sphinx.addnodesdocument)}( rawsourcechildren]( translations LanguagesNode)}(hhh](h pending_xref)}(hhh]docutils.nodesTextChinese (Simplified)}parenthsba attributes}(ids]classes]names]dupnames]backrefs] refdomainstdreftypedoc reftarget*/translations/zh_CN/userspace-api/landlockmodnameN classnameN refexplicitutagnamehhh ubh)}(hhh]hChinese (Traditional)}hh2sbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget*/translations/zh_TW/userspace-api/landlockmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hItalian}hhFsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget*/translations/it_IT/userspace-api/landlockmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hJapanese}hhZsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget*/translations/ja_JP/userspace-api/landlockmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hKorean}hhnsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget*/translations/ko_KR/userspace-api/landlockmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hSpanish}hhsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget*/translations/sp_SP/userspace-api/landlockmodnameN classnameN refexplicituh1hhh ubeh}(h]h ]h"]h$]h&]current_languageEnglishuh1h hh _documenthsourceNlineNubhcomment)}(h SPDX-License-Identifier: GPL-2.0h]h SPDX-License-Identifier: GPL-2.0}hhsbah}(h]h ]h"]h$]h&] xml:spacepreserveuh1hhhhhhD/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock.rsthKubh)}(h9Copyright © 2017-2020 Mickaël Salaün h]h9Copyright © 2017-2020 Mickaël Salaün }hhsbah}(h]h ]h"]h$]h&]hhuh1hhhhhhhhKubh)}(hCopyright © 2019-2020 ANSSIh]hCopyright © 2019-2020 ANSSI}hhsbah}(h]h ]h"]h$]h&]hhuh1hhhhhhhhKubh)}(h,Copyright © 2021-2022 Microsoft Corporationh]h,Copyright © 2021-2022 Microsoft Corporation}hhsbah}(h]h ]h"]h$]h&]hhuh1hhhhhhhhKubhsection)}(hhh](htitle)}(h%Landlock: unprivileged access controlh]h%Landlock: unprivileged access control}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhhhhhKubh field_list)}(hhh](hfield)}(hhh](h field_name)}(hAuthorh]hAuthor}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhhhKubh field_body)}(hMickaël Salaünh]h paragraph)}(hjh]hMickaël Salaün}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK hjubah}(h]h ]h"]h$]h&]uh1j hhubeh}(h]h ]h"]h$]h&]uh1hhhhK hhhhubh)}(hhh](h)}(hDateh]hDate}(hj1hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj.hhhKubj)}(h March 2025 h]j)}(h March 2025h]h March 2025}(hjChhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK hj?ubah}(h]h ]h"]h$]h&]uh1j hj.ubeh}(h]h ]h"]h$]h&]uh1hhhhK hhhhubeh}(h]h ]h"]h$]h&]uh1hhhhhhhhK ubj)}(hXThe goal of Landlock is to enable restriction of ambient rights (e.g. global filesystem or network access) for a set of processes. Because Landlock is a stackable LSM, it makes it possible to create safe security sandboxes as new security layers in addition to the existing system-wide access-controls. This kind of sandbox is expected to help mitigate the security impact of bugs or unexpected/malicious behaviors in user space applications. Landlock empowers any process, including unprivileged ones, to securely restrict themselves.h]hXThe goal of Landlock is to enable restriction of ambient rights (e.g. global filesystem or network access) for a set of processes. Because Landlock is a stackable LSM, it makes it possible to create safe security sandboxes as new security layers in addition to the existing system-wide access-controls. This kind of sandbox is expected to help mitigate the security impact of bugs or unexpected/malicious behaviors in user space applications. Landlock empowers any process, including unprivileged ones, to securely restrict themselves.}(hjchhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK hhhhubj)}(hXWe can quickly make sure that Landlock is enabled in the running system by looking for "landlock: Up and running" in kernel logs (as root): ``dmesg | grep landlock || journalctl -kb -g landlock`` . Developers can also easily check for Landlock support with a :ref:`related system call `. If Landlock is not currently supported, we need to :ref:`configure the kernel appropriately `.h](hWe can quickly make sure that Landlock is enabled in the running system by looking for “landlock: Up and running” in kernel logs (as root): }(hjqhhhNhNubhliteral)}(h7``dmesg | grep landlock || journalctl -kb -g landlock``h]h3dmesg | grep landlock || journalctl -kb -g landlock}(hj{hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjqubh@ . Developers can also easily check for Landlock support with a }(hjqhhhNhNubh)}(h2:ref:`related system call `h]hinline)}(hjh]hrelated system call}(hjhhhNhNubah}(h]h ](xrefstdstd-refeh"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]refdocuserspace-api/landlock refdomainjreftyperef refexplicitrefwarn reftargetlandlock_abi_versionsuh1hhhhKhjqubh5. If Landlock is not currently supported, we need to }(hjqhhhNhNubh)}(h::ref:`configure the kernel appropriately `h]j)}(hjh]h"configure the kernel appropriately}(hjhhhNhNubah}(h]h ](jstdstd-refeh"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]refdocj refdomainjreftyperef refexplicitrefwarnjkernel_supportuh1hhhhKhjqubh.}(hjqhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKhhhhubh)}(hhh](h)}(hLandlock rulesh]hLandlock rules}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKubj)}(hA Landlock rule describes an action on an object which the process intends to perform. A set of rules is aggregated in a ruleset, which can then restrict the thread enforcing it, and its future children.h]hA Landlock rule describes an action on an object which the process intends to perform. A set of rules is aggregated in a ruleset, which can then restrict the thread enforcing it, and its future children.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK hjhhubj)}(h$The two existing types of rules are:h]h$The two existing types of rules are:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK$hjhhubhdefinition_list)}(hhh](hdefinition_list_item)}(hFilesystem rules For these rules, the object is a file hierarchy, and the related filesystem actions are defined with `filesystem access rights`. h](hterm)}(hFilesystem rulesh]hFilesystem rules}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK)hjubh definition)}(hhh]j)}(hFor these rules, the object is a file hierarchy, and the related filesystem actions are defined with `filesystem access rights`.h](heFor these rules, the object is a file hierarchy, and the related filesystem actions are defined with }(hj-hhhNhNubhtitle_reference)}(h`filesystem access rights`h]hfilesystem access rights}(hj7hhhNhNubah}(h]h ]h"]h$]h&]uh1j5hj-ubh.}(hj-hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhK'hj*ubah}(h]h ]h"]h$]h&]uh1j(hjubeh}(h]h ]h"]h$]h&]uh1jhhhK)hjubj)}(hNetwork rules (since ABI v4) For these rules, the object is a TCP port, and the related actions are defined with `network access rights`. h](j)}(hNetwork rules (since ABI v4)h]hNetwork rules (since ABI v4)}(hj_hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK-hj[ubj))}(hhh]j)}(hlFor these rules, the object is a TCP port, and the related actions are defined with `network access rights`.h](hTFor these rules, the object is a TCP port, and the related actions are defined with }(hjphhhNhNubj6)}(h`network access rights`h]hnetwork access rights}(hjxhhhNhNubah}(h]h ]h"]h$]h&]uh1j5hjpubh.}(hjphhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhK,hjmubah}(h]h ]h"]h$]h&]uh1j(hj[ubeh}(h]h ]h"]h$]h&]uh1jhhhK-hjhhubeh}(h]h ]h"]h$]h&]uh1j hjhhhhhNubh)}(hhh](h)}(h(Defining and enforcing a security policyh]h(Defining and enforcing a security policy}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhK0ubj)}(h@We first need to define the ruleset that will contain our rules.h]h@We first need to define the ruleset that will contain our rules.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK2hjhhubj)}(hFor this example, the ruleset will contain rules that only allow filesystem read actions and establish a specific TCP connection. Filesystem write actions and other TCP actions will be denied.h]hFor this example, the ruleset will contain rules that only allow filesystem read actions and establish a specific TCP connection. Filesystem write actions and other TCP actions will be denied.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK4hjhhubj)}(hXThe ruleset then needs to handle both these kinds of actions. This is required for backward and forward compatibility (i.e. the kernel and user space may not know each other's supported restrictions), hence the need to be explicit about the denied-by-default access rights.h]hXThe ruleset then needs to handle both these kinds of actions. This is required for backward and forward compatibility (i.e. the kernel and user space may not know each other’s supported restrictions), hence the need to be explicit about the denied-by-default access rights.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK8hjhhubh literal_block)}(hXwstruct landlock_ruleset_attr ruleset_attr = { .handled_access_fs = LANDLOCK_ACCESS_FS_EXECUTE | LANDLOCK_ACCESS_FS_WRITE_FILE | LANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_READ_DIR | LANDLOCK_ACCESS_FS_REMOVE_DIR | LANDLOCK_ACCESS_FS_REMOVE_FILE | LANDLOCK_ACCESS_FS_MAKE_CHAR | LANDLOCK_ACCESS_FS_MAKE_DIR | LANDLOCK_ACCESS_FS_MAKE_REG | LANDLOCK_ACCESS_FS_MAKE_SOCK | LANDLOCK_ACCESS_FS_MAKE_FIFO | LANDLOCK_ACCESS_FS_MAKE_BLOCK | LANDLOCK_ACCESS_FS_MAKE_SYM | LANDLOCK_ACCESS_FS_REFER | LANDLOCK_ACCESS_FS_TRUNCATE | LANDLOCK_ACCESS_FS_IOCTL_DEV, .handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP | LANDLOCK_ACCESS_NET_CONNECT_TCP, .scoped = LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET | LANDLOCK_SCOPE_SIGNAL, };h]hXwstruct landlock_ruleset_attr ruleset_attr = { .handled_access_fs = LANDLOCK_ACCESS_FS_EXECUTE | LANDLOCK_ACCESS_FS_WRITE_FILE | LANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_READ_DIR | LANDLOCK_ACCESS_FS_REMOVE_DIR | LANDLOCK_ACCESS_FS_REMOVE_FILE | LANDLOCK_ACCESS_FS_MAKE_CHAR | LANDLOCK_ACCESS_FS_MAKE_DIR | LANDLOCK_ACCESS_FS_MAKE_REG | LANDLOCK_ACCESS_FS_MAKE_SOCK | LANDLOCK_ACCESS_FS_MAKE_FIFO | LANDLOCK_ACCESS_FS_MAKE_BLOCK | LANDLOCK_ACCESS_FS_MAKE_SYM | LANDLOCK_ACCESS_FS_REFER | LANDLOCK_ACCESS_FS_TRUNCATE | LANDLOCK_ACCESS_FS_IOCTL_DEV, .handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP | LANDLOCK_ACCESS_NET_CONNECT_TCP, .scoped = LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET | LANDLOCK_SCOPE_SIGNAL, };}hjsbah}(h]h ]h"]h$]h&]hhforcelanguagechighlight_args}uh1jhhhK=hjhhubj)}(hBecause we may not know which kernel version an application will be executed on, it is safer to follow a best-effort security approach. Indeed, we should try to protect users as much as possible whatever the kernel they are using.h]hBecause we may not know which kernel version an application will be executed on, it is safer to follow a best-effort security approach. Indeed, we should try to protect users as much as possible whatever the kernel they are using.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhKYhjhhubj)}(hTo be compatible with older Linux versions, we detect the available Landlock ABI version, and only use the available subset of access rights:h]hTo be compatible with older Linux versions, we detect the available Landlock ABI version, and only use the available subset of access rights:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK^hjhhubj)}(hXuint abi; abi = landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_VERSION); if (abi < 0) { /* Degrades gracefully if Landlock is not handled. */ perror("The running kernel does not enable to use Landlock"); return 0; } switch (abi) { case 1: /* Removes LANDLOCK_ACCESS_FS_REFER for ABI < 2 */ ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_REFER; __attribute__((fallthrough)); case 2: /* Removes LANDLOCK_ACCESS_FS_TRUNCATE for ABI < 3 */ ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_TRUNCATE; __attribute__((fallthrough)); case 3: /* Removes network support for ABI < 4 */ ruleset_attr.handled_access_net &= ~(LANDLOCK_ACCESS_NET_BIND_TCP | LANDLOCK_ACCESS_NET_CONNECT_TCP); __attribute__((fallthrough)); case 4: /* Removes LANDLOCK_ACCESS_FS_IOCTL_DEV for ABI < 5 */ ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_IOCTL_DEV; __attribute__((fallthrough)); case 5: /* Removes LANDLOCK_SCOPE_* for ABI < 6 */ ruleset_attr.scoped &= ~(LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET | LANDLOCK_SCOPE_SIGNAL); }h]hXuint abi; abi = landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_VERSION); if (abi < 0) { /* Degrades gracefully if Landlock is not handled. */ perror("The running kernel does not enable to use Landlock"); return 0; } switch (abi) { case 1: /* Removes LANDLOCK_ACCESS_FS_REFER for ABI < 2 */ ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_REFER; __attribute__((fallthrough)); case 2: /* Removes LANDLOCK_ACCESS_FS_TRUNCATE for ABI < 3 */ ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_TRUNCATE; __attribute__((fallthrough)); case 3: /* Removes network support for ABI < 4 */ ruleset_attr.handled_access_net &= ~(LANDLOCK_ACCESS_NET_BIND_TCP | LANDLOCK_ACCESS_NET_CONNECT_TCP); __attribute__((fallthrough)); case 4: /* Removes LANDLOCK_ACCESS_FS_IOCTL_DEV for ABI < 5 */ ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_IOCTL_DEV; __attribute__((fallthrough)); case 5: /* Removes LANDLOCK_SCOPE_* for ABI < 6 */ ruleset_attr.scoped &= ~(LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET | LANDLOCK_SCOPE_SIGNAL); }}hjsbah}(h]h ]h"]h$]h&]hhjjjj}uh1jhhhKahjhhubj)}(hNThis enables the creation of an inclusive ruleset that will contain our rules.h]hNThis enables the creation of an inclusive ruleset that will contain our rules.