example for compatibility with older callers), never a blanket set: a blanket set follows the running kernel's known members and would hide surprising or future denials from audit.h](hxDenials of specific capabilities or namespace types can be excluded from audit logging per rule, by listing them in the }(hj hhhNhNubj)}(h``quiet_capabilities``h]hquiet_capabilities}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubh or }(hj hhhNhNubj)}(h``quiet_namespace_types``h]hquiet_namespace_types}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubhX' field of the rule (independently of the allowed members). Quieting requires the permission to be handled, is member-granular, and only suppresses the audit record of a denial attributed to the rule’s own layer; it never changes the denial itself or suppresses its trace event, which reports }(hj hhhNhNubj)}(h ``logged=0``h]hlogged=0}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubhX. Sandboxes should quiet only specific members known to be requested but expected to be denied (for example for compatibility with older callers), never a blanket set: a blanket set follows the running kernel’s known members and would hide surprising or future denials from audit.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhM5hj hhubj()}(hXURule bodies silently accept values unknown to the current kernel (capabilities above ``CAP_LAST_CAP``, unrecognised ``CLONE_NEW*`` bits): they have no runtime effect, so a rule compiled against future kernel headers loads without error on older kernels. Future kernels gain new members denied by default until a rule explicitly allows them.h](hURule bodies silently accept values unknown to the current kernel (capabilities above }(hjhhhNhNubj)}(h``CAP_LAST_CAP``h]h CAP_LAST_CAP}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh, unrecognised }(hjhhhNhNubj)}(h``CLONE_NEW*``h]h CLONE_NEW*}(hj)hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh bits): they have no runtime effect, so a rule compiled against future kernel headers loads without error on older kernels. Future kernels gain new members denied by default until a rule explicitly allows them.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhM@hj hhubj()}(hXThe single ``LANDLOCK_PERMISSION_NAMESPACE_USE`` bit gates every kernel path that grants the calling process access to a namespace of the controlled types, whether by becoming a member of the namespace or by holding a file descriptor that references it. The covered syscall paths are:h](h The single }(hjAhhhNhNubj)}(h%``LANDLOCK_PERMISSION_NAMESPACE_USE``h]h!LANDLOCK_PERMISSION_NAMESPACE_USE}(hjIhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjAubh bit gates every kernel path that grants the calling process access to a namespace of the controlled types, whether by becoming a member of the namespace or by holding a file descriptor that references it. The covered syscall paths are:}(hjAhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMFhj hhubh bullet_list)}(hhh](h list_item)}(hd:manpage:`unshare(2)` with ``CLONE_NEW*``: the caller becomes a member of a newly-created namespace.h]j()}(hd:manpage:`unshare(2)` with ``CLONE_NEW*``: the caller becomes a member of a newly-created namespace.h](j)}(h:manpage:`unshare(2)`h]h unshare(2)}(hjphhhNhNubah}(h]h ]jah"]h$]h&]hhj unshare(2)junsharejjuh1jhjlubh with }(hjlhhhNhNubj)}(h``CLONE_NEW*``h]h CLONE_NEW*}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjlubh;: the caller becomes a member of a newly-created namespace.}(hjlhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMKhjhubah}(h]h ]h"]h$]h&]uh1jfhjchhhhhNubjg)}(h{:manpage:`clone(2)` (or :manpage:`clone3(2)`) with ``CLONE_NEW*``: the child becomes a member of a newly-created namespace.h]j()}(h{:manpage:`clone(2)` (or :manpage:`clone3(2)`) with ``CLONE_NEW*``: the child becomes a member of a newly-created namespace.h](j)}(h:manpage:`clone(2)`h]hclone(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhjclone(2)jclonejjuh1jhjubh (or }(hjhhhNhNubj)}(h:manpage:`clone3(2)`h]h clone3(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj clone3(2)jclone3jjuh1jhjubh) with }(hjhhhNhNubj)}(h``CLONE_NEW*``h]h CLONE_NEW*}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh:: the child becomes a member of a newly-created namespace.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMMhjubah}(h]h ]h"]h$]h&]uh1jfhjchhhhhNubjg)}(hh:manpage:`setns(2)`: the caller becomes a member of an existing namespace referenced by file descriptor.h]j()}(hh:manpage:`setns(2)`: the caller becomes a member of an existing namespace referenced by file descriptor.h](j)}(h:manpage:`setns(2)`h]hsetns(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhjsetns(2)jsetnsjjuh1jhjubhU: the caller becomes a member of an existing namespace referenced by file descriptor.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMOhjubah}(h]h ]h"]h$]h&]uh1jfhjchhhhhNubjg)}(h:manpage:`open_tree(2)` with ``OPEN_TREE_NAMESPACE``: the caller obtains a file descriptor referring to a newly-created mount namespace.h]j()}(h:manpage:`open_tree(2)` with ``OPEN_TREE_NAMESPACE``: the caller obtains a file descriptor referring to a newly-created mount namespace.h](j)}(h:manpage:`open_tree(2)`h]h open_tree(2)}(hj hhhNhNubah}(h]h ]jah"]h$]h&]hhj open_tree(2)j open_treejjuh1jhjubh with }(hjhhhNhNubj)}(h``OPEN_TREE_NAMESPACE``h]hOPEN_TREE_NAMESPACE}(hj4hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhT: the caller obtains a file descriptor referring to a newly-created mount namespace.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMQhjubah}(h]h ]h"]h$]h&]uh1jfhjchhhhhNubjg)}(h:manpage:`open_tree(2)` with ``OPEN_TREE_CLONE``: the caller obtains a file descriptor referring to a newly-created anonymous mount namespace.h]j()}(h:manpage:`open_tree(2)` with ``OPEN_TREE_CLONE``: the caller obtains a file descriptor referring to a newly-created anonymous mount namespace.h](j)}(h:manpage:`open_tree(2)`h]h open_tree(2)}(hjZhhhNhNubah}(h]h ]jah"]h$]h&]hhj open_tree(2)j open_treejjuh1jhjVubh with }(hjVhhhNhNubj)}(h``OPEN_TREE_CLONE``h]hOPEN_TREE_CLONE}(hjnhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjVubh^: the caller obtains a file descriptor referring to a newly-created anonymous mount namespace.}(hjVhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMShjRubah}(h]h ]h"]h$]h&]uh1jfhjchhhhhNubjg)}(h:manpage:`fsmount(2)` with ``FSMOUNT_NAMESPACE``: the caller obtains a file descriptor referring to a newly-created mount namespace.h]j()}(h:manpage:`fsmount(2)` with ``FSMOUNT_NAMESPACE``: the caller obtains a file descriptor referring to a newly-created mount namespace.h](j)}(h:manpage:`fsmount(2)`h]h fsmount(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj fsmount(2)jfsmountjjuh1jhjubh with }(hjhhhNhNubj)}(h``FSMOUNT_NAMESPACE``h]hFSMOUNT_NAMESPACE}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhT: the caller obtains a file descriptor referring to a newly-created mount namespace.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMUhjubah}(h]h ]h"]h$]h&]uh1jfhjchhhhhNubjg)}(h~:manpage:`fsmount(2)` (default): the caller obtains a file descriptor referring to a newly-created anonymous mount namespace. h]j()}(h}:manpage:`fsmount(2)` (default): the caller obtains a file descriptor referring to a newly-created anonymous mount namespace.h](j)}(h:manpage:`fsmount(2)`h]h fsmount(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj fsmount(2)jfsmountjjuh1jhjubhh (default): the caller obtains a file descriptor referring to a newly-created anonymous mount namespace.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMWhjubah}(h]h ]h"]h$]h&]uh1jfhjchhhhhNubeh}(h]h ]h"]h$]h&]bullet*uh1jahhhMKhj hhubj()}(hXKAnonymous mount namespaces (created by ``open_tree(OPEN_TREE_CLONE)`` and the default :manpage:`fsmount(2)`) are intentionally covered by the bit even though the calling process does not become a member of them. Without this coverage, a sandboxed process could combine ``open_tree(OPEN_TREE_CLONE)`` with :manpage:`move_mount(2)` to graft mounts from a freshly-allocated mount namespace into its current namespace, bypassing a ``CLONE_NEWNS`` restriction (these mount operations require ``CAP_SYS_ADMIN``, which a sandboxed process typically obtains by first creating a user namespace).h](h'Anonymous mount namespaces (created by }(hjhhhNhNubj)}(h``open_tree(OPEN_TREE_CLONE)``h]hopen_tree(OPEN_TREE_CLONE)}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh and the default }(hjhhhNhNubj)}(h:manpage:`fsmount(2)`h]h fsmount(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj fsmount(2)jfsmountjjuh1jhjubh) are intentionally covered by the bit even though the calling process does not become a member of them. Without this coverage, a sandboxed process could combine }(hjhhhNhNubj)}(h``open_tree(OPEN_TREE_CLONE)``h]hopen_tree(OPEN_TREE_CLONE)}(hj$hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh with }(hjhhhNhNubj)}(h:manpage:`move_mount(2)`h]h move_mount(2)}(hj6hhhNhNubah}(h]h ]jah"]h$]h&]hhj move_mount(2)j move_mountjjuh1jhjubhb to graft mounts from a freshly-allocated mount namespace into its current namespace, bypassing a }(hjhhhNhNubj)}(h``CLONE_NEWNS``h]h CLONE_NEWNS}(hjJhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh- restriction (these mount operations require }(hjhhhNhNubj)}(h``CAP_SYS_ADMIN``h]h CAP_SYS_ADMIN}(hj\hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhR, which a sandboxed process typically obtains by first creating a user namespace).}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMZhj hhubj()}(hXIn practice, unprivileged processes first create a user namespace (which requires no capability and grants all capabilities within it), then use those capabilities to create other namespace types. All non-user namespace types require ``CAP_SYS_ADMIN`` for both creation and :manpage:`setns(2)` entry; mount namespace entry additionally requires ``CAP_SYS_CHROOT``. For :manpage:`setns(2)`, capabilities are checked relative to the target namespace, so a process in an ancestor user namespace naturally satisfies them; this includes joining user namespaces, which requires ``CAP_SYS_ADMIN``. When ``LANDLOCK_PERMISSION_CAPABILITY_USE`` is also handled, each of these capabilities must be explicitly allowed by a rule.h](hIn practice, unprivileged processes first create a user namespace (which requires no capability and grants all capabilities within it), then use those capabilities to create other namespace types. All non-user namespace types require }(hjthhhNhNubj)}(h``CAP_SYS_ADMIN``h]h CAP_SYS_ADMIN}(hj|hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjtubh for both creation and }(hjthhhNhNubj)}(h:manpage:`setns(2)`h]hsetns(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhjsetns(2)jsetnsjjuh1jhjtubh4 entry; mount namespace entry additionally requires }(hjthhhNhNubj)}(h``CAP_SYS_CHROOT``h]hCAP_SYS_CHROOT}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjtubh. For }(hjthhhNhNubj)}(h:manpage:`setns(2)`h]hsetns(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhjsetns(2)jsetnsjjuh1jhjtubh, capabilities are checked relative to the target namespace, so a process in an ancestor user namespace naturally satisfies them; this includes joining user namespaces, which requires }(hjthhhNhNubj)}(h``CAP_SYS_ADMIN``h]h CAP_SYS_ADMIN}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjtubh. When }(hjthhhNhNubj)}(h&``LANDLOCK_PERMISSION_CAPABILITY_USE``h]h"LANDLOCK_PERMISSION_CAPABILITY_USE}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjtubhR is also handled, each of these capabilities must be explicitly allowed by a rule.}(hjthhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMchj hhubj()}(hXCreating a non-user namespace always requires ``CAP_SYS_ADMIN``, and ``LANDLOCK_PERMISSION_CAPABILITY_USE`` (when handled) gates that check regardless of which user namespace it targets. This is true whether the namespace is created on its own, combined with ``CLONE_NEWUSER`` in a single :manpage:`unshare(2)` call, or in a separate :manpage:`unshare(2)` call after a user namespace: in all cases the kernel checks ``CAP_SYS_ADMIN`` against the owning user namespace, and Landlock denies it unless a rule allows ``CAP_SYS_ADMIN``. Combining ``CLONE_NEWUSER`` with another ``CLONE_NEW*`` flag therefore does not avoid the capability check; only user namespace creation itself needs no capability rule.h](h.Creating a non-user namespace always requires }(hjhhhNhNubj)}(h``CAP_SYS_ADMIN``h]h CAP_SYS_ADMIN}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh, and }(hjhhhNhNubj)}(h&``LANDLOCK_PERMISSION_CAPABILITY_USE``h]h"LANDLOCK_PERMISSION_CAPABILITY_USE}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh (when handled) gates that check regardless of which user namespace it targets. This is true whether the namespace is created on its own, combined with }(hjhhhNhNubj)}(h``CLONE_NEWUSER``h]h CLONE_NEWUSER}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh in a single }(hjhhhNhNubj)}(h:manpage:`unshare(2)`h]h unshare(2)}(hj0hhhNhNubah}(h]h ]jah"]h$]h&]hhj unshare(2)junsharejjuh1jhjubh call, or in a separate }(hjhhhNhNubj)}(h:manpage:`unshare(2)`h]h unshare(2)}(hjDhhhNhNubah}(h]h ]jah"]h$]h&]hhj unshare(2)junsharejjuh1jhjubh= call after a user namespace: in all cases the kernel checks }(hjhhhNhNubj)}(h``CAP_SYS_ADMIN``h]h CAP_SYS_ADMIN}(hjXhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhP against the owning user namespace, and Landlock denies it unless a rule allows }(hjhhhNhNubj)}(h``CAP_SYS_ADMIN``h]h CAP_SYS_ADMIN}(hjjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh . Combining }(hjhhhNhNubj)}(h``CLONE_NEWUSER``h]h CLONE_NEWUSER}(hj|hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh with another }(hjhhhNhNubj)}(h``CLONE_NEW*``h]h CLONE_NEW*}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhr flag therefore does not avoid the capability check; only user namespace creation itself needs no capability rule.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMnhj hhubj()}(hWhen creating child user namespaces, it is recommended to also create a dedicated Landlock domain with restrictions relevant to each namespace context.h]hWhen creating child user namespaces, it is recommended to also create a dedicated Landlock domain with restrictions relevant to each namespace context.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMzhj hhubj()}(hXNote that ``LANDLOCK_PERMISSION_CAPABILITY_USE`` restricts the *use* of capabilities, not their presence in the process's credential. Capability sets can change after a domain is enforced through user namespace entry or :manpage:`capset(2)`; privileged sandboxes that did not set ``PR_SET_NO_NEW_PRIVS`` may also gain capabilities through :manpage:`execve(2)` of binaries with file capabilities. In all cases, :manpage:`capget(2)` will report the credential's capability sets, but any denied capability will fail with ``EPERM`` when exercised. Do not rely on :manpage:`capget(2)` to determine whether the policy permits a given capability; only the actual operation will return ``EPERM`` upon denial.h](h Note that }(hjhhhNhNubj)}(h&``LANDLOCK_PERMISSION_CAPABILITY_USE``h]h"LANDLOCK_PERMISSION_CAPABILITY_USE}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh restricts the }(hjhhhNhNubj| )}(h*use*h]huse}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j{ hjubh of capabilities, not their presence in the process’s credential. Capability sets can change after a domain is enforced through user namespace entry or }(hjhhhNhNubj)}(h:manpage:`capset(2)`h]h capset(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj capset(2)jcapsetjjuh1jhjubh(; privileged sandboxes that did not set }(hjhhhNhNubj)}(h``PR_SET_NO_NEW_PRIVS``h]hPR_SET_NO_NEW_PRIVS}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh$ may also gain capabilities through }(hjhhhNhNubj)}(h:manpage:`execve(2)`h]h execve(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj execve(2)jexecvejjuh1jhjubh3 of binaries with file capabilities. In all cases, }(hjhhhNhNubj)}(h:manpage:`capget(2)`h]h capget(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj capget(2)jcapgetjjuh1jhjubhZ will report the credential’s capability sets, but any denied capability will fail with }(hjhhhNhNubj)}(h ``EPERM``h]hEPERM}(hj.hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh! when exercised. Do not rely on }(hjhhhNhNubj)}(h:manpage:`capget(2)`h]h capget(2)}(hj@hhhNhNubah}(h]h ]jah"]h$]h&]hhj capget(2)jcapgetjjuh1jhjubhc to determine whether the policy permits a given capability; only the actual operation will return }(hjhhhNhNubj)}(h ``EPERM``h]hEPERM}(hjThhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh upon denial.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhM}hj hhubeh}(h]jGah ]h"]%capability and namespace restrictionsah$]h&]uh1hhjhhhhhMj Kubh)}(hhh](h)}(hTruncating filesh]hTruncating files}(hjvhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjshhhhhMubj()}(hXThe operations covered by ``LANDLOCK_ACCESS_FS_WRITE_FILE`` and ``LANDLOCK_ACCESS_FS_TRUNCATE`` both change the contents of a file and sometimes overlap in non-intuitive ways. It is strongly recommended to always specify both of these together (either granting both, or granting none).h](hThe operations covered by }(hjhhhNhNubj)}(h!``LANDLOCK_ACCESS_FS_WRITE_FILE``h]hLANDLOCK_ACCESS_FS_WRITE_FILE}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh and }(hjhhhNhNubj)}(h``LANDLOCK_ACCESS_FS_TRUNCATE``h]hLANDLOCK_ACCESS_FS_TRUNCATE}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh both change the contents of a file and sometimes overlap in non-intuitive ways. It is strongly recommended to always specify both of these together (either granting both, or granting none).}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjshhubj()}(hA particularly surprising example is :manpage:`creat(2)`. The name suggests that this system call requires the rights to create and write files. However, it also requires the truncate right if an existing file under the same name is already present.h](h%A particularly surprising example is }(hjhhhNhNubj)}(h:manpage:`creat(2)`h]hcreat(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhjcreat(2)jcreatjjuh1jhjubh. The name suggests that this system call requires the rights to create and write files. However, it also requires the truncate right if an existing file under the same name is already present.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjshhubj()}(hIt should also be noted that truncating files does not require the ``LANDLOCK_ACCESS_FS_WRITE_FILE`` right. Apart from the :manpage:`truncate(2)` system call, this can also be done through :manpage:`open(2)` with the flags ``O_RDONLY | O_TRUNC``.h](hCIt should also be noted that truncating files does not require the }(hjhhhNhNubj)}(h!``LANDLOCK_ACCESS_FS_WRITE_FILE``h]hLANDLOCK_ACCESS_FS_WRITE_FILE}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh right. Apart from the }(hjhhhNhNubj)}(h:manpage:`truncate(2)`h]h truncate(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj truncate(2)jtruncatejjuh1jhjubh, system call, this can also be done through }(hjhhhNhNubj)}(h:manpage:`open(2)`h]hopen(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhjopen(2)jopenjjuh1jhjubh with the flags }(hjhhhNhNubj)}(h``O_RDONLY | O_TRUNC``h]hO_RDONLY | O_TRUNC}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjshhubj()}(hAt the same time, on some filesystems, :manpage:`fallocate(2)` offers a way to shorten file contents with ``FALLOC_FL_COLLAPSE_RANGE`` when the file is opened for writing, sidestepping the ``LANDLOCK_ACCESS_FS_TRUNCATE`` right.h](h'At the same time, on some filesystems, }(hj2hhhNhNubj)}(h:manpage:`fallocate(2)`h]h fallocate(2)}(hj:hhhNhNubah}(h]h ]jah"]h$]h&]hhj fallocate(2)j fallocatejjuh1jhj2ubh, offers a way to shorten file contents with }(hj2hhhNhNubj)}(h``FALLOC_FL_COLLAPSE_RANGE``h]hFALLOC_FL_COLLAPSE_RANGE}(hjNhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj2ubh7 when the file is opened for writing, sidestepping the }(hj2hhhNhNubj)}(h``LANDLOCK_ACCESS_FS_TRUNCATE``h]hLANDLOCK_ACCESS_FS_TRUNCATE}(hj`hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj2ubh right.}(hj2hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjshhubj()}(hBThe truncate right is associated with the opened file (see below).h]hBThe truncate right is associated with the opened file (see below).}(hjxhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMhjshhubeh}(h]truncating-filesah ]h"]truncating filesah$]h&]uh1hhjhhhhhMubh)}(hhh](h)}(h'Rights associated with file descriptorsh]h'Rights associated with file descriptors}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhMubj()}(hXWhen opening a file, the availability of the ``LANDLOCK_ACCESS_FS_TRUNCATE`` and ``LANDLOCK_ACCESS_FS_IOCTL_DEV`` rights is associated with the newly created file descriptor and will be used for subsequent truncation and ioctl attempts using :manpage:`ftruncate(2)` and :manpage:`ioctl(2)`. The behavior is similar to opening a file for reading or writing, where permissions are checked during :manpage:`open(2)`, but not during the subsequent :manpage:`read(2)` and :manpage:`write(2)` calls.h](h-When opening a file, the availability of the }(hjhhhNhNubj)}(h``LANDLOCK_ACCESS_FS_TRUNCATE``h]hLANDLOCK_ACCESS_FS_TRUNCATE}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh and }(hjhhhNhNubj)}(h ``LANDLOCK_ACCESS_FS_IOCTL_DEV``h]hLANDLOCK_ACCESS_FS_IOCTL_DEV}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh rights is associated with the newly created file descriptor and will be used for subsequent truncation and ioctl attempts using }(hjhhhNhNubj)}(h:manpage:`ftruncate(2)`h]h ftruncate(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj ftruncate(2)j ftruncatejjuh1jhjubh and }(hjhhhNhNubj)}(h:manpage:`ioctl(2)`h]hioctl(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhjioctl(2)jioctljjuh1jhjubhj. The behavior is similar to opening a file for reading or writing, where permissions are checked during }(hjhhhNhNubj)}(h:manpage:`open(2)`h]hopen(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhjopen(2)jopenjjuh1jhjubh , but not during the subsequent }(hjhhhNhNubj)}(h:manpage:`read(2)`h]hread(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhjread(2)jreadjjuh1jhjubh and }hjsbj)}(h:manpage:`write(2)`h]hwrite(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhjwrite(2)jwritejjuh1jhjubh calls.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjhhubj()}(hXAs a consequence, it is possible that a process has multiple open file descriptors referring to the same file, but Landlock enforces different things when operating with these file descriptors. This can happen when a Landlock ruleset gets enforced and the process keeps file descriptors which were opened both before and after the enforcement. It is also possible to pass such file descriptors between processes, keeping their Landlock properties, even when some of the involved processes do not have an enforced Landlock ruleset.h]hXAs a consequence, it is possible that a process has multiple open file descriptors referring to the same file, but Landlock enforces different things when operating with these file descriptors. This can happen when a Landlock ruleset gets enforced and the process keeps file descriptors which were opened both before and after the enforcement. It is also possible to pass such file descriptors between processes, keeping their Landlock properties, even when some of the involved processes do not have an enforced Landlock ruleset.}(hj5hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMhjhhubeh}(h]'rights-associated-with-file-descriptorsah ]h"]'rights associated with file descriptorsah$]h&]uh1hhjhhhhhMubeh}(h]landlock-rulesah ]h"]landlock rulesah$]h&]uh1hhhhhhhhKubh)}(hhh](h)}(h Compatibilityh]h Compatibility}(hjVhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjShhhhhMubh)}(hhh](h)}(h"Backward and forward compatibilityh]h"Backward and forward compatibility}(hjghhhNhNubah}(h]h ]h"]h$]h&]uh1hhjdhhhhhMubj()}(hXLandlock is designed to be compatible with past and future versions of the kernel. This is achieved thanks to the system call attributes and the associated bitflags, particularly the ruleset's ``handled_access_fs``. Making handled access rights explicit enables the kernel and user space to have a clear contract with each other. This is required to make sure sandboxing will not get stricter with a system update, which could break applications.h](hLandlock is designed to be compatible with past and future versions of the kernel. This is achieved thanks to the system call attributes and the associated bitflags, particularly the ruleset’s }(hjuhhhNhNubj)}(h``handled_access_fs``h]hhandled_access_fs}(hj}hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjuubh. Making handled access rights explicit enables the kernel and user space to have a clear contract with each other. This is required to make sure sandboxing will not get stricter with a system update, which could break applications.}(hjuhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjdhhubj()}(hXDevelopers can subscribe to the `Landlock mailing list `_ to knowingly update and test their applications with the latest available features. In the interest of users, and because they may use different kernel versions, it is strongly encouraged to follow a best-effort security approach by checking the Landlock ABI version at runtime and only enforcing the supported features.h](h Developers can subscribe to the }(hjhhhNhNubj5)}(hK`Landlock mailing list `_h]hLandlock mailing list}(hjhhhNhNubah}(h]h ]h"]h$]h&]nameLandlock mailing listj0https://subspace.kernel.org/lists.linux.dev.htmluh1j4hjubhtarget)}(h3 h]h}(h]landlock-mailing-listah ]h"]landlock mailing listah$]h&]refurijuh1jj KhjubhXB to knowingly update and test their applications with the latest available features. In the interest of users, and because they may use different kernel versions, it is strongly encouraged to follow a best-effort security approach by checking the Landlock ABI version at runtime and only enforcing the supported features.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjdhhubj)}(h.. _landlock_abi_versions:h]h}(h]h ]h"]h$]h&]jFlandlock-abi-versionsuh1jhMhjdhhhhubeh}(h]"backward-and-forward-compatibilityah ]h"]"backward and forward compatibilityah$]h&]uh1hhjShhhhhMubh)}(hhh](h)}(hLandlock ABI versionsh]hLandlock ABI versions}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhMubj()}(hXThe Landlock ABI version can be read with the sys_landlock_create_ruleset() system call:h]hXThe Landlock ABI version can be read with the sys_landlock_create_ruleset() system call:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMhjhhubj)}(hXint abi; abi = landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_VERSION); if (abi < 0) { switch (errno) { case ENOSYS: printf("Landlock is not supported by the current kernel.\n"); break; case EOPNOTSUPP: printf("Landlock is currently disabled.\n"); break; } return 0; } if (abi >= 2) { printf("Landlock supports LANDLOCK_ACCESS_FS_REFER.\n"); }h]hXint abi; abi = landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_VERSION); if (abi < 0) { switch (errno) { case ENOSYS: printf("Landlock is not supported by the current kernel.\n"); break; case EOPNOTSUPP: printf("Landlock is currently disabled.\n"); break; } return 0; } if (abi >= 2) { printf("Landlock supports LANDLOCK_ACCESS_FS_REFER.\n"); }}hjsbah}(h]h ]h"]h$]h&]hhjjjj}uh1jhhhMhjhhubj()}(huAll Landlock kernel interfaces are supported by the first ABI version unless explicitly noted in their documentation.h]huAll Landlock kernel interfaces are supported by the first ABI version unless explicitly noted in their documentation.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMhjhhubeh}(h](jid1eh ]h"](landlock abi versionslandlock_abi_versionseh$]h&]uh1hhjShhhhhMexpect_referenced_by_name}jjsexpect_referenced_by_id}jjsubh)}(hhh](h)}(hLandlock erratah]hLandlock errata}(hj&hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj#hhhhhMubj()}(hIn addition to ABI versions, Landlock provides an errata mechanism to track fixes for issues that may affect backwards compatibility or require userspace awareness. The errata bitmask can be queried using:h]hIn addition to ABI versions, Landlock provides an errata mechanism to track fixes for issues that may affect backwards compatibility or require userspace awareness. The errata bitmask can be queried using:}(hj4hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMhj#hhubj)}(hint errata; errata = landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_ERRATA); if (errata < 0) { /* Landlock not available or disabled */ return 0; }h]hint errata; errata = landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_ERRATA); if (errata < 0) { /* Landlock not available or disabled */ return 0; }}hjBsbah}(h]h ]h"]h$]h&]hhjjjj}uh1jhhhMhj#hhubj()}(hThe returned value is a bitmask where each bit represents a specific erratum. If bit N is set (``errata & (1 << (N - 1))``), then erratum N has been fixed in the running kernel.h](h_The returned value is a bitmask where each bit represents a specific erratum. If bit N is set (}(hjQhhhNhNubj)}(h``errata & (1 << (N - 1))``h]herrata & (1 << (N - 1))}(hjYhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjQubh7), then erratum N has been fixed in the running kernel.