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhKhjhhubj)}(hint ruleset_fd; ruleset_fd = landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); if (ruleset_fd < 0) { perror("Failed to create a ruleset"); return 1; }h]hint ruleset_fd; ruleset_fd = landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); if (ruleset_fd < 0) { perror("Failed to create a ruleset"); return 1; }}hj+sbah}(h]h ]h"]h$]h&]hhjjjj}uh1jhhhKhjhhubj)}(hXWe can now add a new rule to this ruleset thanks to the returned file descriptor referring to this ruleset. The rule will only allow reading the file hierarchy ``/usr``. Without another rule, write actions would then be denied by the ruleset. To add ``/usr`` to the ruleset, we open it with the ``O_PATH`` flag and fill the &struct landlock_path_beneath_attr with this file descriptor.h](hWe can now add a new rule to this ruleset thanks to the returned file descriptor referring to this ruleset. The rule will only allow reading the file hierarchy }(hj:hhhNhNubjz)}(h``/usr``h]h/usr}(hjBhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj:ubhT. Without another rule, write actions would then be denied by the ruleset. To add }(hj:hhhNhNubjz)}(h``/usr``h]h/usr}(hjThhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj:ubh% to the ruleset, we open it with the }(hj:hhhNhNubjz)}(h ``O_PATH``h]hO_PATH}(hjfhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj:ubhP flag and fill the &struct landlock_path_beneath_attr with this file descriptor.}(hj:hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKhjhhubj)}(hXQint err; struct landlock_path_beneath_attr path_beneath = { .allowed_access = LANDLOCK_ACCESS_FS_EXECUTE | LANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_READ_DIR, }; path_beneath.parent_fd = open("/usr", O_PATH | O_CLOEXEC); if (path_beneath.parent_fd < 0) { perror("Failed to open file"); close(ruleset_fd); return 1; } err = landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH, &path_beneath, 0); close(path_beneath.parent_fd); if (err) { perror("Failed to update ruleset"); close(ruleset_fd); return 1; }h]hXQint err; struct landlock_path_beneath_attr path_beneath = { .allowed_access = LANDLOCK_ACCESS_FS_EXECUTE | LANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_READ_DIR, }; path_beneath.parent_fd = open("/usr", O_PATH | O_CLOEXEC); if (path_beneath.parent_fd < 0) { perror("Failed to open file"); close(ruleset_fd); return 1; } err = landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH, &path_beneath, 0); close(path_beneath.parent_fd); if (err) { perror("Failed to update ruleset"); close(ruleset_fd); return 1; }}hj~sbah}(h]h ]h"]h$]h&]hhjjjj}uh1jhhhKhjhhubj)}(hX'It may also be required to create rules following the same logic as explained for the ruleset creation, by filtering access rights according to the Landlock ABI version. In this example, this is not required because all of the requested ``allowed_access`` rights are already available in ABI 1.h](hIt may also be required to create rules following the same logic as explained for the ruleset creation, by filtering access rights according to the Landlock ABI version. In this example, this is not required because all of the requested }(hjhhhNhNubjz)}(h``allowed_access``h]hallowed_access}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjubh' rights are already available in ABI 1.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKhjhhubj)}(hFor network access-control, we can add a set of rules that allow to use a port number for a specific action: HTTPS connections.h]hFor network access-control, we can add a set of rules that allow to use a port number for a specific action: HTTPS connections.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhKhjhhubj)}(hstruct landlock_net_port_attr net_port = { .allowed_access = LANDLOCK_ACCESS_NET_CONNECT_TCP, .port = 443, }; err = landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &net_port, 0);h]hstruct landlock_net_port_attr net_port = { .allowed_access = LANDLOCK_ACCESS_NET_CONNECT_TCP, .port = 443, }; err = landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &net_port, 0);}hjsbah}(h]h ]h"]h$]h&]hhjjjj}uh1jhhhKhjhhubj)}(hX!The next step is to restrict the current thread from gaining more privileges (e.g. through a SUID binary). We now have a ruleset with the first rule allowing read access to ``/usr`` while denying all other handled accesses for the filesystem, and a second rule allowing HTTPS connections.h](hThe next step is to restrict the current thread from gaining more privileges (e.g. through a SUID binary). We now have a ruleset with the first rule allowing read access to }(hjhhhNhNubjz)}(h``/usr``h]h/usr}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjubhk while denying all other handled accesses for the filesystem, and a second rule allowing HTTPS connections.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKhjhhubj)}(hif (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { perror("Failed to restrict privileges"); close(ruleset_fd); return 1; }h]hif (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { perror("Failed to restrict privileges"); close(ruleset_fd); return 1; }}hjsbah}(h]h ]h"]h$]h&]hhjjjj}uh1jhhhKhjhhubj)}(hCThe current thread is now ready to sandbox itself with the ruleset.h]hCThe current thread is now ready to sandbox itself with the ruleset.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhKhjhhubj)}(hif (landlock_restrict_self(ruleset_fd, 0)) { perror("Failed to enforce ruleset"); close(ruleset_fd); return 1; } close(ruleset_fd);h]hif (landlock_restrict_self(ruleset_fd, 0)) { perror("Failed to enforce ruleset"); close(ruleset_fd); return 1; } close(ruleset_fd);}hjsbah}(h]h ]h"]h$]h&]hhjjjj}uh1jhhhKhjhhubj)}(hXIf the ``landlock_restrict_self`` system call succeeds, the current thread is now restricted and this policy will be enforced on all its subsequently created children as well. Once a thread is landlocked, there is no way to remove its security policy; only adding more restrictions is allowed. These threads are now in a new Landlock domain, which is a merger of their parent one (if any) with the new ruleset.h](hIf the }(hjhhhNhNubjz)}(h``landlock_restrict_self``h]hlandlock_restrict_self}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjubhX{ system call succeeds, the current thread is now restricted and this policy will be enforced on all its subsequently created children as well. Once a thread is landlocked, there is no way to remove its security policy; only adding more restrictions is allowed. These threads are now in a new Landlock domain, which is a merger of their parent one (if any) with the new ruleset.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKhjhhubj)}(hBFull working code can be found in `samples/landlock/sandboxer.c`_.h](h"Full working code can be found in }(hj6hhhNhNubh reference)}(h`samples/landlock/sandboxer.c`_h]hsamples/landlock/sandboxer.c}(hj@hhhNhNubah}(h]h ]h"]h$]h&]namesamples/landlock/sandboxer.crefuribhttps://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/samples/landlock/sandboxer.cuh1j>hj6resolvedKubh.}(hj6hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKhjhhubeh}(h](defining-and-enforcing-a-security-policyah ]h"](defining and enforcing a security policyah$]h&]uh1hhjhhhhhK0ubh)}(hhh](h)}(hGood practicesh]hGood practices}(hjhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjehhhhhKubj)}(hXIt is recommended to set access rights to file hierarchy leaves as much as possible. For instance, it is better to be able to have ``~/doc/`` as a read-only hierarchy and ``~/tmp/`` as a read-write hierarchy, compared to ``~/`` as a read-only hierarchy and ``~/tmp/`` as a read-write hierarchy. Following this good practice leads to self-sufficient hierarchies that do not depend on their location (i.e. parent directories). This is particularly relevant when we want to allow linking or renaming. Indeed, having consistent access rights per directory enables changing the location of such directories without relying on the destination directory access rights (except those that are required for this operation, see ``LANDLOCK_ACCESS_FS_REFER`` documentation).h](hIt is recommended to set access rights to file hierarchy leaves as much as possible. For instance, it is better to be able to have }(hjvhhhNhNubjz)}(h ``~/doc/``h]h~/doc/}(hj~hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjvubh as a read-only hierarchy and }(hjvhhhNhNubjz)}(h ``~/tmp/``h]h~/tmp/}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjvubh( as a read-write hierarchy, compared to }(hjvhhhNhNubjz)}(h``~/``h]h~/}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjvubh as a read-only hierarchy and }(hjvhhhNhNubjz)}(h ``~/tmp/``h]h~/tmp/}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjvubhX as a read-write hierarchy. Following this good practice leads to self-sufficient hierarchies that do not depend on their location (i.e. parent directories). This is particularly relevant when we want to allow linking or renaming. Indeed, having consistent access rights per directory enables changing the location of such directories without relying on the destination directory access rights (except those that are required for this operation, see }(hjvhhhNhNubjz)}(h``LANDLOCK_ACCESS_FS_REFER``h]hLANDLOCK_ACCESS_FS_REFER}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjvubh documentation).}(hjvhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKhjehhubj)}(hXHaving self-sufficient hierarchies also helps to tighten the required access rights to the minimal set of data. This also helps avoid sinkhole directories, i.e. directories where data can be linked to but not linked from. However, this depends on data organization, which might not be controlled by developers. In this case, granting read-write access to ``~/tmp/``, instead of write-only access, would potentially allow moving ``~/tmp/`` to a non-readable directory and still keep the ability to list the content of ``~/tmp/``.h](hXeHaving self-sufficient hierarchies also helps to tighten the required access rights to the minimal set of data. This also helps avoid sinkhole directories, i.e. directories where data can be linked to but not linked from. However, this depends on data organization, which might not be controlled by developers. In this case, granting read-write access to }(hjhhhNhNubjz)}(h ``~/tmp/``h]h~/tmp/}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjubh?, instead of write-only access, would potentially allow moving }(hjhhhNhNubjz)}(h ``~/tmp/``h]h~/tmp/}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjubhO to a non-readable directory and still keep the ability to list the content of }(hjhhhNhNubjz)}(h ``~/tmp/``h]h~/tmp/}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjubh.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKhjehhubeh}(h]good-practicesah ]h"]good practicesah$]h&]uh1hhjhhhhhKubh)}(hhh](h)}(h!Layers of file path access rightsh]h!Layers of file path access rights}(hj-hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj*hhhhhKubj)}(hX6Each time a thread enforces a ruleset on itself, it updates its Landlock domain with a new layer of policy. This complementary policy is stacked with any other rulesets potentially already restricting this thread. A sandboxed thread can then safely add more constraints to itself with a new enforced ruleset.h]hX6Each time a thread enforces a ruleset on itself, it updates its Landlock domain with a new layer of policy. This complementary policy is stacked with any other rulesets potentially already restricting this thread. A sandboxed thread can then safely add more constraints to itself with a new enforced ruleset.}(hj;hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhKhj*hhubj)}(hX9One policy layer grants access to a file path if at least one of its rules encountered on the path grants the access. A sandboxed thread can only access a file path if all its enforced policy layers grant the access as well as all the other system access controls (e.g. filesystem DAC, other LSM policies, etc.).h]hX9One policy layer grants access to a file path if at least one of its rules encountered on the path grants the access. A sandboxed thread can only access a file path if all its enforced policy layers grant the access as well as all the other system access controls (e.g. filesystem DAC, other LSM policies, etc.).}(hjIhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhMhj*hhubeh}(h]!layers-of-file-path-access-rightsah ]h"]!layers of file path access rightsah$]h&]uh1hhjhhhhhKubh)}(hhh](h)}(hBind mounts and OverlayFSh]hBind mounts and OverlayFS}(hjbhhhNhNubah}(h]h ]h"]h$]h&]uh1hhj_hhhhhM ubj)}(hLandlock enables restricting access to file hierarchies, which means that these access rights can be propagated with bind mounts (cf. Documentation/filesystems/sharedsubtree.rst) but not with Documentation/filesystems/overlayfs.rst.h]hLandlock enables restricting access to file hierarchies, which means that these access rights can be propagated with bind mounts (cf. Documentation/filesystems/sharedsubtree.rst) but not with Documentation/filesystems/overlayfs.rst.}(hjphhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhM hj_hhubj)}(hXA bind mount mirrors a source file hierarchy to a destination. The destination hierarchy is then composed of the exact same files, on which Landlock rules can be tied, either via the source or the destination path. These rules restrict access when they are encountered on a path, which means that they can restrict access to multiple file hierarchies at the same time, whether these hierarchies are the result of bind mounts or not.h]hXA bind mount mirrors a source file hierarchy to a destination. The destination hierarchy is then composed of the exact same files, on which Landlock rules can be tied, either via the source or the destination path. These rules restrict access when they are encountered on a path, which means that they can restrict access to multiple file hierarchies at the same time, whether these hierarchies are the result of bind mounts or not.}(hj~hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhMhj_hhubj)}(hXAn OverlayFS mount point consists of upper and lower layers. These layers are combined in a merge directory, and that merged directory becomes available at the mount point. This merge hierarchy may include files from the upper and lower layers, but modifications performed on the merge hierarchy only reflect on the upper layer. From a Landlock policy point of view, all OverlayFS layers and merge hierarchies are standalone and each contains their own set of files and directories, which is different from bind mounts. A policy restricting an OverlayFS layer will not restrict the resulted merged hierarchy, and vice versa. Landlock users should then only think about file hierarchies they want to allow access to, regardless of the underlying filesystem.h]hXAn OverlayFS mount point consists of upper and lower layers. These layers are combined in a merge directory, and that merged directory becomes available at the mount point. This merge hierarchy may include files from the upper and lower layers, but modifications performed on the merge hierarchy only reflect on the upper layer. From a Landlock policy point of view, all OverlayFS layers and merge hierarchies are standalone and each contains their own set of files and directories, which is different from bind mounts. A policy restricting an OverlayFS layer will not restrict the resulted merged hierarchy, and vice versa. Landlock users should then only think about file hierarchies they want to allow access to, regardless of the underlying filesystem.