}(hjQhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhj#hhubhwarning)}(hXa**Most applications should NOT check errata.** In 99.9% of cases, checking errata is unnecessary, increases code complexity, and can potentially decrease protection if misused. For example, disabling the sandbox when an erratum is not fixed could leave the system less secure than using Landlock's best-effort protection. When in doubt, ignore errata.h]j()}(hXa**Most applications should NOT check errata.** In 99.9% of cases, checking errata is unnecessary, increases code complexity, and can potentially decrease protection if misused. For example, disabling the sandbox when an erratum is not fixed could leave the system less secure than using Landlock's best-effort protection. When in doubt, ignore errata.h](hstrong)}(h.**Most applications should NOT check errata.**h]h*Most applications should NOT check errata.}(hj}hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hjwubhX5 In 99.9% of cases, checking errata is unnecessary, increases code complexity, and can potentially decrease protection if misused. For example, disabling the sandbox when an erratum is not fixed could leave the system less secure than using Landlock’s best-effort protection. When in doubt, ignore errata.}(hjwhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjsubah}(h]h ]h"]h$]h&]uh1jqhj#hhhhhNubh)}(hhh](h)}(h$Erratum 1: TCP socket identificationh]h$Erratum 1: TCP socket identification}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhNhNubj()}(hX]This fix addresses an issue where IPv4 and IPv6 stream sockets (e.g., SMC, MPTCP, or SCTP) were incorrectly restricted by TCP access rights during :manpage:`bind(2)` and :manpage:`connect(2)` operations. This change ensures that only TCP sockets are subject to TCP access rights, allowing other protocols to operate without unnecessary restrictions.h](hThis fix addresses an issue where IPv4 and IPv6 stream sockets (e.g., SMC, MPTCP, or SCTP) were incorrectly restricted by TCP access rights during }(hjhhhNhNubj)}(h:manpage:`bind(2)`h]hbind(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhjbind(2)jbindjjuh1jhjubh and }(hjhhhNhNubj)}(h:manpage:`connect(2)`h]h connect(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj connect(2)jconnectjjuh1jhjubh operations. This change ensures that only TCP sockets are subject to TCP access rights, allowing other protocols to operate without unnecessary restrictions.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hh/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:771: ./security/landlock/errata/abi-4.hhKhjubj()}(hImpact:h]hImpact:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hh/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:771: ./security/landlock/errata/abi-4.hhK hjubj()}(hXIn kernels without this fix, using ``LANDLOCK_ACCESS_NET_BIND_TCP`` or ``LANDLOCK_ACCESS_NET_CONNECT_TCP`` would incorrectly restrict non-TCP stream protocols (SMC, MPTCP, SCTP), potentially breaking applications that rely on these protocols while using Landlock network restrictions.h](h#In kernels without this fix, using }(hjhhhNhNubj)}(h ``LANDLOCK_ACCESS_NET_BIND_TCP``h]hLANDLOCK_ACCESS_NET_BIND_TCP}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh or }(hjhhhNhNubj)}(h#``LANDLOCK_ACCESS_NET_CONNECT_TCP``h]hLANDLOCK_ACCESS_NET_CONNECT_TCP}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh would incorrectly restrict non-TCP stream protocols (SMC, MPTCP, SCTP), potentially breaking applications that rely on these protocols while using Landlock network restrictions.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hh/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:771: ./security/landlock/errata/abi-4.hhKhjubeh}(h]#erratum-1-tcp-socket-identificationah ]h"]$erratum 1: tcp socket identificationah$]h&]uh1hhj#hhhNhNubh)}(hhh](h)}(h!Erratum 2: Scoped signal handlingh]h!Erratum 2: Scoped signal handling}(hj0hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj-hNhNubj()}(hXThis fix addresses an issue where signal scoping was overly restrictive, preventing sandboxed threads from signaling other threads within the same process if they belonged to different domains. Because threads are not security boundaries, user space might assume that all threads within the same process can send signals between themselves (see :manpage:`nptl(7)` and :manpage:`libpsx(3)`). Consistent with :manpage:`ptrace(2)` behavior, direct interaction between threads of the same process should always be allowed. This change ensures that any thread is allowed to send signals to any other thread within the same process, regardless of their domain.h](hXZThis fix addresses an issue where signal scoping was overly restrictive, preventing sandboxed threads from signaling other threads within the same process if they belonged to different domains. Because threads are not security boundaries, user space might assume that all threads within the same process can send signals between themselves (see }(hj>hhhNhNubj)}(h:manpage:`nptl(7)`h]hnptl(7)}(hjFhhhNhNubah}(h]h ]jah"]h$]h&]hhjnptl(7)jnptljjuh1jhj>ubh and }(hj>hhhNhNubj)}(h:manpage:`libpsx(3)`h]h libpsx(3)}(hjZhhhNhNubah}(h]h ]jah"]h$]h&]hhj libpsx(3)jlibpsxj3uh1jhj>ubh). Consistent with }(hj>hhhNhNubj)}(h:manpage:`ptrace(2)`h]h ptrace(2)}(hjohhhNhNubah}(h]h ]jah"]h$]h&]hhj ptrace(2)jptracejjuh1jhj>ubh behavior, direct interaction between threads of the same process should always be allowed. This change ensures that any thread is allowed to send signals to any other thread within the same process, regardless of their domain.}(hj>hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hh/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:774: ./security/landlock/errata/abi-6.hhKhj-ubj()}(hImpact:h]hImpact:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hh/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:774: ./security/landlock/errata/abi-6.hhKhj-ubj()}(hXThis problem only manifests when the userspace process is itself using :manpage:`libpsx(3)` or an equivalent mechanism to enforce a Landlock policy on multiple already-running threads at once. Programs which enforce a Landlock policy at startup time and only then become multithreaded are not affected. Without this fix, signal scoping could break multi-threaded applications that expect threads within the same process to freely signal each other.h](hGThis problem only manifests when the userspace process is itself using }(hjhhhNhNubj)}(h:manpage:`libpsx(3)`h]h libpsx(3)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj libpsx(3)jlibpsxjjjuh1jhjubhXg or an equivalent mechanism to enforce a Landlock policy on multiple already-running threads at once. Programs which enforce a Landlock policy at startup time and only then become multithreaded are not affected. Without this fix, signal scoping could break multi-threaded applications that expect threads within the same process to freely signal each other.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hh/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:774: ./security/landlock/errata/abi-6.hhKhj-ubeh}(h] erratum-2-scoped-signal-handlingah ]h"]!erratum 2: scoped signal handlingah$]h&]uh1hhj#hhhNhNubh)}(hhh](h)}(h*Erratum 3: Disconnected directory handlingh]h*Erratum 3: Disconnected directory handling}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhNhNubj()}(hX}This fix addresses an issue with disconnected directories that occur when a directory is moved outside the scope of a bind mount. The change ensures that evaluated access rights include both those from the disconnected file hierarchy down to its filesystem root and those from the related mount point hierarchy. This prevents access right widening through rename or link actions.h]hX}This fix addresses an issue with disconnected directories that occur when a directory is moved outside the scope of a bind mount. The change ensures that evaluated access rights include both those from the disconnected file hierarchy down to its filesystem root and those from the related mount point hierarchy. This prevents access right widening through rename or link actions.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hh/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:777: ./security/landlock/errata/abi-1.hhKhjubj()}(hImpact:h]hImpact:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hh/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:777: ./security/landlock/errata/abi-1.hhKhjubj()}(hXFWithout this fix, it was possible to widen access rights through rename or link actions involving disconnected directories, potentially bypassing ``LANDLOCK_ACCESS_FS_REFER`` restrictions. This could allow privilege escalation in complex mount scenarios where directories become disconnected from their original mount points.h](hWithout this fix, it was possible to widen access rights through rename or link actions involving disconnected directories, potentially bypassing }(hjhhhNhNubj)}(h``LANDLOCK_ACCESS_FS_REFER``h]hLANDLOCK_ACCESS_FS_REFER}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh restrictions. This could allow privilege escalation in complex mount scenarios where directories become disconnected from their original mount points.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hh/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:777: ./security/landlock/errata/abi-1.hhKhjubeh}(h])erratum-3-disconnected-directory-handlingah ]h"]*erratum 3: disconnected directory handlingah$]h&]uh1hhj#hhhNhNubh)}(hhh](h)}(h'Erratum 4: Creation of whiteout objectsh]h'Erratum 4: Creation of whiteout objects}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhNhNubj()}(hXThis fix changes the access rights required for the creation of whiteout objects through :manpage:`mknod(2)`, :manpage:`renameat2(2)`, or :manpage:`link(2)`. Creating whiteout objects is now guarded by ``LANDLOCK_ACCESS_FS_MAKE_REG`` instead of ``LANDLOCK_ACCESS_FS_MAKE_CHAR``.h](hYThis fix changes the access rights required for the creation of whiteout objects through }(hj-hhhNhNubj)}(h:manpage:`mknod(2)`h]hmknod(2)}(hj5hhhNhNubah}(h]h ]jah"]h$]h&]hhjmknod(2)jmknodjjuh1jhj-ubh, }(hj-hhhNhNubj)}(h:manpage:`renameat2(2)`h]h renameat2(2)}(hjIhhhNhNubah}(h]h ]jah"]h$]h&]hhj renameat2(2)j renameat2jjuh1jhj-ubh, or }(hj-hhhNhNubj)}(h:manpage:`link(2)`h]hlink(2)}(hj]hhhNhNubah}(h]h ]jah"]h$]h&]hhjlink(2)jlinkjjuh1jhj-ubh/. Creating whiteout objects is now guarded by }(hj-hhhNhNubj)}(h``LANDLOCK_ACCESS_FS_MAKE_REG``h]hLANDLOCK_ACCESS_FS_MAKE_REG}(hjqhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj-ubh instead of }(hj-hhhNhNubj)}(h ``LANDLOCK_ACCESS_FS_MAKE_CHAR``h]hLANDLOCK_ACCESS_FS_MAKE_CHAR}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj-ubh.}(hj-hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hh/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:780: ./security/landlock/errata/abi-1.hhKhjubj()}(hWhiteout objects are used in OverlayFS to mark the absence of a file in an upper file system. Despite being created with ``S_IFCHR``, whiteout objects do not count as character devices.h](hzWhiteout objects are used in OverlayFS to mark the absence of a file in an upper file system. Despite being created with }(hjhhhNhNubj)}(h ``S_IFCHR``h]hS_IFCHR}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh5, whiteout objects do not count as character devices.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hh/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:780: ./security/landlock/errata/abi-1.hhK#hjubj()}(hImpact:h]hImpact:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hh/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:780: ./security/landlock/errata/abi-1.hhK'hjubj()}(hSandboxed programs that create OverlayFS whiteouts (such as fuse-overlayfs) now require ``LANDLOCK_ACCESS_FS_MAKE_REG`` instead of ``LANDLOCK_ACCESS_FS_MAKE_CHAR``.h](hXSandboxed programs that create OverlayFS whiteouts (such as fuse-overlayfs) now require }(hjhhhNhNubj)}(h``LANDLOCK_ACCESS_FS_MAKE_REG``h]hLANDLOCK_ACCESS_FS_MAKE_REG}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh instead of }(hjhhhNhNubj)}(h ``LANDLOCK_ACCESS_FS_MAKE_CHAR``h]hLANDLOCK_ACCESS_FS_MAKE_CHAR}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hh/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:780: ./security/landlock/errata/abi-1.hhK)hjubeh}(h]&erratum-4-creation-of-whiteout-objectsah ]h"]'erratum 4: creation of whiteout objectsah$]h&]uh1hhj#hhhNhNubh)}(hhh](h)}(hHow to check for erratah]hHow to check for errata}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhMubj()}(h\If you determine that your application needs to check for specific errata, use this pattern:h]h\If you determine that your application needs to check for specific errata, use this pattern:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMhjhhubj)}(hXVint errata = landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_ERRATA); if (errata >= 0) { /* Check for specific erratum (1-indexed) */ if (errata & (1 << (erratum_number - 1))) { /* Erratum N is fixed in this kernel */ } else { /* Erratum N is NOT fixed - consider implications for your use case */ } }h]hXVint errata = landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_ERRATA); if (errata >= 0) { /* Check for specific erratum (1-indexed) */ if (errata & (1 << (erratum_number - 1))) { /* Erratum N is fixed in this kernel */ } else { /* Erratum N is NOT fixed - consider implications for your use case */ } }}hj&sbah}(h]h ]h"]h$]h&]hhjjjj}uh1jhhhMhjhhubj()}(h**Important:** Only check errata if your application specifically relies on behavior that changed due to the fix. The fixes generally make Landlock less restrictive or more correct, not more restrictive.h](j|)}(h**Important:**h]h Important:}(hj9hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hj5ubh Only check errata if your application specifically relies on behavior that changed due to the fix. The fixes generally make Landlock less restrictive or more correct, not more restrictive.}(hj5hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhM!hjhhubeh}(h]how-to-check-for-errataah ]h"]how to check for errataah$]h&]uh1hhj#hhhhhMubeh}(h]landlock-errataah ]h"]landlock errataah$]h&]uh1hhjShhhhhMubeh}(h] compatibilityah ]h"] compatibilityah$]h&]uh1hhhhhhhhMubh)}(hhh](h)}(hKernel interfaceh]hKernel interface}(hjlhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjihhhhhM&ubh)}(hhh](h)}(h Access rightsh]h Access rights}(hj}hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjzhhhhhM)ubj()}(hA set of actions on kernel objects may be defined by an attribute (e.g. :c:type:`struct landlock_path_beneath_attr `) including a bitmask of access.h](hHA set of actions on kernel objects may be defined by an attribute (e.g. }(hjhhhNhNubh)}(hH:c:type:`struct landlock_path_beneath_attr `h]j)}(hjh]h!struct landlock_path_beneath_attr}(hjhhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]refdocj refdomainjereftypetype refexplicitrefwarnjlandlock_path_beneath_attruh1hhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMshjubh ) including a bitmask of access.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hjhMshjzhhubh)}(hhh](h)}(hFilesystem flagsh]hFilesystem flags}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhNhNubj()}(hThese flags enable to restrict a sandboxed process to a set of actions on files and directories. Files or directories opened before the sandboxing are not subject to these restrictions.h]hThese flags enable to restrict a sandboxed process to a set of actions on files and directories. Files or directories opened before the sandboxing are not subject to these restrictions.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMyhjubj()}(h0The following access rights apply only to files:h]h0The following access rights apply only to files:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhM}hjubjb)}(hhh](jg)}(h/``LANDLOCK_ACCESS_FS_EXECUTE``: Execute a file.h]j()}(hjh](j)}(h``LANDLOCK_ACCESS_FS_EXECUTE``h]hLANDLOCK_ACCESS_FS_EXECUTE}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh: Execute a file.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMhjubah}(h]h ]h"]h$]h&]uh1jfhjubjg)}(hX``LANDLOCK_ACCESS_FS_WRITE_FILE``: Open a file with write access. When opening files for writing, you will often additionally need the ``LANDLOCK_ACCESS_FS_TRUNCATE`` right. In many cases, these system calls truncate existing files when overwriting them (e.g., :manpage:`creat(2)`).h]j()}(hX``LANDLOCK_ACCESS_FS_WRITE_FILE``: Open a file with write access. When opening files for writing, you will often additionally need the ``LANDLOCK_ACCESS_FS_TRUNCATE`` right. In many cases, these system calls truncate existing files when overwriting them (e.g., :manpage:`creat(2)`).h](j)}(h!``LANDLOCK_ACCESS_FS_WRITE_FILE``h]hLANDLOCK_ACCESS_FS_WRITE_FILE}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhg: Open a file with write access. When opening files for writing, you will often additionally need the }(hjhhhNhNubj)}(h``LANDLOCK_ACCESS_FS_TRUNCATE``h]hLANDLOCK_ACCESS_FS_TRUNCATE}(hj/hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh` right. In many cases, these system calls truncate existing files when overwriting them (e.g., }(hjhhhNhNubj)}(h:manpage:`creat(2)`h]hcreat(2)}(hjAhhhNhNubah}(h]h ]jah"]h$]h&]hhjcreat(2)jcreatjjuh1jhjubh).}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMhjubah}(h]h ]h"]h$]h&]uh1jfhjubjg)}(h?``LANDLOCK_ACCESS_FS_READ_FILE``: Open a file with read access.h]j()}(hjdh](j)}(h ``LANDLOCK_ACCESS_FS_READ_FILE``h]hLANDLOCK_ACCESS_FS_READ_FILE}(hjihhhNhNubah}(h]h ]h"]h$]h&]uh1jhjfubh: Open a file with read access.}(hjfhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMhjbubah}(h]h ]h"]h$]h&]uh1jfhjubjg)}(h``LANDLOCK_ACCESS_FS_TRUNCATE``: Truncate a file with :manpage:`truncate(2)`, :manpage:`ftruncate(2)`, :manpage:`creat(2)`, or :manpage:`open(2)` with ``O_TRUNC``. This access right is available since the third version of the Landlock ABI.h]j()}(h``LANDLOCK_ACCESS_FS_TRUNCATE``: Truncate a file with :manpage:`truncate(2)`, :manpage:`ftruncate(2)`, :manpage:`creat(2)`, or :manpage:`open(2)` with ``O_TRUNC``. This access right is available since the third version of the Landlock ABI.h](j)}(h``LANDLOCK_ACCESS_FS_TRUNCATE``h]hLANDLOCK_ACCESS_FS_TRUNCATE}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh: Truncate a file with }(hjhhhNhNubj)}(h:manpage:`truncate(2)`h]h truncate(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj truncate(2)jtruncatejjuh1jhjubh, }(hjhhhNhNubj)}(h:manpage:`ftruncate(2)`h]h ftruncate(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj ftruncate(2)j ftruncatejjuh1jhjubh, }(hjhhhNhNubj)}(h:manpage:`creat(2)`h]hcreat(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhjcreat(2)jcreatjjuh1jhjubh, or }(hjhhhNhNubj)}(h:manpage:`open(2)`h]hopen(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhjopen(2)jopenjjuh1jhjubh with }(hjhhhNhNubj)}(h ``O_TRUNC``h]hO_TRUNC}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhN. This access right is available since the third version of the Landlock ABI.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMhjubah}(h]h ]h"]h$]h&]uh1jfhjubjg)}(hX}``LANDLOCK_ACCESS_FS_IOCTL_DEV``: Invoke :manpage:`ioctl(2)` commands on an opened character or block device. This access right applies to all `ioctl(2)` commands implemented by device drivers. However, the following common IOCTL commands continue to be invokable independent of the ``LANDLOCK_ACCESS_FS_IOCTL_DEV`` right: * IOCTL commands targeting file descriptors (``FIOCLEX``, ``FIONCLEX``), * IOCTL commands targeting file descriptions (``FIONBIO``, ``FIOASYNC``), * IOCTL commands targeting file systems (``FIFREEZE``, ``FITHAW``, ``FIGETBSZ``, ``FS_IOC_GETFSUUID``, ``FS_IOC_GETFSSYSFSPATH``) * Some IOCTL commands which do not make sense when used with devices, but whose implementations are safe and return the right error codes (``FS_IOC_FIEMAP``, ``FICLONE``, ``FICLONERANGE``, ``FIDEDUPERANGE``) This access right is available since the fifth version of the Landlock ABI.h](j()}(hm``LANDLOCK_ACCESS_FS_IOCTL_DEV``: Invoke :manpage:`ioctl(2)` commands on an opened character or block device.h](j)}(h ``LANDLOCK_ACCESS_FS_IOCTL_DEV``h]hLANDLOCK_ACCESS_FS_IOCTL_DEV}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh : Invoke }(hjhhhNhNubj)}(h:manpage:`ioctl(2)`h]hioctl(2)}(hj+hhhNhNubah}(h]h ]jah"]h$]h&]hhjioctl(2)jioctljjuh1jhjubh1 commands on an opened character or block device.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMhjubj()}(hThis access right applies to all `ioctl(2)` commands implemented by device drivers. However, the following common IOCTL commands continue to be invokable independent of the ``LANDLOCK_ACCESS_FS_IOCTL_DEV`` right:h](h!This access right applies to all }(hjFhhhNhNubjJ)}(h `ioctl(2)`h]hioctl(2)}(hjNhhhNhNubah}(h]h ]h"]h$]h&]uh1jIhjFubh commands implemented by device drivers. However, the following common IOCTL commands continue to be invokable independent of the }(hjFhhhNhNubj)}(h ``LANDLOCK_ACCESS_FS_IOCTL_DEV``h]hLANDLOCK_ACCESS_FS_IOCTL_DEV}(hj`hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjFubh right:}(hjFhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMhjubjb)}(hhh](jg)}(hFIOCTL commands targeting file descriptors (``FIOCLEX``, ``FIONCLEX``),h]j()}(hj~h](h+IOCTL commands targeting file descriptors (}(hjhhhNhNubj)}(h ``FIOCLEX``h]hFIOCLEX}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh, }(hjhhhNhNubj)}(h ``FIONCLEX``h]hFIONCLEX}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh),}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMhj|ubah}(h]h ]h"]h$]h&]uh1jfhjyubjg)}(hGIOCTL commands targeting file descriptions (``FIONBIO``, ``FIOASYNC``),h]j()}(hjh](h,IOCTL commands targeting file descriptions (}(hjhhhNhNubj)}(h ``FIONBIO``h]hFIONBIO}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh, }(hjhhhNhNubj)}(h ``FIOASYNC``h]hFIOASYNC}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh),}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMhjubah}(h]h ]h"]h$]h&]uh1jfhjyubjg)}(hIOCTL commands targeting file systems (``FIFREEZE``, ``FITHAW``, ``FIGETBSZ``, ``FS_IOC_GETFSUUID``, ``FS_IOC_GETFSSYSFSPATH``)h]j()}(hIOCTL commands targeting file systems (``FIFREEZE``, ``FITHAW``, ``FIGETBSZ``, ``FS_IOC_GETFSUUID``, ``FS_IOC_GETFSSYSFSPATH``)h](h'IOCTL commands targeting file systems (}(hjhhhNhNubj)}(h ``FIFREEZE``h]hFIFREEZE}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh, }(hjhhhNhNubj)}(h ``FITHAW``h]hFITHAW}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh, }(hjhhhNhNubj)}(h ``FIGETBSZ``h]hFIGETBSZ}(hj$hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh, }hjsbj)}(h``FS_IOC_GETFSUUID``h]hFS_IOC_GETFSUUID}(hj6hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh, }hjsbj)}(h``FS_IOC_GETFSSYSFSPATH``h]hFS_IOC_GETFSSYSFSPATH}(hjHhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh)}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMhjubah}(h]h ]h"]h$]h&]uh1jfhjyubjg)}(hSome IOCTL commands which do not make sense when used with devices, but whose implementations are safe and return the right error codes (``FS_IOC_FIEMAP``, ``FICLONE``, ``FICLONERANGE``, ``FIDEDUPERANGE``) h]j()}(hSome IOCTL commands which do not make sense when used with devices, but whose implementations are safe and return the right error codes (``FS_IOC_FIEMAP``, ``FICLONE``, ``FICLONERANGE``, ``FIDEDUPERANGE``)h](hSome IOCTL commands which do not make sense when used with devices, but whose implementations are safe and return the right error codes (}(hjkhhhNhNubj)}(h``FS_IOC_FIEMAP``h]h FS_IOC_FIEMAP}(hjshhhNhNubah}(h]h ]h"]h$]h&]uh1jhjkubh, }(hjkhhhNhNubj)}(h ``FICLONE``h]hFICLONE}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjkubh, }hjksbj)}(h``FICLONERANGE``h]h FICLONERANGE}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjkubh, }hjksbj)}(h``FIDEDUPERANGE``h]h FIDEDUPERANGE}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjkubh)}(hjkhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMhjgubah}(h]h ]h"]h$]h&]uh1jfhjyubeh}(h]h ]h"]h$]h&]jjuh1jahjhMhjubj()}(hKThis access right is available since the fifth version of the Landlock ABI.h]hKThis access right is available since the fifth version of the Landlock ABI.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMhjubeh}(h]h ]h"]h$]h&]uh1jfhjubjg)}(hX``LANDLOCK_ACCESS_FS_RESOLVE_UNIX``: Look up pathname UNIX domain sockets (:manpage:`unix(7)`). On UNIX domain sockets, this restricts both calls to :manpage:`connect(2)` as well as calls to :manpage:`sendmsg(2)` with an explicit recipient address. This access right applies only to connections to UNIX server sockets which were created outside of the newly created Landlock domain (e.g. from within a parent domain or from an unrestricted process). Newly created UNIX servers within the same Landlock domain continue to be accessible. In this regard, ``LANDLOCK_ACCESS_FS_RESOLVE_UNIX`` has the same semantics as the ``LANDLOCK_SCOPE_*`` flags. If a resolution attempt is denied, the operation returns an ``EACCES`` error, in line with other filesystem access rights (but different to denials for abstract UNIX domain sockets). This access right is available since the ninth version of the Landlock ABI. The rationale for this design is described in :ref:`Documentation/security/landlock.rst `. h](j()}(h``LANDLOCK_ACCESS_FS_RESOLVE_UNIX``: Look up pathname UNIX domain sockets (:manpage:`unix(7)`). On UNIX domain sockets, this restricts both calls to :manpage:`connect(2)` as well as calls to :manpage:`sendmsg(2)` with an explicit recipient address.h](j)}(h#``LANDLOCK_ACCESS_FS_RESOLVE_UNIX``h]hLANDLOCK_ACCESS_FS_RESOLVE_UNIX}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh(: Look up pathname UNIX domain sockets (}(hjhhhNhNubj)}(h:manpage:`unix(7)`h]hunix(7)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhjunix(7)junixjjuh1jhjubh9). On UNIX domain sockets, this restricts both calls to }(hjhhhNhNubj)}(h:manpage:`connect(2)`h]h connect(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj connect(2)jconnectjjuh1jhjubh as well as calls to }(hjhhhNhNubj)}(h:manpage:`sendmsg(2)`h]h sendmsg(2)}(hj%hhhNhNubah}(h]h ]jah"]h$]h&]hhj sendmsg(2)jsendmsgjjuh1jhjubh$ with an explicit recipient address.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMhjubj()}(hXThis access right applies only to connections to UNIX server sockets which were created outside of the newly created Landlock domain (e.g. from within a parent domain or from an unrestricted process). Newly created UNIX servers within the same Landlock domain continue to be accessible. In this regard, ``LANDLOCK_ACCESS_FS_RESOLVE_UNIX`` has the same semantics as the ``LANDLOCK_SCOPE_*`` flags.h](hX1This access right applies only to connections to UNIX server sockets which were created outside of the newly created Landlock domain (e.g. from within a parent domain or from an unrestricted process). Newly created UNIX servers within the same Landlock domain continue to be accessible. In this regard, }(hj@hhhNhNubj)}(h#``LANDLOCK_ACCESS_FS_RESOLVE_UNIX``h]hLANDLOCK_ACCESS_FS_RESOLVE_UNIX}(hjHhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj@ubh has the same semantics as the }(hj@hhhNhNubj)}(h``LANDLOCK_SCOPE_*``h]hLANDLOCK_SCOPE_*}(hjZhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj@ubh flags.}(hj@hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMhjubj()}(hIf a resolution attempt is denied, the operation returns an ``EACCES`` error, in line with other filesystem access rights (but different to denials for abstract UNIX domain sockets).h](h`.h](h.The rationale for this design is described in }(hjhhhNhNubh)}(hE:ref:`Documentation/security/landlock.rst `h]j)}(hjh]h#Documentation/security/landlock.rst}(hjhhhNhNubah}(h]h ](jstdstd-refeh"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]refdocj refdomainjreftyperef refexplicitrefwarnjscoped-flags-interactionuh1hhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMhjubh.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hjhMhjubeh}(h]h ]h"]h$]h&]uh1jfhjubeh}(h]h ]h"]h$]h&]j-uh1jahjhMhjubj()}(hX'Whether an opened file can be truncated with :manpage:`ftruncate(2)` or used with `ioctl(2)` is determined during :manpage:`open(2)`, in the same way as read and write permissions are checked during :manpage:`open(2)` using ``LANDLOCK_ACCESS_FS_READ_FILE`` and ``LANDLOCK_ACCESS_FS_WRITE_FILE``.h](h-Whether an opened file can be truncated with }(hjhhhNhNubj)}(h:manpage:`ftruncate(2)`h]h ftruncate(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj ftruncate(2)j ftruncatejjuh1jhjubh or used with }(hjhhhNhNubjJ)}(h `ioctl(2)`h]hioctl(2)}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jIhjubh is determined during }(hjhhhNhNubj)}(h:manpage:`open(2)`h]hopen(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhjopen(2)jopenjjuh1jhjubhC, in the same way as read and write permissions are checked during }(hjhhhNhNubj)}(h:manpage:`open(2)`h]hopen(2)}(hj%hhhNhNubah}(h]h ]jah"]h$]h&]hhjopen(2)jopenjjuh1jhjubh using }(hjhhhNhNubj)}(h ``LANDLOCK_ACCESS_FS_READ_FILE``h]hLANDLOCK_ACCESS_FS_READ_FILE}(hj9hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh and }(hjhhhNhNubj)}(h!