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhMhj_hhubeh}(h]bind-mounts-and-overlayfsah ]h"]bind mounts and overlayfsah$]h&]uh1hhjhhhhhM ubh)}(hhh](h)}(h Inheritanceh]h Inheritance}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhM#ubj)}(hXEvery new thread resulting from a :manpage:`clone(2)` inherits Landlock domain restrictions from its parent. This is similar to seccomp inheritance (cf. Documentation/userspace-api/seccomp_filter.rst) or any other LSM dealing with task's :manpage:`credentials(7)`. For instance, one process's thread may apply Landlock rules to itself, but they will not be automatically applied to other sibling threads (unlike POSIX thread credential changes, cf. :manpage:`nptl(7)`).h](h"Every new thread resulting from a }(hjhhhNhNubhmanpage)}(h:manpage:`clone(2)`h]hclone(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhpathclone(2)pageclonesection2uh1jhjubh inherits Landlock domain restrictions from its parent. This is similar to seccomp inheritance (cf. Documentation/userspace-api/seccomp_filter.rst) or any other LSM dealing with task’s }(hjhhhNhNubj)}(h:manpage:`credentials(7)`h]hcredentials(7)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhjcredentials(7)j credentialsj7uh1jhjubh. For instance, one process’s thread may apply Landlock rules to itself, but they will not be automatically applied to other sibling threads (unlike POSIX thread credential changes, cf. }(hjhhhNhNubj)}(h:manpage:`nptl(7)`h]hnptl(7)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhjnptl(7)jnptljjuh1jhjubh).}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhM%hjhhubj)}(hX?When a thread sandboxes itself, we have the guarantee that the related security policy will stay enforced on all this thread's descendants. This allows creating standalone and modular security policies per application, which will automatically be composed between themselves according to their runtime parent policies.h]hXAWhen a thread sandboxes itself, we have the guarantee that the related security policy will stay enforced on all this thread’s descendants. This allows creating standalone and modular security policies per application, which will automatically be composed between themselves according to their runtime parent policies.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhM-hjhhubeh}(h] inheritanceah ]h"] inheritanceah$]h&]uh1hhjhhhhhM#ubh)}(hhh](h)}(hPtrace restrictionsh]hPtrace restrictions}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhM4ubj)}(hXA sandboxed process has less privileges than a non-sandboxed process and must then be subject to additional restrictions when manipulating another process. To be allowed to use :manpage:`ptrace(2)` and related syscalls on a target process, a sandboxed process should have a superset of the target process's access rights, which means the tracee must be in a sub-domain of the tracer.h](hA sandboxed process has less privileges than a non-sandboxed process and must then be subject to additional restrictions when manipulating another process. To be allowed to use }(hj+hhhNhNubj)}(h:manpage:`ptrace(2)`h]h ptrace(2)}(hj3hhhNhNubah}(h]h ]jah"]h$]h&]hhj ptrace(2)jptracejjuh1jhj+ubh and related syscalls on a target process, a sandboxed process should have a superset of the target process’s access rights, which means the tracee must be in a sub-domain of the tracer.}(hj+hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhM6hjhhubeh}(h]ptrace-restrictionsah ]h"]ptrace restrictionsah$]h&]uh1hhjhhhhhM4 referencedKubh)}(hhh](h)}(h IPC scopingh]h IPC scoping}(hjYhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjVhhhhhM=ubj)}(hX`Similar to the implicit `Ptrace restrictions`_, we may want to further restrict interactions between sandboxes. Therefore, at ruleset creation time, each Landlock domain can restrict the scope for certain operations, so that these operations can only reach out to processes within the same Landlock domain or in a nested Landlock domain (the "scope").h](hSimilar to the implicit }(hjghhhNhNubj?)}(h`Ptrace restrictions`_h]hPtrace restrictions}(hjohhhNhNubah}(h]h ]h"]h$]h&]namePtrace restrictionsrefidjOuh1j>hjgjRKubhX6, we may want to further restrict interactions between sandboxes. Therefore, at ruleset creation time, each Landlock domain can restrict the scope for certain operations, so that these operations can only reach out to processes within the same Landlock domain or in a nested Landlock domain (the “scope”).}(hjghhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhM?hjVhhubj)}(h'The operations which can be scoped are:h]h'The operations which can be scoped are:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhMEhjVhhubj)}(hhh](j)}(h``LANDLOCK_SCOPE_SIGNAL`` This limits the sending of signals to target processes which run within the same or a nested Landlock domain. h](j)}(h``LANDLOCK_SCOPE_SIGNAL``h]jz)}(hjh]hLANDLOCK_SCOPE_SIGNAL}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjubah}(h]h ]h"]h$]h&]uh1jhhhMIhjubj))}(hhh]j)}(hmThis limits the sending of signals to target processes which run within the same or a nested Landlock domain.h]hmThis limits the sending of signals to target processes which run within the same or a nested Landlock domain.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhMHhjubah}(h]h ]h"]h$]h&]uh1j(hjubeh}(h]h ]h"]h$]h&]uh1jhhhMIhjubj)}(hXN``LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET`` This limits the set of abstract :manpage:`unix(7)` sockets to which we can :manpage:`connect(2)` to socket addresses which were created by a process in the same or a nested Landlock domain. A :manpage:`sendto(2)` on a non-connected datagram socket is treated as if it were doing an implicit :manpage:`connect(2)` and will be blocked if the remote end does not stem from the same or a nested Landlock domain. A :manpage:`sendto(2)` on a socket which was previously connected will not be restricted. This works for both datagram and stream sockets. h](j)}(h'``LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET``h]jz)}(hjh]h#LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjubah}(h]h ]h"]h$]h&]uh1jhhhMUhjubj))}(hhh](j)}(hThis limits the set of abstract :manpage:`unix(7)` sockets to which we can :manpage:`connect(2)` to socket addresses which were created by a process in the same or a nested Landlock domain.h](h This limits the set of abstract }(hjhhhNhNubj)}(h:manpage:`unix(7)`h]hunix(7)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhjunix(7)junixjjuh1jhjubh sockets to which we can }(hjhhhNhNubj)}(h:manpage:`connect(2)`h]h connect(2)}(hj hhhNhNubah}(h]h ]jah"]h$]h&]hhj connect(2)jconnectjjuh1jhjubh] to socket addresses which were created by a process in the same or a nested Landlock domain.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhMLhjubj)}(hA :manpage:`sendto(2)` on a non-connected datagram socket is treated as if it were doing an implicit :manpage:`connect(2)` and will be blocked if the remote end does not stem from the same or a nested Landlock domain.h](hA }(hj'hhhNhNubj)}(h:manpage:`sendto(2)`h]h sendto(2)}(hj/hhhNhNubah}(h]h ]jah"]h$]h&]hhj sendto(2)jsendtojjuh1jhj'ubhO on a non-connected datagram socket is treated as if it were doing an implicit }(hj'hhhNhNubj)}(h:manpage:`connect(2)`h]h connect(2)}(hjChhhNhNubah}(h]h ]jah"]h$]h&]hhj connect(2)jconnectjjuh1jhj'ubh_ and will be blocked if the remote end does not stem from the same or a nested Landlock domain.}(hj'hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhMPhjubj)}(hA :manpage:`sendto(2)` on a socket which was previously connected will not be restricted. This works for both datagram and stream sockets.h](hA }(hj]hhhNhNubj)}(h:manpage:`sendto(2)`h]h sendto(2)}(hjehhhNhNubah}(h]h ]jah"]h$]h&]hhj sendto(2)jsendtojjuh1jhj]ubhu on a socket which was previously connected will not be restricted. This works for both datagram and stream sockets.}(hj]hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhMThjubeh}(h]h ]h"]h$]h&]uh1j(hjubeh}(h]h ]h"]h$]h&]uh1jhhhMUhjhhubeh}(h]h ]h"]h$]h&]uh1j hjVhhhhhNubj)}(hIPC scoping does not support exceptions via :manpage:`landlock_add_rule(2)`. If an operation is scoped within a domain, no rules can be added to allow access to resources or processes outside of the scope.h](h,IPC scoping does not support exceptions via }(hjhhhNhNubj)}(h:manpage:`landlock_add_rule(2)`h]hlandlock_add_rule(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhjlandlock_add_rule(2)jlandlock_add_rulejjuh1jhjubh. If an operation is scoped within a domain, no rules can be added to allow access to resources or processes outside of the scope.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhMWhjVhhubeh}(h] ipc-scopingah ]h"] ipc scopingah$]h&]uh1hhjhhhhhM=ubh)}(hhh](h)}(hTruncating filesh]hTruncating files}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhM\ubj)}(hThe operations covered by ``LANDLOCK_ACCESS_FS_WRITE_FILE`` and ``LANDLOCK_ACCESS_FS_TRUNCATE`` both change the contents of a file and sometimes overlap in non-intuitive ways. It is recommended to always specify both of these together.h](hThe operations covered by }(hjhhhNhNubjz)}(h!``LANDLOCK_ACCESS_FS_WRITE_FILE``h]hLANDLOCK_ACCESS_FS_WRITE_FILE}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjubh and }(hjhhhNhNubjz)}(h``LANDLOCK_ACCESS_FS_TRUNCATE``h]hLANDLOCK_ACCESS_FS_TRUNCATE}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjubh both change the contents of a file and sometimes overlap in non-intuitive ways. It is recommended to always specify both of these together.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhM^hjhhubj)}(hA particularly surprising example is :manpage:`creat(2)`. The name suggests that this system call requires the rights to create and write files. However, it also requires the truncate right if an existing file under the same name is already present.h](h%A particularly surprising example is }(hjhhhNhNubj)}(h:manpage:`creat(2)`h]hcreat(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhjcreat(2)jcreatjjuh1jhjubh. The name suggests that this system call requires the rights to create and write files. However, it also requires the truncate right if an existing file under the same name is already present.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhMchjhhubj)}(hIt should also be noted that truncating files does not require the ``LANDLOCK_ACCESS_FS_WRITE_FILE`` right. Apart from the :manpage:`truncate(2)` system call, this can also be done through :manpage:`open(2)` with the flags ``O_RDONLY | O_TRUNC``.h](hCIt should also be noted that truncating files does not require the }(hj hhhNhNubjz)}(h!``LANDLOCK_ACCESS_FS_WRITE_FILE``h]hLANDLOCK_ACCESS_FS_WRITE_FILE}(hj(hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj ubh right. Apart from the }(hj hhhNhNubj)}(h:manpage:`truncate(2)`h]h truncate(2)}(hj:hhhNhNubah}(h]h ]jah"]h$]h&]hhj truncate(2)jtruncatejjuh1jhj ubh, system call, this can also be done through }(hj hhhNhNubj)}(h:manpage:`open(2)`h]hopen(2)}(hjNhhhNhNubah}(h]h ]jah"]h$]h&]hhjopen(2)jopenjjuh1jhj ubh with the flags }(hj hhhNhNubjz)}(h``O_RDONLY | O_TRUNC``h]hO_RDONLY | O_TRUNC}(hjbhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj ubh.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhMhhjhhubj)}(hBThe truncate right is associated with the opened file (see below).h]hBThe truncate right is associated with the opened file (see below).}(hjzhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhMmhjhhubeh}(h]truncating-filesah ]h"]truncating filesah$]h&]uh1hhjhhhhhM\ubh)}(hhh](h)}(h'Rights associated with file descriptorsh]h'Rights associated with file descriptors}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhMpubj)}(hXWhen opening a file, the availability of the ``LANDLOCK_ACCESS_FS_TRUNCATE`` and ``LANDLOCK_ACCESS_FS_IOCTL_DEV`` rights is associated with the newly created file descriptor and will be used for subsequent truncation and ioctl attempts using :manpage:`ftruncate(2)` and :manpage:`ioctl(2)`. The behavior is similar to opening a file for reading or writing, where permissions are checked during :manpage:`open(2)`, but not during the subsequent :manpage:`read(2)` and :manpage:`write(2)` calls.h](h-When opening a file, the availability of the }(hjhhhNhNubjz)}(h``LANDLOCK_ACCESS_FS_TRUNCATE``h]hLANDLOCK_ACCESS_FS_TRUNCATE}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjubh and }(hjhhhNhNubjz)}(h ``LANDLOCK_ACCESS_FS_IOCTL_DEV``h]hLANDLOCK_ACCESS_FS_IOCTL_DEV}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjubh rights is associated with the newly created file descriptor and will be used for subsequent truncation and ioctl attempts using }(hjhhhNhNubj)}(h:manpage:`ftruncate(2)`h]h ftruncate(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj ftruncate(2)j ftruncatejjuh1jhjubh and }(hjhhhNhNubj)}(h:manpage:`ioctl(2)`h]hioctl(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhjioctl(2)jioctljjuh1jhjubhj. The behavior is similar to opening a file for reading or writing, where permissions are checked during }(hjhhhNhNubj)}(h:manpage:`open(2)`h]hopen(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhjopen(2)jopenjjuh1jhjubh , but not during the subsequent }(hjhhhNhNubj)}(h:manpage:`read(2)`h]hread(2)}(hj hhhNhNubah}(h]h ]jah"]h$]h&]hhjread(2)jreadjjuh1jhjubh and }hjsbj)}(h:manpage:`write(2)`h]hwrite(2)}(hj hhhNhNubah}(h]h ]jah"]h$]h&]hhjwrite(2)jwritejjuh1jhjubh calls.