``LANDLOCK_ACCESS_FS_WRITE_FILE``h]hLANDLOCK_ACCESS_FS_WRITE_FILE}(hjKhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMhjubj()}(hA directory can receive access rights related to files or directories. The following access right is applied to the directory itself, and the directories beneath it:h]hA directory can receive access rights related to files or directories. The following access right is applied to the directory itself, and the directories beneath it:}(hjdhhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMhjubjb)}(hhh]jg)}(hG``LANDLOCK_ACCESS_FS_READ_DIR``: Open a directory or list its content. h]j()}(hF``LANDLOCK_ACCESS_FS_READ_DIR``: Open a directory or list its content.h](j)}(h``LANDLOCK_ACCESS_FS_READ_DIR``h]hLANDLOCK_ACCESS_FS_READ_DIR}(hj~hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjzubh': Open a directory or list its content.}(hjzhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMhjvubah}(h]h ]h"]h$]h&]uh1jfhjsubah}(h]h ]h"]h$]h&]jjuh1jahjhMhjubj()}(hhHowever, the following access rights only apply to the content of a directory, not the directory itself:h]hhHowever, the following access rights only apply to the content of a directory, not the directory itself:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMhjubjb)}(hhh](jg)}(hK``LANDLOCK_ACCESS_FS_REMOVE_DIR``: Remove an empty directory or rename one.h]j()}(hjh](j)}(h!``LANDLOCK_ACCESS_FS_REMOVE_DIR``h]hLANDLOCK_ACCESS_FS_REMOVE_DIR}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh*: Remove an empty directory or rename one.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMhjubah}(h]h ]h"]h$]h&]uh1jfhjubjg)}(h>``LANDLOCK_ACCESS_FS_REMOVE_FILE``: Unlink (or rename) a file.h]j()}(hjh](j)}(h"``LANDLOCK_ACCESS_FS_REMOVE_FILE``h]hLANDLOCK_ACCESS_FS_REMOVE_FILE}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh: Unlink (or rename) a file.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMhjubah}(h]h ]h"]h$]h&]uh1jfhjubjg)}(hP``LANDLOCK_ACCESS_FS_MAKE_CHAR``: Create (or rename or link) a character device.h]j()}(hP``LANDLOCK_ACCESS_FS_MAKE_CHAR``: Create (or rename or link) a character device.h](j)}(h ``LANDLOCK_ACCESS_FS_MAKE_CHAR``h]hLANDLOCK_ACCESS_FS_MAKE_CHAR}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh0: Create (or rename or link) a character device.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMhjubah}(h]h ]h"]h$]h&]uh1jfhjubjg)}(h@``LANDLOCK_ACCESS_FS_MAKE_DIR``: Create (or rename) a directory.h]j()}(hj*h](j)}(h``LANDLOCK_ACCESS_FS_MAKE_DIR``h]hLANDLOCK_ACCESS_FS_MAKE_DIR}(hj/hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj,ubh!: Create (or rename) a directory.}(hj,hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMhj(ubah}(h]h ]h"]h$]h&]uh1jfhjubjg)}(h``LANDLOCK_ACCESS_FS_MAKE_REG``: Create (or rename or link) a regular file. This also guards the creation of whiteout objects as used in OverlayFS.h]j()}(h``LANDLOCK_ACCESS_FS_MAKE_REG``: Create (or rename or link) a regular file. This also guards the creation of whiteout objects as used in OverlayFS.h](j)}(h``LANDLOCK_ACCESS_FS_MAKE_REG``h]hLANDLOCK_ACCESS_FS_MAKE_REG}(hjVhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjRubht: Create (or rename or link) a regular file. This also guards the creation of whiteout objects as used in OverlayFS.}(hjRhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMhjNubah}(h]h ]h"]h$]h&]uh1jfhjubjg)}(hR``LANDLOCK_ACCESS_FS_MAKE_SOCK``: Create (or rename or link) a UNIX domain socket.h]j()}(hR``LANDLOCK_ACCESS_FS_MAKE_SOCK``: Create (or rename or link) a UNIX domain socket.h](j)}(h ``LANDLOCK_ACCESS_FS_MAKE_SOCK``h]hLANDLOCK_ACCESS_FS_MAKE_SOCK}(hj}hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjyubh2: Create (or rename or link) a UNIX domain socket.}(hjyhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMhjuubah}(h]h ]h"]h$]h&]uh1jfhjubjg)}(hJ``LANDLOCK_ACCESS_FS_MAKE_FIFO``: Create (or rename or link) a named pipe.h]j()}(hjh](j)}(h ``LANDLOCK_ACCESS_FS_MAKE_FIFO``h]hLANDLOCK_ACCESS_FS_MAKE_FIFO}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh*: Create (or rename or link) a named pipe.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMhjubah}(h]h ]h"]h$]h&]uh1jfhjubjg)}(hM``LANDLOCK_ACCESS_FS_MAKE_BLOCK``: Create (or rename or link) a block device.h]j()}(hjh](j)}(h!``LANDLOCK_ACCESS_FS_MAKE_BLOCK``h]hLANDLOCK_ACCESS_FS_MAKE_BLOCK}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh,: Create (or rename or link) a block device.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMhjubah}(h]h ]h"]h$]h&]uh1jfhjubjg)}(hL``LANDLOCK_ACCESS_FS_MAKE_SYM``: Create (or rename or link) a symbolic link.h]j()}(hjh](j)}(h``LANDLOCK_ACCESS_FS_MAKE_SYM``h]hLANDLOCK_ACCESS_FS_MAKE_SYM}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh-: Create (or rename or link) a symbolic link.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMhjubah}(h]h ]h"]h$]h&]uh1jfhjubjg)}(hX``LANDLOCK_ACCESS_FS_REFER``: Link or rename a file from or to a different directory (i.e. reparent a file hierarchy). This access right is available since the second version of the Landlock ABI. This is the only access right which is denied by default by any ruleset, even if the right is not specified as handled at ruleset creation time. The only way to make a ruleset grant this right is to explicitly allow it for a specific directory by adding a matching rule to the ruleset. In particular, when using the first Landlock ABI version, Landlock will always deny attempts to reparent files between different directories. In addition to the source and destination directories having the ``LANDLOCK_ACCESS_FS_REFER`` access right, the attempted link or rename operation must meet the following constraints: * The reparented file may not gain more access rights in the destination directory than it previously had in the source directory. If this is attempted, the operation results in an ``EXDEV`` error. * When linking or renaming, the ``LANDLOCK_ACCESS_FS_MAKE_*`` right for the respective file type must be granted for the destination directory. Otherwise, the operation results in an ``EACCES`` error. * When renaming, the ``LANDLOCK_ACCESS_FS_REMOVE_*`` right for the respective file type must be granted for the source directory. Otherwise, the operation results in an ``EACCES`` error. If multiple requirements are not met, the ``EACCES`` error code takes precedence over ``EXDEV``. h](j()}(hv``LANDLOCK_ACCESS_FS_REFER``: Link or rename a file from or to a different directory (i.e. reparent a file hierarchy).h](j)}(h``LANDLOCK_ACCESS_FS_REFER``h]hLANDLOCK_ACCESS_FS_REFER}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhZ: Link or rename a file from or to a different directory (i.e. reparent a file hierarchy).}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMhjubj()}(hLThis access right is available since the second version of the Landlock ABI.h]hLThis access right is available since the second version of the Landlock ABI.}(hj/hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMhjubj()}(hXThis is the only access right which is denied by default by any ruleset, even if the right is not specified as handled at ruleset creation time. The only way to make a ruleset grant this right is to explicitly allow it for a specific directory by adding a matching rule to the ruleset.h]hXThis is the only access right which is denied by default by any ruleset, even if the right is not specified as handled at ruleset creation time. The only way to make a ruleset grant this right is to explicitly allow it for a specific directory by adding a matching rule to the ruleset.}(hj>hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMhjubj()}(hIn particular, when using the first Landlock ABI version, Landlock will always deny attempts to reparent files between different directories.h]hIn particular, when using the first Landlock ABI version, Landlock will always deny attempts to reparent files between different directories.}(hjMhhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMhjubj()}(hIn addition to the source and destination directories having the ``LANDLOCK_ACCESS_FS_REFER`` access right, the attempted link or rename operation must meet the following constraints:h](hAIn addition to the source and destination directories having the }(hj\hhhNhNubj)}(h``LANDLOCK_ACCESS_FS_REFER``h]hLANDLOCK_ACCESS_FS_REFER}(hjdhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj\ubhZ access right, the attempted link or rename operation must meet the following constraints:}(hj\hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMhjubjb)}(hhh](jg)}(hThe reparented file may not gain more access rights in the destination directory than it previously had in the source directory. If this is attempted, the operation results in an ``EXDEV`` error. h]j()}(hThe reparented file may not gain more access rights in the destination directory than it previously had in the source directory. If this is attempted, the operation results in an ``EXDEV`` error.h](hThe reparented file may not gain more access rights in the destination directory than it previously had in the source directory. If this is attempted, the operation results in an }(hjhhhNhNubj)}(h ``EXDEV``h]hEXDEV}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh error.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMhjubah}(h]h ]h"]h$]h&]uh1jfhj}ubjg)}(hWhen linking or renaming, the ``LANDLOCK_ACCESS_FS_MAKE_*`` right for the respective file type must be granted for the destination directory. Otherwise, the operation results in an ``EACCES`` error. h]j()}(hWhen linking or renaming, the ``LANDLOCK_ACCESS_FS_MAKE_*`` right for the respective file type must be granted for the destination directory. Otherwise, the operation results in an ``EACCES`` error.h](hWhen linking or renaming, the }(hjhhhNhNubj)}(h``LANDLOCK_ACCESS_FS_MAKE_*``h]hLANDLOCK_ACCESS_FS_MAKE_*}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhz right for the respective file type must be granted for the destination directory. Otherwise, the operation results in an }(hjhhhNhNubj)}(h ``EACCES``h]hEACCES}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh error.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMhjubah}(h]h ]h"]h$]h&]uh1jfhj}ubjg)}(hWhen renaming, the ``LANDLOCK_ACCESS_FS_REMOVE_*`` right for the respective file type must be granted for the source directory. Otherwise, the operation results in an ``EACCES`` error. h]j()}(hWhen renaming, the ``LANDLOCK_ACCESS_FS_REMOVE_*`` right for the respective file type must be granted for the source directory. Otherwise, the operation results in an ``EACCES`` error.h](hWhen renaming, the }(hjhhhNhNubj)}(h``LANDLOCK_ACCESS_FS_REMOVE_*``h]hLANDLOCK_ACCESS_FS_REMOVE_*}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhv right for the respective file type must be granted for the source directory. Otherwise, the operation results in an }(hjhhhNhNubj)}(h ``EACCES``h]hEACCES}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh error.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMhjubah}(h]h ]h"]h$]h&]uh1jfhj}ubeh}(h]h ]h"]h$]h&]jjuh1jahjhMhjubj()}(h`If multiple requirements are not met, the ``EACCES`` error code takes precedence over ``EXDEV``.h](h*If multiple requirements are not met, the }(hj+ hhhNhNubj)}(h ``EACCES``h]hEACCES}(hj3 hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj+ ubh" error code takes precedence over }(hj+ hhhNhNubj)}(h ``EXDEV``h]hEXDEV}(hjE hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj+ ubh.}(hj+ hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMhjubeh}(h]h ]h"]h$]h&]uh1jfhjubeh}(h]h ]h"]h$]h&]jjuh1jahjhMhjubjr)}(hXfIt is currently not possible to restrict some file-related actions accessible through these syscall families: :manpage:`chdir(2)`, :manpage:`stat(2)`, :manpage:`flock(2)`, :manpage:`chmod(2)`, :manpage:`chown(2)`, :manpage:`setxattr(2)`, :manpage:`utime(2)`, :manpage:`fcntl(2)`, :manpage:`access(2)`. Future Landlock evolutions will enable to restrict them.h]j()}(hXfIt is currently not possible to restrict some file-related actions accessible through these syscall families: :manpage:`chdir(2)`, :manpage:`stat(2)`, :manpage:`flock(2)`, :manpage:`chmod(2)`, :manpage:`chown(2)`, :manpage:`setxattr(2)`, :manpage:`utime(2)`, :manpage:`fcntl(2)`, :manpage:`access(2)`. Future Landlock evolutions will enable to restrict them.h](hnIt is currently not possible to restrict some file-related actions accessible through these syscall families: }(hjn hhhNhNubj)}(h:manpage:`chdir(2)`h]hchdir(2)}(hjv hhhNhNubah}(h]h ]jah"]h$]h&]hhjchdir(2)jchdirjjuh1jhjn ubh, }(hjn hhhNhNubj)}(h:manpage:`stat(2)`h]hstat(2)}(hj hhhNhNubah}(h]h ]jah"]h$]h&]hhjstat(2)jstatjjuh1jhjn ubh, }(hjn hhhNhNubj)}(h:manpage:`flock(2)`h]hflock(2)}(hj hhhNhNubah}(h]h ]jah"]h$]h&]hhjflock(2)jflockjjuh1jhjn ubh, }hjn sbj)}(h:manpage:`chmod(2)`h]hchmod(2)}(hj hhhNhNubah}(h]h ]jah"]h$]h&]hhjchmod(2)jchmodjjuh1jhjn ubh, }hjn sbj)}(h:manpage:`chown(2)`h]hchown(2)}(hj hhhNhNubah}(h]h ]jah"]h$]h&]hhjchown(2)jchownjjuh1jhjn ubh, }hjn sbj)}(h:manpage:`setxattr(2)`h]h setxattr(2)}(hj hhhNhNubah}(h]h ]jah"]h$]h&]hhj setxattr(2)jsetxattrjjuh1jhjn ubh, }hjn sbj)}(h:manpage:`utime(2)`h]hutime(2)}(hj hhhNhNubah}(h]h ]jah"]h$]h&]hhjutime(2)jutimejjuh1jhjn ubh, }hjn sbj)}(h:manpage:`fcntl(2)`h]hfcntl(2)}(hj!hhhNhNubah}(h]h ]jah"]h$]h&]hhjfcntl(2)jfcntljjuh1jhjn ubh, }hjn sbj)}(h:manpage:`access(2)`h]h access(2)}(hj!hhhNhNubah}(h]h ]jah"]h$]h&]hhj access(2)jaccessjjuh1jhjn ubh:. Future Landlock evolutions will enable to restrict them.}(hjn hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMhjj ubah}(h]h ]h"]h$]h&]uh1jqhjubeh}(h]filesystem-flagsah ]h"]filesystem flagsah$]h&]uh1hhjzhhhNhNj Kubh)}(hhh](h)}(h Network flagsh]h Network flags}(hjB!hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj?!hNhNubj()}(hOThese flags enable to restrict a sandboxed process to a set of network actions.h]hOThese flags enable to restrict a sandboxed process to a set of network actions.}(hjP!hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhM hj?!ubj()}(h6The following access rights apply to TCP port numbers:h]h6The following access rights apply to TCP port numbers:}(hj_!hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMhj?!ubjb)}(hhh](jg)}(ht``LANDLOCK_ACCESS_NET_BIND_TCP``: Bind TCP sockets to the given local port. Support added in Landlock ABI version 4.h]j()}(ht``LANDLOCK_ACCESS_NET_BIND_TCP``: Bind TCP sockets to the given local port. Support added in Landlock ABI version 4.h](j)}(h ``LANDLOCK_ACCESS_NET_BIND_TCP``h]hLANDLOCK_ACCESS_NET_BIND_TCP}(hjy!hhhNhNubah}(h]h ]h"]h$]h&]uh1jhju!ubhT: Bind TCP sockets to the given local port. Support added in Landlock ABI version 4.}(hju!hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMhjq!ubah}(h]h ]h"]h$]h&]uh1jfhjn!ubjg)}(h|``LANDLOCK_ACCESS_NET_CONNECT_TCP``: Connect TCP sockets to the given remote port. Support added in Landlock ABI version 4. h]j()}(h{``LANDLOCK_ACCESS_NET_CONNECT_TCP``: Connect TCP sockets to the given remote port. Support added in Landlock ABI version 4.h](j)}(h#``LANDLOCK_ACCESS_NET_CONNECT_TCP``h]hLANDLOCK_ACCESS_NET_CONNECT_TCP}(hj!hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj!ubhX: Connect TCP sockets to the given remote port. Support added in Landlock ABI version 4.}(hj!hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMhj!ubah}(h]h ]h"]h$]h&]uh1jfhjn!ubeh}(h]h ]h"]h$]h&]jjuh1jahj!hMhj?!ubj()}(h#And similarly for UDP port numbers:h]h#And similarly for UDP port numbers:}(hj!hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMhj?!ubjb)}(hhh](jg)}(hu``LANDLOCK_ACCESS_NET_BIND_UDP``: Bind UDP sockets to the given local port. Support added in Landlock ABI version 10.h]j()}(hu``LANDLOCK_ACCESS_NET_BIND_UDP``: Bind UDP sockets to the given local port. Support added in Landlock ABI version 10.h](j)}(h ``LANDLOCK_ACCESS_NET_BIND_UDP``h]hLANDLOCK_ACCESS_NET_BIND_UDP}(hj!hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj!ubhU: Bind UDP sockets to the given local port. Support added in Landlock ABI version 10.}(hj!hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMhj!ubah}(h]h ]h"]h$]h&]uh1jfhj!ubjg)}(h``LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP``: Set the remote port of UDP sockets to the given port, or send datagrams to the given remote port ignoring any destination pre-set on a socket. Support added in Landlock ABI version 10. h]j()}(h``LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP``: Set the remote port of UDP sockets to the given port, or send datagrams to the given remote port ignoring any destination pre-set on a socket. Support added in Landlock ABI version 10.h](j)}(h(``LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP``h]h$LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP}(hj"hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj"ubh: Set the remote port of UDP sockets to the given port, or send datagrams to the given remote port ignoring any destination pre-set on a socket. Support added in Landlock ABI version 10.}(hj"hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMhj!ubah}(h]h ]h"]h$]h&]uh1jfhj!ubeh}(h]h ]h"]h$]h&]jjuh1jahj!hMhj?!ubhnote)}(hXmSetting a remote address or sending a first datagram auto-binds UDP sockets to an ephemeral local source port if not already bound. To allow this if both ``LANDLOCK_ACCESS_NET_BIND_UDP`` and ``LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP`` are handled, you need to either: - use a socket already bound to a port before the ruleset started being enforced; - or grant ``LANDLOCK_ACCESS_NET_BIND_UDP`` on port 0, meaning "any port in the ephemeral port range"; - or grant ``LANDLOCK_ACCESS_NET_BIND_UDP`` on a specific port, and call :manpage:`bind(2)` on that port before trying to :manpage:`connect(2)` or send datagrams.h](j()}(hXSetting a remote address or sending a first datagram auto-binds UDP sockets to an ephemeral local source port if not already bound. To allow this if both ``LANDLOCK_ACCESS_NET_BIND_UDP`` and ``LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP`` are handled, you need to either:h](hSetting a remote address or sending a first datagram auto-binds UDP sockets to an ephemeral local source port if not already bound. To allow this if both }(hj1"hhhNhNubj)}(h ``LANDLOCK_ACCESS_NET_BIND_UDP``h]hLANDLOCK_ACCESS_NET_BIND_UDP}(hj9"hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj1"ubh and }(hj1"hhhNhNubj)}(h(``LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP``h]h$LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP}(hjK"hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj1"ubh! are handled, you need to either:}(hj1"hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhM hj-"ubjb)}(hhh](jg)}(hOuse a socket already bound to a port before the ruleset started being enforced;h]j()}(hOuse a socket already bound to a port before the ruleset started being enforced;h]hOuse a socket already bound to a port before the ruleset started being enforced;}(hjk"hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhM&hjg"ubah}(h]h ]h"]h$]h&]uh1jfhjd"ubjg)}(hdor grant ``LANDLOCK_ACCESS_NET_BIND_UDP`` on port 0, meaning "any port in the ephemeral port range";h]j()}(hdor grant ``LANDLOCK_ACCESS_NET_BIND_UDP`` on port 0, meaning "any port in the ephemeral port range";h](h or grant }(hj"hhhNhNubj)}(h ``LANDLOCK_ACCESS_NET_BIND_UDP``h]hLANDLOCK_ACCESS_NET_BIND_UDP}(hj"hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj"ubh? on port 0, meaning “any port in the ephemeral port range”;}(hj"hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhM(hj"ubah}(h]h ]h"]h$]h&]uh1jfhjd"ubjg)}(hor grant ``LANDLOCK_ACCESS_NET_BIND_UDP`` on a specific port, and call :manpage:`bind(2)` on that port before trying to :manpage:`connect(2)` or send datagrams.h]j()}(hor grant ``LANDLOCK_ACCESS_NET_BIND_UDP`` on a specific port, and call :manpage:`bind(2)` on that port before trying to :manpage:`connect(2)` or send datagrams.h](h or grant }(hj"hhhNhNubj)}(h ``LANDLOCK_ACCESS_NET_BIND_UDP``h]hLANDLOCK_ACCESS_NET_BIND_UDP}(hj"hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj"ubh on a specific port, and call }(hj"hhhNhNubj)}(h:manpage:`bind(2)`h]hbind(2)}(hj"hhhNhNubah}(h]h ]jah"]h$]h&]hhjbind(2)jbindjjuh1jhj"ubh on that port before trying to }(hj"hhhNhNubj)}(h:manpage:`connect(2)`h]h connect(2)}(hj"hhhNhNubah}(h]h ]jah"]h$]h&]hhj connect(2)jconnectjjuh1jhj"ubh or send datagrams.}(hj"hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhM*hj"ubah}(h]h ]h"]h$]h&]uh1jfhjd"ubeh}(h]h ]h"]h$]h&]jjuh1jahjy"hM&hj-"ubeh}(h]h ]h"]h$]h&]uh1j+"hj?!ubj,")}(hSending datagrams to an ``AF_UNSPEC`` destination address family is not supported for IPv6 UDP sockets: you will need to use a ``NULL`` address instead.h]j()}(hSending datagrams to an ``AF_UNSPEC`` destination address family is not supported for IPv6 UDP sockets: you will need to use a ``NULL`` address instead.h](hSending datagrams to an }(hj#hhhNhNubj)}(h ``AF_UNSPEC``h]h AF_UNSPEC}(hj#hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj#ubhZ destination address family is not supported for IPv6 UDP sockets: you will need to use a }(hj#hhhNhNubj)}(h``NULL``h]hNULL}(hj(#hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj#ubh address instead.}(hj#hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhM.hj #ubah}(h]h ]h"]h$]h&]uh1j+"hj?!ubeh}(h] network-flagsah ]h"] network flagsah$]h&]uh1hhjzhhhNhNj Kubh)}(hhh](h)}(h Scope flagsh]h Scope flags}(hjR#hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjO#hNhNubj()}(hThese flags enable to isolate a sandboxed process from a set of IPC actions. Setting a flag for a ruleset will isolate the Landlock domain to forbid connections to resources outside the domain.h]hThese flags enable to isolate a sandboxed process from a set of IPC actions. Setting a flag for a ruleset will isolate the Landlock domain to forbid connections to resources outside the domain.}(hj`#hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhM?hjO#ubj()}(h/This is supported since Landlock ABI version 6.h]h/This is supported since Landlock ABI version 6.}(hjo#hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMChjO#ubj()}(hScopes:h]hScopes:}(hj~#hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMEhjO#ubjb)}(hhh](jg)}(h``LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET``: Restrict a sandboxed process from connecting to an abstract UNIX socket created by a process outside the related Landlock domain (e.g., a parent domain or a non-sandboxed process).h]j()}(h``LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET``: Restrict a sandboxed process from connecting to an abstract UNIX socket created by a process outside the related Landlock domain (e.g., a parent domain or a non-sandboxed process).h](j)}(h'``LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET``h]h#LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET}(hj#hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj#ubh: Restrict a sandboxed process from connecting to an abstract UNIX socket created by a process outside the related Landlock domain (e.g., a parent domain or a non-sandboxed process).}(hj#hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMGhj#ubah}(h]h ]h"]h$]h&]uh1jfhj#ubjg)}(hv``LANDLOCK_SCOPE_SIGNAL``: Restrict a sandboxed process from sending a signal to another process outside the domain. h]j()}(ht``LANDLOCK_SCOPE_SIGNAL``: Restrict a sandboxed process from sending a signal to another process outside the domain.h](j)}(h``LANDLOCK_SCOPE_SIGNAL``h]hLANDLOCK_SCOPE_SIGNAL}(hj#hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj#ubh[: Restrict a sandboxed process from sending a signal to another process outside the domain.}(hj#hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMJhj#ubah}(h]h ]h"]h$]h&]uh1jfhj#ubeh}(h]h ]h"]h$]h&]jjuh1jahj#hMGhjO#ubeh}(h] scope-flagsah ]h"] scope flagsah$]h&]uh1hhjzhhhNhNj Kubh)}(hhh](h)}(hPermission flagsh]hPermission flags}(hj#hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj#hNhNubj()}(hXThese flags restrict the use of members of a category, each member being identified by a constant from another kernel subsystem (e.g. CLONE_NEW* namespace types, CAP_* capabilities). A flag covers every kernel path that uses a member of its category, and members that no rule explicitly allows are denied. Values unknown to the running kernel are silently accepted for forward compatibility and stay denied by default. See Documentation/security/landlock.rst for design details.h]hXThese flags restrict the use of members of a category, each member being identified by a constant from another kernel subsystem (e.g. CLONE_NEW* namespace types, CAP_* capabilities). A flag covers every kernel path that uses a member of its category, and members that no rule explicitly allows are denied. Values unknown to the running kernel are silently accepted for forward compatibility and stay denied by default. See Documentation/security/landlock.rst for design details.}(hj#hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMXhj#ubj()}(hXWhen a ruleset handles multiple permissions whose operations overlap (e.g. a non-user namespace needs both its namespace type and CAP_SYS_ADMIN), the operation is allowed only if each handled permission independently allows it. See Documentation/userspace-api/landlock.rst.h]hXWhen a ruleset handles multiple permissions whose operations overlap (e.g. a non-user namespace needs both its namespace type and CAP_SYS_ADMIN), the operation is allowed only if each handled permission independently allows it. See Documentation/userspace-api/landlock.rst.}(hj $hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhM`hj#ubjb)}(hhh](jg)}(hX``LANDLOCK_PERMISSION_NAMESPACE_USE``: Restrict the use of specific namespace types: creation (:manpage:`unshare(2)`, :manpage:`clone(2)`, :manpage:`clone3(2)`), joining (:manpage:`setns(2)`), and acquiring an fd reference (:manpage:`open_tree(2)`, :manpage:`fsmount(2)`). A process in a Landlock domain that handles this permission is denied from using namespace types that are not explicitly allowed by a ``LANDLOCK_RULE_NAMESPACE`` rule. Support added in Landlock ABI version 12.h]j()}(hX``LANDLOCK_PERMISSION_NAMESPACE_USE``: Restrict the use of specific namespace types: creation (:manpage:`unshare(2)`, :manpage:`clone(2)`, :manpage:`clone3(2)`), joining (:manpage:`setns(2)`), and acquiring an fd reference (:manpage:`open_tree(2)`, :manpage:`fsmount(2)`). A process in a Landlock domain that handles this permission is denied from using namespace types that are not explicitly allowed by a ``LANDLOCK_RULE_NAMESPACE`` rule. Support added in Landlock ABI version 12.h](j)}(h%``LANDLOCK_PERMISSION_NAMESPACE_USE``h]h!LANDLOCK_PERMISSION_NAMESPACE_USE}(hj&$hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj"$ubh:: Restrict the use of specific namespace types: creation (}(hj"$hhhNhNubj)}(h:manpage:`unshare(2)`h]h unshare(2)}(hj8$hhhNhNubah}(h]h ]jah"]h$]h&]hhj unshare(2)junsharejjuh1jhj"$ubh, }(hj"$hhhNhNubj)}(h:manpage:`clone(2)`h]hclone(2)}(hjL$hhhNhNubah}(h]h ]jah"]h$]h&]hhjclone(2)jclonejjuh1jhj"$ubh, }(hj"$hhhNhNubj)}(h:manpage:`clone3(2)`h]h clone3(2)}(hj`$hhhNhNubah}(h]h ]jah"]h$]h&]hhj clone3(2)jclone3jjuh1jhj"$ubh ), joining (}(hj"$hhhNhNubj)}(h:manpage:`setns(2)`h]hsetns(2)}(hjt$hhhNhNubah}(h]h ]jah"]h$]h&]hhjsetns(2)jsetnsjjuh1jhj"$ubh"), and acquiring an fd reference (}(hj"$hhhNhNubj)}(h:manpage:`open_tree(2)`h]h open_tree(2)}(hj$hhhNhNubah}(h]h ]jah"]h$]h&]hhj open_tree(2)j open_treejjuh1jhj"$ubh, }hj"$sbj)}(h:manpage:`fsmount(2)`h]h fsmount(2)}(hj$hhhNhNubah}(h]h ]jah"]h$]h&]hhj fsmount(2)jfsmountjjuh1jhj"$ubh). A process in a Landlock domain that handles this permission is denied from using namespace types that are not explicitly allowed by a }(hj"$hhhNhNubj)}(h``LANDLOCK_RULE_NAMESPACE``h]hLANDLOCK_RULE_NAMESPACE}(hj$hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj"$ubh0 rule. Support added in Landlock ABI version 12.