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhMrhjhhubj)}(hXAs a consequence, it is possible that a process has multiple open file descriptors referring to the same file, but Landlock enforces different things when operating with these file descriptors. This can happen when a Landlock ruleset gets enforced and the process keeps file descriptors which were opened both before and after the enforcement. It is also possible to pass such file descriptors between processes, keeping their Landlock properties, even when some of the involved processes do not have an enforced Landlock ruleset.h]hXAs a consequence, it is possible that a process has multiple open file descriptors referring to the same file, but Landlock enforces different things when operating with these file descriptors. This can happen when a Landlock ruleset gets enforced and the process keeps file descriptors which were opened both before and after the enforcement. It is also possible to pass such file descriptors between processes, keeping their Landlock properties, even when some of the involved processes do not have an enforced Landlock ruleset.}(hj7 hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhMzhjhhubeh}(h]'rights-associated-with-file-descriptorsah ]h"]'rights associated with file descriptorsah$]h&]uh1hhjhhhhhMpubeh}(h]landlock-rulesah ]h"]landlock rulesah$]h&]uh1hhhhhhhhKubh)}(hhh](h)}(h Compatibilityh]h Compatibility}(hjX hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjU hhhhhMubh)}(hhh](h)}(h"Backward and forward compatibilityh]h"Backward and forward compatibility}(hji hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjf hhhhhMubj)}(hXLandlock is designed to be compatible with past and future versions of the kernel. This is achieved thanks to the system call attributes and the associated bitflags, particularly the ruleset's ``handled_access_fs``. Making handled access rights explicit enables the kernel and user space to have a clear contract with each other. This is required to make sure sandboxing will not get stricter with a system update, which could break applications.h](hLandlock is designed to be compatible with past and future versions of the kernel. This is achieved thanks to the system call attributes and the associated bitflags, particularly the ruleset’s }(hjw hhhNhNubjz)}(h``handled_access_fs``h]hhandled_access_fs}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjw ubh. Making handled access rights explicit enables the kernel and user space to have a clear contract with each other. This is required to make sure sandboxing will not get stricter with a system update, which could break applications.}(hjw hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhMhjf hhubj)}(hXDevelopers can subscribe to the `Landlock mailing list `_ to knowingly update and test their applications with the latest available features. In the interest of users, and because they may use different kernel versions, it is strongly encouraged to follow a best-effort security approach by checking the Landlock ABI version at runtime and only enforcing the supported features.h](h Developers can subscribe to the }(hj hhhNhNubj?)}(hK`Landlock mailing list `_h]hLandlock mailing list}(hj hhhNhNubah}(h]h ]h"]h$]h&]nameLandlock mailing listjP0https://subspace.kernel.org/lists.linux.dev.htmluh1j>hj ubhtarget)}(h3 h]h}(h]landlock-mailing-listah ]h"]landlock mailing listah$]h&]refurij uh1j jUKhj ubhXB to knowingly update and test their applications with the latest available features. In the interest of users, and because they may use different kernel versions, it is strongly encouraged to follow a best-effort security approach by checking the Landlock ABI version at runtime and only enforcing the supported features.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhMhjf hhubj )}(h.. _landlock_abi_versions:h]h}(h]h ]h"]h$]h&]jlandlock-abi-versionsuh1j hMhjf hhhhubeh}(h]"backward-and-forward-compatibilityah ]h"]"backward and forward compatibilityah$]h&]uh1hhjU hhhhhMubh)}(hhh](h)}(hLandlock ABI versionsh]hLandlock ABI versions}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj hhhhhMubj)}(hXThe Landlock ABI version can be read with the sys_landlock_create_ruleset() system call:h]hXThe Landlock ABI version can be read with the sys_landlock_create_ruleset() system call:}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhMhj hhubj)}(hXint abi; abi = landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_VERSION); if (abi < 0) { switch (errno) { case ENOSYS: printf("Landlock is not supported by the current kernel.\n"); break; case EOPNOTSUPP: printf("Landlock is currently disabled.\n"); break; } return 0; } if (abi >= 2) { printf("Landlock supports LANDLOCK_ACCESS_FS_REFER.\n"); }h]hXint abi; abi = landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_VERSION); if (abi < 0) { switch (errno) { case ENOSYS: printf("Landlock is not supported by the current kernel.\n"); break; case EOPNOTSUPP: printf("Landlock is currently disabled.\n"); break; } return 0; } if (abi >= 2) { printf("Landlock supports LANDLOCK_ACCESS_FS_REFER.\n"); }}hj sbah}(h]h ]h"]h$]h&]hhjjjj}uh1jhhhMhj hhubj)}(hThe following kernel interfaces are implicitly supported by the first ABI version. Features only supported from a specific version are explicitly marked as such.h]hThe following kernel interfaces are implicitly supported by the first ABI version. Features only supported from a specific version are explicitly marked as such.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhMhj hhubeh}(h](j id1eh ]h"](landlock abi versionslandlock_abi_versionseh$]h&]uh1hhjU hhhhhMexpect_referenced_by_name}j j sexpect_referenced_by_id}j j subeh}(h] compatibilityah ]h"] compatibilityah$]h&]uh1hhhhhhhhMubh)}(hhh](h)}(hKernel interfaceh]hKernel interface}(hj0 hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj- hhhhhMubh)}(hhh](h)}(h Access rightsh]h Access rights}(hjA hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj> hhhhhMubj)}(hA set of actions on kernel objects may be defined by an attribute (e.g. :c:type:`struct landlock_path_beneath_attr `) including a bitmask of access.h](hHA set of actions on kernel objects may be defined by an attribute (e.g. }(hjO hhhNhNubh)}(hH:c:type:`struct landlock_path_beneath_attr `h]jz)}(hjY h]h!struct landlock_path_beneath_attr}(hj[ hhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jyhjW ubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnjlandlock_path_beneath_attruh1hhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhKhjO ubh ) including a bitmask of access.}(hjO hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhjv hKhj> hhubh)}(hhh](h)}(hFilesystem flagsh]hFilesystem flags}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj hNhNubj)}(hThese flags enable to restrict a sandboxed process to a set of actions on files and directories. Files or directories opened before the sandboxing are not subject to these restrictions.h]hThese flags enable to restrict a sandboxed process to a set of actions on files and directories. Files or directories opened before the sandboxing are not subject to these restrictions.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhKhj ubj)}(h0The following access rights apply only to files:h]h0The following access rights apply only to files:}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhKhj ubh bullet_list)}(hhh](h list_item)}(h/``LANDLOCK_ACCESS_FS_EXECUTE``: Execute a file.h]j)}(hj h](jz)}(h``LANDLOCK_ACCESS_FS_EXECUTE``h]hLANDLOCK_ACCESS_FS_EXECUTE}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj ubh: Execute a file.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhKhj ubah}(h]h ]h"]h$]h&]uh1j hj ubj )}(hX``LANDLOCK_ACCESS_FS_WRITE_FILE``: Open a file with write access. When opening files for writing, you will often additionally need the ``LANDLOCK_ACCESS_FS_TRUNCATE`` right. In many cases, these system calls truncate existing files when overwriting them (e.g., :manpage:`creat(2)`).h]j)}(hX``LANDLOCK_ACCESS_FS_WRITE_FILE``: Open a file with write access. When opening files for writing, you will often additionally need the ``LANDLOCK_ACCESS_FS_TRUNCATE`` right. In many cases, these system calls truncate existing files when overwriting them (e.g., :manpage:`creat(2)`).h](jz)}(h!``LANDLOCK_ACCESS_FS_WRITE_FILE``h]hLANDLOCK_ACCESS_FS_WRITE_FILE}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj ubhg: Open a file with write access. When opening files for writing, you will often additionally need the }(hj hhhNhNubjz)}(h``LANDLOCK_ACCESS_FS_TRUNCATE``h]hLANDLOCK_ACCESS_FS_TRUNCATE}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj ubh` right. In many cases, these system calls truncate existing files when overwriting them (e.g., }(hj hhhNhNubj)}(h:manpage:`creat(2)`h]hcreat(2)}(hj hhhNhNubah}(h]h ]jah"]h$]h&]hhjcreat(2)jcreatjjuh1jhj ubh).}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhKhj ubah}(h]h ]h"]h$]h&]uh1j hj ubj )}(h?``LANDLOCK_ACCESS_FS_READ_FILE``: Open a file with read access.h]j)}(hj, h](jz)}(h ``LANDLOCK_ACCESS_FS_READ_FILE``h]hLANDLOCK_ACCESS_FS_READ_FILE}(hj1 hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj. ubh: Open a file with read access.}(hj. hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhKhj* ubah}(h]h ]h"]h$]h&]uh1j hj ubj )}(h``LANDLOCK_ACCESS_FS_TRUNCATE``: Truncate a file with :manpage:`truncate(2)`, :manpage:`ftruncate(2)`, :manpage:`creat(2)`, or :manpage:`open(2)` with ``O_TRUNC``. This access right is available since the third version of the Landlock ABI. h]j)}(h``LANDLOCK_ACCESS_FS_TRUNCATE``: Truncate a file with :manpage:`truncate(2)`, :manpage:`ftruncate(2)`, :manpage:`creat(2)`, or :manpage:`open(2)` with ``O_TRUNC``. This access right is available since the third version of the Landlock ABI.h](jz)}(h``LANDLOCK_ACCESS_FS_TRUNCATE``h]hLANDLOCK_ACCESS_FS_TRUNCATE}(hjX hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjT ubh: Truncate a file with }(hjT hhhNhNubj)}(h:manpage:`truncate(2)`h]h truncate(2)}(hjj hhhNhNubah}(h]h ]jah"]h$]h&]hhj truncate(2)jtruncatejjuh1jhjT ubh, }(hjT hhhNhNubj)}(h:manpage:`ftruncate(2)`h]h ftruncate(2)}(hj~ hhhNhNubah}(h]h ]jah"]h$]h&]hhj ftruncate(2)j ftruncatejjuh1jhjT ubh, }(hjT hhhNhNubj)}(h:manpage:`creat(2)`h]hcreat(2)}(hj hhhNhNubah}(h]h ]jah"]h$]h&]hhjcreat(2)jcreatjjuh1jhjT ubh, or }(hjT hhhNhNubj)}(h:manpage:`open(2)`h]hopen(2)}(hj hhhNhNubah}(h]h ]jah"]h$]h&]hhjopen(2)jopenjjuh1jhjT ubh with }(hjT hhhNhNubjz)}(h ``O_TRUNC``h]hO_TRUNC}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjT ubhN. This access right is available since the third version of the Landlock ABI.}(hjT hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhKhjP ubah}(h]h ]h"]h$]h&]uh1j hj ubeh}(h]h ]h"]h$]h&]bullet-uh1j hj hKhj ubj)}(hX'Whether an opened file can be truncated with :manpage:`ftruncate(2)` or used with `ioctl(2)` is determined during :manpage:`open(2)`, in the same way as read and write permissions are checked during :manpage:`open(2)` using ``LANDLOCK_ACCESS_FS_READ_FILE`` and ``LANDLOCK_ACCESS_FS_WRITE_FILE``.h](h-Whether an opened file can be truncated with }(hj hhhNhNubj)}(h:manpage:`ftruncate(2)`h]h ftruncate(2)}(hj hhhNhNubah}(h]h ]jah"]h$]h&]hhj ftruncate(2)j ftruncatejjuh1jhj ubh or used with }(hj hhhNhNubj6)}(h `ioctl(2)`h]hioctl(2)}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j5hj ubh is determined during }(hj hhhNhNubj)}(h:manpage:`open(2)`h]hopen(2)}(hj hhhNhNubah}(h]h ]jah"]h$]h&]hhjopen(2)jopenjjuh1jhj ubhC, in the same way as read and write permissions are checked during }(hj hhhNhNubj)}(h:manpage:`open(2)`h]hopen(2)}(hj# hhhNhNubah}(h]h ]jah"]h$]h&]hhjopen(2)jopenjjuh1jhj ubh using }(hj hhhNhNubjz)}(h ``LANDLOCK_ACCESS_FS_READ_FILE``h]hLANDLOCK_ACCESS_FS_READ_FILE}(hj7 hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj ubh and }(hj hhhNhNubjz)}(h!``LANDLOCK_ACCESS_FS_WRITE_FILE``h]hLANDLOCK_ACCESS_FS_WRITE_FILE}(hjI hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj ubh.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhKhj ubj)}(hA directory can receive access rights related to files or directories. The following access right is applied to the directory itself, and the directories beneath it:h]hA directory can receive access rights related to files or directories. The following access right is applied to the directory itself, and the directories beneath it:}(hjb hhhNhNubah}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhKhj ubj )}(hhh]j )}(hG``LANDLOCK_ACCESS_FS_READ_DIR``: Open a directory or list its content. h]j)}(hF``LANDLOCK_ACCESS_FS_READ_DIR``: Open a directory or list its content.h](jz)}(h``LANDLOCK_ACCESS_FS_READ_DIR``h]hLANDLOCK_ACCESS_FS_READ_DIR}(hj| hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjx ubh': Open a directory or list its content.}(hjx hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhKhjt ubah}(h]h ]h"]h$]h&]uh1j hjq ubah}(h]h ]h"]h$]h&]j j uh1j hj hKhj ubj)}(hhHowever, the following access rights only apply to the content of a directory, not the directory itself:h]hhHowever, the following access rights only apply to the content of a directory, not the directory itself:}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhKhj ubj )}(hhh](j )}(hK``LANDLOCK_ACCESS_FS_REMOVE_DIR``: Remove an empty directory or rename one.h]j)}(hj h](jz)}(h!``LANDLOCK_ACCESS_FS_REMOVE_DIR``h]hLANDLOCK_ACCESS_FS_REMOVE_DIR}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj ubh*: Remove an empty directory or rename one.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhKhj ubah}(h]h ]h"]h$]h&]uh1j hj ubj )}(h>``LANDLOCK_ACCESS_FS_REMOVE_FILE``: Unlink (or rename) a file.h]j)}(hj h](jz)}(h"``LANDLOCK_ACCESS_FS_REMOVE_FILE``h]hLANDLOCK_ACCESS_FS_REMOVE_FILE}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj ubh: Unlink (or rename) a file.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhKhj ubah}(h]h ]h"]h$]h&]uh1j hj ubj )}(hP``LANDLOCK_ACCESS_FS_MAKE_CHAR``: Create (or rename or link) a character device.h]j)}(hP``LANDLOCK_ACCESS_FS_MAKE_CHAR``: Create (or rename or link) a character device.h](jz)}(h ``LANDLOCK_ACCESS_FS_MAKE_CHAR``h]hLANDLOCK_ACCESS_FS_MAKE_CHAR}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj ubh0: Create (or rename or link) a character device.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhKhj ubah}(h]h ]h"]h$]h&]uh1j hj ubj )}(h@``LANDLOCK_ACCESS_FS_MAKE_DIR``: Create (or rename) a directory.h]j)}(hj( h](jz)}(h``LANDLOCK_ACCESS_FS_MAKE_DIR``h]hLANDLOCK_ACCESS_FS_MAKE_DIR}(hj- hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj* ubh!: Create (or rename) a directory.}(hj* hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhKhj& ubah}(h]h ]h"]h$]h&]uh1j hj ubj )}(hK``LANDLOCK_ACCESS_FS_MAKE_REG``: Create (or rename or link) a regular file.h]j)}(hjN h](jz)}(h``LANDLOCK_ACCESS_FS_MAKE_REG``h]hLANDLOCK_ACCESS_FS_MAKE_REG}(hjS hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjP ubh,: Create (or rename or link) a regular file.}(hjP hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhKhjL ubah}(h]h ]h"]h$]h&]uh1j hj ubj )}(hR``LANDLOCK_ACCESS_FS_MAKE_SOCK``: Create (or rename or link) a UNIX domain socket.h]j)}(hR``LANDLOCK_ACCESS_FS_MAKE_SOCK``: Create (or rename or link) a UNIX domain socket.h](jz)}(h ``LANDLOCK_ACCESS_FS_MAKE_SOCK``h]hLANDLOCK_ACCESS_FS_MAKE_SOCK}(hjz hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjv ubh2: Create (or rename or link) a UNIX domain socket.}(hjv hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhKhjr ubah}(h]h ]h"]h$]h&]uh1j hj ubj )}(hJ``LANDLOCK_ACCESS_FS_MAKE_FIFO``: Create (or rename or link) a named pipe.h]j)}(hj h](jz)}(h ``LANDLOCK_ACCESS_FS_MAKE_FIFO``h]hLANDLOCK_ACCESS_FS_MAKE_FIFO}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj ubh*: Create (or rename or link) a named pipe.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhKhj ubah}(h]h ]h"]h$]h&]uh1j hj ubj )}(hM``LANDLOCK_ACCESS_FS_MAKE_BLOCK``: Create (or rename or link) a block device.h]j)}(hj h](jz)}(h!``LANDLOCK_ACCESS_FS_MAKE_BLOCK``h]hLANDLOCK_ACCESS_FS_MAKE_BLOCK}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj ubh,: Create (or rename or link) a block device.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhKhj ubah}(h]h ]h"]h$]h&]uh1j hj ubj )}(hL``LANDLOCK_ACCESS_FS_MAKE_SYM``: Create (or rename or link) a symbolic link.h]j)}(hj h](jz)}(h``LANDLOCK_ACCESS_FS_MAKE_SYM``h]hLANDLOCK_ACCESS_FS_MAKE_SYM}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj ubh-: Create (or rename or link) a symbolic link.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhKhj ubah}(h]h ]h"]h$]h&]uh1j hj ubj )}(hX``LANDLOCK_ACCESS_FS_REFER``: Link or rename a file from or to a different directory (i.e. reparent a file hierarchy). This access right is available since the second version of the Landlock ABI. This is the only access right which is denied by default by any ruleset, even if the right is not specified as handled at ruleset creation time. The only way to make a ruleset grant this right is to explicitly allow it for a specific directory by adding a matching rule to the ruleset. In particular, when using the first Landlock ABI version, Landlock will always deny attempts to reparent files between different directories. In addition to the source and destination directories having the ``LANDLOCK_ACCESS_FS_REFER`` access right, the attempted link or rename operation must meet the following constraints: * The reparented file may not gain more access rights in the destination directory than it previously had in the source directory. If this is attempted, the operation results in an ``EXDEV`` error. * When linking or renaming, the ``LANDLOCK_ACCESS_FS_MAKE_*`` right for the respective file type must be granted for the destination directory. Otherwise, the operation results in an ``EACCES`` error. * When renaming, the ``LANDLOCK_ACCESS_FS_REMOVE_*`` right for the respective file type must be granted for the source directory. Otherwise, the operation results in an ``EACCES`` error. If multiple requirements are not met, the ``EACCES`` error code takes precedence over ``EXDEV``. h](j)}(hv``LANDLOCK_ACCESS_FS_REFER``: Link or rename a file from or to a different directory (i.e. reparent a file hierarchy).h](jz)}(h``LANDLOCK_ACCESS_FS_REFER``h]hLANDLOCK_ACCESS_FS_REFER}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjubhZ: Link or rename a file from or to a different directory (i.e. reparent a file hierarchy).}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhKhj ubj)}(hLThis access right is available since the second version of the Landlock ABI.h]hLThis access right is available since the second version of the Landlock ABI.}(hj,hhhNhNubah}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhKhj ubj)}(hXThis is the only access right which is denied by default by any ruleset, even if the right is not specified as handled at ruleset creation time. The only way to make a ruleset grant this right is to explicitly allow it for a specific directory by adding a matching rule to the ruleset.h]hXThis is the only access right which is denied by default by any ruleset, even if the right is not specified as handled at ruleset creation time. The only way to make a ruleset grant this right is to explicitly allow it for a specific directory by adding a matching rule to the ruleset.}(hj;hhhNhNubah}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhKhj ubj)}(hIn particular, when using the first Landlock ABI version, Landlock will always deny attempts to reparent files between different directories.h]hIn particular, when using the first Landlock ABI version, Landlock will always deny attempts to reparent files between different directories.}(hjJhhhNhNubah}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhKhj ubj)}(hIn addition to the source and destination directories having the ``LANDLOCK_ACCESS_FS_REFER`` access right, the attempted link or rename operation must meet the following constraints:h](hAIn addition to the source and destination directories having the }(hjYhhhNhNubjz)}(h``LANDLOCK_ACCESS_FS_REFER``h]hLANDLOCK_ACCESS_FS_REFER}(hjahhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjYubhZ access right, the attempted link or rename operation must meet the following constraints:}(hjYhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhMhj ubj )}(hhh](j )}(hThe reparented file may not gain more access rights in the destination directory than it previously had in the source directory. If this is attempted, the operation results in an ``EXDEV`` error. h]j)}(hThe reparented file may not gain more access rights in the destination directory than it previously had in the source directory. If this is attempted, the operation results in an ``EXDEV`` error.h](hThe reparented file may not gain more access rights in the destination directory than it previously had in the source directory. If this is attempted, the operation results in an }(hjhhhNhNubjz)}(h ``EXDEV``h]hEXDEV}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjubh error.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhMhj}ubah}(h]h ]h"]h$]h&]uh1j hjzubj )}(hWhen linking or renaming, the ``LANDLOCK_ACCESS_FS_MAKE_*`` right for the respective file type must be granted for the destination directory. Otherwise, the operation results in an ``EACCES`` error. h]j)}(hWhen linking or renaming, the ``LANDLOCK_ACCESS_FS_MAKE_*`` right for the respective file type must be granted for the destination directory. Otherwise, the operation results in an ``EACCES`` error.h](hWhen linking or renaming, the }(hjhhhNhNubjz)}(h``LANDLOCK_ACCESS_FS_MAKE_*``h]hLANDLOCK_ACCESS_FS_MAKE_*}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjubhz right for the respective file type must be granted for the destination directory. Otherwise, the operation results in an }(hjhhhNhNubjz)}(h ``EACCES``h]hEACCES}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjubh error.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhM hjubah}(h]h ]h"]h$]h&]uh1j hjzubj )}(hWhen renaming, the ``LANDLOCK_ACCESS_FS_REMOVE_*`` right for the respective file type must be granted for the source directory. Otherwise, the operation results in an ``EACCES`` error. h]j)}(hWhen renaming, the ``LANDLOCK_ACCESS_FS_REMOVE_*`` right for the respective file type must be granted for the source directory. Otherwise, the operation results in an ``EACCES`` error.h](hWhen renaming, the }(hjhhhNhNubjz)}(h``LANDLOCK_ACCESS_FS_REMOVE_*``h]hLANDLOCK_ACCESS_FS_REMOVE_*}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjubhv right for the respective file type must be granted for the source directory. Otherwise, the operation results in an }(hjhhhNhNubjz)}(h ``EACCES``h]hEACCES}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjubh error.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhM hjubah}(h]h ]h"]h$]h&]uh1j hjzubeh}(h]h ]h"]h$]h&]j *uh1j hjhMhj ubj)}(h`If multiple requirements are not met, the ``EACCES`` error code takes precedence over ``EXDEV``.h](h*If multiple requirements are not met, the }(hj)hhhNhNubjz)}(h ``EACCES``h]hEACCES}(hj1hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj)ubh" error code takes precedence over }(hj)hhhNhNubjz)}(h ``EXDEV``h]hEXDEV}(hjChhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj)ubh.}(hj)hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhMhj ubeh}(h]h ]h"]h$]h&]uh1j hj ubeh}(h]h ]h"]h$]h&]j j uh1j hj hKhj ubj)}(hAThe following access right applies both to files and directories:h]hAThe following access right applies both to files and directories:}(hjhhhhNhNubah}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhMhj ubj )}(hhh]j )}(hX~``LANDLOCK_ACCESS_FS_IOCTL_DEV``: Invoke :manpage:`ioctl(2)` commands on an opened character or block device. This access right applies to all `ioctl(2)` commands implemented by device drivers. However, the following common IOCTL commands continue to be invokable independent of the ``LANDLOCK_ACCESS_FS_IOCTL_DEV`` right: * IOCTL commands targeting file descriptors (``FIOCLEX``, ``FIONCLEX``), * IOCTL commands targeting file descriptions (``FIONBIO``, ``FIOASYNC``), * IOCTL commands targeting file systems (``FIFREEZE``, ``FITHAW``, ``FIGETBSZ``, ``FS_IOC_GETFSUUID``, ``FS_IOC_GETFSSYSFSPATH``) * Some IOCTL commands which do not make sense when used with devices, but whose implementations are safe and return the right error codes (``FS_IOC_FIEMAP``, ``FICLONE``, ``FICLONERANGE``, ``FIDEDUPERANGE``) This access right is available since the fifth version of the Landlock ABI. h](j)}(hm``LANDLOCK_ACCESS_FS_IOCTL_DEV``: Invoke :manpage:`ioctl(2)` commands on an opened character or block device.h](jz)}(h ``LANDLOCK_ACCESS_FS_IOCTL_DEV``h]hLANDLOCK_ACCESS_FS_IOCTL_DEV}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj~ubh : Invoke }(hj~hhhNhNubj)}(h:manpage:`ioctl(2)`h]hioctl(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhjioctl(2)jioctljjuh1jhj~ubh1 commands on an opened character or block device.}(hj~hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhMhjzubj)}(hThis access right applies to all `ioctl(2)` commands implemented by device drivers. However, the following common IOCTL commands continue to be invokable independent of the ``LANDLOCK_ACCESS_FS_IOCTL_DEV`` right:h](h!This access right applies to all }(hjhhhNhNubj6)}(h `ioctl(2)`h]hioctl(2)}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j5hjubh commands implemented by device drivers. However, the following common IOCTL commands continue to be invokable independent of the }(hjhhhNhNubjz)}(h ``LANDLOCK_ACCESS_FS_IOCTL_DEV``h]hLANDLOCK_ACCESS_FS_IOCTL_DEV}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjubh right:}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhMhjzubj )}(hhh](j )}(hFIOCTL commands targeting file descriptors (``FIOCLEX``, ``FIONCLEX``),h]j)}(hjh](h+IOCTL commands targeting file descriptors (}(hjhhhNhNubjz)}(h ``FIOCLEX``h]hFIOCLEX}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjubh, }(hjhhhNhNubjz)}(h ``FIONCLEX``h]hFIONCLEX}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjubh),}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhMhjubah}(h]h ]h"]h$]h&]uh1j hjubj )}(hGIOCTL commands targeting file descriptions (``FIONBIO``, ``FIOASYNC``),h]j)}(hj#h](h,IOCTL commands targeting file descriptions (}(hj%hhhNhNubjz)}(h ``FIONBIO``h]hFIONBIO}(hj,hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj%ubh, }(hj%hhhNhNubjz)}(h ``FIOASYNC``h]hFIOASYNC}(hj>hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj%ubh),}(hj%hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhMhj!ubah}(h]h ]h"]h$]h&]uh1j hjubj )}(hIOCTL commands targeting file systems (``FIFREEZE``, ``FITHAW``, ``FIGETBSZ``, ``FS_IOC_GETFSUUID``, ``FS_IOC_GETFSSYSFSPATH``)h]j)}(hIOCTL commands targeting file systems (``FIFREEZE``, ``FITHAW``, ``FIGETBSZ``, ``FS_IOC_GETFSUUID``, ``FS_IOC_GETFSSYSFSPATH``)h](h'IOCTL commands targeting file systems (}(hjahhhNhNubjz)}(h ``FIFREEZE``h]hFIFREEZE}(hjihhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjaubh, }(hjahhhNhNubjz)}(h ``FITHAW``h]hFITHAW}(hj{hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjaubh, }(hjahhhNhNubjz)}(h ``FIGETBSZ``h]hFIGETBSZ}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjaubh, }hjasbjz)}(h``FS_IOC_GETFSUUID``h]hFS_IOC_GETFSUUID}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjaubh, }hjasbjz)}(h``FS_IOC_GETFSSYSFSPATH``h]hFS_IOC_GETFSSYSFSPATH}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjaubh)}(hjahhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhMhj]ubah}(h]h ]h"]h$]h&]uh1j hjubj )}(hSome IOCTL commands which do not make sense when used with devices, but whose implementations are safe and return the right error codes (``FS_IOC_FIEMAP``, ``FICLONE``, ``FICLONERANGE``, ``FIDEDUPERANGE``) h]j)}(hSome IOCTL commands which do not make sense when used with devices, but whose implementations are safe and return the right error codes (``FS_IOC_FIEMAP``, ``FICLONE``, ``FICLONERANGE``, ``FIDEDUPERANGE``)h](hSome IOCTL commands which do not make sense when used with devices, but whose implementations are safe and return the right error codes (}(hjhhhNhNubjz)}(h``FS_IOC_FIEMAP``h]h FS_IOC_FIEMAP}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjubh, }(hjhhhNhNubjz)}(h ``FICLONE``h]hFICLONE}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjubh, }hjsbjz)}(h``FICLONERANGE``h]h FICLONERANGE}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjubh, }hjsbjz)}(h``FIDEDUPERANGE``h]h FIDEDUPERANGE}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjubh)}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhM!hjubah}(h]h ]h"]h$]h&]uh1j hjubeh}(h]h ]h"]h$]h&]j j(uh1j hjhMhjzubj)}(hKThis access right is available since the fifth version of the Landlock ABI.h]hKThis access right is available since the fifth version of the Landlock ABI.