}(hj"$hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMehj$ubah}(h]h ]h"]h$]h&]uh1jfhj$ubjg)}(hX``LANDLOCK_PERMISSION_CAPABILITY_USE``: Restrict the use of specific Linux capabilities. A process in a Landlock domain that handles this permission is denied from exercising capabilities that are not explicitly allowed by a ``LANDLOCK_RULE_CAPABILITY`` rule. This hook is purely restrictive: it can deny capabilities that the kernel would otherwise grant, but it can never grant capabilities that the kernel already denied. Support added in Landlock ABI version 12. h]j()}(hX``LANDLOCK_PERMISSION_CAPABILITY_USE``: Restrict the use of specific Linux capabilities. A process in a Landlock domain that handles this permission is denied from exercising capabilities that are not explicitly allowed by a ``LANDLOCK_RULE_CAPABILITY`` rule. This hook is purely restrictive: it can deny capabilities that the kernel would otherwise grant, but it can never grant capabilities that the kernel already denied. Support added in Landlock ABI version 12.h](j)}(h&``LANDLOCK_PERMISSION_CAPABILITY_USE``h]h"LANDLOCK_PERMISSION_CAPABILITY_USE}(hj$hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj$ubh: Restrict the use of specific Linux capabilities. A process in a Landlock domain that handles this permission is denied from exercising capabilities that are not explicitly allowed by a }(hj$hhhNhNubj)}(h``LANDLOCK_RULE_CAPABILITY``h]hLANDLOCK_RULE_CAPABILITY}(hj$hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj$ubh rule. This hook is purely restrictive: it can deny capabilities that the kernel would otherwise grant, but it can never grant capabilities that the kernel already denied. Support added in Landlock ABI version 12.}(hj$hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:811: ./include/uapi/linux/landlock.hhMlhj$ubah}(h]h ]h"]h$]h&]uh1jfhj$ubeh}(h]h ]h"]h$]h&]jjuh1jahj$hMehj#ubeh}(h]permission-flagsah ]h"]permission flagsah$]h&]uh1hhjzhhhNhNj Kubeh}(h] access-rightsah ]h"] access rightsah$]h&]uh1hhjihhhhhM)ubh)}(hhh](h)}(hCreating a new ruleseth]hCreating a new ruleset}(hj!%hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj%hhhhhM/ubhindex)}(hhh]h}(h]h ]h"]h$]h&]entries](single(sys_landlock_create_ruleset (C function)c.sys_landlock_create_rulesethNtauh1j/%hj%hhhNhNubhdesc)}(hhh](hdesc_signature)}(h~long sys_landlock_create_ruleset (const struct landlock_ruleset_attr __user *const attr, const size_t size, const __u32 flags)h]hdesc_signature_line)}(h}long sys_landlock_create_ruleset(const struct landlock_ruleset_attr __user *const attr, const size_t size, const __u32 flags)h](hdesc_sig_keyword_type)}(hlongh]hlong}(hjS%hhhNhNubah}(h]h ]ktah"]h$]h&]uh1jQ%hjM%hhhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:817: ./security/landlock/syscalls.chKubhdesc_sig_space)}(h h]h }(hje%hhhNhNubah}(h]h ]wah"]h$]h&]uh1jc%hjM%hhhjb%hKubh desc_name)}(hsys_landlock_create_ruleseth]h desc_sig_name)}(hsys_landlock_create_ruleseth]hsys_landlock_create_ruleset}(hj|%hhhNhNubah}(h]h ]nah"]h$]h&]uh1jz%hjv%ubah}(h]h ](sig-namedescnameeh"]h$]h&]hhuh1jt%hjM%hhhjb%hKubhdesc_parameterlist)}(h](const struct landlock_ruleset_attr __user *const attr, const size_t size, const __u32 flags)h](hdesc_parameter)}(h5const struct landlock_ruleset_attr __user *const attrh](hdesc_sig_keyword)}(hconsth]hconst}(hj%hhhNhNubah}(h]h ]kah"]h$]h&]uh1j%hj%ubjd%)}(h h]h }(hj%hhhNhNubah}(h]h ]jp%ah"]h$]h&]uh1jc%hj%ubj%)}(hstructh]hstruct}(hj%hhhNhNubah}(h]h ]j%ah"]h$]h&]uh1j%hj%ubjd%)}(h h]h }(hj%hhhNhNubah}(h]h ]jp%ah"]h$]h&]uh1jc%hj%ubh)}(hhh]j{%)}(hlandlock_ruleset_attrh]hlandlock_ruleset_attr}(hj%hhhNhNubah}(h]h ]j%ah"]h$]h&]uh1jz%hj%ubah}(h]h ]h"]h$]h&] refdomainjreftype identifier reftargetj%modnameN classnameN c:parent_keysphinx.domains.c LookupKey)}data]j% ASTIdentifier)}j%j~%sbc.sys_landlock_create_rulesetasbuh1hhj%ubjd%)}(h h]h }(hj&hhhNhNubah}(h]h ]jp%ah"]h$]h&]uh1jc%hj%ubh__user}(hj%hhhNhNubjd%)}(h h]h }(hj&hhhNhNubah}(h]h ]jp%ah"]h$]h&]uh1jc%hj%ubhdesc_sig_punctuation)}(hjh]h*}(hj'&hhhNhNubah}(h]h ]pah"]h$]h&]uh1j%&hj%ubj%)}(hj%h]hconst}(hj5&hhhNhNubah}(h]h ]j%ah"]h$]h&]uh1j%hj%ubjd%)}(h h]h }(hjB&hhhNhNubah}(h]h ]jp%ah"]h$]h&]uh1jc%hj%ubj{%)}(hattrh]hattr}(hjP&hhhNhNubah}(h]h ]j%ah"]h$]h&]uh1jz%hj%ubeh}(h]h ]h"]h$]h&]noemphhhuh1j%hj%ubj%)}(hconst size_t sizeh](j%)}(hj%h]hconst}(hji&hhhNhNubah}(h]h ]j%ah"]h$]h&]uh1j%hje&ubjd%)}(h h]h }(hjv&hhhNhNubah}(h]h ]jp%ah"]h$]h&]uh1jc%hje&ubh)}(hhh]j{%)}(hsize_th]hsize_t}(hj&hhhNhNubah}(h]h ]j%ah"]h$]h&]uh1jz%hj&ubah}(h]h ]h"]h$]h&] refdomainjreftypej% reftargetj&modnameN classnameNj%j%)}j%]j&c.sys_landlock_create_rulesetasbuh1hhje&ubjd%)}(h h]h }(hj&hhhNhNubah}(h]h ]jp%ah"]h$]h&]uh1jc%hje&ubj{%)}(hsizeh]hsize}(hj&hhhNhNubah}(h]h ]j%ah"]h$]h&]uh1jz%hje&ubeh}(h]h ]h"]h$]h&]noemphhhuh1j%hj%ubj%)}(hconst __u32 flagsh](j%)}(hj%h]hconst}(hj&hhhNhNubah}(h]h ]j%ah"]h$]h&]uh1j%hj&ubjd%)}(h h]h }(hj&hhhNhNubah}(h]h ]jp%ah"]h$]h&]uh1jc%hj&ubh)}(hhh]j{%)}(h__u32h]h__u32}(hj&hhhNhNubah}(h]h ]j%ah"]h$]h&]uh1jz%hj&ubah}(h]h ]h"]h$]h&] refdomainjreftypej% reftargetj&modnameN classnameNj%j%)}j%]j&c.sys_landlock_create_rulesetasbuh1hhj&ubjd%)}(h h]h }(hj'hhhNhNubah}(h]h ]jp%ah"]h$]h&]uh1jc%hj&ubj{%)}(hflagsh]hflags}(hj'hhhNhNubah}(h]h ]j%ah"]h$]h&]uh1jz%hj&ubeh}(h]h ]h"]h$]h&]noemphhhuh1j%hj%ubeh}(h]h ]h"]h$]h&]hhuh1j%hjM%hhhjb%hKubeh}(h]h ]h"]h$]h&]hhƌ add_permalinkuh1jK%sphinx_line_type declaratorhjG%hhhjb%hKubah}(h]j>%ah ](sig sig-objecteh"]h$]h&] is_multiline _toc_parts) _toc_namehuh1jE%hjb%hKhjB%hhubh desc_content)}(hhh]j()}(hCreate a new ruleseth]hCreate a new ruleset}(hjJ'hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:817: ./security/landlock/syscalls.chKhjG'hhubah}(h]h ]h"]h$]h&]uh1jE'hjB%hhhjb%hKubeh}(h]h ](jfunctioneh"]h$]h&]domainjobjtypejb'desctypejb'noindex noindexentrynocontentsentryuh1j@%hhhj%hNhNubh container)}(hX**Parameters** ``const struct landlock_ruleset_attr __user *const attr`` Pointer to a :c:type:`struct landlock_ruleset_attr ` identifying the scope of the new ruleset. ``const size_t size`` Size of the pointed :c:type:`struct landlock_ruleset_attr ` (needed for backward and forward compatibility). ``const __u32 flags`` Supported values: **Description** - ``LANDLOCK_CREATE_RULESET_VERSION`` - ``LANDLOCK_CREATE_RULESET_ERRATA`` This system call enables to create a new Landlock ruleset. If ``LANDLOCK_CREATE_RULESET_VERSION`` or ``LANDLOCK_CREATE_RULESET_ERRATA`` is set, then **attr** must be NULL and **size** must be 0. - ``EOPNOTSUPP``: Landlock is supported by the kernel but disabled at boot time; - ``EINVAL``: unknown **flags**, access, scope, or permission, or too small **size**; - ``EINVAL``: quiet_access_fs, quiet_access_net, or quiet_scoped is not a subset of the corresponding handled_access_fs, handled_access_net, or scoped; - ``E2BIG``: **attr** or **size** inconsistencies; - ``EFAULT``: **attr** or **size** inconsistencies; - ``ENOMSG``: all handled access, scope, and permission fields are empty. .. kernel-doc:: include/uapi/linux/landlock.h :identifiers: landlock_create_ruleset_flags **Return** The ruleset file descriptor on success, the Landlock ABI version if ``LANDLOCK_CREATE_RULESET_VERSION`` is set, the errata value if ``LANDLOCK_CREATE_RULESET_ERRATA`` is set, or -errno on failure. Possible returned errors are:yh](j()}(h**Parameters**h]j|)}(hjt'h]h Parameters}(hjv'hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hjr'ubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:817: ./security/landlock/syscalls.chKhjn'ubj")}(hhh](j')}(h``const struct landlock_ruleset_attr __user *const attr`` Pointer to a :c:type:`struct landlock_ruleset_attr ` identifying the scope of the new ruleset. h](j-)}(h9``const struct landlock_ruleset_attr __user *const attr``h]j)}(hj'h]h5const struct landlock_ruleset_attr __user *const attr}(hj'hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj'ubah}(h]h ]h"]h$]h&]uh1j,hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:817: ./security/landlock/syscalls.chKhj'ubj=)}(hhh]j()}(huPointer to a :c:type:`struct landlock_ruleset_attr ` identifying the scope of the new ruleset.h](h Pointer to a }(hj'hhhNhNubh)}(h>:c:type:`struct landlock_ruleset_attr `h]j)}(hj'h]hstruct landlock_ruleset_attr}(hj'hhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jhj'ubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnj%j%)}j%]sbjlandlock_ruleset_attruh1hhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:817: ./security/landlock/syscalls.chKhj'ubh* identifying the scope of the new ruleset.}(hj'hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hj'hKhj'ubah}(h]h ]h"]h$]h&]uh1j<hj'ubeh}(h]h ]h"]h$]h&]uh1j&hj'hKhj'ubj')}(h``const size_t size`` Size of the pointed :c:type:`struct landlock_ruleset_attr ` (needed for backward and forward compatibility). h](j-)}(h``const size_t size``h]j)}(hj'h]hconst size_t size}(hj'hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj'ubah}(h]h ]h"]h$]h&]uh1j,hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:817: ./security/landlock/syscalls.chKhj'ubj=)}(hhh]j()}(hSize of the pointed :c:type:`struct landlock_ruleset_attr ` (needed for backward and forward compatibility).h](hSize of the pointed }(hj (hhhNhNubh)}(h>:c:type:`struct landlock_ruleset_attr `h]j)}(hj(h]hstruct landlock_ruleset_attr}(hj(hhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jhj(ubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnj%j'jlandlock_ruleset_attruh1hhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:817: ./security/landlock/syscalls.chKhj (ubh1 (needed for backward and forward compatibility).}(hj (hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hj3(hKhj (ubah}(h]h ]h"]h$]h&]uh1j<hj'ubeh}(h]h ]h"]h$]h&]uh1j&hj(hKhj'ubj')}(h(``const __u32 flags`` Supported values: h](j-)}(h``const __u32 flags``h]j)}(hjP(h]hconst __u32 flags}(hjR(hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjN(ubah}(h]h ]h"]h$]h&]uh1j,hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:817: ./security/landlock/syscalls.chKhjJ(ubj=)}(hhh]j()}(hSupported values:h]hSupported values:}(hji(hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hje(hKhjf(ubah}(h]h ]h"]h$]h&]uh1j<hjJ(ubeh}(h]h ]h"]h$]h&]uh1j&hje(hKhj'ubeh}(h]h ]h"]h$]h&]uh1j!hjn'ubj()}(h**Description**h]j|)}(hj(h]h Description}(hj(hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hj(ubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:817: ./security/landlock/syscalls.chKhjn'ubh block_quote)}(hK- ``LANDLOCK_CREATE_RULESET_VERSION`` - ``LANDLOCK_CREATE_RULESET_ERRATA`` h]jb)}(hhh](jg)}(h#``LANDLOCK_CREATE_RULESET_VERSION``h]j()}(hj(h]j)}(hj(h]hLANDLOCK_CREATE_RULESET_VERSION}(hj(hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj(ubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:817: ./security/landlock/syscalls.chKhj(ubah}(h]h ]h"]h$]h&]uh1jfhj(ubjg)}(h#``LANDLOCK_CREATE_RULESET_ERRATA`` h]j()}(h"``LANDLOCK_CREATE_RULESET_ERRATA``h]j)}(hj(h]hLANDLOCK_CREATE_RULESET_ERRATA}(hj(hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj(ubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:817: ./security/landlock/syscalls.chKhj(ubah}(h]h ]h"]h$]h&]uh1jfhj(ubeh}(h]h ]h"]h$]h&]jjuh1jahj(hKhj(ubah}(h]h ]h"]h$]h&]uh1j(hj(hKhjn'ubj()}(h:This system call enables to create a new Landlock ruleset.h]h:This system call enables to create a new Landlock ruleset.}(hj(hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:817: ./security/landlock/syscalls.chKhjn'ubj()}(hIf ``LANDLOCK_CREATE_RULESET_VERSION`` or ``LANDLOCK_CREATE_RULESET_ERRATA`` is set, then **attr** must be NULL and **size** must be 0.h](hIf }(hj)hhhNhNubj)}(h#``LANDLOCK_CREATE_RULESET_VERSION``h]hLANDLOCK_CREATE_RULESET_VERSION}(hj)hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj)ubh or }(hj)hhhNhNubj)}(h"``LANDLOCK_CREATE_RULESET_ERRATA``h]hLANDLOCK_CREATE_RULESET_ERRATA}(hj")hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj)ubh is set, then }(hj)hhhNhNubj|)}(h**attr**h]hattr}(hj4)hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hj)ubh must be NULL and }(hj)hhhNhNubj|)}(h**size**h]hsize}(hjF)hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hj)ubh must be 0.}(hj)hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:817: ./security/landlock/syscalls.chKhjn'ubjb)}(hhh](jg)}(hN``EOPNOTSUPP``: Landlock is supported by the kernel but disabled at boot time;h]j()}(hjd)h](j)}(h``EOPNOTSUPP``h]h EOPNOTSUPP}(hji)hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjf)ubh@: Landlock is supported by the kernel but disabled at boot time;}(hjf)hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:817: ./security/landlock/syscalls.chKhjb)ubah}(h]h ]h"]h$]h&]uh1jfhj_)ubjg)}(hS``EINVAL``: unknown **flags**, access, scope, or permission, or too small **size**;h]j()}(hj)h](j)}(h ``EINVAL``h]hEINVAL}(hj)hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj)ubh : unknown }(hj)hhhNhNubj|)}(h **flags**h]hflags}(hj)hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hj)ubh-, access, scope, or permission, or too small }(hj)hhhNhNubj|)}(h**size**h]hsize}(hj)hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hj)ubh;}(hj)hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:817: ./security/landlock/syscalls.chKhj)ubah}(h]h ]h"]h$]h&]uh1jfhj_)ubjg)}(h``EINVAL``: quiet_access_fs, quiet_access_net, or quiet_scoped is not a subset of the corresponding handled_access_fs, handled_access_net, or scoped;h]j()}(h``EINVAL``: quiet_access_fs, quiet_access_net, or quiet_scoped is not a subset of the corresponding handled_access_fs, handled_access_net, or scoped;h](j)}(h ``EINVAL``h]hEINVAL}(hj)hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj)ubh: quiet_access_fs, quiet_access_net, or quiet_scoped is not a subset of the corresponding handled_access_fs, handled_access_net, or scoped;}(hj)hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:817: ./security/landlock/syscalls.chKhj)ubah}(h]h ]h"]h$]h&]uh1jfhj_)ubjg)}(h0``E2BIG``: **attr** or **size** inconsistencies;h]j()}(hj)h](j)}(h ``E2BIG``h]hE2BIG}(hj*hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj)ubh: }(hj)hhhNhNubj|)}(h**attr**h]hattr}(hj*hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hj)ubh or }(hj)hhhNhNubj|)}(h**size**h]hsize}(hj$*hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hj)ubh inconsistencies;}(hj)hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:817: ./security/landlock/syscalls.chKhj)ubah}(h]h ]h"]h$]h&]uh1jfhj_)ubjg)}(h1``EFAULT``: **attr** or **size** inconsistencies;h]j()}(hjE*h](j)}(h ``EFAULT``h]hEFAULT}(hjJ*hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjG*ubh: }(hjG*hhhNhNubj|)}(h**attr**h]hattr}(hj\*hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hjG*ubh or }(hjG*hhhNhNubj|)}(h**size**h]hsize}(hjn*hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hjG*ubh inconsistencies;}(hjG*hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:817: ./security/landlock/syscalls.chKhjC*ubah}(h]h ]h"]h$]h&]uh1jfhj_)ubjg)}(hH``ENOMSG``: all handled access, scope, and permission fields are empty. h]j()}(hG``ENOMSG``: all handled access, scope, and permission fields are empty.h](j)}(h ``ENOMSG``h]hENOMSG}(hj*hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj*ubh=: all handled access, scope, and permission fields are empty.}(hj*hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:817: ./security/landlock/syscalls.chKhj*ubah}(h]h ]h"]h$]h&]uh1jfhj_)ubeh}(h]h ]h"]h$]h&]jjuh1jahj)hKhjn'ubj()}(h **Flags**h]j|)}(hj*h]hFlags}(hj*hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hj*ubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:40: ./include/uapi/linux/landlock.hhKZhjn'ubj")}(hhh](j')}(hd``LANDLOCK_CREATE_RULESET_VERSION`` Get the highest supported Landlock ABI version (starting at 1). h](j-)}(h#``LANDLOCK_CREATE_RULESET_VERSION``h]j)}(hj*h]hLANDLOCK_CREATE_RULESET_VERSION}(hj*hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj*ubah}(h]h ]h"]h$]h&]uh1j,hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:40: ./include/uapi/linux/landlock.hhK]hj*ubj=)}(hhh]j()}(h?Get the highest supported Landlock ABI version (starting at 1).h]h?Get the highest supported Landlock ABI version (starting at 1).}(hj*hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hj*hK]hj*ubah}(h]h ]h"]h$]h&]uh1j<hj*ubeh}(h]h ]h"]h$]h&]uh1j&hj*hK]hj*ubj')}(hh``LANDLOCK_CREATE_RULESET_ERRATA`` Get a bitmask of fixed issues for the current Landlock ABI version. h](j-)}(h"``LANDLOCK_CREATE_RULESET_ERRATA``h]j)}(hj+h]hLANDLOCK_CREATE_RULESET_ERRATA}(hj+hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj+ubah}(h]h ]h"]h$]h&]uh1j,hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:40: ./include/uapi/linux/landlock.hhKahj+ubj=)}(hhh]j()}(hCGet a bitmask of fixed issues for the current Landlock ABI version.h]hCGet a bitmask of fixed issues for the current Landlock ABI version.}(hj-+hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:40: ./include/uapi/linux/landlock.hhK`hj*+ubah}(h]h ]h"]h$]h&]uh1j<hj+ubeh}(h]h ]h"]h$]h&]uh1j&hj)+hKahj*ubeh}(h]h ]h"]h$]h&]uh1j!hjn'ubj()}(h **Return**h]j|)}(hjP+h]hReturn}(hjR+hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hjN+ubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:817: ./security/landlock/syscalls.chKhjn'ubj()}(hThe ruleset file descriptor on success, the Landlock ABI version if ``LANDLOCK_CREATE_RULESET_VERSION`` is set, the errata value if ``LANDLOCK_CREATE_RULESET_ERRATA`` is set, or -errno on failure. Possible returned errors are:h](hDThe ruleset file descriptor on success, the Landlock ABI version if }(hjf+hhhNhNubj)}(h#``LANDLOCK_CREATE_RULESET_VERSION``h]hLANDLOCK_CREATE_RULESET_VERSION}(hjn+hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjf+ubh is set, the errata value if }(hjf+hhhNhNubj)}(h"``LANDLOCK_CREATE_RULESET_ERRATA``h]hLANDLOCK_CREATE_RULESET_ERRATA}(hj+hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjf+ubh= is set, or -errno on failure. Possible returned errors are:}(hjf+hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:817: ./security/landlock/syscalls.chKhjn'ubeh}(h]h ] kernelindentah"]h$]h&]uh1jl'hj%hhhNhNubj0%)}(hhh]h}(h]h ]h"]h$]h&]entries](j<% landlock_ruleset_attr (C struct)c.landlock_ruleset_attrhNtauh1j/%hj%hhhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:820: ./include/uapi/linux/landlock.hhNubjA%)}(hhh](jF%)}(hlandlock_ruleset_attrh]jL%)}(hstruct landlock_ruleset_attrh](j%)}(hj%h]hstruct}(hj+hhhNhNubah}(h]h ]j%ah"]h$]h&]uh1j%hj+hhhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:820: ./include/uapi/linux/landlock.hhKubjd%)}(h h]h }(hj+hhhNhNubah}(h]h ]jp%ah"]h$]h&]uh1jc%hj+hhhj+hKubju%)}(hlandlock_ruleset_attrh]j{%)}(hj+h]hlandlock_ruleset_attr}(hj+hhhNhNubah}(h]h ]j%ah"]h$]h&]uh1jz%hj+ubah}(h]h ](j%j%eh"]h$]h&]hhuh1jt%hj+hhhj+hKubeh}(h]h ]h"]h$]h&]hhj7'uh1jK%j8'j9'hj+hhhj+hKubah}(h]j+ah ](j='j>'eh"]h$]h&]jB'jC')jD'huh1jE%hj+hKhj+hhubjF')}(hhh]j()}(hRuleset definition.h]hRuleset definition.}(hj+hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:820: ./include/uapi/linux/landlock.hhKhj+hhubah}(h]h ]h"]h$]h&]uh1jE'hj+hhhj+hKubeh}(h]h ](jstructeh"]h$]h&]jf'jjg'j,jh'j,ji'jj'jk'uh1j@%hhhj%hj+hNubjm')}(hX**Definition**:: struct landlock_ruleset_attr { __u64 handled_access_fs; __u64 handled_access_net; __u64 scoped; __u64 quiet_access_fs; __u64 quiet_access_net; __u64 quiet_scoped; __u64 handled_permissions; }; **Members** ``handled_access_fs`` Bitmask of handled filesystem actions (cf. `Filesystem flags`_). ``handled_access_net`` Bitmask of handled network actions (cf. `Network flags`_). ``scoped`` Bitmask of scopes (cf. `Scope flags`_) restricting a Landlock domain from accessing outside resources (e.g. IPCs). ``quiet_access_fs`` Bitmask of filesystem actions which should not be submitted to audit if the per-object quiet flag is set. ``quiet_access_net`` Bitmask of network actions which should not be submitted to audit if the per-object quiet flag is set. ``quiet_scoped`` Bitmask of scoped actions which should not be submitted to audit. ``handled_permissions`` Bitmask of handled permissions (cf. `Permission flags`_).h](j()}(h**Definition**::h](j|)}(h**Definition**h]h Definition}(hj ,hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hj,ubh:}(hj,hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:820: ./include/uapi/linux/landlock.hhKhj,ubj)}(hstruct landlock_ruleset_attr { __u64 handled_access_fs; __u64 handled_access_net; __u64 scoped; __u64 quiet_access_fs; __u64 quiet_access_net; __u64 quiet_scoped; __u64 handled_permissions; };h]hstruct landlock_ruleset_attr { __u64 handled_access_fs; __u64 handled_access_net; __u64 scoped; __u64 quiet_access_fs; __u64 quiet_access_net; __u64 quiet_scoped; __u64 handled_permissions; };}hj9,sbah}(h]h ]h"]h$]h&]hhuh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:820: ./include/uapi/linux/landlock.hhKhj,ubj()}(h **Members**h]j|)}(hjJ,h]hMembers}(hjL,hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hjH,ubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:820: ./include/uapi/linux/landlock.hhK hj,ubj")}(hhh](j')}(hW``handled_access_fs`` Bitmask of handled filesystem actions (cf. `Filesystem flags`_). h](j-)}(h``handled_access_fs``h]j)}(hji,h]hhandled_access_fs}(hjk,hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjg,ubah}(h]h ]h"]h$]h&]uh1j,he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:820: ./include/uapi/linux/landlock.hhK6hjc,ubj=)}(hhh]j()}(h@Bitmask of handled filesystem actions (cf. `Filesystem flags`_).h](h+Bitmask of handled filesystem actions (cf. }(hj,hhhNhNubj5)}(h`Filesystem flags`_h]hFilesystem flags}(hj,hhhNhNubah}(h]h ]h"]h$]h&]nameFilesystem flagsjFj9!uh1j4hj,jHKubh).}(hj,hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:820: ./include/uapi/linux/landlock.hhK5hj,ubah}(h]h ]h"]h$]h&]uh1j<hjc,ubeh}(h]h ]h"]h$]h&]uh1j&hj~,hK6hj`,ubj')}(hR``handled_access_net`` Bitmask of handled network actions (cf. `Network flags`_). h](j-)}(h``handled_access_net``h]j)}(hj,h]hhandled_access_net}(hj,hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj,ubah}(h]h ]h"]h$]h&]uh1j,he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:820: ./include/uapi/linux/landlock.hhK;hj,ubj=)}(hhh]j()}(h:Bitmask of handled network actions (cf. `Network flags`_).h](h(Bitmask of handled network actions (cf. }(hj,hhhNhNubj5)}(h`Network flags`_h]h Network flags}(hj,hhhNhNubah}(h]h ]h"]h$]h&]name Network flagsjFjI#uh1j4hj,jHKubh).}(hj,hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:820: ./include/uapi/linux/landlock.hhK:hj,ubah}(h]h ]h"]h$]h&]uh1j<hj,ubeh}(h]h ]h"]h$]h&]uh1j&hj,hK;hj`,ubj')}(h~``scoped`` Bitmask of scopes (cf. `Scope flags`_) restricting a Landlock domain from accessing outside resources (e.g. IPCs). h](j-)}(h ``scoped``h]j)}(hj-h]hscoped}(hj-hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj-ubah}(h]h ]h"]h$]h&]uh1j,he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:820: ./include/uapi/linux/landlock.hhKAhj,ubj=)}(hhh]j()}(hrBitmask of scopes (cf. `Scope flags`_) restricting a Landlock domain from accessing outside resources (e.g. IPCs).h](hBitmask of scopes (cf. }(hj-hhhNhNubj5)}(h`Scope flags`_h]h Scope flags}(hj&-hhhNhNubah}(h]h ]h"]h$]h&]name Scope flagsjFj#uh1j4hj-jHKubhM) restricting a Landlock domain from accessing outside resources (e.g. IPCs).}(hj-hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:820: ./include/uapi/linux/landlock.hhK?hj-ubah}(h]h ]h"]h$]h&]uh1j<hj,ubeh}(h]h ]h"]h$]h&]uh1j&hj-hKAhj`,ubj')}(h~``quiet_access_fs`` Bitmask of filesystem actions which should not be submitted to audit if the per-object quiet flag is set. h](j-)}(h``quiet_access_fs``h]j)}(hjS-h]hquiet_access_fs}(hjU-hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjQ-ubah}(h]h ]h"]h$]h&]uh1j,he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:820: ./include/uapi/linux/landlock.hhKFhjM-ubj=)}(hhh]j()}(hiBitmask of filesystem actions which should not be submitted to audit if the per-object quiet flag is set.h]hiBitmask of filesystem actions which should not be submitted to audit if the per-object quiet flag is set.}(hjl-hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:820: ./include/uapi/linux/landlock.hhKEhji-ubah}(h]h ]h"]h$]h&]uh1j<hjM-ubeh}(h]h ]h"]h$]h&]uh1j&hjh-hKFhj`,ubj')}(h|``quiet_access_net`` Bitmask of network actions which should not be submitted to audit if the per-object quiet flag is set. h](j-)}(h``quiet_access_net``h]j)}(hj-h]hquiet_access_net}(hj-hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj-ubah}(h]h ]h"]h$]h&]uh1j,he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:820: ./include/uapi/linux/landlock.hhKKhj-ubj=)}(hhh]j()}(hfBitmask of network actions which should not be submitted to audit if the per-object quiet flag is set.h]hfBitmask of network actions which should not be submitted to audit if the per-object quiet flag is set.}(hj-hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:820: ./include/uapi/linux/landlock.hhKJhj-ubah}(h]h ]h"]h$]h&]uh1j<hj-ubeh}(h]h ]h"]h$]h&]uh1j&hj-hKKhj`,ubj')}(hS``quiet_scoped`` Bitmask of scoped actions which should not be submitted to audit. h](j-)}(h``quiet_scoped``h]j)}(hj-h]h quiet_scoped}(hj-hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj-ubah}(h]h ]h"]h$]h&]uh1j,he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:820: ./include/uapi/linux/landlock.hhKPhj-ubj=)}(hhh]j()}(hABitmask of scoped actions which should not be submitted to audit.h]hABitmask of scoped actions which should not be submitted to audit.}(hj-hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:820: ./include/uapi/linux/landlock.hhKOhj-ubah}(h]h ]h"]h$]h&]uh1j<hj-ubeh}(h]h ]h"]h$]h&]uh1j&hj-hKPhj`,ubj')}(hQ``handled_permissions`` Bitmask of handled permissions (cf. `Permission flags`_).h](j-)}(h``handled_permissions``h]j)}(hj.h]hhandled_permissions}(hj.hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj-ubah}(h]h ]h"]h$]h&]uh1j,he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:820: ./include/uapi/linux/landlock.hhKThj-ubj=)}(hhh]j()}(h9Bitmask of handled permissions (cf. `Permission flags`_).h](h$Bitmask of handled permissions (cf. }(hj.hhhNhNubj5)}(h`Permission flags`_h]hPermission flags}(hj".hhhNhNubah}(h]h ]h"]h$]h&]namePermission flagsjFj%uh1j4hj.jHKubh).}(hj.hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hj.hKThj.ubah}(h]h ]h"]h$]h&]uh1j<hj-ubeh}(h]h ]h"]h$]h&]uh1j&hj.hKThj`,ubeh}(h]h ]h"]h$]h&]uh1j!hj,ubeh}(h]h ] kernelindentah"]h$]h&]uh1jl'hj%hhhj+hNubj()}(h**Description**h]j|)}(hjW.h]h Description}(hjY.hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hjU.ubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:820: ./include/uapi/linux/landlock.hhKXhj%hhubj()}(h*Argument of sys_landlock_create_ruleset().h]h*Argument of sys_landlock_create_ruleset().}(hjm.hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:820: ./include/uapi/linux/landlock.hhKhj%hhubj()}(hX#This structure defines a set of *handled access rights*, a set of actions on different object types, which should be denied by default when the ruleset is enacted. Vice versa, access rights that are not specifically listed here are not going to be denied by this ruleset when it is enacted.h](h This structure defines a set of }(hj|.hhhNhNubj| )}(h*handled access rights*h]hhandled access rights}(hj.hhhNhNubah}(h]h ]h"]h$]h&]uh1j{ hj|.ubh, a set of actions on different object types, which should be denied by default when the ruleset is enacted. Vice versa, access rights that are not specifically listed here are not going to be denied by this ruleset when it is enacted.}(hj|.hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:820: ./include/uapi/linux/landlock.hhKhj%hhubj()}(hXFor historical reasons, the ``LANDLOCK_ACCESS_FS_REFER`` right is always denied by default, even when its bit is not set in **handled_access_fs**. In order to add new rules with this access right, the bit must still be set explicitly (cf. `Filesystem flags`_).h](hFor historical reasons, the }(hj.hhhNhNubj)}(h``LANDLOCK_ACCESS_FS_REFER``h]hLANDLOCK_ACCESS_FS_REFER}(hj.hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj.ubhD right is always denied by default, even when its bit is not set in }(hj.hhhNhNubj|)}(h**handled_access_fs**h]hhandled_access_fs}(hj.hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hj.ubh_. In order to add new rules with this access right, the bit must still be set explicitly (cf. }(hj.hhhNhNubj5)}(h`Filesystem flags`_h]hFilesystem flags}(hj.hhhNhNubah}(h]h ]h"]h$]h&]nameFilesystem flagsjFj9!uh1j4hj.jHKubh).}(hj.hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:820: ./include/uapi/linux/landlock.hhKhj%hhubj()}(hX&The explicit listing of *handled access rights* is required for backwards compatibility reasons. In most use cases, processes that use Landlock will *handle* a wide range or all access rights that they know about at build time (and that they have tested with a kernel that supported them all).h](hThe explicit listing of }(hj.hhhNhNubj| )}(h*handled access rights*h]hhandled access rights}(hj.hhhNhNubah}(h]h ]h"]h$]h&]uh1j{ hj.ubhg is required for backwards compatibility reasons. In most use cases, processes that use Landlock will }(hj.hhhNhNubj| )}(h*handle*h]hhandle}(hj.hhhNhNubah}(h]h ]h"]h$]h&]uh1j{ hj.ubh a wide range or all access rights that they know about at build time (and that they have tested with a kernel that supported them all).}(hj.hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:820: ./include/uapi/linux/landlock.hhKhj%hhubj()}(hX~**quiet_access_fs** and **quiet_access_net** are bitmasks of actions for which a denial by this layer will not trigger an audit record if the corresponding object (or its children, for filesystem rules) is marked with the "quiet" bit via ``LANDLOCK_ADD_RULE_QUIET``, even if logging would normally take place per landlock_restrict_self() flags. **quiet_scoped** is similar, except that it does not require marking any objects as quiet - if the ruleset is created with any bits set in **quiet_scoped**, then denial of such scoped resources will not trigger an audit record. These three fields are available since Landlock ABI version 10.h](j|)}(h**quiet_access_fs**h]hquiet_access_fs}(hj/hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hj/ubh and }(hj/hhhNhNubj|)}(h**quiet_access_net**h]hquiet_access_net}(hj-/hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hj/ubh are bitmasks of actions for which a denial by this layer will not trigger an audit record if the corresponding object (or its children, for filesystem rules) is marked with the “quiet” bit via }(hj/hhhNhNubj)}(h``LANDLOCK_ADD_RULE_QUIET``h]hLANDLOCK_ADD_RULE_QUIET}(hj?/hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj/ubhQ, even if logging would normally take place per landlock_restrict_self() flags. }(hj/hhhNhNubj|)}(h**quiet_scoped**h]h quiet_scoped}(hjQ/hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hj/ubh{ is similar, except that it does not require marking any objects as quiet - if the ruleset is created with any bits set in }(hj/hhhNhNubj|)}(h**quiet_scoped**h]h quiet_scoped}(hjc/hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hj/ubh, then denial of such scoped resources will not trigger an audit record. These three fields are available since Landlock ABI version 10.}(hj/hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:820: ./include/uapi/linux/landlock.hhK"hj%hhubj()}(h**quiet_access_fs**, **quiet_access_net** and **quiet_scoped** must be a subset of **handled_access_fs**, **handled_access_net** and **scoped** respectively.h](j|)}(h**quiet_access_fs**h]hquiet_access_fs}(hj/hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hj|/ubh, }(hj|/hhhNhNubj|)}(h**quiet_access_net**h]hquiet_access_net}(hj/hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hj|/ubh and }(hj|/hhhNhNubj|)}(h**quiet_scoped**h]h quiet_scoped}(hj/hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hj|/ubh must be a subset of }(hj|/hhhNhNubj|)}(h**handled_access_fs**h]hhandled_access_fs}(hj/hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hj|/ubh, }hj|/sbj|)}(h**handled_access_net**h]hhandled_access_net}(hj/hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hj|/ubh and }hj|/sbj|)}(h **scoped**h]hscoped}(hj/hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hj|/ubh respectively.}(hj|/hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:820: ./include/uapi/linux/landlock.hhK,hj%hhubj()}(h4This structure can grow in future Landlock versions.h]h4This structure can grow in future Landlock versions.}(hj/hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:820: ./include/uapi/linux/landlock.hhK/hj%hhubeh}(h]creating-a-new-rulesetah ]h"]creating a new rulesetah$]h&]uh1hhjihhhhhM/ubh)}(hhh](h)}(hExtending a ruleseth]hExtending a ruleset}(hj 0hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj 0hhhhhM8ubj0%)}(hhh]h}(h]h ]h"]h$]h&]entries](j<%"sys_landlock_add_rule (C function)c.sys_landlock_add_rulehNtauh1j/%hj 0hhhNhNubjA%)}(hhh](jF%)}(hlong sys_landlock_add_rule (const int ruleset_fd, const enum landlock_rule_type rule_type, const void __user *const rule_attr, const __u32 flags)h]jL%)}(hlong sys_landlock_add_rule(const int ruleset_fd, const enum landlock_rule_type rule_type, const void __user *const rule_attr, const __u32 flags)h](jR%)}(hlongh]hlong}(hj40hhhNhNubah}(h]h ]j^%ah"]h$]h&]uh1jQ%hj00hhhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:826: ./security/landlock/syscalls.chMeubjd%)}(h h]h }(hjC0hhhNhNubah}(h]h ]jp%ah"]h$]h&]uh1jc%hj00hhhjB0hMeubju%)}(hsys_landlock_add_ruleh]j{%)}(hsys_landlock_add_ruleh]hsys_landlock_add_rule}(hjU0hhhNhNubah}(h]h ]j%ah"]h$]h&]uh1jz%hjQ0ubah}(h]h ](j%j%eh"]h$]h&]hhuh1jt%hj00hhhjB0hMeubj%)}(hv(const int ruleset_fd, const enum landlock_rule_type rule_type, const void __user *const rule_attr, const __u32 flags)h](j%)}(hconst int ruleset_fdh](j%)}(hj%h]hconst}(hjq0hhhNhNubah}(h]h ]j%ah"]h$]h&]uh1j%hjm0ubjd%)}(h h]h }(hj~0hhhNhNubah}(h]h ]jp%ah"]h$]h&]uh1jc%hjm0ubjR%)}(hinth]hint}(hj0hhhNhNubah}(h]h ]j^%ah"]h$]h&]uh1jQ%hjm0ubjd%)}(h h]h }(hj0hhhNhNubah}(h]h ]jp%ah"]h$]h&]uh1jc%hjm0ubj{%)}(h ruleset_fdh]h ruleset_fd}(hj0hhhNhNubah}(h]h ]j%ah"]h$]h&]uh1jz%hjm0ubeh}(h]h ]h"]h$]h&]noemphhhuh1j%hji0ubj%)}(h'const enum landlock_rule_type rule_typeh](j%)}(hj%h]hconst}(hj0hhhNhNubah}(h]h ]j%ah"]h$]h&]uh1j%hj0ubjd%)}(h h]h }(hj0hhhNhNubah}(h]h ]jp%ah"]h$]h&]uh1jc%hj0ubj%)}(henumh]henum}(hj0hhhNhNubah}(h]h ]j%ah"]h$]h&]uh1j%hj0ubjd%)}(h h]h }(hj0hhhNhNubah}(h]h ]jp%ah"]h$]h&]uh1jc%hj0ubh)}(hhh]j{%)}(hlandlock_rule_typeh]hlandlock_rule_type}(hj0hhhNhNubah}(h]h ]j%ah"]h$]h&]uh1jz%hj0ubah}(h]h ]h"]h$]h&] refdomainjreftypej% reftargetj0modnameN classnameNj%j%)}j%]j&)}j%jW0sbc.sys_landlock_add_ruleasbuh1hhj0ubjd%)}(h h]h }(hj1hhhNhNubah}(h]h ]jp%ah"]h$]h&]uh1jc%hj0ubj{%)}(h rule_typeh]h rule_type}(hj)1hhhNhNubah}(h]h ]j%ah"]h$]h&]uh1jz%hj0ubeh}(h]h ]h"]h$]h&]noemphhhuh1j%hji0ubj%)}(h"const void __user *const rule_attrh](j%)}(hj%h]hconst}(hjB1hhhNhNubah}(h]h ]j%ah"]h$]h&]uh1j%hj>1ubjd%)}(h h]h }(hjO1hhhNhNubah}(h]h ]jp%ah"]h$]h&]uh1jc%hj>1ubjR%)}(hvoidh]hvoid}(hj]1hhhNhNubah}(h]h ]j^%ah"]h$]h&]uh1jQ%hj>1ubjd%)}(h h]h }(hjk1hhhNhNubah}(h]h ]jp%ah"]h$]h&]uh1jc%hj>1ubh__user}(hj>1hhhNhNubjd%)}(h h]h }(hj}1hhhNhNubah}(h]h ]jp%ah"]h$]h&]uh1jc%hj>1ubj&&)}(hjh]h*}(hj1hhhNhNubah}(h]h ]j1&ah"]h$]h&]uh1j%&hj>1ubj%)}(hj%h]hconst}(hj1hhhNhNubah}(h]h ]j%ah"]h$]h&]uh1j%hj>1ubjd%)}(h h]h }(hj1hhhNhNubah}(h]h ]jp%ah"]h$]h&]uh1jc%hj>1ubj{%)}(h rule_attrh]h rule_attr}(hj1hhhNhNubah}(h]h ]j%ah"]h$]h&]uh1jz%hj>1ubeh}(h]h ]h"]h$]h&]noemphhhuh1j%hji0ubj%)}(hconst __u32 flagsh](j%)}(hj%h]hconst}(hj1hhhNhNubah}(h]h ]j%ah"]h$]h&]uh1j%hj1ubjd%)}(h h]h }(hj1hhhNhNubah}(h]h ]jp%ah"]h$]h&]uh1jc%hj1ubh)}(hhh]j{%)}(h__u32h]h__u32}(hj1hhhNhNubah}(h]h ]j%ah"]h$]h&]uh1jz%hj1ubah}(h]h ]h"]h$]h&] refdomainjreftypej% reftargetj1modnameN classnameNj%j%)}j%]j1c.sys_landlock_add_ruleasbuh1hhj1ubjd%)}(h h]h }(hj2hhhNhNubah}(h]h ]jp%ah"]h$]h&]uh1jc%hj1ubj{%)}(hflagsh]hflags}(hj2hhhNhNubah}(h]h ]j%ah"]h$]h&]uh1jz%hj1ubeh}(h]h ]h"]h$]h&]noemphhhuh1j%hji0ubeh}(h]h ]h"]h$]h&]hhuh1j%hj00hhhjB0hMeubeh}(h]h ]h"]h$]h&]hhj7'uh1jK%j8'j9'hj,0hhhjB0hMeubah}(h]j'0ah ](j='j>'eh"]h$]h&]jB'jC')jD'huh1jE%hjB0hMehj)0hhubjF')}(hhh]j()}(hAdd a new rule to a ruleseth]hAdd a new rule to a ruleset}(hj@2hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:826: ./security/landlock/syscalls.chMehj=2hhubah}(h]h ]h"]h$]h&]uh1jE'hj)0hhhjB0hMeubeh}(h]h ](jfunctioneh"]h$]h&]jf'jjg'jX2jh'jX2ji'jj'jk'uh1j@%hhhj 0hNhNubjm')}(hX **Parameters** ``const int ruleset_fd`` File descriptor tied to the ruleset that should be extended with the new rule. ``const enum landlock_rule_type rule_type`` Identify the structure type pointed to by **rule_attr**: ``LANDLOCK_RULE_PATH_BENEATH``, ``LANDLOCK_RULE_NET_PORT``, ``LANDLOCK_RULE_NAMESPACE``, or ``LANDLOCK_RULE_CAPABILITY``. ``const void __user *const rule_attr`` Pointer to a rule (matching the **rule_type**). ``const __u32 flags`` Must be 0 or ``LANDLOCK_ADD_RULE_QUIET``. **Description** This system call enables to define a new rule and add it to an existing ruleset. - ``EOPNOTSUPP``: Landlock is supported by the kernel but disabled at boot time; - ``EAFNOSUPPORT``: **rule_type** is ``LANDLOCK_RULE_NET_PORT`` but TCP/IP is not supported by the running kernel; - ``EINVAL``: **flags** is not valid; - ``EINVAL``: The rule accesses are inconsistent (i.e. :c:type:`landlock_path_beneath_attr.allowed_access ` or :c:type:`landlock_net_port_attr.allowed_access ` is not a subset of the ruleset handled accesses) - ``EINVAL``: A nonzero :c:type:`landlock_namespace_attr.permissions ` is not ``LANDLOCK_PERMISSION_NAMESPACE_USE`` or is not handled by the ruleset; - ``EINVAL``: A nonzero :c:type:`landlock_capability_attr.permissions ` is not ``LANDLOCK_PERMISSION_CAPABILITY_USE`` or is not handled by the ruleset; - ``EINVAL``: :c:type:`landlock_net_port_attr.port ` is greater than 65535; - ``EINVAL``: LANDLOCK_ADD_RULE_QUIET is passed but the ruleset has no quiet access bits set for the corresponding rule type. - ``ENOMSG``: Empty accesses (e.g. :c:type:`landlock_path_beneath_attr.allowed_access ` is 0) and no flags; - ``ENOMSG``: :c:type:`landlock_namespace_attr.permissions ` is 0, or both :c:type:`landlock_namespace_attr.allowed_namespace_types ` and :c:type:`landlock_namespace_attr.quiet_namespace_types ` are 0; - ``ENOMSG``: :c:type:`landlock_capability_attr.permissions ` is 0, or both :c:type:`landlock_capability_attr.allowed_capabilities ` and :c:type:`landlock_capability_attr.quiet_capabilities ` are 0; - ``EBADF``: **ruleset_fd** is not a file descriptor for the current thread, or a member of **rule_attr** is not a file descriptor as expected; - ``EBADFD``: **ruleset_fd** is not a ruleset file descriptor, or a member of **rule_attr** is not the expected file descriptor type; - ``EPERM``: **ruleset_fd** has no write access to the underlying ruleset; - ``EFAULT``: **rule_attr** was not a valid address. .. kernel-doc:: include/uapi/linux/landlock.h :identifiers: landlock_add_rule_flags **Return** 0 on success, or -errno on failure. Possible returned errors are:h](j()}(h**Parameters**h]j|)}(hjb2h]h Parameters}(hjd2hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hj`2ubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:826: ./security/landlock/syscalls.chMihj\2ubj")}(hhh](j')}(hh``const int ruleset_fd`` File descriptor tied to the ruleset that should be extended with the new rule. h](j-)}(h``const int ruleset_fd``h]j)}(hj2h]hconst int ruleset_fd}(hj2hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj2ubah}(h]h ]h"]h$]h&]uh1j,hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:826: ./security/landlock/syscalls.chMhhj{2ubj=)}(hhh]j()}(hNFile descriptor tied to the ruleset that should be extended with the new rule.h]hNFile descriptor tied to the ruleset that should be extended with the new rule.}(hj2hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:826: ./security/landlock/syscalls.chMghj2ubah}(h]h ]h"]h$]h&]uh1j<hj{2ubeh}(h]h ]h"]h$]h&]uh1j&hj2hMhhjx2ubj')}(h``const enum landlock_rule_type rule_type`` Identify the structure type pointed to by **rule_attr**: ``LANDLOCK_RULE_PATH_BENEATH``, ``LANDLOCK_RULE_NET_PORT``, ``LANDLOCK_RULE_NAMESPACE``, or ``LANDLOCK_RULE_CAPABILITY``. h](j-)}(h+``const enum landlock_rule_type rule_type``h]j)}(hj2h]h'const enum landlock_rule_type rule_type}(hj2hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj2ubah}(h]h ]h"]h$]h&]uh1j,hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:826: ./security/landlock/syscalls.chMkhj2ubj=)}(hhh]j()}(hIdentify the structure type pointed to by **rule_attr**: ``LANDLOCK_RULE_PATH_BENEATH``, ``LANDLOCK_RULE_NET_PORT``, ``LANDLOCK_RULE_NAMESPACE``, or ``LANDLOCK_RULE_CAPABILITY``.h](h*Identify the structure type pointed to by }(hj2hhhNhNubj|)}(h **rule_attr**h]h rule_attr}(hj2hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hj2ubh: }(hj2hhhNhNubj)}(h``LANDLOCK_RULE_PATH_BENEATH``h]hLANDLOCK_RULE_PATH_BENEATH}(hj2hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj2ubh, }(hj2hhhNhNubj)}(h``LANDLOCK_RULE_NET_PORT``h]hLANDLOCK_RULE_NET_PORT}(hj3hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj2ubh, }(hj2hhhNhNubj)}(h``LANDLOCK_RULE_NAMESPACE``h]hLANDLOCK_RULE_NAMESPACE}(hj3hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj2ubh, or }(hj2hhhNhNubj)}(h``LANDLOCK_RULE_CAPABILITY``h]hLANDLOCK_RULE_CAPABILITY}(hj$3hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj2ubh.}(hj2hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:826: ./security/landlock/syscalls.chMihj2ubah}(h]h ]h"]h$]h&]uh1j<hj2ubeh}(h]h ]h"]h$]h&]uh1j&hj2hMkhjx2ubj')}(hW``const void __user *const rule_attr`` Pointer to a rule (matching the **rule_type**). h](j-)}(h&``const void __user *const rule_attr``h]j)}(hjO3h]h"const void __user *const rule_attr}(hjQ3hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjM3ubah}(h]h ]h"]h$]h&]uh1j,hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:826: ./security/landlock/syscalls.chMlhjI3ubj=)}(hhh]j()}(h/Pointer to a rule (matching the **rule_type**).h](h Pointer to a rule (matching the }(hjh3hhhNhNubj|)}(h **rule_type**h]h rule_type}(hjp3hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hjh3ubh).}(hjh3hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hjd3hMlhje3ubah}(h]h ]h"]h$]h&]uh1j<hjI3ubeh}(h]h ]h"]h$]h&]uh1j&hjd3hMlhjx2ubj')}(h@``const __u32 flags`` Must be 0 or ``LANDLOCK_ADD_RULE_QUIET``. h](j-)}(h``const __u32 flags``h]j)}(hj3h]hconst __u32 flags}(hj3hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj3ubah}(h]h ]h"]h$]h&]uh1j,hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:826: ./security/landlock/syscalls.chMmhj3ubj=)}(hhh]j()}(h)Must be 0 or ``LANDLOCK_ADD_RULE_QUIET``.h](h Must be 0 or }(hj3hhhNhNubj)}(h``LANDLOCK_ADD_RULE_QUIET``h]hLANDLOCK_ADD_RULE_QUIET}(hj3hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj3ubh.}(hj3hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hj3hMmhj3ubah}(h]h ]h"]h$]h&]uh1j<hj3ubeh}(h]h ]h"]h$]h&]uh1j&hj3hMmhjx2ubeh}(h]h ]h"]h$]h&]uh1j!hj\2ubj()}(h**Description**h]j|)}(hj3h]h Description}(hj3hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hj3ubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:826: ./security/landlock/syscalls.chMohj\2ubj()}(hPThis system call enables to define a new rule and add it to an existing ruleset.h]hPThis system call enables to define a new rule and add it to an existing ruleset.}(hj3hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:826: ./security/landlock/syscalls.chMnhj\2ubjb)}(hhh](jg)}(hN``EOPNOTSUPP``: Landlock is supported by the kernel but disabled at boot time;h]j()}(hj4h](j)}(h``EOPNOTSUPP``h]h EOPNOTSUPP}(hj4hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj4ubh@: Landlock is supported by the kernel but disabled at boot time;}(hj4hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:826: ./security/landlock/syscalls.chMrhj4ubah}(h]h ]h"]h$]h&]uh1jfhj 4ubjg)}(hp``EAFNOSUPPORT``: **rule_type** is ``LANDLOCK_RULE_NET_PORT`` but TCP/IP is not supported by the running kernel;h]j()}(hp``EAFNOSUPPORT``: **rule_type** is ``LANDLOCK_RULE_NET_PORT`` but TCP/IP is not supported by the running kernel;h](j)}(h``EAFNOSUPPORT``h]h EAFNOSUPPORT}(hj=4hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj94ubh: }(hj94hhhNhNubj|)}(h **rule_type**h]h rule_type}(hjO4hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hj94ubh is }(hj94hhhNhNubj)}(h``LANDLOCK_RULE_NET_PORT``h]hLANDLOCK_RULE_NET_PORT}(hja4hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj94ubh3 but TCP/IP is not supported by the running kernel;}(hj94hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:826: ./security/landlock/syscalls.chMshj54ubah}(h]h ]h"]h$]h&]uh1jfhj 4ubjg)}(h#``EINVAL``: **flags** is not valid;h]j()}(hj4h](j)}(h ``EINVAL``h]hEINVAL}(hj4hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj4ubh: }(hj4hhhNhNubj|)}(h **flags**h]hflags}(hj4hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hj4ubh is not valid;}(hj4hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:826: ./security/landlock/syscalls.chMuhj4ubah}(h]h ]h"]h$]h&]uh1jfhj 4ubjg)}(hX``EINVAL``: The rule accesses are inconsistent (i.e. :c:type:`landlock_path_beneath_attr.allowed_access ` or :c:type:`landlock_net_port_attr.allowed_access ` is not a subset of the ruleset handled accesses)h]j()}(hX``EINVAL``: The rule accesses are inconsistent (i.e. :c:type:`landlock_path_beneath_attr.allowed_access ` or :c:type:`landlock_net_port_attr.allowed_access ` is not a subset of the ruleset handled accesses)h](j)}(h ``EINVAL``h]hEINVAL}(hj4hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj4ubh+: The rule accesses are inconsistent (i.e. }(hj4hhhNhNubh)}(hP:c:type:`landlock_path_beneath_attr.allowed_access `h]j)}(hj4h]h)landlock_path_beneath_attr.allowed_access}(hj4hhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jhj4ubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnj%j'jlandlock_path_beneath_attruh1hhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:826: ./security/landlock/syscalls.chMvhj4ubh or }(hj4hhhNhNubh)}(hH:c:type:`landlock_net_port_attr.allowed_access `h]j)}(hj4h]h%landlock_net_port_attr.allowed_access}(hj4hhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jhj4ubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnj%j'jlandlock_net_port_attruh1hhj4hMvhj4ubh1 is not a subset of the ruleset handled accesses)}(hj4hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hj4hMvhj4ubah}(h]h ]h"]h$]h&]uh1jfhj 4ubjg)}(h``EINVAL``: A nonzero :c:type:`landlock_namespace_attr.permissions ` is not ``LANDLOCK_PERMISSION_NAMESPACE_USE`` or is not handled by the ruleset;h]j()}(h``EINVAL``: A nonzero :c:type:`landlock_namespace_attr.permissions ` is not ``LANDLOCK_PERMISSION_NAMESPACE_USE`` or is not handled by the ruleset;h](j)}(h ``EINVAL``h]hEINVAL}(hj-5hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj)5ubh : A nonzero }(hj)5hhhNhNubh)}(hG:c:type:`landlock_namespace_attr.permissions `h]j)}(hjA5h]h#landlock_namespace_attr.permissions}(hjC5hhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jhj?5ubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnj%j'jlandlock_namespace_attruh1hhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:826: ./security/landlock/syscalls.chMzhj)5ubh is not }(hj)5hhhNhNubj)}(h%``LANDLOCK_PERMISSION_NAMESPACE_USE``h]h!LANDLOCK_PERMISSION_NAMESPACE_USE}(hjc5hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj)5ubh" or is not handled by the ruleset;}(hj)5hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hj^5hMzhj%5ubah}(h]h ]h"]h$]h&]uh1jfhj 4ubjg)}(h``EINVAL``: A nonzero :c:type:`landlock_capability_attr.permissions ` is not ``LANDLOCK_PERMISSION_CAPABILITY_USE`` or is not handled by the ruleset;h]j()}(h``EINVAL``: A nonzero :c:type:`landlock_capability_attr.permissions ` is not ``LANDLOCK_PERMISSION_CAPABILITY_USE`` or is not handled by the ruleset;h](j)}(h ``EINVAL``h]hEINVAL}(hj5hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj5ubh : A nonzero }(hj5hhhNhNubh)}(hI:c:type:`landlock_capability_attr.permissions `h]j)}(hj5h]h$landlock_capability_attr.permissions}(hj5hhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jhj5ubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnj%j'jlandlock_capability_attruh1hhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:826: ./security/landlock/syscalls.chM|hj5ubh is not }(hj5hhhNhNubj)}(h&``LANDLOCK_PERMISSION_CAPABILITY_USE``h]h"LANDLOCK_PERMISSION_CAPABILITY_USE}(hj5hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj5ubh" or is not handled by the ruleset;}(hj5hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hj5hM|hj5ubah}(h]h ]h"]h$]h&]uh1jfhj 4ubjg)}(ha``EINVAL``: :c:type:`landlock_net_port_attr.port ` is greater than 65535;h]j()}(hj5h](j)}(h ``EINVAL``h]hEINVAL}(hj5hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj5ubh: }(hj5hhhNhNubh)}(h>:c:type:`landlock_net_port_attr.port `h]j)}(hj5h]hlandlock_net_port_attr.port}(hj5hhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jhj5ubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnj%j'jlandlock_net_port_attruh1hhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:826: ./security/landlock/syscalls.chM~hj5ubh is greater than 65535;}(hj5hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hj6hM~hj5ubah}(h]h ]h"]h$]h&]uh1jfhj 4ubjg)}(h{``EINVAL``: LANDLOCK_ADD_RULE_QUIET is passed but the ruleset has no quiet access bits set for the corresponding rule type.h]j()}(h{``EINVAL``: LANDLOCK_ADD_RULE_QUIET is passed but the ruleset has no quiet access bits set for the corresponding rule type.h](j)}(h ``EINVAL``h]hEINVAL}(hj.6hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj*6ubhq: LANDLOCK_ADD_RULE_QUIET is passed but the ruleset has no quiet access bits set for the corresponding rule type.}(hj*6hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:826: ./security/landlock/syscalls.chMhj&6ubah}(h]h ]h"]h$]h&]uh1jfhj 4ubjg)}(h``ENOMSG``: Empty accesses (e.g. :c:type:`landlock_path_beneath_attr.allowed_access ` is 0) and no flags;h]j()}(h``ENOMSG``: Empty accesses (e.g. :c:type:`landlock_path_beneath_attr.allowed_access ` is 0) and no flags;h](j)}(h ``ENOMSG``h]hENOMSG}(hjU6hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjQ6ubh: Empty accesses (e.g. }(hjQ6hhhNhNubh)}(hP:c:type:`landlock_path_beneath_attr.allowed_access `h]j)}(hji6h]h)landlock_path_beneath_attr.allowed_access}(hjk6hhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jhjg6ubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnj%j'jlandlock_path_beneath_attruh1hhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:826: ./security/landlock/syscalls.chMhjQ6ubh is 0) and no flags;}(hjQ6hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hj6hMhjM6ubah}(h]h ]h"]h$]h&]uh1jfhj 4ubjg)}(hX``ENOMSG``: :c:type:`landlock_namespace_attr.permissions ` is 0, or both :c:type:`landlock_namespace_attr.allowed_namespace_types ` and :c:type:`landlock_namespace_attr.quiet_namespace_types ` are 0;h]j()}(hX``ENOMSG``: :c:type:`landlock_namespace_attr.permissions ` is 0, or both :c:type:`landlock_namespace_attr.allowed_namespace_types ` and :c:type:`landlock_namespace_attr.quiet_namespace_types ` are 0;h](j)}(h ``ENOMSG``h]hENOMSG}(hj6hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj6ubh: }(hj6hhhNhNubh)}(hG:c:type:`landlock_namespace_attr.permissions `h]j)}(hj6h]h#landlock_namespace_attr.permissions}(hj6hhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jhj6ubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnj%j'jlandlock_namespace_attruh1hhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:826: ./security/landlock/syscalls.chMhj6ubh is 0, or both }(hj6hhhNhNubh)}(hS:c:type:`landlock_namespace_attr.allowed_namespace_types `h]j)}(hj6h]h/landlock_namespace_attr.allowed_namespace_types}(hj6hhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jhj6ubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnj%j'jlandlock_namespace_attruh1hhj6hMhj6ubh and }(hj6hhhNhNubh)}(hQ:c:type:`landlock_namespace_attr.quiet_namespace_types `h]j)}(hj6h]h-landlock_namespace_attr.quiet_namespace_types}(hj6hhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jhj6ubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnj%j'jlandlock_namespace_attruh1hhj6hMhj6ubh are 0;}(hj6hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hj6hMhj6ubah}(h]h ]h"]h$]h&]uh1jfhj 4ubjg)}(hX``ENOMSG``: :c:type:`landlock_capability_attr.permissions ` is 0, or both :c:type:`landlock_capability_attr.allowed_capabilities ` and :c:type:`landlock_capability_attr.quiet_capabilities ` are 0;h]j()}(hX``ENOMSG``: :c:type:`landlock_capability_attr.permissions ` is 0, or both :c:type:`landlock_capability_attr.allowed_capabilities ` and :c:type:`landlock_capability_attr.quiet_capabilities ` are 0;h](j)}(h ``ENOMSG``h]hENOMSG}(hj/7hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj+7ubh: }(hj+7hhhNhNubh)}(hI:c:type:`landlock_capability_attr.permissions `h]j)}(hjC7h]h$landlock_capability_attr.permissions}(hjE7hhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jhjA7ubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnj%j'jlandlock_capability_attruh1hhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:826: ./security/landlock/syscalls.chMhj+7ubh is 0, or both }(hj+7hhhNhNubh)}(hR:c:type:`landlock_capability_attr.allowed_capabilities `h]j)}(hjg7h]h-landlock_capability_attr.allowed_capabilities}(hji7hhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jhje7ubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnj%j'jlandlock_capability_attruh1hhj`7hMhj+7ubh and }(hj+7hhhNhNubh)}(hP:c:type:`landlock_capability_attr.quiet_capabilities `h]j)}(hj7h]h+landlock_capability_attr.quiet_capabilities}(hj7hhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jhj7ubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnj%j'jlandlock_capability_attruh1hhj`7hMhj+7ubh are 0;}(hj+7hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hj`7hMhj'7ubah}(h]h ]h"]h$]h&]uh1jfhj 4ubjg)}(h``EBADF``: **ruleset_fd** is not a file descriptor for the current thread, or a member of **rule_attr** is not a file descriptor as expected;h]j()}(h``EBADF``: **ruleset_fd** is not a file descriptor for the current thread, or a member of **rule_attr** is not a file descriptor as expected;h](j)}(h ``EBADF``h]hEBADF}(hj7hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj7ubh: }(hj7hhhNhNubj|)}(h**ruleset_fd**h]h ruleset_fd}(hj7hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hj7ubhA is not a file descriptor for the current thread, or a member of }(hj7hhhNhNubj|)}(h **rule_attr**h]h rule_attr}(hj7hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hj7ubh& is not a file descriptor as expected;}(hj7hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:826: ./security/landlock/syscalls.chMhj7ubah}(h]h ]h"]h$]h&]uh1jfhj 4ubjg)}(h``EBADFD``: **ruleset_fd** is not a ruleset file descriptor, or a member of **rule_attr** is not the expected file descriptor type;h]j()}(h``EBADFD``: **ruleset_fd** is not a ruleset file descriptor, or a member of **rule_attr** is not the expected file descriptor type;h](j)}(h ``EBADFD``h]hEBADFD}(hj 8hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj8ubh: }(hj8hhhNhNubj|)}(h**ruleset_fd**h]h ruleset_fd}(hj8hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hj8ubh2 is not a ruleset file descriptor, or a member of }(hj8hhhNhNubj|)}(h **rule_attr**h]h rule_attr}(hj.8hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hj8ubh* is not the expected file descriptor type;}(hj8hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:826: ./security/landlock/syscalls.chMhj8ubah}(h]h ]h"]h$]h&]uh1jfhj 4ubjg)}(hH``EPERM``: **ruleset_fd** has no write access to the underlying ruleset;h]j()}(hjO8h](j)}(h ``EPERM``h]hEPERM}(hjT8hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjQ8ubh: }(hjQ8hhhNhNubj|)}(h**ruleset_fd**h]h ruleset_fd}(hjf8hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hjQ8ubh/ has no write access to the underlying ruleset;}(hjQ8hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:826: ./security/landlock/syscalls.chMhjM8ubah}(h]h ]h"]h$]h&]uh1jfhj 4ubjg)}(h3``EFAULT``: **rule_attr** was not a valid address. h]j()}(h2``EFAULT``: **rule_attr** was not a valid address.h](j)}(h ``EFAULT``h]hEFAULT}(hj8hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj8ubh: }(hj8hhhNhNubj|)}(h **rule_attr**h]h rule_attr}(hj8hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hj8ubh was not a valid address.}(hj8hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:826: ./security/landlock/syscalls.chMhj8ubah}(h]h ]h"]h$]h&]uh1jfhj 4ubeh}(h]h ]h"]h$]h&]jjuh1jahj.4hMrhj\2ubj()}(h **Flags**h]j|)}(hj8h]hFlags}(hj8hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hj8ubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:60: ./include/uapi/linux/landlock.hhKjhj\2ubj")}(hhh]j')}(hX``LANDLOCK_ADD_RULE_QUIET`` Together with the quiet_* fields in struct landlock_ruleset_attr, this flag controls whether Landlock will log audit messages when access to the objects covered by this rule is denied by this layer. If logging is enabled, when Landlock denies an access, it will suppress the log if all of the following are true: - this layer is the innermost layer that denied the access; - all accesses denied by this layer are part of the quiet_* fields in the related struct landlock_ruleset_attr; - the object (or one of its parents, for filesystem rules) is marked as "quiet" via ``LANDLOCK_ADD_RULE_QUIET``. Because logging is only suppressed by a layer if the layer denies access, a sandboxed program cannot use this flag to "hide" access denials, without denying itself the access in the first place. The effect of this flag does not depend on the value of allowed_access in the passed in rule_attr. When this flag is present, the caller is also allowed to pass in an empty allowed_access. h](j-)}(h``LANDLOCK_ADD_RULE_QUIET``h]j)}(hj8h]hLANDLOCK_ADD_RULE_QUIET}(hj8hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj8ubah}(h]h ]h"]h$]h&]uh1j,hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:60: ./include/uapi/linux/landlock.hhKhj8ubj=)}(hhh](j()}(hTogether with the quiet_* fields in struct landlock_ruleset_attr, this flag controls whether Landlock will log audit messages when access to the objects covered by this rule is denied by this layer.h]hTogether with the quiet_* fields in struct landlock_ruleset_attr, this flag controls whether Landlock will log audit messages when access to the objects covered by this rule is denied by this layer.}(hj8hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:60: ./include/uapi/linux/landlock.hhKmhj8ubj()}(hqIf logging is enabled, when Landlock denies an access, it will suppress the log if all of the following are true:h]hqIf logging is enabled, when Landlock denies an access, it will suppress the log if all of the following are true:}(hj 9hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:60: ./include/uapi/linux/landlock.hhKqhj8ubjb)}(hhh](jg)}(h9this layer is the innermost layer that denied the access;h]j()}(hj!9h]h9this layer is the innermost layer that denied the access;}(hj#9hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:60: ./include/uapi/linux/landlock.hhKthj9ubah}(h]h ]h"]h$]h&]uh1jfhj9ubjg)}(hmall accesses denied by this layer are part of the quiet_* fields in the related struct landlock_ruleset_attr;h]j()}(hmall accesses denied by this layer are part of the quiet_* fields in the related struct landlock_ruleset_attr;h]hmall accesses denied by this layer are part of the quiet_* fields in the related struct landlock_ruleset_attr;}(hj;9hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:60: ./include/uapi/linux/landlock.hhKuhj79ubah}(h]h ]h"]h$]h&]uh1jfhj9ubjg)}(hothe object (or one of its parents, for filesystem rules) is marked as "quiet" via ``LANDLOCK_ADD_RULE_QUIET``. h]j()}(hnthe object (or one of its parents, for filesystem rules) is marked as "quiet" via ``LANDLOCK_ADD_RULE_QUIET``.h](hVthe object (or one of its parents, for filesystem rules) is marked as “quiet” via }(hjT9hhhNhNubj)}(h``LANDLOCK_ADD_RULE_QUIET``h]hLANDLOCK_ADD_RULE_QUIET}(hj\9hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjT9ubh.}(hjT9hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:60: ./include/uapi/linux/landlock.hhKwhjP9ubah}(h]h ]h"]h$]h&]uh1jfhj9ubeh}(h]h ]h"]h$]h&]jjuh1jahj09hKthj8ubj()}(hBecause logging is only suppressed by a layer if the layer denies access, a sandboxed program cannot use this flag to "hide" access denials, without denying itself the access in the first place.h]hBecause logging is only suppressed by a layer if the layer denies access, a sandboxed program cannot use this flag to “hide” access denials, without denying itself the access in the first place.}(hj9hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:60: ./include/uapi/linux/landlock.hhKzhj8ubj()}(hThe effect of this flag does not depend on the value of allowed_access in the passed in rule_attr. When this flag is present, the caller is also allowed to pass in an empty allowed_access.h]hThe effect of this flag does not depend on the value of allowed_access in the passed in rule_attr. When this flag is present, the caller is also allowed to pass in an empty allowed_access.}(hj9hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:60: ./include/uapi/linux/landlock.hhK~hj8ubeh}(h]h ]h"]h$]h&]uh1j<hj8ubeh}(h]h ]h"]h$]h&]uh1j&hj8hKhj8ubah}(h]h ]h"]h$]h&]uh1j!hj\2ubj()}(h **Return**h]j|)}(hj9h]hReturn}(hj9hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hj9ubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:826: ./security/landlock/syscalls.chMhj\2ubj()}(hB0 on success, or -errno on failure. Possible returned errors are:h]hB0 on success, or -errno on failure. Possible returned errors are:}(hj9hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:826: ./security/landlock/syscalls.chMrhj\2ubeh}(h]h ] kernelindentah"]h$]h&]uh1jl'hj 0hhhNhNubj0%)}(hhh]h}(h]h ]h"]h$]h&]entries](j<%landlock_rule_type (C enum)c.landlock_rule_typehNtauh1j/%hj 0hhhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhNubjA%)}(hhh](jF%)}(hlandlock_rule_typeh]jL%)}(henum landlock_rule_typeh](j%)}(hj0h]henum}(hj9hhhNhNubah}(h]h ]j%ah"]h$]h&]uh1j%hj9hhhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhKubjd%)}(h h]h }(hj:hhhNhNubah}(h]h ]jp%ah"]h$]h&]uh1jc%hj9hhhj:hKubju%)}(hlandlock_rule_typeh]j{%)}(hj9h]hlandlock_rule_type}(hj:hhhNhNubah}(h]h ]j%ah"]h$]h&]uh1jz%hj:ubah}(h]h ](j%j%eh"]h$]h&]hhuh1jt%hj9hhhj:hKubeh}(h]h ]h"]h$]h&]hhj7'uh1jK%j8'j9'hj9hhhj:hKubah}(h]j9ah ](j='j>'eh"]h$]h&]jB'jC')jD'huh1jE%hj:hKhj9hhubjF')}(hhh]j()}(hLandlock rule typeh]hLandlock rule type}(hj;:hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhKhj8:hhubah}(h]h ]h"]h$]h&]uh1jE'hj9hhhj:hKubeh}(h]h ](jenumeh"]h$]h&]jf'jjg'jS:jh'jS:ji'jj'jk'uh1j@%hhhj 0hj9hNubjm')}(hX**Constants** ``LANDLOCK_RULE_PATH_BENEATH`` Type of a :c:type:`struct landlock_path_beneath_attr ` . ``LANDLOCK_RULE_NET_PORT`` Type of a :c:type:`struct landlock_net_port_attr ` . ``LANDLOCK_RULE_NAMESPACE`` Type of a :c:type:`struct landlock_namespace_attr ` . ``LANDLOCK_RULE_CAPABILITY`` Type of a :c:type:`struct landlock_capability_attr ` .h](j()}(h **Constants**h]j|)}(hj]:h]h Constants}(hj_:hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hj[:ubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhKhjW:ubj")}(hhh](j')}(ht``LANDLOCK_RULE_PATH_BENEATH`` Type of a :c:type:`struct landlock_path_beneath_attr ` . h](j-)}(h``LANDLOCK_RULE_PATH_BENEATH``h]j)}(hj|:h]hLANDLOCK_RULE_PATH_BENEATH}(hj~:hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjz:ubah}(h]h ]h"]h$]h&]uh1j,he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhKhjv:ubj=)}(hhh]j()}(hTType of a :c:type:`struct landlock_path_beneath_attr ` .h](h Type of a }(hj:hhhNhNubh)}(hH:c:type:`struct landlock_path_beneath_attr `h]j)}(hj:h]h!struct landlock_path_beneath_attr}(hj:hhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jhj:ubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnj%j'jlandlock_path_beneath_attruh1hhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhKhj:ubh .}(hj:hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hj:hKhj:ubah}(h]h ]h"]h$]h&]uh1j<hjv:ubeh}(h]h ]h"]h$]h&]uh1j&hj:hKhjs:ubj')}(hh``LANDLOCK_RULE_NET_PORT`` Type of a :c:type:`struct landlock_net_port_attr ` . h](j-)}(h``LANDLOCK_RULE_NET_PORT``h]j)}(hj:h]hLANDLOCK_RULE_NET_PORT}(hj:hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj:ubah}(h]h ]h"]h$]h&]uh1j,he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhKhj:ubj=)}(hhh]j()}(hLType of a :c:type:`struct landlock_net_port_attr ` .h](h Type of a }(hj:hhhNhNubh)}(h@:c:type:`struct landlock_net_port_attr `h]j)}(hj:h]hstruct landlock_net_port_attr}(hj:hhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jhj:ubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnj%j'jlandlock_net_port_attruh1hhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhKhj:ubh .}(hj:hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hj;hKhj:ubah}(h]h ]h"]h$]h&]uh1j<hj:ubeh}(h]h ]h"]h$]h&]uh1j&hj:hKhjs:ubj')}(hk``LANDLOCK_RULE_NAMESPACE`` Type of a :c:type:`struct landlock_namespace_attr ` . h](j-)}(h``LANDLOCK_RULE_NAMESPACE``h]j)}(hj6;h]hLANDLOCK_RULE_NAMESPACE}(hj8;hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj4;ubah}(h]h ]h"]h$]h&]uh1j,he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhKhj0;ubj=)}(hhh]j()}(hNType of a :c:type:`struct landlock_namespace_attr ` .h](h Type of a }(hjO;hhhNhNubh)}(hB:c:type:`struct landlock_namespace_attr `h]j)}(hjY;h]hstruct landlock_namespace_attr}(hj[;hhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jhjW;ubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnj%j'jlandlock_namespace_attruh1hhjK;hKhjO;ubh .}(hjO;hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hjK;hKhjL;ubah}(h]h ]h"]h$]h&]uh1j<hj0;ubeh}(h]h ]h"]h$]h&]uh1j&hjK;hKhjs:ubj')}(hm``LANDLOCK_RULE_CAPABILITY`` Type of a :c:type:`struct landlock_capability_attr ` .h](j-)}(h``LANDLOCK_RULE_CAPABILITY``h]j)}(hj;h]hLANDLOCK_RULE_CAPABILITY}(hj;hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj;ubah}(h]h ]h"]h$]h&]uh1j,he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhKhj;ubj=)}(hhh]j()}(hPType of a :c:type:`struct landlock_capability_attr ` .h](h Type of a }(hj;hhhNhNubh)}(hD:c:type:`struct landlock_capability_attr `h]j)}(hj;h]hstruct landlock_capability_attr}(hj;hhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jhj;ubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnj%j'jlandlock_capability_attruh1hhj;hKhj;ubh .}(hj;hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hj;hKhj;ubah}(h]h ]h"]h$]h&]uh1j<hj;ubeh}(h]h ]h"]h$]h&]uh1j&hj;hKhjs:ubeh}(h]h ]h"]h$]h&]uh1j!hjW:ubeh}(h]h ] kernelindentah"]h$]h&]uh1jl'hj 0hhhj9hNubj()}(h**Description**h]j|)}(hj;h]h Description}(hj;hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hj;ubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhKhj 0hhubj()}(h$Argument of sys_landlock_add_rule().h]h$Argument of sys_landlock_add_rule().}(hj <hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhKhj 0hhubj0%)}(hhh]h}(h]h ]h"]h$]h&]entries](j<%%landlock_path_beneath_attr (C struct)c.landlock_path_beneath_attrhNtauh1j/%hj 0hhhj9hNubjA%)}(hhh](jF%)}(hlandlock_path_beneath_attrh]jL%)}(h!struct landlock_path_beneath_attrh](j%)}(hj%h]hstruct}(hj5<hhhNhNubah}(h]h ]j%ah"]h$]h&]uh1j%hj1<hhhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhKubjd%)}(h h]h }(hjC<hhhNhNubah}(h]h ]jp%ah"]h$]h&]uh1jc%hj1<hhhjB<hKubju%)}(hlandlock_path_beneath_attrh]j{%)}(hj/<h]hlandlock_path_beneath_attr}(hjU<hhhNhNubah}(h]h ]j%ah"]h$]h&]uh1jz%hjQ<ubah}(h]h ](j%j%eh"]h$]h&]hhuh1jt%hj1<hhhjB<hKubeh}(h]h ]h"]h$]h&]hhj7'uh1jK%j8'j9'hj-<hhhjB<hKubah}(h]j(<ah ](j='j>'eh"]h$]h&]jB'jC')jD'huh1jE%hjB<hKhj*<hhubjF')}(hhh]j()}(hPath hierarchy definitionh]hPath hierarchy definition}(hjw<hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhKhjt<hhubah}(h]h ]h"]h$]h&]uh1jE'hj*<hhhjB<hKubeh}(h]h ](jstructeh"]h$]h&]jf'jjg'j<jh'j<ji'jj'jk'uh1j@%hhhj 0hj9hNubjm')}(hXv**Definition**:: struct landlock_path_beneath_attr { __u64 allowed_access; __s32 parent_fd; }; **Members** ``allowed_access`` Bitmask of allowed actions for this file hierarchy (cf. `Filesystem flags`_). ``parent_fd`` File descriptor, preferably opened with ``O_PATH``, which identifies the parent directory of a file hierarchy, or just a file.h](j()}(h**Definition**::h](j|)}(h**Definition**h]h Definition}(hj<hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hj<ubh:}(hj<hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhKhj<ubj)}(hUstruct landlock_path_beneath_attr { __u64 allowed_access; __s32 parent_fd; };h]hUstruct landlock_path_beneath_attr { __u64 allowed_access; __s32 parent_fd; };}hj<sbah}(h]h ]h"]h$]h&]hhuh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhKhj<ubj()}(h **Members**h]j|)}(hj<h]hMembers}(hj<hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hj<ubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhMhj<ubj")}(hhh](j')}(ha``allowed_access`` Bitmask of allowed actions for this file hierarchy (cf. `Filesystem flags`_). h](j-)}(h``allowed_access``h]j)}(hj<h]hallowed_access}(hj<hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj<ubah}(h]h ]h"]h$]h&]uh1j,he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhMhj<ubj=)}(hhh]j()}(hMBitmask of allowed actions for this file hierarchy (cf. `Filesystem flags`_).h](h8Bitmask of allowed actions for this file hierarchy (cf. }(hj<hhhNhNubj5)}(h`Filesystem flags`_h]hFilesystem flags}(hj=hhhNhNubah}(h]h ]h"]h$]h&]nameFilesystem flagsjFj9!uh1j4hj<jHKubh).}(hj<hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhMhj<ubah}(h]h ]h"]h$]h&]uh1j<hj<ubeh}(h]h ]h"]h$]h&]uh1j&hj<hMhj<ubj')}(h``parent_fd`` File descriptor, preferably opened with ``O_PATH``, which identifies the parent directory of a file hierarchy, or just a file.h](j-)}(h ``parent_fd``h]j)}(hj2=h]h parent_fd}(hj4=hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj0=ubah}(h]h ]h"]h$]h&]uh1j,he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhMhj,=ubj=)}(hhh]j()}(h~File descriptor, preferably opened with ``O_PATH``, which identifies the parent directory of a file hierarchy, or just a file.h](h(File descriptor, preferably opened with }(hjK=hhhNhNubj)}(h ``O_PATH``h]hO_PATH}(hjS=hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjK=ubhL, which identifies the parent directory of a file hierarchy, or just a file.}(hjK=hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhMhjH=ubah}(h]h ]h"]h$]h&]uh1j<hj,=ubeh}(h]h ]h"]h$]h&]uh1j&hjG=hMhj<ubeh}(h]h ]h"]h$]h&]uh1j!hj<ubeh}(h]h ] kernelindentah"]h$]h&]uh1jl'hj 0hhhj9hNubj()}(h**Description**h]j|)}(hj=h]h Description}(hj=hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hj=ubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhM hj 0hhubj()}(h$Argument of sys_landlock_add_rule().h]h$Argument of sys_landlock_add_rule().}(hj=hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhKhj 0hhubj0%)}(hhh]h}(h]h ]h"]h$]h&]entries](j<%!landlock_net_port_attr (C struct)c.landlock_net_port_attrhNtauh1j/%hj 0hhhj9hNubjA%)}(hhh](jF%)}(hlandlock_net_port_attrh]jL%)}(hstruct landlock_net_port_attrh](j%)}(hj%h]hstruct}(hj=hhhNhNubah}(h]h ]j%ah"]h$]h&]uh1j%hj=hhhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhKubjd%)}(h h]h }(hj=hhhNhNubah}(h]h ]jp%ah"]h$]h&]uh1jc%hj=hhhj=hKubju%)}(hlandlock_net_port_attrh]j{%)}(hj=h]hlandlock_net_port_attr}(hj=hhhNhNubah}(h]h ]j%ah"]h$]h&]uh1jz%hj=ubah}(h]h ](j%j%eh"]h$]h&]hhuh1jt%hj=hhhj=hKubeh}(h]h ]h"]h$]h&]hhj7'uh1jK%j8'j9'hj=hhhj=hKubah}(h]j=ah ](j='j>'eh"]h$]h&]jB'jC')jD'huh1jE%hj=hKhj=hhubjF')}(hhh]j()}(hNetwork port definitionh]hNetwork port definition}(hj>hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhMhj>hhubah}(h]h ]h"]h$]h&]uh1jE'hj=hhhj=hKubeh}(h]h ](jstructeh"]h$]h&]jf'jjg'j>jh'j>ji'jj'jk'uh1j@%hhhj 0hj9hNubjm')}(hXB**Definition**:: struct landlock_net_port_attr { __u64 allowed_access; __u64 port; }; **Members** ``allowed_access`` Bitmask of allowed network actions for a port (cf. `Network flags`_). ``port`` Network port in host endianness. It should be noted that port 0 passed to :manpage:`bind(2)` will bind to an available port from the ephemeral port range. This can be configured with the ``/proc/sys/net/ipv4/ip_local_port_range`` sysctl (also used for IPv6), and within that range, on a per-socket basis with ``setsockopt(IP_LOCAL_PORT_RANGE)``. A Landlock rule with port 0 and the ``LANDLOCK_ACCESS_NET_BIND_TCP`` or ``LANDLOCK_ACCESS_NET_BIND_UDP`` right means that requesting to bind on port 0 is allowed and it will automatically translate to binding on a kernel-assigned ephemeral port.h](j()}(h**Definition**::h](j|)}(h**Definition**h]h Definition}(hj+>hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hj'>ubh:}(hj'>hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhMhj#>ubj)}(hLstruct landlock_net_port_attr { __u64 allowed_access; __u64 port; };h]hLstruct landlock_net_port_attr { __u64 allowed_access; __u64 port; };}hjD>sbah}(h]h ]h"]h$]h&]hhuh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhMhj#>ubj()}(h **Members**h]j|)}(hjU>h]hMembers}(hjW>hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hjS>ubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhMhj#>ubj")}(hhh](j')}(hY``allowed_access`` Bitmask of allowed network actions for a port (cf. `Network flags`_). h](j-)}(h``allowed_access``h]j)}(hjt>h]hallowed_access}(hjv>hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjr>ubah}(h]h ]h"]h$]h&]uh1j,he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhMhjn>ubj=)}(hhh]j()}(hEBitmask of allowed network actions for a port (cf. `Network flags`_).h](h3Bitmask of allowed network actions for a port (cf. }(hj>hhhNhNubj5)}(h`Network flags`_h]h Network flags}(hj>hhhNhNubah}(h]h ]h"]h$]h&]name Network flagsjFjI#uh1j4hj>jHKubh).}(hj>hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhMhj>ubah}(h]h ]h"]h$]h&]uh1j<hjn>ubeh}(h]h ]h"]h$]h&]uh1j&hj>hMhjk>ubj')}(hX[``port`` Network port in host endianness. It should be noted that port 0 passed to :manpage:`bind(2)` will bind to an available port from the ephemeral port range. This can be configured with the ``/proc/sys/net/ipv4/ip_local_port_range`` sysctl (also used for IPv6), and within that range, on a per-socket basis with ``setsockopt(IP_LOCAL_PORT_RANGE)``. A Landlock rule with port 0 and the ``LANDLOCK_ACCESS_NET_BIND_TCP`` or ``LANDLOCK_ACCESS_NET_BIND_UDP`` right means that requesting to bind on port 0 is allowed and it will automatically translate to binding on a kernel-assigned ephemeral port.h](j-)}(h``port``h]j)}(hj>h]hport}(hj>hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj>ubah}(h]h ]h"]h$]h&]uh1j,he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhM&hj>ubj=)}(hhh](j()}(h Network port in host endianness.h]h Network port in host endianness.}(hj>hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhMhj>ubj()}(hX9It should be noted that port 0 passed to :manpage:`bind(2)` will bind to an available port from the ephemeral port range. This can be configured with the ``/proc/sys/net/ipv4/ip_local_port_range`` sysctl (also used for IPv6), and within that range, on a per-socket basis with ``setsockopt(IP_LOCAL_PORT_RANGE)``.h](h)It should be noted that port 0 passed to }(hj>hhhNhNubj)}(h:manpage:`bind(2)`h]hbind(2)}(hj>hhhNhNubah}(h]h ]jah"]h$]h&]hhjbind(2)jbindjjuh1jhj>ubh` will bind to an available port from the ephemeral port range. This can be configured with the }(hj>hhhNhNubj)}(h*``/proc/sys/net/ipv4/ip_local_port_range``h]h&/proc/sys/net/ipv4/ip_local_port_range}(hj?hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj>ubhP sysctl (also used for IPv6), and within that range, on a per-socket basis with }(hj>hhhNhNubj)}(h#``setsockopt(IP_LOCAL_PORT_RANGE)``h]hsetsockopt(IP_LOCAL_PORT_RANGE)}(hj?hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj>ubh.}(hj>hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhMhj>ubj()}(hA Landlock rule with port 0 and the ``LANDLOCK_ACCESS_NET_BIND_TCP`` or ``LANDLOCK_ACCESS_NET_BIND_UDP`` right means that requesting to bind on port 0 is allowed and it will automatically translate to binding on a kernel-assigned ephemeral port.h](h$A Landlock rule with port 0 and the }(hj1?hhhNhNubj)}(h ``LANDLOCK_ACCESS_NET_BIND_TCP``h]hLANDLOCK_ACCESS_NET_BIND_TCP}(hj9?hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj1?ubh or }(hj1?hhhNhNubj)}(h ``LANDLOCK_ACCESS_NET_BIND_UDP``h]hLANDLOCK_ACCESS_NET_BIND_UDP}(hjK?hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj1?ubh right means that requesting to bind on port 0 is allowed and it will automatically translate to binding on a kernel-assigned ephemeral port.}(hj1?hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhM$hj>ubeh}(h]h ]h"]h$]h&]uh1j<hj>ubeh}(h]h ]h"]h$]h&]uh1j&hj>hM&hjk>ubeh}(h]h ]h"]h$]h&]uh1j!hj#>ubeh}(h]h ] kernelindentah"]h$]h&]uh1jl'hj 0hhhj9hNubj()}(h**Description**h]j|)}(hj?h]h Description}(hj?hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hj}?ubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhM*hj 0hhubj()}(h$Argument of sys_landlock_add_rule().h]h$Argument of sys_landlock_add_rule().}(hj?hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhMhj 0hhubj0%)}(hhh]h}(h]h ]h"]h$]h&]entries](j<%"landlock_namespace_attr (C struct)c.landlock_namespace_attrhNtauh1j/%hj 0hhhj9hNubjA%)}(hhh](jF%)}(hlandlock_namespace_attrh]jL%)}(hstruct landlock_namespace_attrh](j%)}(hj%h]hstruct}(hj?hhhNhNubah}(h]h ]j%ah"]h$]h&]uh1j%hj?hhhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhMubjd%)}(h h]h }(hj?hhhNhNubah}(h]h ]jp%ah"]h$]h&]uh1jc%hj?hhhj?hMubju%)}(hlandlock_namespace_attrh]j{%)}(hj?h]hlandlock_namespace_attr}(hj?hhhNhNubah}(h]h ]j%ah"]h$]h&]uh1jz%hj?ubah}(h]h ](j%j%eh"]h$]h&]hhuh1jt%hj?hhhj?hMubeh}(h]h ]h"]h$]h&]hhj7'uh1jK%j8'j9'hj?hhhj?hMubah}(h]j?ah ](j='j>'eh"]h$]h&]jB'jC')jD'huh1jE%hj?hMhj?hhubjF')}(hhh]j()}(hNamespace type definitionh]hNamespace type definition}(hj?hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhM,hj?hhubah}(h]h ]h"]h$]h&]uh1jE'hj?hhhj?hMubeh}(h]h ](jstructeh"]h$]h&]jf'jjg'j@jh'j@ji'jj'jk'uh1j@%hhhj 0hj9hNubjm')}(hX**Definition**:: struct landlock_namespace_attr { __u64 permissions; __u64 allowed_namespace_types; __u64 quiet_namespace_types; }; **Members** ``permissions`` Must be set to ``LANDLOCK_PERMISSION_NAMESPACE_USE``. ``allowed_namespace_types`` Bitmask of namespace types (``CLONE_NEW*`` flags) to allow under this rule. Unknown bits are silently ignored for forward compatibility. ``quiet_namespace_types`` Bitmask of namespace types (``CLONE_NEW*`` flags) whose denial by this layer should not be submitted to audit, even when landlock_restrict_self() enables audit logging. Only audit records attributed to this layer are suppressed; denial tracepoints still fire (see `Permission flags`_). Bits also set in **allowed_namespace_types** have no effect, since an allowed type is never denied. Unknown bits are silently ignored. At least one of **allowed_namespace_types** or **quiet_namespace_types** must be non-zero, otherwise the call returns ``-ENOMSG``. The non-zero check runs on the raw input before unknown-bit masking, so a rule that sets only bits unknown to the running kernel succeeds but has no runtime effect. Programs should omit this rule when they neither allow nor quiet a namespace type.h](j()}(h**Definition**::h](j|)}(h**Definition**h]h Definition}(hj#@hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hj@ubh:}(hj@hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhM0hj@ubj)}(h~struct landlock_namespace_attr { __u64 permissions; __u64 allowed_namespace_types; __u64 quiet_namespace_types; };h]h~struct landlock_namespace_attr { __u64 permissions; __u64 allowed_namespace_types; __u64 quiet_namespace_types; };}hj<@sbah}(h]h ]h"]h$]h&]hhuh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhM2hj@ubj()}(h **Members**h]j|)}(hjM@h]hMembers}(hjO@hhhNhNubah}(h]h ]h"]h$]h&]uh1j{hjK@ubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhM8hj@ubj")}(hhh](j')}(hF``permissions`` Must be set to ``LANDLOCK_PERMISSION_NAMESPACE_USE``. h](j-)}(h``permissions``h]j)}(hjl@h]h permissions}(hjn@hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjj@ubah}(h]h ]h"]h$]h&]uh1j,he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhM3hjf@ubj=)}(hhh]j()}(h5Must be set to ``LANDLOCK_PERMISSION_NAMESPACE_USE``.h](hMust be set to }(hj@hhhNhNubj)}(h%``LANDLOCK_PERMISSION_NAMESPACE_USE``h]h!LANDLOCK_PERMISSION_NAMESPACE_USE}(hj@hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj@ubh.}(hj@hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hj@hM3hj@ubah}(h]h ]h"]h$]h&]uh1j<hjf@ubeh}(h]h ]h"]h$]h&]uh1j&hj@hM3hjc@ubj')}(h``allowed_namespace_types`` Bitmask of namespace types (``CLONE_NEW*`` flags) to allow under this rule. Unknown bits are silently ignored for forward compatibility. h](j-)}(h``allowed_namespace_types``h]j)}(hj@h]hallowed_namespace_types}(hj@hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj@ubah}(h]h ]h"]h$]h&]uh1j,he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhM9hj@ubj=)}(hhh]j()}(hBitmask of namespace types (``CLONE_NEW*`` flags) to allow under this rule. Unknown bits are silently ignored for forward compatibility.h](hBitmask of namespace types (}(hj@hhhNhNubj)}(h``CLONE_NEW*``h]h CLONE_NEW*}(hj@hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj@ubh_ flags) to allow under this rule. Unknown bits are silently ignored for forward compatibility.}(hj@hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhM7hj@ubah}(h]h ]h"]h$]h&]uh1j<hj@ubeh}(h]h ]h"]h$]h&]uh1j&hj@hM9hjc@ubj')}(hX?``quiet_namespace_types`` Bitmask of namespace types (``CLONE_NEW*`` flags) whose denial by this layer should not be submitted to audit, even when landlock_restrict_self() enables audit logging. Only audit records attributed to this layer are suppressed; denial tracepoints still fire (see `Permission flags`_). Bits also set in **allowed_namespace_types** have no effect, since an allowed type is never denied. Unknown bits are silently ignored. At least one of **allowed_namespace_types** or **quiet_namespace_types** must be non-zero, otherwise the call returns ``-ENOMSG``. The non-zero check runs on the raw input before unknown-bit masking, so a rule that sets only bits unknown to the running kernel succeeds but has no runtime effect. Programs should omit this rule when they neither allow nor quiet a namespace type.h](j-)}(h``quiet_namespace_types``h]j)}(hjAh]hquiet_namespace_types}(hjAhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjAubah}(h]h ]h"]h$]h&]uh1j,he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhMIhj@ubj=)}(hhh](j()}(hXBitmask of namespace types (``CLONE_NEW*`` flags) whose denial by this layer should not be submitted to audit, even when landlock_restrict_self() enables audit logging. Only audit records attributed to this layer are suppressed; denial tracepoints still fire (see `Permission flags`_). Bits also set in **allowed_namespace_types** have no effect, since an allowed type is never denied. Unknown bits are silently ignored.h](hBitmask of namespace types (}(hjAhhhNhNubj)}(h``CLONE_NEW*``h]h CLONE_NEW*}(hj$AhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjAubh flags) whose denial by this layer should not be submitted to audit, even when landlock_restrict_self() enables audit logging. Only audit records attributed to this layer are suppressed; denial tracepoints still fire (see }(hjAhhhNhNubj5)}(h`Permission flags`_h]hPermission flags}(hj6AhhhNhNubah}(h]h ]h"]h$]h&]namePermission flagsjFj%uh1j4hjAjHKubh). Bits also set in }(hjAhhhNhNubj|)}(h**allowed_namespace_types**h]hallowed_namespace_types}(hjJAhhhNhNubah}(h]h ]h"]h$]h&]uh1j{hjAubh[ have no effect, since an allowed type is never denied. Unknown bits are silently ignored.}(hjAhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhM=hjAubj()}(hX|At least one of **allowed_namespace_types** or **quiet_namespace_types** must be non-zero, otherwise the call returns ``-ENOMSG``. The non-zero check runs on the raw input before unknown-bit masking, so a rule that sets only bits unknown to the running kernel succeeds but has no runtime effect. Programs should omit this rule when they neither allow nor quiet a namespace type.h](hAt least one of }(hjcAhhhNhNubj|)}(h**allowed_namespace_types**h]hallowed_namespace_types}(hjkAhhhNhNubah}(h]h ]h"]h$]h&]uh1j{hjcAubh or }(hjcAhhhNhNubj|)}(h**quiet_namespace_types**h]hquiet_namespace_types}(hj}AhhhNhNubah}(h]h ]h"]h$]h&]uh1j{hjcAubh. must be non-zero, otherwise the call returns }(hjcAhhhNhNubj)}(h ``-ENOMSG``h]h-ENOMSG}(hjAhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjcAubh. The non-zero check runs on the raw input before unknown-bit masking, so a rule that sets only bits unknown to the running kernel succeeds but has no runtime effect. Programs should omit this rule when they neither allow nor quiet a namespace type.}(hjcAhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhMEhjAubeh}(h]h ]h"]h$]h&]uh1j<hj@ubeh}(h]h ]h"]h$]h&]uh1j&hjAhMIhjc@ubeh}(h]h ]h"]h$]h&]uh1j!hj@ubeh}(h]h ] kernelindentah"]h$]h&]uh1jl'hj 0hhhj9hNubj()}(h**Description**h]j|)}(hjAh]h Description}(hjAhhhNhNubah}(h]h ]h"]h$]h&]uh1j{hjAubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhMMhj 0hhubj()}(hEArgument of sys_landlock_add_rule() with ``LANDLOCK_RULE_NAMESPACE``.h](h)Argument of sys_landlock_add_rule() with }(hjAhhhNhNubj)}(h``LANDLOCK_RULE_NAMESPACE``h]hLANDLOCK_RULE_NAMESPACE}(hjAhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjAubh.}(hjAhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhM-hj 0hhubj0%)}(hhh]h}(h]h ]h"]h$]h&]entries](j<%#landlock_capability_attr (C struct)c.landlock_capability_attrhNtauh1j/%hj 0hhhj9hNubjA%)}(hhh](jF%)}(hlandlock_capability_attrh]jL%)}(hstruct landlock_capability_attrh](j%)}(hj%h]hstruct}(hjBhhhNhNubah}(h]h ]j%ah"]h$]h&]uh1j%hjBhhhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhM2ubjd%)}(h h]h }(hj!BhhhNhNubah}(h]h ]jp%ah"]h$]h&]uh1jc%hjBhhhj BhM2ubju%)}(hlandlock_capability_attrh]j{%)}(hj Bh]hlandlock_capability_attr}(hj3BhhhNhNubah}(h]h ]j%ah"]h$]h&]uh1jz%hj/Bubah}(h]h ](j%j%eh"]h$]h&]hhuh1jt%hjBhhhj BhM2ubeh}(h]h ]h"]h$]h&]hhj7'uh1jK%j8'j9'hj Bhhhj BhM2ubah}(h]jBah ](j='j>'eh"]h$]h&]jB'jC')jD'huh1jE%hj BhM2hjBhhubjF')}(hhh]j()}(hCapability definitionh]hCapability definition}(hjUBhhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhMOhjRBhhubah}(h]h ]h"]h$]h&]uh1jE'hjBhhhj BhM2ubeh}(h]h ](jstructeh"]h$]h&]jf'jjg'jmBjh'jmBji'jj'jk'uh1j@%hhhj 0hj9hNubjm')}(hX.**Definition**:: struct landlock_capability_attr { __u64 permissions; __u64 allowed_capabilities; __u64 quiet_capabilities; }; **Members** ``permissions`` Must be set to ``LANDLOCK_PERMISSION_CAPABILITY_USE``. ``allowed_capabilities`` Bitmask of capabilities (``1ULL << CAP_*``) to allow under this rule. Bits above ``CAP_LAST_CAP`` are silently ignored for forward compatibility. ``quiet_capabilities`` Bitmask of capabilities (``1ULL << CAP_*``) whose denial by this layer should not be submitted to audit, even if audit logging would normally take place per landlock_restrict_self() flags. Only audit records attributed to this layer are suppressed; denial tracepoints still fire (see `Permission flags`_). Bits also set in **allowed_capabilities** have no effect, since an allowed capability is never denied. Bits above ``CAP_LAST_CAP`` are silently ignored. At least one of **allowed_capabilities** or **quiet_capabilities** must be non-zero, otherwise the call returns ``-ENOMSG``. The non-zero check runs on the raw input before unknown-bit masking, so a rule that sets only bits unknown to the running kernel (above ``CAP_LAST_CAP``) succeeds but has no runtime effect. Programs should omit this rule when they neither allow nor quiet a capability.h](j()}(h**Definition**::h](j|)}(h**Definition**h]h Definition}(hjyBhhhNhNubah}(h]h ]h"]h$]h&]uh1j{hjuBubh:}(hjuBhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhMShjqBubj)}(hystruct landlock_capability_attr { __u64 permissions; __u64 allowed_capabilities; __u64 quiet_capabilities; };h]hystruct landlock_capability_attr { __u64 permissions; __u64 allowed_capabilities; __u64 quiet_capabilities; };}hjBsbah}(h]h ]h"]h$]h&]hhuh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhMUhjqBubj()}(h **Members**h]j|)}(hjBh]hMembers}(hjBhhhNhNubah}(h]h ]h"]h$]h&]uh1j{hjBubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhM[hjqBubj")}(hhh](j')}(hG``permissions`` Must be set to ``LANDLOCK_PERMISSION_CAPABILITY_USE``. h](j-)}(h``permissions``h]j)}(hjBh]h permissions}(hjBhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjBubah}(h]h ]h"]h$]h&]uh1j,he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhMVhjBubj=)}(hhh]j()}(h6Must be set to ``LANDLOCK_PERMISSION_CAPABILITY_USE``.h](hMust be set to }(hjBhhhNhNubj)}(h&``LANDLOCK_PERMISSION_CAPABILITY_USE``h]h"LANDLOCK_PERMISSION_CAPABILITY_USE}(hjBhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjBubh.}(hjBhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hjBhMVhjBubah}(h]h ]h"]h$]h&]uh1j<hjBubeh}(h]h ]h"]h$]h&]uh1j&hjBhMVhjBubj')}(h``allowed_capabilities`` Bitmask of capabilities (``1ULL << CAP_*``) to allow under this rule. Bits above ``CAP_LAST_CAP`` are silently ignored for forward compatibility. h](j-)}(h``allowed_capabilities``h]j)}(hj Ch]hallowed_capabilities}(hjChhhNhNubah}(h]h ]h"]h$]h&]uh1jhj Cubah}(h]h ]h"]h$]h&]uh1j,he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhM\hjCubj=)}(hhh]j()}(hBitmask of capabilities (``1ULL << CAP_*``) to allow under this rule. Bits above ``CAP_LAST_CAP`` are silently ignored for forward compatibility.h](hBitmask of capabilities (}(hj&ChhhNhNubj)}(h``1ULL << CAP_*``h]h 1ULL << CAP_*}(hj.ChhhNhNubah}(h]h ]h"]h$]h&]uh1jhj&Cubh() to allow under this rule. Bits above }(hj&ChhhNhNubj)}(h``CAP_LAST_CAP``h]h CAP_LAST_CAP}(hj@ChhhNhNubah}(h]h ]h"]h$]h&]uh1jhj&Cubh0 are silently ignored for forward compatibility.}(hj&ChhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhMZhj#Cubah}(h]h ]h"]h$]h&]uh1j<hjCubeh}(h]h ]h"]h$]h&]uh1j&hj"ChM\hjBubj')}(hXq``quiet_capabilities`` Bitmask of capabilities (``1ULL << CAP_*``) whose denial by this layer should not be submitted to audit, even if audit logging would normally take place per landlock_restrict_self() flags. Only audit records attributed to this layer are suppressed; denial tracepoints still fire (see `Permission flags`_). Bits also set in **allowed_capabilities** have no effect, since an allowed capability is never denied. Bits above ``CAP_LAST_CAP`` are silently ignored. At least one of **allowed_capabilities** or **quiet_capabilities** must be non-zero, otherwise the call returns ``-ENOMSG``. The non-zero check runs on the raw input before unknown-bit masking, so a rule that sets only bits unknown to the running kernel (above ``CAP_LAST_CAP``) succeeds but has no runtime effect. Programs should omit this rule when they neither allow nor quiet a capability.h](j-)}(h``quiet_capabilities``h]j)}(hjkCh]hquiet_capabilities}(hjmChhhNhNubah}(h]h ]h"]h$]h&]uh1jhjiCubah}(h]h ]h"]h$]h&]uh1j,he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhMmhjeCubj=)}(hhh](j()}(hXBitmask of capabilities (``1ULL << CAP_*``) whose denial by this layer should not be submitted to audit, even if audit logging would normally take place per landlock_restrict_self() flags. Only audit records attributed to this layer are suppressed; denial tracepoints still fire (see `Permission flags`_). Bits also set in **allowed_capabilities** have no effect, since an allowed capability is never denied. Bits above ``CAP_LAST_CAP`` are silently ignored.h](hBitmask of capabilities (}(hjChhhNhNubj)}(h``1ULL << CAP_*``h]h 1ULL << CAP_*}(hjChhhNhNubah}(h]h ]h"]h$]h&]uh1jhjCubh) whose denial by this layer should not be submitted to audit, even if audit logging would normally take place per landlock_restrict_self() flags. Only audit records attributed to this layer are suppressed; denial tracepoints still fire (see }(hjChhhNhNubj5)}(h`Permission flags`_h]hPermission flags}(hjChhhNhNubah}(h]h ]h"]h$]h&]namePermission flagsjFj%uh1j4hjCjHKubh). Bits also set in }(hjChhhNhNubj|)}(h**allowed_capabilities**h]hallowed_capabilities}(hjChhhNhNubah}(h]h ]h"]h$]h&]uh1j{hjCubhJ have no effect, since an allowed capability is never denied. Bits above }(hjChhhNhNubj)}(h``CAP_LAST_CAP``h]h CAP_LAST_CAP}(hjChhhNhNubah}(h]h ]h"]h$]h&]uh1jhjCubh are silently ignored.}(hjChhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhM`hjCubj()}(hXAt least one of **allowed_capabilities** or **quiet_capabilities** must be non-zero, otherwise the call returns ``-ENOMSG``. The non-zero check runs on the raw input before unknown-bit masking, so a rule that sets only bits unknown to the running kernel (above ``CAP_LAST_CAP``) succeeds but has no runtime effect. Programs should omit this rule when they neither allow nor quiet a capability.h](hAt least one of }(hjChhhNhNubj|)}(h**allowed_capabilities**h]hallowed_capabilities}(hjChhhNhNubah}(h]h ]h"]h$]h&]uh1j{hjCubh or }(hjChhhNhNubj|)}(h**quiet_capabilities**h]hquiet_capabilities}(hjChhhNhNubah}(h]h ]h"]h$]h&]uh1j{hjCubh. must be non-zero, otherwise the call returns }(hjChhhNhNubj)}(h ``-ENOMSG``h]h-ENOMSG}(hj DhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjCubh. The non-zero check runs on the raw input before unknown-bit masking, so a rule that sets only bits unknown to the running kernel (above }(hjChhhNhNubj)}(h``CAP_LAST_CAP``h]h CAP_LAST_CAP}(hjDhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjCubhu) succeeds but has no runtime effect. Programs should omit this rule when they neither allow nor quiet a capability.}(hjChhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhMihjCubeh}(h]h ]h"]h$]h&]uh1j<hjeCubeh}(h]h ]h"]h$]h&]uh1j&hjChMmhjBubeh}(h]h ]h"]h$]h&]uh1j!hjqBubeh}(h]h ] kernelindentah"]h$]h&]uh1jl'hj 0hhhj9hNubj()}(h**Description**h]j|)}(hjODh]h Description}(hjQDhhhNhNubah}(h]h ]h"]h$]h&]uh1j{hjMDubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhMqhj 0hhubj()}(hFArgument of sys_landlock_add_rule() with ``LANDLOCK_RULE_CAPABILITY``.h](h)Argument of sys_landlock_add_rule() with }(hjeDhhhNhNubj)}(h``LANDLOCK_RULE_CAPABILITY``h]hLANDLOCK_RULE_CAPABILITY}(hjmDhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjeDubh.}(hjeDhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:829: ./include/uapi/linux/landlock.hhMPhj 0hhubeh}(h]extending-a-rulesetah ]h"]extending a rulesetah$]h&]uh1hhjihhhhhM8ubh)}(hhh](h)}(hEnforcing a ruleseth]hEnforcing a ruleset}(hjDhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjDhhhhhMCubj0%)}(hhh]h}(h]h ]h"]h$]h&]entries](j<%'sys_landlock_restrict_self (C function)c.sys_landlock_restrict_selfhNtauh1j/%hjDhhhNhNubjA%)}(hhh](jF%)}(hIlong sys_landlock_restrict_self (const int ruleset_fd, const __u32 flags)h]jL%)}(hHlong sys_landlock_restrict_self(const int ruleset_fd, const __u32 flags)h](jR%)}(hlongh]hlong}(hjDhhhNhNubah}(h]h ]j^%ah"]h$]h&]uh1jQ%hjDhhhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:837: ./security/landlock/syscalls.chMubjd%)}(h h]h }(hjDhhhNhNubah}(h]h ]jp%ah"]h$]h&]uh1jc%hjDhhhjDhMubju%)}(hsys_landlock_restrict_selfh]j{%)}(hsys_landlock_restrict_selfh]hsys_landlock_restrict_self}(hjDhhhNhNubah}(h]h ]j%ah"]h$]h&]uh1jz%hjDubah}(h]h ](j%j%eh"]h$]h&]hhuh1jt%hjDhhhjDhMubj%)}(h)(const int ruleset_fd, const __u32 flags)h](j%)}(hconst int ruleset_fdh](j%)}(hj%h]hconst}(hjDhhhNhNubah}(h]h ]j%ah"]h$]h&]uh1j%hjDubjd%)}(h h]h }(hjEhhhNhNubah}(h]h ]jp%ah"]h$]h&]uh1jc%hjDubjR%)}(hinth]hint}(hjEhhhNhNubah}(h]h ]j^%ah"]h$]h&]uh1jQ%hjDubjd%)}(h h]h }(hjEhhhNhNubah}(h]h ]jp%ah"]h$]h&]uh1jc%hjDubj{%)}(h ruleset_fdh]h ruleset_fd}(hj,EhhhNhNubah}(h]h ]j%ah"]h$]h&]uh1jz%hjDubeh}(h]h ]h"]h$]h&]noemphhhuh1j%hjDubj%)}(hconst __u32 flagsh](j%)}(hj%h]hconst}(hjEEhhhNhNubah}(h]h ]j%ah"]h$]h&]uh1j%hjAEubjd%)}(h h]h }(hjREhhhNhNubah}(h]h ]jp%ah"]h$]h&]uh1jc%hjAEubh)}(hhh]j{%)}(h__u32h]h__u32}(hjcEhhhNhNubah}(h]h ]j%ah"]h$]h&]uh1jz%hj`Eubah}(h]h ]h"]h$]h&] refdomainjreftypej% reftargetjeEmodnameN classnameNj%j%)}j%]j&)}j%jDsbc.sys_landlock_restrict_selfasbuh1hhjAEubjd%)}(h h]h }(hjEhhhNhNubah}(h]h ]jp%ah"]h$]h&]uh1jc%hjAEubj{%)}(hflagsh]hflags}(hjEhhhNhNubah}(h]h ]j%ah"]h$]h&]uh1jz%hjAEubeh}(h]h ]h"]h$]h&]noemphhhuh1j%hjDubeh}(h]h ]h"]h$]h&]hhuh1j%hjDhhhjDhMubeh}(h]h ]h"]h$]h&]hhj7'uh1jK%j8'j9'hjDhhhjDhMubah}(h]jDah ](j='j>'eh"]h$]h&]jB'jC')jD'huh1jE%hjDhMhjDhhubjF')}(hhh]j()}(h'Enforce a ruleset on the calling threadh]h'Enforce a ruleset on the calling thread}(hjEhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:837: ./security/landlock/syscalls.chMhjEhhubah}(h]h ]h"]h$]h&]uh1jE'hjDhhhjDhMubeh}(h]h ](jfunctioneh"]h$]h&]jf'jjg'jEjh'jEji'jj'jk'uh1j@%hhhjDhNhNubjm')}(hX**Parameters** ``const int ruleset_fd`` File descriptor tied to the ruleset to merge with the target. ``const __u32 flags`` Supported values: **Description** - ``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF`` - ``LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON`` - ``LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF`` - ``LANDLOCK_RESTRICT_SELF_TSYNC`` - ``LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS`` This system call enforces a Landlock ruleset on the current thread. Enforcing a ruleset requires that the task has ``CAP_SYS_ADMIN`` in its namespace or is running with no_new_privs. This avoids scenarios where unprivileged tasks can affect the behavior of privileged children. With ``LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS``, the no_new_privs attribute of the calling thread is set only once the enforcement of the ruleset succeeded, which fulfills the above requirement: no_new_privs is set if and only if the call succeeds. - ``EOPNOTSUPP``: Landlock is supported by the kernel but disabled at boot time; - ``EINVAL``: **flags** contains an unknown bit. - ``EBADF``: **ruleset_fd** is not a file descriptor for the current thread; - ``EBADFD``: **ruleset_fd** is not a ruleset file descriptor; - ``EPERM``: **ruleset_fd** has no read access to the underlying ruleset, or ``LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS`` is not set while the current thread is not running with no_new_privs and doesn't have ``CAP_SYS_ADMIN`` in its namespace. - ``E2BIG``: The maximum number of stacked rulesets is reached for the current thread. .. kernel-doc:: include/uapi/linux/landlock.h :identifiers: landlock_restrict_self_flags **Return** 0 on success, or -errno on failure. Possible returned errors are:h](j()}(h**Parameters**h]j|)}(hjEh]h Parameters}(hjEhhhNhNubah}(h]h ]h"]h$]h&]uh1j{hjEubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:837: ./security/landlock/syscalls.chMhjEubj")}(hhh](j')}(hW``const int ruleset_fd`` File descriptor tied to the ruleset to merge with the target. h](j-)}(h``const int ruleset_fd``h]j)}(hjEh]hconst int ruleset_fd}(hjEhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjEubah}(h]h ]h"]h$]h&]uh1j,hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:837: ./security/landlock/syscalls.chMhjEubj=)}(hhh]j()}(h=File descriptor tied to the ruleset to merge with the target.h]h=File descriptor tied to the ruleset to merge with the target.}(hjFhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hjFhMhjFubah}(h]h ]h"]h$]h&]uh1j<hjEubeh}(h]h ]h"]h$]h&]uh1j&hjFhMhjEubj')}(h(``const __u32 flags`` Supported values: h](j-)}(h``const __u32 flags``h]j)}(hj5Fh]hconst __u32 flags}(hj7FhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj3Fubah}(h]h ]h"]h$]h&]uh1j,hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:837: ./security/landlock/syscalls.chMhj/Fubj=)}(hhh]j()}(hSupported values:h]hSupported values:}(hjNFhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hjJFhMhjKFubah}(h]h ]h"]h$]h&]uh1j<hj/Fubeh}(h]h ]h"]h$]h&]uh1j&hjJFhMhjEubeh}(h]h ]h"]h$]h&]uh1j!hjEubj()}(h**Description**h]j|)}(hjpFh]h Description}(hjrFhhhNhNubah}(h]h ]h"]h$]h&]uh1j{hjnFubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:837: ./security/landlock/syscalls.chMhjEubj()}(h- ``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF`` - ``LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON`` - ``LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF`` - ``LANDLOCK_RESTRICT_SELF_TSYNC`` - ``LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS`` h]jb)}(hhh](jg)}(h,``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF``h]j()}(hjFh]j)}(hjFh]h(LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF}(hjFhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjFubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:837: ./security/landlock/syscalls.chMhjFubah}(h]h ]h"]h$]h&]uh1jfhjFubjg)}(h*``LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON``h]j()}(hjFh]j)}(hjFh]h&LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON}(hjFhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjFubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:837: ./security/landlock/syscalls.chMhjFubah}(h]h ]h"]h$]h&]uh1jfhjFubjg)}(h-``LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF``h]j()}(hjFh]j)}(hjFh]h)LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF}(hjFhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjFubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:837: ./security/landlock/syscalls.chMhjFubah}(h]h ]h"]h$]h&]uh1jfhjFubjg)}(h ``LANDLOCK_RESTRICT_SELF_TSYNC``h]j()}(hjFh]j)}(hjFh]hLANDLOCK_RESTRICT_SELF_TSYNC}(hjFhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjFubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:837: ./security/landlock/syscalls.chMhjFubah}(h]h ]h"]h$]h&]uh1jfhjFubjg)}(h(``LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS`` h]j()}(h'``LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS``h]j)}(hjGh]h#LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS}(hjGhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjGubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:837: ./security/landlock/syscalls.chMhjGubah}(h]h ]h"]h$]h&]uh1jfhjFubeh}(h]h ]h"]h$]h&]jjuh1jahjFhMhjFubah}(h]h ]h"]h$]h&]uh1j(hjFhMhjEubj()}(hXThis system call enforces a Landlock ruleset on the current thread. Enforcing a ruleset requires that the task has ``CAP_SYS_ADMIN`` in its namespace or is running with no_new_privs. This avoids scenarios where unprivileged tasks can affect the behavior of privileged children.h](hsThis system call enforces a Landlock ruleset on the current thread. Enforcing a ruleset requires that the task has }(hj?GhhhNhNubj)}(h``CAP_SYS_ADMIN``h]h CAP_SYS_ADMIN}(hjGGhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj?Gubh in its namespace or is running with no_new_privs. This avoids scenarios where unprivileged tasks can affect the behavior of privileged children.}(hj?GhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:837: ./security/landlock/syscalls.chMhjEubj()}(hWith ``LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS``, the no_new_privs attribute of the calling thread is set only once the enforcement of the ruleset succeeded, which fulfills the above requirement: no_new_privs is set if and only if the call succeeds.h](hWith }(hj`GhhhNhNubj)}(h'``LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS``h]h#LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS}(hjhGhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj`Gubh, the no_new_privs attribute of the calling thread is set only once the enforcement of the ruleset succeeded, which fulfills the above requirement: no_new_privs is set if and only if the call succeeds.}(hj`GhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:837: ./security/landlock/syscalls.chMhjEubjb)}(hhh](jg)}(hN``EOPNOTSUPP``: Landlock is supported by the kernel but disabled at boot time;h]j()}(hjGh](j)}(h``EOPNOTSUPP``h]h EOPNOTSUPP}(hjGhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjGubh@: Landlock is supported by the kernel but disabled at boot time;}(hjGhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:837: ./security/landlock/syscalls.chMhjGubah}(h]h ]h"]h$]h&]uh1jfhjGubjg)}(h.``EINVAL``: **flags** contains an unknown bit.h]j()}(hjGh](j)}(h ``EINVAL``h]hEINVAL}(hjGhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjGubh: }(hjGhhhNhNubj|)}(h **flags**h]hflags}(hjGhhhNhNubah}(h]h ]h"]h$]h&]uh1j{hjGubh contains an unknown bit.}(hjGhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:837: ./security/landlock/syscalls.chMhjGubah}(h]h ]h"]h$]h&]uh1jfhjGubjg)}(hJ``EBADF``: **ruleset_fd** is not a file descriptor for the current thread;h]j()}(hjGh](j)}(h ``EBADF``h]hEBADF}(hjGhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjGubh: }(hjGhhhNhNubj|)}(h**ruleset_fd**h]h ruleset_fd}(hjGhhhNhNubah}(h]h ]h"]h$]h&]uh1j{hjGubh1 is not a file descriptor for the current thread;}(hjGhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:837: ./security/landlock/syscalls.chMhjGubah}(h]h ]h"]h$]h&]uh1jfhjGubjg)}(h<``EBADFD``: **ruleset_fd** is not a ruleset file descriptor;h]j()}(hjHh](j)}(h ``EBADFD``h]hEBADFD}(hj!HhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjHubh: }(hjHhhhNhNubj|)}(h**ruleset_fd**h]h ruleset_fd}(hj3HhhhNhNubah}(h]h ]h"]h$]h&]uh1j{hjHubh" is not a ruleset file descriptor;}(hjHhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:837: ./security/landlock/syscalls.chMhjHubah}(h]h ]h"]h$]h&]uh1jfhjGubjg)}(h``EPERM``: **ruleset_fd** has no read access to the underlying ruleset, or ``LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS`` is not set while the current thread is not running with no_new_privs and doesn't have ``CAP_SYS_ADMIN`` in its namespace.h]j()}(h``EPERM``: **ruleset_fd** has no read access to the underlying ruleset, or ``LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS`` is not set while the current thread is not running with no_new_privs and doesn't have ``CAP_SYS_ADMIN`` in its namespace.h](j)}(h ``EPERM``h]hEPERM}(hjZHhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjVHubh: }(hjVHhhhNhNubj|)}(h**ruleset_fd**h]h ruleset_fd}(hjlHhhhNhNubah}(h]h ]h"]h$]h&]uh1j{hjVHubh2 has no read access to the underlying ruleset, or }(hjVHhhhNhNubj)}(h'``LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS``h]h#LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS}(hj~HhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjVHubhY is not set while the current thread is not running with no_new_privs and doesn’t have }(hjVHhhhNhNubj)}(h``CAP_SYS_ADMIN``h]h CAP_SYS_ADMIN}(hjHhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjVHubh in its namespace.}(hjVHhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:837: ./security/landlock/syscalls.chMhjRHubah}(h]h ]h"]h$]h&]uh1jfhjGubjg)}(hU``E2BIG``: The maximum number of stacked rulesets is reached for the current thread. h]j()}(hT``E2BIG``: The maximum number of stacked rulesets is reached for the current thread.h](j)}(h ``E2BIG``h]hE2BIG}(hjHhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjHubhK: The maximum number of stacked rulesets is reached for the current thread.}(hjHhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:837: ./security/landlock/syscalls.chMhjHubah}(h]h ]h"]h$]h&]uh1jfhjGubeh}(h]h ]h"]h$]h&]jjuh1jahjGhMhjEubj()}(h **Flags**h]j|)}(hjHh]hFlags}(hjHhhhNhNubah}(h]h ]h"]h$]h&]uh1j{hjHubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:45: ./include/uapi/linux/landlock.hhKhjEubj()}(hXBy default, denied accesses originating from programs that sandbox themselves are logged via the audit subsystem. Such events typically indicate unexpected behavior, such as bugs or exploitation attempts. However, to avoid excessive logging, access requests denied by a domain not created by the originating program are not logged by default. The rationale is that programs should know their own behavior, but not necessarily the behavior of other programs. This default configuration is suitable for most programs that sandbox themselves. For specific use cases, the following flags allow programs to modify this default logging behavior.h]hXBy default, denied accesses originating from programs that sandbox themselves are logged via the audit subsystem. Such events typically indicate unexpected behavior, such as bugs or exploitation attempts. However, to avoid excessive logging, access requests denied by a domain not created by the originating program are not logged by default. The rationale is that programs should know their own behavior, but not necessarily the behavior of other programs. This default configuration is suitable for most programs that sandbox themselves. For specific use cases, the following flags allow programs to modify this default logging behavior.}(hjHhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:45: ./include/uapi/linux/landlock.hhKhjEubj()}(hThe ``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF`` and ``LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON`` flags apply to the newly created Landlock domain.h](hThe }(hjIhhhNhNubj)}(h,``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF``h]h(LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF}(hj IhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjIubh and }(hjIhhhNhNubj)}(h*``LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON``h]h&LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON}(hjIhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjIubh2 flags apply to the newly created Landlock domain.}(hjIhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:45: ./include/uapi/linux/landlock.hhKhjEubj")}(hhh](j')}(hX``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF`` Disables logging of denied accesses originating from the thread creating the Landlock domain, as well as its children, as long as they continue running the same executable code (i.e., without an intervening :manpage:`execve(2)` call). This is intended for programs that execute unknown code without invoking :manpage:`execve(2)`, such as script interpreters. Programs that only sandbox themselves should not set this flag, so users can be notified of unauthorized access attempts via system logs. h](j-)}(h,``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF``h]j)}(hj?Ih]h(LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF}(hjAIhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj=Iubah}(h]h ]h"]h$]h&]uh1j,hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:45: ./include/uapi/linux/landlock.hhKhj9Iubj=)}(hhh]j()}(hXDisables logging of denied accesses originating from the thread creating the Landlock domain, as well as its children, as long as they continue running the same executable code (i.e., without an intervening :manpage:`execve(2)` call). This is intended for programs that execute unknown code without invoking :manpage:`execve(2)`, such as script interpreters. Programs that only sandbox themselves should not set this flag, so users can be notified of unauthorized access attempts via system logs.h](hDisables logging of denied accesses originating from the thread creating the Landlock domain, as well as its children, as long as they continue running the same executable code (i.e., without an intervening }(hjXIhhhNhNubj)}(h:manpage:`execve(2)`h]h execve(2)}(hj`IhhhNhNubah}(h]h ]jah"]h$]h&]hhj execve(2)jexecvejjuh1jhjXIubhQ call). This is intended for programs that execute unknown code without invoking }(hjXIhhhNhNubj)}(h:manpage:`execve(2)`h]h execve(2)}(hjtIhhhNhNubah}(h]h ]jah"]h$]h&]hhj execve(2)jexecvejjuh1jhjXIubh, such as script interpreters. Programs that only sandbox themselves should not set this flag, so users can be notified of unauthorized access attempts via system logs.}(hjXIhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:45: ./include/uapi/linux/landlock.hhKhjUIubah}(h]h ]h"]h$]h&]uh1j<hj9Iubeh}(h]h ]h"]h$]h&]uh1j&hjTIhKhj6Iubj')}(hX``LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON`` Enables logging of denied accesses after an :manpage:`execve(2)` call, providing visibility into unauthorized access attempts by newly executed programs within the created Landlock domain. This flag is recommended only when all potential executables in the domain are expected to comply with the access restrictions, as excessive audit log entries could make it more difficult to identify critical events. h](j-)}(h*``LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON``h]j)}(hjIh]h&LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON}(hjIhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjIubah}(h]h ]h"]h$]h&]uh1j,hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:45: ./include/uapi/linux/landlock.hhKhjIubj=)}(hhh]j()}(hXEnables logging of denied accesses after an :manpage:`execve(2)` call, providing visibility into unauthorized access attempts by newly executed programs within the created Landlock domain. This flag is recommended only when all potential executables in the domain are expected to comply with the access restrictions, as excessive audit log entries could make it more difficult to identify critical events.h](h,Enables logging of denied accesses after an }(hjIhhhNhNubj)}(h:manpage:`execve(2)`h]h execve(2)}(hjIhhhNhNubah}(h]h ]jah"]h$]h&]hhj execve(2)jexecvejjuh1jhjIubhXU call, providing visibility into unauthorized access attempts by newly executed programs within the created Landlock domain. This flag is recommended only when all potential executables in the domain are expected to comply with the access restrictions, as excessive audit log entries could make it more difficult to identify critical events.}(hjIhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:45: ./include/uapi/linux/landlock.hhKhjIubah}(h]h ]h"]h$]h&]uh1j<hjIubeh}(h]h ]h"]h$]h&]uh1j&hjIhKhj6Iubj')}(hXL``LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF`` Disables logging of denied accesses originating from nested Landlock domains created by the caller or its descendants. This flag should be set according to runtime configuration, not hardcoded, to avoid suppressing important security events. It is useful for container runtimes or sandboxing tools that may launch programs which themselves create Landlock domains and could otherwise generate excessive logs. Unlike ``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF``, this flag only affects future nested domains, not the one being created. It can also be used with a **ruleset_fd** value of -1 to mute subdomain logs without creating a domain. When combined with ``LANDLOCK_RESTRICT_SELF_TSYNC`` and a **ruleset_fd** value of -1, this configuration is propagated to all threads of the current process. h](j-)}(h-``LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF``h]j)}(hjIh]h)LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF}(hjIhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjIubah}(h]h ]h"]h$]h&]uh1j,hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:45: ./include/uapi/linux/landlock.hhKhjIubj=)}(hhh]j()}(hXDisables logging of denied accesses originating from nested Landlock domains created by the caller or its descendants. This flag should be set according to runtime configuration, not hardcoded, to avoid suppressing important security events. It is useful for container runtimes or sandboxing tools that may launch programs which themselves create Landlock domains and could otherwise generate excessive logs. Unlike ``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF``, this flag only affects future nested domains, not the one being created. It can also be used with a **ruleset_fd** value of -1 to mute subdomain logs without creating a domain. When combined with ``LANDLOCK_RESTRICT_SELF_TSYNC`` and a **ruleset_fd** value of -1, this configuration is propagated to all threads of the current process.h](hXDisables logging of denied accesses originating from nested Landlock domains created by the caller or its descendants. This flag should be set according to runtime configuration, not hardcoded, to avoid suppressing important security events. It is useful for container runtimes or sandboxing tools that may launch programs which themselves create Landlock domains and could otherwise generate excessive logs. Unlike }(hjJhhhNhNubj)}(h,``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF``h]h(LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF}(hjJhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjJubhf, this flag only affects future nested domains, not the one being created. It can also be used with a }(hjJhhhNhNubj|)}(h**ruleset_fd**h]h ruleset_fd}(hj"JhhhNhNubah}(h]h ]h"]h$]h&]uh1j{hjJubhS value of -1 to mute subdomain logs without creating a domain. When combined with }(hjJhhhNhNubj)}(h ``LANDLOCK_RESTRICT_SELF_TSYNC``h]hLANDLOCK_RESTRICT_SELF_TSYNC}(hj4JhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjJubh and a }(hjJhhhNhNubj|)}(h**ruleset_fd**h]h ruleset_fd}(hjFJhhhNhNubah}(h]h ]h"]h$]h&]uh1j{hjJubhU value of -1, this configuration is propagated to all threads of the current process.