}(hj7hhhNhNubah}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhM%hjzubeh}(h]h ]h"]h$]h&]uh1j hjwubah}(h]h ]h"]h$]h&]j j uh1j hjhMhj ubhwarning)}(hXfIt is currently not possible to restrict some file-related actions accessible through these syscall families: :manpage:`chdir(2)`, :manpage:`stat(2)`, :manpage:`flock(2)`, :manpage:`chmod(2)`, :manpage:`chown(2)`, :manpage:`setxattr(2)`, :manpage:`utime(2)`, :manpage:`fcntl(2)`, :manpage:`access(2)`. Future Landlock evolutions will enable to restrict them.h]j)}(hXfIt is currently not possible to restrict some file-related actions accessible through these syscall families: :manpage:`chdir(2)`, :manpage:`stat(2)`, :manpage:`flock(2)`, :manpage:`chmod(2)`, :manpage:`chown(2)`, :manpage:`setxattr(2)`, :manpage:`utime(2)`, :manpage:`fcntl(2)`, :manpage:`access(2)`. Future Landlock evolutions will enable to restrict them.h](hnIt is currently not possible to restrict some file-related actions accessible through these syscall families: }(hjXhhhNhNubj)}(h:manpage:`chdir(2)`h]hchdir(2)}(hj`hhhNhNubah}(h]h ]jah"]h$]h&]hhjchdir(2)jchdirjjuh1jhjXubh, }(hjXhhhNhNubj)}(h:manpage:`stat(2)`h]hstat(2)}(hjthhhNhNubah}(h]h ]jah"]h$]h&]hhjstat(2)jstatjjuh1jhjXubh, }(hjXhhhNhNubj)}(h:manpage:`flock(2)`h]hflock(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhjflock(2)jflockjjuh1jhjXubh, }hjXsbj)}(h:manpage:`chmod(2)`h]hchmod(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhjchmod(2)jchmodjjuh1jhjXubh, }hjXsbj)}(h:manpage:`chown(2)`h]hchown(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhjchown(2)jchownjjuh1jhjXubh, }hjXsbj)}(h:manpage:`setxattr(2)`h]h setxattr(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj setxattr(2)jsetxattrjjuh1jhjXubh, }hjXsbj)}(h:manpage:`utime(2)`h]hutime(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhjutime(2)jutimejjuh1jhjXubh, }hjXsbj)}(h:manpage:`fcntl(2)`h]hfcntl(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhjfcntl(2)jfcntljjuh1jhjXubh, }hjXsbj)}(h:manpage:`access(2)`h]h access(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj access(2)jaccessjjuh1jhjXubh:. Future Landlock evolutions will enable to restrict them.}(hjXhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhM*hjTubah}(h]h ]h"]h$]h&]uh1jRhj ubeh}(h]filesystem-flagsah ]h"]filesystem flagsah$]h&]uh1hhj> hhhNhNjUKubh)}(hhh](h)}(h Network flagsh]h Network flags}(hj,hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj)hNhNubj)}(hOThese flags enable to restrict a sandboxed process to a set of network actions.h]hOThese flags enable to restrict a sandboxed process to a set of network actions.}(hj:hhhNhNubah}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhMJhj)ubj)}(h/This is supported since Landlock ABI version 4.h]h/This is supported since Landlock ABI version 4.}(hjIhhhNhNubah}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhMMhj)ubj)}(h6The following access rights apply to TCP port numbers:h]h6The following access rights apply to TCP port numbers:}(hjXhhhNhNubah}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhMOhj)ubj )}(hhh](j )}(hD``LANDLOCK_ACCESS_NET_BIND_TCP``: Bind a TCP socket to a local port.h]j)}(hjlh](jz)}(h ``LANDLOCK_ACCESS_NET_BIND_TCP``h]hLANDLOCK_ACCESS_NET_BIND_TCP}(hjqhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjnubh$: Bind a TCP socket to a local port.}(hjnhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhMQhjjubah}(h]h ]h"]h$]h&]uh1j hjgubj )}(hT``LANDLOCK_ACCESS_NET_CONNECT_TCP``: Connect an active TCP socket to a remote port. h]j)}(hS``LANDLOCK_ACCESS_NET_CONNECT_TCP``: Connect an active TCP socket to a remote port.h](jz)}(h#``LANDLOCK_ACCESS_NET_CONNECT_TCP``h]hLANDLOCK_ACCESS_NET_CONNECT_TCP}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjubh0: Connect an active TCP socket to a remote port.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhMRhjubah}(h]h ]h"]h$]h&]uh1j hjgubeh}(h]h ]h"]h$]h&]j j uh1j hjhMQhj)ubeh}(h] network-flagsah ]h"] network flagsah$]h&]uh1hhj> hhhNhNjUKubh)}(hhh](h)}(h Scope flagsh]h Scope flags}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhNhNubj)}(hThese flags enable to isolate a sandboxed process from a set of IPC actions. Setting a flag for a ruleset will isolate the Landlock domain to forbid connections to resources outside the domain.h]hThese flags enable to isolate a sandboxed process from a set of IPC actions. Setting a flag for a ruleset will isolate the Landlock domain to forbid connections to resources outside the domain.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhM`hjubj)}(h/This is supported since Landlock ABI version 6.h]h/This is supported since Landlock ABI version 6.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhMdhjubj)}(hScopes:h]hScopes:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhMfhjubj )}(hhh](j )}(h``LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET``: Restrict a sandboxed process from connecting to an abstract UNIX socket created by a process outside the related Landlock domain (e.g., a parent domain or a non-sandboxed process).h]j)}(h``LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET``: Restrict a sandboxed process from connecting to an abstract UNIX socket created by a process outside the related Landlock domain (e.g., a parent domain or a non-sandboxed process).h](jz)}(h'``LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET``h]h#LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj ubh: Restrict a sandboxed process from connecting to an abstract UNIX socket created by a process outside the related Landlock domain (e.g., a parent domain or a non-sandboxed process).}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhMhhjubah}(h]h ]h"]h$]h&]uh1j hjubj )}(hu``LANDLOCK_SCOPE_SIGNAL``: Restrict a sandboxed process from sending a signal to another process outside the domain. h]j)}(ht``LANDLOCK_SCOPE_SIGNAL``: Restrict a sandboxed process from sending a signal to another process outside the domain.h](jz)}(h``LANDLOCK_SCOPE_SIGNAL``h]hLANDLOCK_SCOPE_SIGNAL}(hj5hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj1ubh[: Restrict a sandboxed process from sending a signal to another process outside the domain.}(hj1hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:444: ./include/uapi/linux/landlock.hhMkhj-ubah}(h]h ]h"]h$]h&]uh1j hjubeh}(h]h ]h"]h$]h&]j j uh1j hj&hMhhjubeh}(h] scope-flagsah ]h"] scope flagsah$]h&]uh1hhj> hhhNhNjUKubeh}(h] access-rightsah ]h"] access rightsah$]h&]uh1hhj- hhhhhMubh)}(hhh](h)}(hCreating a new ruleseth]hCreating a new ruleset}(hjmhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjjhhhhhMubhindex)}(hhh]h}(h]h ]h"]h$]h&]entries](single(sys_landlock_create_ruleset (C function)c.sys_landlock_create_rulesethNtauh1j{hjjhhhNhNubhdesc)}(hhh](hdesc_signature)}(h~long sys_landlock_create_ruleset (const struct landlock_ruleset_attr __user *const attr, const size_t size, const __u32 flags)h]hdesc_signature_line)}(h}long sys_landlock_create_ruleset(const struct landlock_ruleset_attr __user *const attr, const size_t size, const __u32 flags)h](hdesc_sig_keyword_type)}(hlongh]hlong}(hjhhhNhNubah}(h]h ]ktah"]h$]h&]uh1jhjhhhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:450: ./security/landlock/syscalls.chKubhdesc_sig_space)}(h h]h }(hjhhhNhNubah}(h]h ]wah"]h$]h&]uh1jhjhhhjhKubh desc_name)}(hsys_landlock_create_ruleseth]h desc_sig_name)}(hsys_landlock_create_ruleseth]hsys_landlock_create_ruleset}(hjhhhNhNubah}(h]h ]nah"]h$]h&]uh1jhjubah}(h]h ](sig-namedescnameeh"]h$]h&]hhuh1jhjhhhjhKubhdesc_parameterlist)}(h](const struct landlock_ruleset_attr __user *const attr, const size_t size, const __u32 flags)h](hdesc_parameter)}(h5const struct landlock_ruleset_attr __user *const attrh](hdesc_sig_keyword)}(hconsth]hconst}(hjhhhNhNubah}(h]h ]kah"]h$]h&]uh1jhjubj)}(h h]h }(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubj)}(hstructh]hstruct}(hj hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubj)}(h h]h }(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubh)}(hhh]j)}(hlandlock_ruleset_attrh]hlandlock_ruleset_attr}(hj)hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj&ubah}(h]h ]h"]h$]h&] refdomainjreftype identifier reftargetj+modnameN classnameN c:parent_keysphinx.domains.c LookupKey)}data]jD ASTIdentifier)}j?jsbc.sys_landlock_create_rulesetasbuh1hhjubj)}(h h]h }(hjQhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubh__user}(hjhhhNhNubj)}(h h]h }(hjchhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubhdesc_sig_punctuation)}(hj(h]h*}(hjshhhNhNubah}(h]h ]pah"]h$]h&]uh1jqhjubj)}(hjh]hconst}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubj)}(h h]h }(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubj)}(hattrh]hattr}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]noemphhhuh1jhjubj)}(hconst size_t sizeh](j)}(hjh]hconst}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubj)}(h h]h }(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubh)}(hhh]j)}(hsize_th]hsize_t}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&] refdomainjreftypej? reftargetjmodnameN classnameNjCjF)}jI]jMc.sys_landlock_create_rulesetasbuh1hhjubj)}(h h]h }(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubj)}(hsizeh]hsize}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]noemphhhuh1jhjubj)}(hconst __u32 flagsh](j)}(hjh]hconst}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubj)}(h h]h }(hj%hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubh)}(hhh]j)}(h__u32h]h__u32}(hj6hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj3ubah}(h]h ]h"]h$]h&] refdomainjreftypej? reftargetj8modnameN classnameNjCjF)}jI]jMc.sys_landlock_create_rulesetasbuh1hhjubj)}(h h]h }(hjThhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubj)}(hflagsh]hflags}(hjbhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]noemphhhuh1jhjubeh}(h]h ]h"]h$]h&]hhuh1jhjhhhjhKubeh}(h]h ]h"]h$]h&]hh add_permalinkuh1jsphinx_line_type declaratorhjhhhjhKubah}(h]jah ](sig sig-objecteh"]h$]h&] is_multiline _toc_parts) _toc_namehuh1jhjhKhjhhubh desc_content)}(hhh]j)}(hCreate a new ruleseth]hCreate a new ruleset}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:450: ./security/landlock/syscalls.chKhjhhubah}(h]h ]h"]h$]h&]uh1jhjhhhjhKubeh}(h]h ](jfunctioneh"]h$]h&]domainjobjtypejdesctypejnoindex noindexentrynocontentsentryuh1jhhhjjhNhNubh container)}(hX**Parameters** ``const struct landlock_ruleset_attr __user *const attr`` Pointer to a :c:type:`struct landlock_ruleset_attr ` identifying the scope of the new ruleset. ``const size_t size`` Size of the pointed :c:type:`struct landlock_ruleset_attr ` (needed for backward and forward compatibility). ``const __u32 flags`` Supported values: - ``LANDLOCK_CREATE_RULESET_VERSION`` - ``LANDLOCK_CREATE_RULESET_ERRATA`` **Description** This system call enables to create a new Landlock ruleset, and returns the related file descriptor on success. If ``LANDLOCK_CREATE_RULESET_VERSION`` or ``LANDLOCK_CREATE_RULESET_ERRATA`` is set, then **attr** must be NULL and **size** must be 0. Possible returned errors are: - ``EOPNOTSUPP``: Landlock is supported by the kernel but disabled at boot time; - ``EINVAL``: unknown **flags**, or unknown access, or unknown scope, or too small **size**; - ``E2BIG``: **attr** or **size** inconsistencies; - ``EFAULT``: **attr** or **size** inconsistencies; - ``ENOMSG``: empty :c:type:`landlock_ruleset_attr.handled_access_fs `. .. kernel-doc:: include/uapi/linux/landlock.h :identifiers: landlock_create_ruleset_flagsh](j)}(h**Parameters**h]hstrong)}(hjh]h Parameters}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:450: ./security/landlock/syscalls.chKhjubj)}(hhh](j)}(h``const struct landlock_ruleset_attr __user *const attr`` Pointer to a :c:type:`struct landlock_ruleset_attr ` identifying the scope of the new ruleset. h](j)}(h9``const struct landlock_ruleset_attr __user *const attr``h]jz)}(hjh]h5const struct landlock_ruleset_attr __user *const attr}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjubah}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:450: ./security/landlock/syscalls.chKhjubj))}(hhh]j)}(huPointer to a :c:type:`struct landlock_ruleset_attr ` identifying the scope of the new ruleset.h](h Pointer to a }(hjhhhNhNubh)}(h>:c:type:`struct landlock_ruleset_attr `h]jz)}(hjh]hstruct landlock_ruleset_attr}(hjhhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jyhjubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnjCjF)}jI]sbjlandlock_ruleset_attruh1hhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:450: ./security/landlock/syscalls.chKhjubh* identifying the scope of the new ruleset.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhj$hKhjubah}(h]h ]h"]h$]h&]uh1j(hjubeh}(h]h ]h"]h$]h&]uh1jhjhKhjubj)}(h``const size_t size`` Size of the pointed :c:type:`struct landlock_ruleset_attr ` (needed for backward and forward compatibility). h](j)}(h``const size_t size``h]jz)}(hjAh]hconst size_t size}(hjChhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj?ubah}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:450: ./security/landlock/syscalls.chKhj;ubj))}(hhh]j)}(hSize of the pointed :c:type:`struct landlock_ruleset_attr ` (needed for backward and forward compatibility).h](hSize of the pointed }(hjZhhhNhNubh)}(h>:c:type:`struct landlock_ruleset_attr `h]jz)}(hjdh]hstruct landlock_ruleset_attr}(hjfhhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jyhjbubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnjCj jlandlock_ruleset_attruh1hhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:450: ./security/landlock/syscalls.chKhjZubh1 (needed for backward and forward compatibility).}(hjZhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhjhKhjWubah}(h]h ]h"]h$]h&]uh1j(hj;ubeh}(h]h ]h"]h$]h&]uh1jhjVhKhjubj)}(ht``const __u32 flags`` Supported values: - ``LANDLOCK_CREATE_RULESET_VERSION`` - ``LANDLOCK_CREATE_RULESET_ERRATA`` h](j)}(h``const __u32 flags``h]jz)}(hjh]hconst __u32 flags}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjubah}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:450: ./security/landlock/syscalls.chKhjubj))}(hhh](j)}(hSupported values:h]hSupported values:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:450: ./security/landlock/syscalls.chKhjubj )}(hhh](j )}(h#``LANDLOCK_CREATE_RULESET_VERSION``h]j)}(hjh]jz)}(hjh]hLANDLOCK_CREATE_RULESET_VERSION}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjubah}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:450: ./security/landlock/syscalls.chKhjubah}(h]h ]h"]h$]h&]uh1j hjubj )}(h#``LANDLOCK_CREATE_RULESET_ERRATA`` h]j)}(h"``LANDLOCK_CREATE_RULESET_ERRATA``h]jz)}(hjh]hLANDLOCK_CREATE_RULESET_ERRATA}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjubah}(h]h ]h"]h$]h&]uh1jhjhKhjubah}(h]h ]h"]h$]h&]uh1j hjubeh}(h]h ]h"]h$]h&]j j uh1j hjhKhjubeh}(h]h ]h"]h$]h&]uh1j(hjubeh}(h]h ]h"]h$]h&]uh1jhjhKhjubeh}(h]h ]h"]h$]h&]uh1j hjubj)}(h**Description**h]j)}(hj%h]h Description}(hj'hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj#ubah}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:450: ./security/landlock/syscalls.chKhjubj)}(hnThis system call enables to create a new Landlock ruleset, and returns the related file descriptor on success.h]hnThis system call enables to create a new Landlock ruleset, and returns the related file descriptor on success.}(hj;hhhNhNubah}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:450: ./security/landlock/syscalls.chKhjubj)}(hIf ``LANDLOCK_CREATE_RULESET_VERSION`` or ``LANDLOCK_CREATE_RULESET_ERRATA`` is set, then **attr** must be NULL and **size** must be 0.h](hIf }(hjJhhhNhNubjz)}(h#``LANDLOCK_CREATE_RULESET_VERSION``h]hLANDLOCK_CREATE_RULESET_VERSION}(hjRhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjJubh or }(hjJhhhNhNubjz)}(h"``LANDLOCK_CREATE_RULESET_ERRATA``h]hLANDLOCK_CREATE_RULESET_ERRATA}(hjdhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjJubh is set, then }(hjJhhhNhNubj)}(h**attr**h]hattr}(hjvhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjJubh must be NULL and }(hjJhhhNhNubj)}(h**size**h]hsize}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjJubh must be 0.}(hjJhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:450: ./security/landlock/syscalls.chKhjubj)}(hPossible returned errors are:h]hPossible returned errors are:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:450: ./security/landlock/syscalls.chKhjubj )}(hhh](j )}(hN``EOPNOTSUPP``: Landlock is supported by the kernel but disabled at boot time;h]j)}(hjh](jz)}(h``EOPNOTSUPP``h]h EOPNOTSUPP}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjubh@: Landlock is supported by the kernel but disabled at boot time;}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:450: ./security/landlock/syscalls.chKhjubah}(h]h ]h"]h$]h&]uh1j hjubj )}(hZ``EINVAL``: unknown **flags**, or unknown access, or unknown scope, or too small **size**;h]j)}(hjh](jz)}(h ``EINVAL``h]hEINVAL}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjubh : unknown }(hjhhhNhNubj)}(h **flags**h]hflags}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh4, or unknown access, or unknown scope, or too small }(hjhhhNhNubj)}(h**size**h]hsize}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh;}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:450: ./security/landlock/syscalls.chKhjubah}(h]h ]h"]h$]h&]uh1j hjubj )}(h0``E2BIG``: **attr** or **size** inconsistencies;h]j)}(hj%h](jz)}(h ``E2BIG``h]hE2BIG}(hj*hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj'ubh: }(hj'hhhNhNubj)}(h**attr**h]hattr}(hj<hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj'ubh or }(hj'hhhNhNubj)}(h**size**h]hsize}(hjNhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj'ubh inconsistencies;}(hj'hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:450: ./security/landlock/syscalls.chKhj#ubah}(h]h ]h"]h$]h&]uh1j hjubj )}(h1``EFAULT``: **attr** or **size** inconsistencies;h]j)}(hjoh](jz)}(h ``EFAULT``h]hEFAULT}(hjthhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjqubh: }(hjqhhhNhNubj)}(h**attr**h]hattr}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjqubh or }(hjqhhhNhNubj)}(h**size**h]hsize}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjqubh inconsistencies;}(hjqhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:450: ./security/landlock/syscalls.chKhjmubah}(h]h ]h"]h$]h&]uh1j hjubj )}(h]``ENOMSG``: empty :c:type:`landlock_ruleset_attr.handled_access_fs `. h]j)}(h\``ENOMSG``: empty :c:type:`landlock_ruleset_attr.handled_access_fs `.h](jz)}(h ``ENOMSG``h]hENOMSG}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjubh: empty }(hjhhhNhNubh)}(hI:c:type:`landlock_ruleset_attr.handled_access_fs `h]jz)}(hjh]h'landlock_ruleset_attr.handled_access_fs}(hjhhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jyhjubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnjCj jlandlock_ruleset_attruh1hhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:450: ./security/landlock/syscalls.chKhjubh.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhjhKhjubah}(h]h ]h"]h$]h&]uh1j hjubeh}(h]h ]h"]h$]h&]j j uh1j hjhKhjubj)}(h **Flags**h]j)}(hj h]hFlags}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:39: ./include/uapi/linux/landlock.hhK9hjubj)}(hhh](j)}(hd``LANDLOCK_CREATE_RULESET_VERSION`` Get the highest supported Landlock ABI version (starting at 1). h](j)}(h#``LANDLOCK_CREATE_RULESET_VERSION``h]jz)}(hj(h]hLANDLOCK_CREATE_RULESET_VERSION}(hj*hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj&ubah}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:39: ./include/uapi/linux/landlock.hhKubah}(h]h ]h"]h$]h&]uh1j(hj"ubeh}(h]h ]h"]h$]h&]uh1jhj=hKhjjRKubh).}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:453: ./include/uapi/linux/landlock.hhK(hjubah}(h]h ]h"]h$]h&]uh1j(hjdubeh}(h]h ]h"]h$]h&]uh1jhjhK)hjaubj)}(hR``handled_access_net`` Bitmask of handled network actions (cf. `Network flags`_). h](j)}(h``handled_access_net``h]jz)}(hjh]hhandled_access_net}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjubah}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:453: ./include/uapi/linux/landlock.hhK.hjubj))}(hhh]j)}(h:Bitmask of handled network actions (cf. `Network flags`_).h](h(Bitmask of handled network actions (cf. }(hjhhhNhNubj?)}(h`Network flags`_h]h Network flags}(hjhhhNhNubah}(h]h ]h"]h$]h&]name Network flagsjjuh1j>hjjRKubh).}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:453: ./include/uapi/linux/landlock.hhK-hjubah}(h]h ]h"]h$]h&]uh1j(hjubeh}(h]h ]h"]h$]h&]uh1jhjhK.hjaubj)}(h}``scoped`` Bitmask of scopes (cf. `Scope flags`_) restricting a Landlock domain from accessing outside resources (e.g. IPCs).h](j)}(h ``scoped``h]jz)}(hjh]hscoped}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjubah}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:453: ./include/uapi/linux/landlock.hhK3hjubj))}(hhh]j)}(hrBitmask of scopes (cf. `Scope flags`_) restricting a Landlock domain from accessing outside resources (e.g. IPCs).h](hBitmask of scopes (cf. }(hjhhhNhNubj?)}(h`Scope flags`_h]h Scope flags}(hj'hhhNhNubah}(h]h ]h"]h$]h&]name Scope flagsjj\uh1j>hjjRKubhM) restricting a Landlock domain from accessing outside resources (e.g. IPCs).}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:453: ./include/uapi/linux/landlock.hhK2hjubah}(h]h ]h"]h$]h&]uh1j(hjubeh}(h]h ]h"]h$]h&]uh1jhjhK3hjaubeh}(h]h ]h"]h$]h&]uh1j hjubeh}(h]h ] kernelindentah"]h$]h&]uh1jhjjhhhjhNubj)}(h**Description**h]j)}(hj]h]h Description}(hj_hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj[ubah}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:453: ./include/uapi/linux/landlock.hhK7hjjhhubj)}(h*Argument of sys_landlock_create_ruleset().h]h*Argument of sys_landlock_create_ruleset().}(hjshhhNhNubah}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:453: ./include/uapi/linux/landlock.hhKhjjhhubj)}(hX#This structure defines a set of *handled access rights*, a set of actions on different object types, which should be denied by default when the ruleset is enacted. Vice versa, access rights that are not specifically listed here are not going to be denied by this ruleset when it is enacted.h](h This structure defines a set of }(hjhhhNhNubhemphasis)}(h*handled access rights*h]hhandled access rights}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh, a set of actions on different object types, which should be denied by default when the ruleset is enacted. Vice versa, access rights that are not specifically listed here are not going to be denied by this ruleset when it is enacted.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:453: ./include/uapi/linux/landlock.hhKhjjhhubj)}(hXFor historical reasons, the ``LANDLOCK_ACCESS_FS_REFER`` right is always denied by default, even when its bit is not set in **handled_access_fs**. In order to add new rules with this access right, the bit must still be set explicitly (cf. `Filesystem flags`_).h](hFor historical reasons, the }(hjhhhNhNubjz)}(h``LANDLOCK_ACCESS_FS_REFER``h]hLANDLOCK_ACCESS_FS_REFER}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjubhD right is always denied by default, even when its bit is not set in }(hjhhhNhNubj)}(h**handled_access_fs**h]hhandled_access_fs}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh_. In order to add new rules with this access right, the bit must still be set explicitly (cf. }(hjhhhNhNubj?)}(h`Filesystem flags`_h]hFilesystem flags}(hjhhhNhNubah}(h]h ]h"]h$]h&]nameFilesystem flagsjj#uh1j>hjjRKubh).}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:453: ./include/uapi/linux/landlock.hhKhjjhhubj)}(hX&The explicit listing of *handled access rights* is required for backwards compatibility reasons. In most use cases, processes that use Landlock will *handle* a wide range or all access rights that they know about at build time (and that they have tested with a kernel that supported them all).h](hThe explicit listing of }(hjhhhNhNubj)}(h*handled access rights*h]hhandled access rights}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhg is required for backwards compatibility reasons. In most use cases, processes that use Landlock will }(hjhhhNhNubj)}(h*handle*h]hhandle}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh a wide range or all access rights that they know about at build time (and that they have tested with a kernel that supported them all).}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:453: ./include/uapi/linux/landlock.hhKhjjhhubj)}(h4This structure can grow in future Landlock versions.h]h4This structure can grow in future Landlock versions.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:453: ./include/uapi/linux/landlock.hhK"hjjhhubeh}(h]creating-a-new-rulesetah ]h"]creating a new rulesetah$]h&]uh1hhj- hhhhhMubh)}(hhh](h)}(hExtending a ruleseth]hExtending a ruleset}(hj9hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj6hhhhhMubj|)}(hhh]h}(h]h ]h"]h$]h&]entries](j"sys_landlock_add_rule (C function)c.sys_landlock_add_rulehNtauh1j{hj6hhhNhNubj)}(hhh](j)}(hlong sys_landlock_add_rule (const int ruleset_fd, const enum landlock_rule_type rule_type, const void __user *const rule_attr, const __u32 flags)h]j)}(hlong sys_landlock_add_rule(const int ruleset_fd, const enum landlock_rule_type rule_type, const void __user *const rule_attr, const __u32 flags)h](j)}(hlongh]hlong}(hj`hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj\hhhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:459: ./security/landlock/syscalls.chMubj)}(h h]h }(hjohhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj\hhhjnhMubj)}(hsys_landlock_add_ruleh]j)}(hsys_landlock_add_ruleh]hsys_landlock_add_rule}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj}ubah}(h]h ](jjeh"]h$]h&]hhuh1jhj\hhhjnhMubj)}(hv(const int ruleset_fd, const enum landlock_rule_type rule_type, const void __user *const rule_attr, const __u32 flags)h](j)}(hconst int ruleset_fdh](j)}(hjh]hconst}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubj)}(h h]h }(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubj)}(hinth]hint}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubj)}(h h]h }(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubj)}(h ruleset_fdh]h ruleset_fd}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]noemphhhuh1jhjubj)}(h'const enum landlock_rule_type rule_typeh](j)}(hjh]hconst}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubj)}(h h]h }(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubj)}(henumh]henum}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubj)}(h h]h }(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubh)}(hhh]j)}(hlandlock_rule_typeh]hlandlock_rule_type}(hj'hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj$ubah}(h]h ]h"]h$]h&] refdomainjreftypej? reftargetj)modnameN classnameNjCjF)}jI]jL)}j?jsbc.sys_landlock_add_ruleasbuh1hhjubj)}(h h]h }(hjGhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubj)}(h rule_typeh]h rule_type}(hjUhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]noemphhhuh1jhjubj)}(h"const void __user *const rule_attrh](j)}(hjh]hconst}(hjnhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjjubj)}(h h]h }(hj{hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjjubj)}(hvoidh]hvoid}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjjubj)}(h h]h }(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjjubh__user}(hjjhhhNhNubj)}(h h]h }(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjjubjr)}(hj(h]h*}(hjhhhNhNubah}(h]h ]j}ah"]h$]h&]uh1jqhjjubj)}(hjh]hconst}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjjubj)}(h h]h }(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjjubj)}(h rule_attrh]h rule_attr}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjjubeh}(h]h ]h"]h$]h&]noemphhhuh1jhjubj)}(hconst __u32 flagsh](j)}(hjh]hconst}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubj)}(h h]h }(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubh)}(hhh]j)}(h__u32h]h__u32}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&] refdomainjreftypej? reftargetjmodnameN classnameNjCjF)}jI]jCc.sys_landlock_add_ruleasbuh1hhjubj)}(h h]h }(hj4hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubj)}(hflagsh]hflags}(hjBhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]noemphhhuh1jhjubeh}(h]h ]h"]h$]h&]hhuh1jhj\hhhjnhMubeh}(h]h ]h"]h$]h&]hhjuh1jjjhjXhhhjnhMubah}(h]jSah ](jjeh"]h$]h&]jj)jhuh1jhjnhMhjUhhubj)}(hhh]j)}(hAdd a new rule to a ruleseth]hAdd a new rule to a ruleset}(hjlhhhNhNubah}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:459: ./security/landlock/syscalls.chMhjihhubah}(h]h ]h"]h$]h&]uh1jhjUhhhjnhMubeh}(h]h ](jfunctioneh"]h$]h&]jjjjjjjjjuh1jhhhj6hNhNubj)}(hX**Parameters** ``const int ruleset_fd`` File descriptor tied to the ruleset that should be extended with the new rule. ``const enum landlock_rule_type rule_type`` Identify the structure type pointed to by **rule_attr**: ``LANDLOCK_RULE_PATH_BENEATH`` or ``LANDLOCK_RULE_NET_PORT``. ``const void __user *const rule_attr`` Pointer to a rule (matching the **rule_type**). ``const __u32 flags`` Must be 0. **Description** This system call enables to define a new rule and add it to an existing ruleset. Possible returned errors are: - ``EOPNOTSUPP``: Landlock is supported by the kernel but disabled at boot time; - ``EAFNOSUPPORT``: **rule_type** is ``LANDLOCK_RULE_NET_PORT`` but TCP/IP is not supported by the running kernel; - ``EINVAL``: **flags** is not 0; - ``EINVAL``: The rule accesses are inconsistent (i.e. :c:type:`landlock_path_beneath_attr.allowed_access ` or :c:type:`landlock_net_port_attr.allowed_access ` is not a subset of the ruleset handled accesses) - ``EINVAL``: :c:type:`landlock_net_port_attr.port ` is greater than 65535; - ``ENOMSG``: Empty accesses (e.g. :c:type:`landlock_path_beneath_attr.allowed_access ` is 0); - ``EBADF``: **ruleset_fd** is not a file descriptor for the current thread, or a member of **rule_attr** is not a file descriptor as expected; - ``EBADFD``: **ruleset_fd** is not a ruleset file descriptor, or a member of **rule_attr** is not the expected file descriptor type; - ``EPERM``: **ruleset_fd** has no write access to the underlying ruleset; - ``EFAULT``: **rule_attr** was not a valid address.h](j)}(h**Parameters**h]j)}(hjh]h Parameters}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:459: ./security/landlock/syscalls.chMhjubj)}(hhh](j)}(hh``const int ruleset_fd`` File descriptor tied to the ruleset that should be extended with the new rule. h](j)}(h``const int ruleset_fd``h]jz)}(hjh]hconst int ruleset_fd}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjubah}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:459: ./security/landlock/syscalls.chMhjubj))}(hhh]j)}(hNFile descriptor tied to the ruleset that should be extended with the new rule.h]hNFile descriptor tied to the ruleset that should be extended with the new rule.