}(hjJhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:45: ./include/uapi/linux/landlock.hhKhjJubah}(h]h ]h"]h$]h&]uh1j<hjIubeh}(h]h ]h"]h$]h&]uh1j&hjJhKhj6Iubeh}(h]h ]h"]h$]h&]uh1j!hjEubj()}(hJThe following flag supports policy enforcement in multithreaded processes:h]hJThe following flag supports policy enforcement in multithreaded processes:}(hjqJhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:45: ./include/uapi/linux/landlock.hhKhjEubj")}(hhh]j')}(hX``LANDLOCK_RESTRICT_SELF_TSYNC`` Applies the new Landlock configuration atomically to all threads of the current process, including the Landlock domain and logging configuration. This overrides the Landlock configuration of sibling threads, irrespective of previously established Landlock domains and logging configurations on these threads. If the calling thread is running with no_new_privs, this operation enables no_new_privs on the sibling threads as well. h](j-)}(h ``LANDLOCK_RESTRICT_SELF_TSYNC``h]j)}(hjJh]hLANDLOCK_RESTRICT_SELF_TSYNC}(hjJhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjJubah}(h]h ]h"]h$]h&]uh1j,hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:45: ./include/uapi/linux/landlock.hhKhjJubj=)}(hhh](j()}(hX4Applies the new Landlock configuration atomically to all threads of the current process, including the Landlock domain and logging configuration. This overrides the Landlock configuration of sibling threads, irrespective of previously established Landlock domains and logging configurations on these threads.h]hX4Applies the new Landlock configuration atomically to all threads of the current process, including the Landlock domain and logging configuration. This overrides the Landlock configuration of sibling threads, irrespective of previously established Landlock domains and logging configurations on these threads.}(hjJhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:45: ./include/uapi/linux/landlock.hhKhjJubj()}(hwIf the calling thread is running with no_new_privs, this operation enables no_new_privs on the sibling threads as well.h]hwIf the calling thread is running with no_new_privs, this operation enables no_new_privs on the sibling threads as well.}(hjJhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:45: ./include/uapi/linux/landlock.hhKhjJubeh}(h]h ]h"]h$]h&]uh1j<hjJubeh}(h]h ]h"]h$]h&]uh1j&hjJhKhjJubah}(h]h ]h"]h$]h&]uh1j!hjEubj()}(hNThe following flag ties the no_new_privs attribute to the ruleset enforcement:h]hNThe following flag ties the no_new_privs attribute to the ruleset enforcement:}(hjJhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:45: ./include/uapi/linux/landlock.hhKhjEubj")}(hhh]j')}(hX``LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS`` Sets the no_new_privs attribute of the calling thread only once the enforcement of the ruleset succeeded: no_new_privs is set if and only if sys_landlock_restrict_self() succeeds. This removes the need for a prior :manpage:`prctl(2)` ``PR_SET_NO_NEW_PRIVS`` call (or ``CAP_SYS_ADMIN`` use). This flag requires a ruleset. When combined with ``LANDLOCK_RESTRICT_SELF_TSYNC``, no_new_privs is set on the sibling threads as well. h](j-)}(h'``LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS``h]j)}(hjJh]h#LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS}(hjJhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjJubah}(h]h ]h"]h$]h&]uh1j,hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:45: ./include/uapi/linux/landlock.hhKhjJubj=)}(hhh]j()}(hXSets the no_new_privs attribute of the calling thread only once the enforcement of the ruleset succeeded: no_new_privs is set if and only if sys_landlock_restrict_self() succeeds. This removes the need for a prior :manpage:`prctl(2)` ``PR_SET_NO_NEW_PRIVS`` call (or ``CAP_SYS_ADMIN`` use). This flag requires a ruleset. When combined with ``LANDLOCK_RESTRICT_SELF_TSYNC``, no_new_privs is set on the sibling threads as well.h](hSets the no_new_privs attribute of the calling thread only once the enforcement of the ruleset succeeded: no_new_privs is set if and only if sys_landlock_restrict_self() succeeds. This removes the need for a prior }(hjKhhhNhNubj)}(h:manpage:`prctl(2)`h]hprctl(2)}(hj KhhhNhNubah}(h]h ]jah"]h$]h&]hhjprctl(2)jprctljjuh1jhjKubh }(hjKhhhNhNubj)}(h``PR_SET_NO_NEW_PRIVS``h]hPR_SET_NO_NEW_PRIVS}(hjKhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjKubh call (or }(hjKhhhNhNubj)}(h``CAP_SYS_ADMIN``h]h CAP_SYS_ADMIN}(hj1KhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjKubh: use). This flag requires a ruleset. When combined with }(hjKhhhNhNubj)}(h ``LANDLOCK_RESTRICT_SELF_TSYNC``h]hLANDLOCK_RESTRICT_SELF_TSYNC}(hjCKhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjKubh5, no_new_privs is set on the sibling threads as well.}(hjKhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:45: ./include/uapi/linux/landlock.hhKhjKubah}(h]h ]h"]h$]h&]uh1j<hjJubeh}(h]h ]h"]h$]h&]uh1j&hjJhKhjJubah}(h]h ]h"]h$]h&]uh1j!hjEubj()}(h **Return**h]j|)}(hjpKh]hReturn}(hjrKhhhNhNubah}(h]h ]h"]h$]h&]uh1j{hjnKubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:837: ./security/landlock/syscalls.chMhjEubj()}(hB0 on success, or -errno on failure. Possible returned errors are:h]hB0 on success, or -errno on failure. Possible returned errors are:}(hjKhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:837: ./security/landlock/syscalls.chMhjEubeh}(h]h ] kernelindentah"]h$]h&]uh1jl'hjDhhhNhNubeh}(h]enforcing-a-rulesetah ]h"]enforcing a rulesetah$]h&]uh1hhjihhhhhMCubeh}(h]kernel-interfaceah ]h"]kernel interfaceah$]h&]uh1hhhhhhhhM&ubh)}(hhh](h)}(hCurrent limitationsh]hCurrent limitations}(hjKhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjKhhhhhMIubh)}(hhh](h)}(h Filesystem topology modificationh]h Filesystem topology modification}(hjKhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjKhhhhhMLubj()}(hThreads sandboxed with filesystem restrictions cannot modify filesystem topology, whether via :manpage:`mount(2)` or :manpage:`pivot_root(2)`. However, :manpage:`chroot(2)` calls are not denied.h](h^Threads sandboxed with filesystem restrictions cannot modify filesystem topology, whether via }(hjKhhhNhNubj)}(h:manpage:`mount(2)`h]hmount(2)}(hjKhhhNhNubah}(h]h ]jah"]h$]h&]hhjmount(2)jmountjjuh1jhjKubh or }(hjKhhhNhNubj)}(h:manpage:`pivot_root(2)`h]h pivot_root(2)}(hjKhhhNhNubah}(h]h ]jah"]h$]h&]hhj pivot_root(2)j pivot_rootjjuh1jhjKubh . However, }(hjKhhhNhNubj)}(h:manpage:`chroot(2)`h]h chroot(2)}(hjKhhhNhNubah}(h]h ]jah"]h$]h&]hhj chroot(2)jchrootjjuh1jhjKubh calls are not denied.}(hjKhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMNhjKhhubeh}(h] filesystem-topology-modificationah ]h"] filesystem topology modificationah$]h&]uh1hhjKhhhhhMLubh)}(hhh](h)}(hSpecial filesystemsh]hSpecial filesystems}(hj#LhhhNhNubah}(h]h ]h"]h$]h&]uh1hhj LhhhhhMSubj()}(hXAccess to regular files and directories can be restricted by Landlock, according to the handled accesses of a ruleset. However, files that do not come from a user-visible filesystem (e.g. pipe, socket), but can still be accessed through ``/proc//fd/*``, cannot currently be explicitly restricted. Likewise, some special kernel filesystems such as nsfs, which can be accessed through ``/proc//ns/*``, cannot currently be explicitly restricted. However, thanks to the `ptrace restrictions`_, access to such sensitive ``/proc`` files are automatically restricted according to domain hierarchies. Future Landlock evolutions could still enable to explicitly restrict such paths with dedicated ruleset flags.h](hAccess to regular files and directories can be restricted by Landlock, according to the handled accesses of a ruleset. However, files that do not come from a user-visible filesystem (e.g. pipe, socket), but can still be accessed through }(hj1LhhhNhNubj)}(h``/proc//fd/*``h]h/proc//fd/*}(hj9LhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj1Lubh, cannot currently be explicitly restricted. Likewise, some special kernel filesystems such as nsfs, which can be accessed through }(hj1LhhhNhNubj)}(h``/proc//ns/*``h]h/proc//ns/*}(hjKLhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj1LubhE, cannot currently be explicitly restricted. However, thanks to the }(hj1LhhhNhNubj5)}(h`ptrace restrictions`_h]hptrace restrictions}(hj]LhhhNhNubah}(h]h ]h"]h$]h&]nameptrace restrictionsjFj uh1j4hj1LjHKubh, access to such sensitive }(hj1LhhhNhNubj)}(h ``/proc``h]h/proc}(hjqLhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj1Lubh files are automatically restricted according to domain hierarchies. Future Landlock evolutions could still enable to explicitly restrict such paths with dedicated ruleset flags.}(hj1LhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMUhj Lhhubeh}(h]special-filesystemsah ]h"]special filesystemsah$]h&]uh1hhjKhhhhhMSubh)}(hhh](h)}(hRuleset layersh]hRuleset layers}(hjLhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjLhhhhhMaubj()}(hXThere is a limit of 16 layers of stacked rulesets. This can be an issue for a task willing to enforce a new ruleset in complement to its 16 inherited rulesets. Once this limit is reached, sys_landlock_restrict_self() returns E2BIG. It is then strongly suggested to carefully build rulesets once in the life of a thread, especially for applications able to launch other applications that may also want to sandbox themselves (e.g. shells, container managers, etc.).h]hXThere is a limit of 16 layers of stacked rulesets. This can be an issue for a task willing to enforce a new ruleset in complement to its 16 inherited rulesets. Once this limit is reached, sys_landlock_restrict_self() returns E2BIG. It is then strongly suggested to carefully build rulesets once in the life of a thread, especially for applications able to launch other applications that may also want to sandbox themselves (e.g. shells, container managers, etc.).}(hjLhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMchjLhhubeh}(h]ruleset-layersah ]h"]ruleset layersah$]h&]uh1hhjKhhhhhMaubh)}(hhh](h)}(h Memory usageh]h Memory usage}(hjLhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjLhhhhhMlubj()}(hKernel memory allocated to create rulesets is accounted and can be restricted by the Documentation/admin-guide/cgroup-v1/memory.rst.h]hKernel memory allocated to create rulesets is accounted and can be restricted by the Documentation/admin-guide/cgroup-v1/memory.rst.}(hjLhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMnhjLhhubeh}(h] memory-usageah ]h"] memory usageah$]h&]uh1hhjKhhhhhMlubh)}(hhh](h)}(h IOCTL supporth]h IOCTL support}(hjLhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjLhhhhhMrubj()}(hThe ``LANDLOCK_ACCESS_FS_IOCTL_DEV`` right restricts the use of :manpage:`ioctl(2)`, but it only applies to *newly opened* device files. This means specifically that pre-existing file descriptors like stdin, stdout and stderr are unaffected.h](hThe }(hjLhhhNhNubj)}(h ``LANDLOCK_ACCESS_FS_IOCTL_DEV``h]hLANDLOCK_ACCESS_FS_IOCTL_DEV}(hjLhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjLubh right restricts the use of }(hjLhhhNhNubj)}(h:manpage:`ioctl(2)`h]hioctl(2)}(hj MhhhNhNubah}(h]h ]jah"]h$]h&]hhjioctl(2)jioctljjuh1jhjLubh, but it only applies to }(hjLhhhNhNubj| )}(h*newly opened*h]h newly opened}(hjMhhhNhNubah}(h]h ]h"]h$]h&]uh1j{ hjLubhx device files. This means specifically that pre-existing file descriptors like stdin, stdout and stderr are unaffected.}(hjLhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMthjLhhubj()}(hXUsers should be aware that TTY devices have traditionally permitted to control other processes on the same TTY through the ``TIOCSTI`` and ``TIOCLINUX`` IOCTL commands. Both of these require ``CAP_SYS_ADMIN`` on modern Linux systems, but the behavior is configurable for ``TIOCSTI``.h](h{Users should be aware that TTY devices have traditionally permitted to control other processes on the same TTY through the }(hj6MhhhNhNubj)}(h ``TIOCSTI``h]hTIOCSTI}(hj>MhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj6Mubh and }(hj6MhhhNhNubj)}(h ``TIOCLINUX``h]h TIOCLINUX}(hjPMhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj6Mubh( IOCTL commands. Both of these require }(hj6MhhhNhNubj)}(h``CAP_SYS_ADMIN``h]h CAP_SYS_ADMIN}(hjbMhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj6Mubh? on modern Linux systems, but the behavior is configurable for }(hj6MhhhNhNubj)}(h ``TIOCSTI``h]hTIOCSTI}(hjtMhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj6Mubh.}(hj6MhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMyhjLhhubj()}(hOn older systems, it is therefore recommended to close inherited TTY file descriptors, or to reopen them from ``/proc/self/fd/*`` without the ``LANDLOCK_ACCESS_FS_IOCTL_DEV`` right, if possible.h](hnOn older systems, it is therefore recommended to close inherited TTY file descriptors, or to reopen them from }(hjMhhhNhNubj)}(h``/proc/self/fd/*``h]h/proc/self/fd/*}(hjMhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjMubh without the }(hjMhhhNhNubj)}(h ``LANDLOCK_ACCESS_FS_IOCTL_DEV``h]hLANDLOCK_ACCESS_FS_IOCTL_DEV}(hjMhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjMubh right, if possible.}(hjMhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhM~hjLhhubj()}(hX1Landlock's IOCTL support is coarse-grained at the moment, but may become more fine-grained in the future. Until then, users are advised to establish the guarantees that they need through the file hierarchy, by only allowing the ``LANDLOCK_ACCESS_FS_IOCTL_DEV`` right on files where it is really required.h](hLandlock’s IOCTL support is coarse-grained at the moment, but may become more fine-grained in the future. Until then, users are advised to establish the guarantees that they need through the file hierarchy, by only allowing the }(hjMhhhNhNubj)}(h ``LANDLOCK_ACCESS_FS_IOCTL_DEV``h]hLANDLOCK_ACCESS_FS_IOCTL_DEV}(hjMhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjMubh, right on files where it is really required.}(hjMhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjLhhubeh}(h] ioctl-supportah ]h"] ioctl supportah$]h&]uh1hhjKhhhhhMrubeh}(h]current-limitationsah ]h"]current limitationsah$]h&]uh1hhhhhhhhMIubh)}(hhh](h)}(hPrevious limitationsh]hPrevious limitations}(hjMhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjMhhhhhMubh)}(hhh](h)}(h#File renaming and linking (ABI < 2)h]h#File renaming and linking (ABI < 2)}(hjNhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjMhhhhhMubj()}(hXBecause Landlock targets unprivileged access controls, it needs to properly handle composition of rules. Such property also implies rules nesting. Properly handling multiple layers of rulesets, each one of them able to restrict access to files, also implies inheritance of the ruleset restrictions from a parent to its hierarchy. Because files are identified and restricted by their hierarchy, moving or linking a file from one directory to another implies propagation of the hierarchy constraints, or restriction of these actions according to the potentially lost constraints. To protect against privilege escalations through renaming or linking, and for the sake of simplicity, Landlock previously limited linking and renaming to the same directory. Starting with the Landlock ABI version 2, it is now possible to securely control renaming and linking thanks to the new ``LANDLOCK_ACCESS_FS_REFER`` access right.h](hXkBecause Landlock targets unprivileged access controls, it needs to properly handle composition of rules. Such property also implies rules nesting. Properly handling multiple layers of rulesets, each one of them able to restrict access to files, also implies inheritance of the ruleset restrictions from a parent to its hierarchy. Because files are identified and restricted by their hierarchy, moving or linking a file from one directory to another implies propagation of the hierarchy constraints, or restriction of these actions according to the potentially lost constraints. To protect against privilege escalations through renaming or linking, and for the sake of simplicity, Landlock previously limited linking and renaming to the same directory. Starting with the Landlock ABI version 2, it is now possible to securely control renaming and linking thanks to the new }(hjNhhhNhNubj)}(h``LANDLOCK_ACCESS_FS_REFER``h]hLANDLOCK_ACCESS_FS_REFER}(hjNhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjNubh access right.}(hjNhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjMhhubeh}(h]file-renaming-and-linking-abi-2ah ]h"]#file renaming and linking (abi < 2)ah$]h&]uh1hhjMhhhhhMubh)}(hhh](h)}(hFile truncation (ABI < 3)h]hFile truncation (ABI < 3)}(hj;NhhhNhNubah}(h]h ]h"]h$]h&]uh1hhj8NhhhhhMubj()}(hFile truncation could not be denied before the third Landlock ABI, so it is always allowed when using a kernel that only supports the first or second ABI.h]hFile truncation could not be denied before the third Landlock ABI, so it is always allowed when using a kernel that only supports the first or second ABI.}(hjINhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMhj8Nhhubj()}(hStarting with the Landlock ABI version 3, it is now possible to securely control truncation thanks to the new ``LANDLOCK_ACCESS_FS_TRUNCATE`` access right.h](hnStarting with the Landlock ABI version 3, it is now possible to securely control truncation thanks to the new }(hjWNhhhNhNubj)}(h``LANDLOCK_ACCESS_FS_TRUNCATE``h]hLANDLOCK_ACCESS_FS_TRUNCATE}(hj_NhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjWNubh access right.}(hjWNhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhj8Nhhubeh}(h]file-truncation-abi-3ah ]h"]file truncation (abi < 3)ah$]h&]uh1hhjMhhhhhMubh)}(hhh](h)}(hTCP bind and connect (ABI < 4)h]hTCP bind and connect (ABI < 4)}(hjNhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjNhhhhhMubj()}(hStarting with the Landlock ABI version 4, it is now possible to restrict TCP bind and connect actions to only a set of allowed ports thanks to the new ``LANDLOCK_ACCESS_NET_BIND_TCP`` and ``LANDLOCK_ACCESS_NET_CONNECT_TCP`` access rights.h](hStarting with the Landlock ABI version 4, it is now possible to restrict TCP bind and connect actions to only a set of allowed ports thanks to the new }(hjNhhhNhNubj)}(h ``LANDLOCK_ACCESS_NET_BIND_TCP``h]hLANDLOCK_ACCESS_NET_BIND_TCP}(hjNhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjNubh and }(hjNhhhNhNubj)}(h#``LANDLOCK_ACCESS_NET_CONNECT_TCP``h]hLANDLOCK_ACCESS_NET_CONNECT_TCP}(hjNhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjNubh access rights.}(hjNhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjNhhubeh}(h]tcp-bind-and-connect-abi-4ah ]h"]tcp bind and connect (abi < 4)ah$]h&]uh1hhjMhhhhhMubh)}(hhh](h)}(hDevice IOCTL (ABI < 5)h]hDevice IOCTL (ABI < 5)}(hjNhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjNhhhhhMubj()}(hIOCTL operations could not be denied before the fifth Landlock ABI, so :manpage:`ioctl(2)` is always allowed when using a kernel that only supports an earlier ABI.h](hGIOCTL operations could not be denied before the fifth Landlock ABI, so }(hjNhhhNhNubj)}(h:manpage:`ioctl(2)`h]hioctl(2)}(hjNhhhNhNubah}(h]h ]jah"]h$]h&]hhjioctl(2)jioctljjuh1jhjNubhI is always allowed when using a kernel that only supports an earlier ABI.}(hjNhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjNhhubj()}(hStarting with the Landlock ABI version 5, it is possible to restrict the use of :manpage:`ioctl(2)` on character and block devices using the new ``LANDLOCK_ACCESS_FS_IOCTL_DEV`` right.h](hPStarting with the Landlock ABI version 5, it is possible to restrict the use of }(hjNhhhNhNubj)}(h:manpage:`ioctl(2)`h]hioctl(2)}(hjOhhhNhNubah}(h]h ]jah"]h$]h&]hhjioctl(2)jioctljjuh1jhjNubh. on character and block devices using the new }(hjNhhhNhNubj)}(h ``LANDLOCK_ACCESS_FS_IOCTL_DEV``h]hLANDLOCK_ACCESS_FS_IOCTL_DEV}(hjOhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjNubh right.}(hjNhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjNhhubeh}(h]device-ioctl-abi-5ah ]h"]device ioctl (abi < 5)ah$]h&]uh1hhjMhhhhhMubh)}(hhh](h)}(hAbstract UNIX socket (ABI < 6)h]hAbstract UNIX socket (ABI < 6)}(hj/dev/null CONFIG_LSM="lockdown,yama,integrity,apparmor"h]h~$ zgrep -h "^CONFIG_LSM=" "/boot/config-$(uname -r)" /proc/config.gz 2>/dev/null CONFIG_LSM="lockdown,yama,integrity,apparmor"}hjTsbah}(h]h ]h"]h$]h&]hhjjconsolej}uh1jhhhM8hj:Thhubj()}(h:...and if the cmdline doesn't contain ``landlock`` either:h](h(...and if the cmdline doesn’t contain }(hjThhhNhNubj)}(h ``landlock``h]hlandlock}(hjThhhNhNubah}(h]h ]h"]h$]h&]uh1jhjTubh either:}(hjThhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhM=hj:Thhubj)}(hW$ sed -n 's/.*\(\The kernel may be configured at build time to always load the }(hj;UhhhNhNubj)}(h ``lockdown``h]hlockdown}(hjCUhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj;Uubh and }(hj;UhhhNhNubj)}(h``capability``h]h capability}(hjUUhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj;UubhE LSMs. In that case, these LSMs will appear at the beginning of the }(hj;UhhhNhNubj)}(h``LSM: initializing``h]hLSM: initializing}(hjgUhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj;UubhF log line as well, even if they are not configured in the boot loader.}(hj;UhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMThj:Thhubeh}(h]boot-time-configurationah ]h"]boot time configurationah$]h&]uh1hhjShhhhhM/ubh)}(hhh](h)}(hNetwork supporth]hNetwork support}(hjUhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjUhhhhhMZubj()}(hXfTo be able to explicitly allow TCP or UDP operations (e.g., adding a network rule with ``LANDLOCK_ACCESS_NET_BIND_TCP``), the kernel must support the TCP/IP protocol suite (``CONFIG_INET=y``). Otherwise, sys_landlock_add_rule() returns an ``EAFNOSUPPORT`` error, which can safely be ignored because this kind of TCP or UDP operation is already not possible.h](hWTo be able to explicitly allow TCP or UDP operations (e.g., adding a network rule with }(hjUhhhNhNubj)}(h ``LANDLOCK_ACCESS_NET_BIND_TCP``h]hLANDLOCK_ACCESS_NET_BIND_TCP}(hjUhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjUubh6), the kernel must support the TCP/IP protocol suite (}(hjUhhhNhNubj)}(h``CONFIG_INET=y``h]h CONFIG_INET=y}(hjUhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjUubh2). Otherwise, sys_landlock_add_rule() returns an }(hjUhhhNhNubj)}(h``EAFNOSUPPORT``h]h EAFNOSUPPORT}(hjUhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjUubhf error, which can safely be ignored because this kind of TCP or UDP operation is already not possible.}(hjUhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhM\hjUhhubeh}(h]network-supportah ]h"]network supportah$]h&]uh1hhjShhhhhMZubeh}(h](jSid2eh ]h"](kernel supportkernel_supporteh$]h&]uh1hhhhhhhhM!j}jUjSsj!}jSjSsubh)}(hhh](h)}(hQuestions and answersh]hQuestions and answers}(hjUhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjUhhhhhMcubh)}(hhh](h)}(h'What about user space sandbox managers?h]h'What about user space sandbox managers?}(hjVhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjVhhhhhMfubj()}(hX6Using user space processes to enforce restrictions on kernel resources can lead to race conditions or inconsistent evaluations (i.e. `Incorrect mirroring of the OS code and state `_).h](hUsing user space processes to enforce restrictions on kernel resources can lead to race conditions or inconsistent evaluations (i.e. }(hjVhhhNhNubj5)}(h`Incorrect mirroring of the OS code and state `_h]h,Incorrect mirroring of the OS code and state}(hjVhhhNhNubah}(h]h ]h"]h$]h&]name,Incorrect mirroring of the OS code and statej}https://www.ndss-symposium.org/ndss2003/traps-and-pitfalls-practical-problems-system-call-interposition-based-security-tools/uh1j4hjVubj)}(h h]h}(h],incorrect-mirroring-of-the-os-code-and-stateah ]h"],incorrect mirroring of the os code and stateah$]h&]refurij)Vuh1jj KhjVubh).}(hjVhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhhjVhhubeh}(h]&what-about-user-space-sandbox-managersah ]h"]'what about user space sandbox managers?ah$]h&]uh1hhjUhhhhhMfubh)}(hhh](h)}(h%What about namespaces and containers?h]h%What about namespaces and containers?}(hjLVhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjIVhhhhhMnubj()}(hXjNamespaces can help create sandboxes but they are not designed for access-control and then miss useful features for such use case (e.g. no fine-grained restrictions). Moreover, their complexity can lead to security issues, especially when untrusted processes can manipulate them (cf. `Controlling access to user namespaces `_).n!h](hXNamespaces can help create sandboxes but they are not designed for access-control and then miss useful features for such use case (e.g. no fine-grained restrictions). Moreover, their complexity can lead to security issues, especially when untrusted processes can manipulate them (cf. }(hjZVhhhNhNubj5)}(hK`Controlling access to user namespaces `_h]h%Controlling access to user namespaces}(hjbVhhhNhNubah}(h]h ]h"]h$]h&]name%Controlling access to user namespacesj https://lwn.net/Articles/673597/uh1j4hjZVubj)}(h# h]h}(h]%controlling-access-to-user-namespacesah ]h"]%controlling access to user namespacesah$]h&]refurijrVuh1jj KhjZVubh).}(hjZVhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMphjIVhhubeh}(h]$what-about-namespaces-and-containersah ]h"]%what about namespaces and containers?ah$]h&]uh1hhjUhhhhhMnubh)}(hhh](h)}(h&How to disable Landlock audit records?h]h&How to disable Landlock audit records?}(hjVhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjVhhhhhMwubj()}(hdYou might want to put in place filters as explained here: Documentation/admin-guide/LSM/landlock.rsth]hdYou might want to put in place filters as explained here: Documentation/admin-guide/LSM/landlock.rst}(hjVhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMyhjVhhubeh}(h]%how-to-disable-landlock-audit-recordsah ]h"]&how to disable landlock audit records?ah$]h&]uh1hhjUhhhhhMwubeh}(h]questions-and-answersah ]h"]questions and answersah$]h&]uh1hhhhhhhhMcubh)}(hhh](h)}(hAdditional documentationh]hAdditional documentation}(hjVhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjVhhhhhM}ubjb)}(hhh](jg)}(h*Documentation/admin-guide/LSM/landlock.rsth]j()}(hjVh]h*Documentation/admin-guide/LSM/landlock.rst}(hjVhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMhjVubah}(h]h ]h"]h$]h&]uh1jfhjVhhhhhNubjg)}(h'Documentation/trace/events-landlock.rsth]j()}(hjVh]h'Documentation/trace/events-landlock.rst}(hjVhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMhjVubah}(h]h ]h"]h$]h&]uh1jfhjVhhhhhNubjg)}(h#Documentation/security/landlock.rsth]j()}(hjWh]h#Documentation/security/landlock.rst}(hjWhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMhjWubah}(h]h ]h"]h$]h&]uh1jfhjVhhhhhNubjg)}(hhttps://landlock.io h]j()}(hhttps://landlock.ioh]j5)}(hj Wh]hhttps://landlock.io}(hj"WhhhNhNubah}(h]h ]h"]h$]h&]refurij Wuh1j4hjWubah}(h]h ]h"]h$]h&]uh1j'hhhMhjWubah}(h]h ]h"]h$]h&]uh1jfhjVhhhhhNubeh}(h]h ]h"]h$]h&]jjuh1jahhhMhjVhhubh)}(hLinksh]hLinks}hjBWsbah}(h]h ]h"]h$]h&]hhuh1hhjVhhhhhMubj)}(h.. _samples/landlock/sandboxer.c: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/samples/landlock/sandboxer.ch]h}(h]samples-landlock-sandboxer-cah ]h"]samples/landlock/sandboxer.cah$]h&]jjuh1jhMhjVhhhhj Kubeh}(h]additional-documentationah ]h"]additional documentationah$]h&]uh1hhhhhhhhM}ubeh}(h]$landlock-unprivileged-access-controlah ]h"]%landlock: unprivileged access controlah$]h&]uh1hhhhhhhhKubeh}(h]h ]h"]h$]h&]sourcehuh1hcurrent_sourceN current_lineNsettingsdocutils.frontendValues)}(hN generatorN datestampN source_linkN source_urlN toc_backlinksentryfootnote_backlinksK sectnum_xformKstrip_commentsNstrip_elements_with_classesN strip_classesN report_levelK halt_levelKexit_status_levelKdebugNwarning_streamN tracebackinput_encoding utf-8-siginput_encoding_error_handlerstrictoutput_encodingutf-8output_encoding_error_handlerjWerror_encodingutf-8error_encoding_error_handlerbackslashreplace language_codeenrecord_dependenciesNconfigN id_prefixhauto_id_prefixid dump_settingsNdump_internalsNdump_transformsNdump_pseudo_xmlNexpose_internalsNstrict_visitorN_disable_configN_sourcehnj _destinationN _config_files]7/var/lib/git/docbuild/linux/Documentation/docutils.confafile_insertion_enabled raw_enabledKline_length_limitM'pep_referencesN pep_base_urlhttps://peps.python.org/pep_file_url_templatepep-%04drfc_referencesN rfc_base_url&https://datatracker.ietf.org/doc/html/ tab_widthKtrim_footnote_reference_spacesyntax_highlightlong smart_quotessmartquotes_locales]character_level_inline_markupdoctitle_xform docinfo_xformKsectsubtitle_xform image_loadinglinkembed_stylesheetcloak_email_addressessection_self_linkenvNubreporterNindirect_targets]substitution_defs}substitution_names}refnames}(%capability and namespace restrictions](j6jesamples/landlock/sandboxer.c]japtrace restrictions](j j]Lefilesystem flags](j,j.j=e network flags](j,j>e scope flags]j&-apermission flags](j".j6AjCeurefids}(j]jajO]jOajS]jSaunameids}(jiWjfWjPjMjjjjjjj jjq jn j j j j jpjGjjjHjEjfjcjjjjjjjjj^j[j*j'jjjjjjjVjSjKjKj%j%j%jG%j+j+jDj 0j'0j,0j9j9j(<j-<j=j=j?j?jBj BjKjDjDjDjMjKjLjKjLj LjLjLjLjLjMjLjSjMj2NjMjyNj8NjNjNj3OjNjOj9OjOjOjOjPjYPjPjPjbPjPjPjUQjPjQj[QjYRjQjRj_RjSjRjSjSjUjSj4TjSjUj:TjUjUjVjUjCVjVj0Vj*VjVjIVjyVjsVjVjVj^WjVjVWjPWu footnote_refs} citation_refs} autofootnotes]autofootnote_refs]symbol_footnotes]symbol_footnote_refs] footnotes] citations]autofootnote_startKsymbol_footnote_startK id_counter collectionsCounter}jWKsRparse_messages]transform_messages](hsystem_message)}(hhh]j()}(hhh]h;Hyperlink target "landlock-abi-versions" is not referenced.}hj Xsbah}(h]h ]h"]h$]h&]uh1j'hjXubah}(h]h ]h"]h$]h&]levelKtypeINFOsourcehnjlineMuh1jXubjX)}(hhh]j()}(hhh]h8Hyperlink target "landlock-log-flags" is not referenced.}hj$Xsbah}(h]h ]h"]h$]h&]uh1j'hj!Xubah}(h]h ]h"]h$]h&]levelKtypejXsourcehnjlineMuh1jXubjX)}(hhh]j()}(hhh]h4Hyperlink target "kernel-support" is not referenced.}hj>Xsbah}(h]h ]h"]h$]h&]uh1j'hj;Xubah}(h]h ]h"]h$]h&]levelKtypejXsourcehnjlineMuh1jXube transformerN include_log] decorationNhhub.