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:459: ./security/landlock/syscalls.chMhjubah}(h]h ]h"]h$]h&]uh1j(hjubeh}(h]h ]h"]h$]h&]uh1jhjhMhjubj)}(h``const enum landlock_rule_type rule_type`` Identify the structure type pointed to by **rule_attr**: ``LANDLOCK_RULE_PATH_BENEATH`` or ``LANDLOCK_RULE_NET_PORT``. h](j)}(h+``const enum landlock_rule_type rule_type``h]jz)}(hjh]h'const enum landlock_rule_type rule_type}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjubah}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:459: ./security/landlock/syscalls.chMhjubj))}(hhh]j)}(hvIdentify the structure type pointed to by **rule_attr**: ``LANDLOCK_RULE_PATH_BENEATH`` or ``LANDLOCK_RULE_NET_PORT``.h](h*Identify the structure type pointed to by }(hjhhhNhNubj)}(h **rule_attr**h]h rule_attr}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh: }(hjhhhNhNubjz)}(h``LANDLOCK_RULE_PATH_BENEATH``h]hLANDLOCK_RULE_PATH_BENEATH}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjubh or }(hjhhhNhNubjz)}(h``LANDLOCK_RULE_NET_PORT``h]hLANDLOCK_RULE_NET_PORT}(hj,hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjubh.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:459: ./security/landlock/syscalls.chMhjubah}(h]h ]h"]h$]h&]uh1j(hjubeh}(h]h ]h"]h$]h&]uh1jhjhMhjubj)}(hW``const void __user *const rule_attr`` Pointer to a rule (matching the **rule_type**). h](j)}(h&``const void __user *const rule_attr``h]jz)}(hjWh]h"const void __user *const rule_attr}(hjYhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjUubah}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:459: ./security/landlock/syscalls.chMhjQubj))}(hhh]j)}(h/Pointer to a rule (matching the **rule_type**).h](h Pointer to a rule (matching the }(hjphhhNhNubj)}(h **rule_type**h]h rule_type}(hjxhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjpubh).}(hjphhhNhNubeh}(h]h ]h"]h$]h&]uh1jhjlhMhjmubah}(h]h ]h"]h$]h&]uh1j(hjQubeh}(h]h ]h"]h$]h&]uh1jhjlhMhjubj)}(h!``const __u32 flags`` Must be 0. h](j)}(h``const __u32 flags``h]jz)}(hjh]hconst __u32 flags}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjubah}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:459: ./security/landlock/syscalls.chMhjubj))}(hhh]j)}(h Must be 0.h]h Must be 0.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjhMhjubah}(h]h ]h"]h$]h&]uh1j(hjubeh}(h]h ]h"]h$]h&]uh1jhjhMhjubeh}(h]h ]h"]h$]h&]uh1j hjubj)}(h**Description**h]j)}(hjh]h Description}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:459: ./security/landlock/syscalls.chMhjubj)}(hPThis system call enables to define a new rule and add it to an existing ruleset.h]hPThis system call enables to define a new rule and add it to an existing ruleset.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:459: ./security/landlock/syscalls.chMhjubj)}(hPossible returned errors are:h]hPossible returned errors are:}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:459: ./security/landlock/syscalls.chMhjubj )}(hhh](j )}(hN``EOPNOTSUPP``: Landlock is supported by the kernel but disabled at boot time;h]j)}(hj h](jz)}(h``EOPNOTSUPP``h]h EOPNOTSUPP}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj ubh@: Landlock is supported by the kernel but disabled at boot time;}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:459: ./security/landlock/syscalls.chMhj ubah}(h]h ]h"]h$]h&]uh1j hj ubj )}(hp``EAFNOSUPPORT``: **rule_type** is ``LANDLOCK_RULE_NET_PORT`` but TCP/IP is not supported by the running kernel;h]j)}(hp``EAFNOSUPPORT``: **rule_type** is ``LANDLOCK_RULE_NET_PORT`` but TCP/IP is not supported by the running kernel;h](jz)}(h``EAFNOSUPPORT``h]h EAFNOSUPPORT}(hjB hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj> ubh: }(hj> hhhNhNubj)}(h **rule_type**h]h rule_type}(hjT hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj> ubh is }(hj> hhhNhNubjz)}(h``LANDLOCK_RULE_NET_PORT``h]hLANDLOCK_RULE_NET_PORT}(hjf hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj> ubh3 but TCP/IP is not supported by the running kernel;}(hj> hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:459: ./security/landlock/syscalls.chMhj: ubah}(h]h ]h"]h$]h&]uh1j hj ubj )}(h``EINVAL``: **flags** is not 0;h]j)}(hj h](jz)}(h ``EINVAL``h]hEINVAL}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj ubh: }(hj hhhNhNubj)}(h **flags**h]hflags}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubh is not 0;}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:459: ./security/landlock/syscalls.chMhj ubah}(h]h ]h"]h$]h&]uh1j hj ubj )}(hX``EINVAL``: The rule accesses are inconsistent (i.e. :c:type:`landlock_path_beneath_attr.allowed_access ` or :c:type:`landlock_net_port_attr.allowed_access ` is not a subset of the ruleset handled accesses)h]j)}(hX``EINVAL``: The rule accesses are inconsistent (i.e. :c:type:`landlock_path_beneath_attr.allowed_access ` or :c:type:`landlock_net_port_attr.allowed_access ` is not a subset of the ruleset handled accesses)h](jz)}(h ``EINVAL``h]hEINVAL}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj ubh+: The rule accesses are inconsistent (i.e. }(hj hhhNhNubh)}(hP:c:type:`landlock_path_beneath_attr.allowed_access `h]jz)}(hj h]h)landlock_path_beneath_attr.allowed_access}(hj hhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jyhj ubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnjCj jlandlock_path_beneath_attruh1hhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:459: ./security/landlock/syscalls.chMhj ubh or }(hj hhhNhNubh)}(hH:c:type:`landlock_net_port_attr.allowed_access `h]jz)}(hj h]h%landlock_net_port_attr.allowed_access}(hj hhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jyhj ubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnjCj jlandlock_net_port_attruh1hhj hMhj ubh1 is not a subset of the ruleset handled accesses)}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhj hMhj ubah}(h]h ]h"]h$]h&]uh1j hj ubj )}(ha``EINVAL``: :c:type:`landlock_net_port_attr.port ` is greater than 65535;h]j)}(hj,!h](jz)}(h ``EINVAL``h]hEINVAL}(hj1!hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj.!ubh: }(hj.!hhhNhNubh)}(h>:c:type:`landlock_net_port_attr.port `h]jz)}(hjE!h]hlandlock_net_port_attr.port}(hjG!hhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jyhjC!ubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnjCj jlandlock_net_port_attruh1hhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:459: ./security/landlock/syscalls.chMhj.!ubh is greater than 65535;}(hj.!hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhjb!hMhj*!ubah}(h]h ]h"]h$]h&]uh1j hj ubj )}(hx``ENOMSG``: Empty accesses (e.g. :c:type:`landlock_path_beneath_attr.allowed_access ` is 0);h]j)}(hx``ENOMSG``: Empty accesses (e.g. :c:type:`landlock_path_beneath_attr.allowed_access ` is 0);h](jz)}(h ``ENOMSG``h]hENOMSG}(hj{!hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjw!ubh: Empty accesses (e.g. }(hjw!hhhNhNubh)}(hP:c:type:`landlock_path_beneath_attr.allowed_access `h]jz)}(hj!h]h)landlock_path_beneath_attr.allowed_access}(hj!hhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jyhj!ubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnjCj jlandlock_path_beneath_attruh1hhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:459: ./security/landlock/syscalls.chMhjw!ubh is 0);}(hjw!hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhj!hMhjs!ubah}(h]h ]h"]h$]h&]uh1j hj ubj )}(h``EBADF``: **ruleset_fd** is not a file descriptor for the current thread, or a member of **rule_attr** is not a file descriptor as expected;h]j)}(h``EBADF``: **ruleset_fd** is not a file descriptor for the current thread, or a member of **rule_attr** is not a file descriptor as expected;h](jz)}(h ``EBADF``h]hEBADF}(hj!hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj!ubh: }(hj!hhhNhNubj)}(h**ruleset_fd**h]h ruleset_fd}(hj!hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj!ubhA is not a file descriptor for the current thread, or a member of }(hj!hhhNhNubj)}(h **rule_attr**h]h rule_attr}(hj!hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj!ubh& is not a file descriptor as expected;}(hj!hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:459: ./security/landlock/syscalls.chMhj!ubah}(h]h ]h"]h$]h&]uh1j hj ubj )}(h``EBADFD``: **ruleset_fd** is not a ruleset file descriptor, or a member of **rule_attr** is not the expected file descriptor type;h]j)}(h``EBADFD``: **ruleset_fd** is not a ruleset file descriptor, or a member of **rule_attr** is not the expected file descriptor type;h](jz)}(h ``EBADFD``h]hEBADFD}(hj"hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj "ubh: }(hj "hhhNhNubj)}(h**ruleset_fd**h]h ruleset_fd}(hj""hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj "ubh2 is not a ruleset file descriptor, or a member of }(hj "hhhNhNubj)}(h **rule_attr**h]h rule_attr}(hj4"hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj "ubh* is not the expected file descriptor type;}(hj "hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:459: ./security/landlock/syscalls.chMhj"ubah}(h]h ]h"]h$]h&]uh1j hj ubj )}(hH``EPERM``: **ruleset_fd** has no write access to the underlying ruleset;h]j)}(hjU"h](jz)}(h ``EPERM``h]hEPERM}(hjZ"hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjW"ubh: }(hjW"hhhNhNubj)}(h**ruleset_fd**h]h ruleset_fd}(hjl"hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjW"ubh/ has no write access to the underlying ruleset;}(hjW"hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:459: ./security/landlock/syscalls.chMhjS"ubah}(h]h ]h"]h$]h&]uh1j hj ubj )}(h2``EFAULT``: **rule_attr** was not a valid address.h]j)}(hj"h](jz)}(h ``EFAULT``h]hEFAULT}(hj"hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj"ubh: }(hj"hhhNhNubj)}(h **rule_attr**h]h rule_attr}(hj"hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj"ubh was not a valid address.}(hj"hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:459: ./security/landlock/syscalls.chMhj"ubah}(h]h ]h"]h$]h&]uh1j hj ubeh}(h]h ]h"]h$]h&]j j uh1j hj3 hMhjubeh}(h]h ] kernelindentah"]h$]h&]uh1jhj6hhhNhNubj|)}(hhh]h}(h]h ]h"]h$]h&]entries](jlandlock_rule_type (C enum)c.landlock_rule_typehNtauh1j{hj6hhhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:462: ./include/uapi/linux/landlock.hhNubj)}(hhh](j)}(hlandlock_rule_typeh]j)}(henum landlock_rule_typeh](j)}(hj h]henum}(hj"hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj"hhhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:462: ./include/uapi/linux/landlock.hhKubj)}(h h]h }(hj"hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj"hhhj"hKubj)}(hlandlock_rule_typeh]j)}(hj"h]hlandlock_rule_type}(hj #hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj#ubah}(h]h ](jjeh"]h$]h&]hhuh1jhj"hhhj"hKubeh}(h]h ]h"]h$]h&]hhjuh1jjjhj"hhhj"hKubah}(h]j"ah ](jjeh"]h$]h&]jj)jhuh1jhj"hKhj"hhubj)}(hhh]j)}(hLandlock rule typeh]hLandlock rule type}(hj,#hhhNhNubah}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:462: ./include/uapi/linux/landlock.hhKhj)#hhubah}(h]h ]h"]h$]h&]uh1jhj"hhhj"hKubeh}(h]h ](jenumeh"]h$]h&]jjjjD#jjD#jjjuh1jhhhj6hj"hNubj)}(h**Constants** ``LANDLOCK_RULE_PATH_BENEATH`` Type of a :c:type:`struct landlock_path_beneath_attr ` . ``LANDLOCK_RULE_NET_PORT`` Type of a :c:type:`struct landlock_net_port_attr ` .h](j)}(h **Constants**h]j)}(hjN#h]h Constants}(hjP#hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjL#ubah}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:462: ./include/uapi/linux/landlock.hhKhjH#ubj)}(hhh](j)}(ht``LANDLOCK_RULE_PATH_BENEATH`` Type of a :c:type:`struct landlock_path_beneath_attr ` . h](j)}(h``LANDLOCK_RULE_PATH_BENEATH``h]jz)}(hjm#h]hLANDLOCK_RULE_PATH_BENEATH}(hjo#hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjk#ubah}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:462: ./include/uapi/linux/landlock.hhKhjg#ubj))}(hhh]j)}(hTType of a :c:type:`struct landlock_path_beneath_attr ` .h](h Type of a }(hj#hhhNhNubh)}(hH:c:type:`struct landlock_path_beneath_attr `h]jz)}(hj#h]h!struct landlock_path_beneath_attr}(hj#hhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jyhj#ubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnjCj jlandlock_path_beneath_attruh1hhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:462: ./include/uapi/linux/landlock.hhKhj#ubh .}(hj#hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhj#hKhj#ubah}(h]h ]h"]h$]h&]uh1j(hjg#ubeh}(h]h ]h"]h$]h&]uh1jhj#hKhjd#ubj)}(hg``LANDLOCK_RULE_NET_PORT`` Type of a :c:type:`struct landlock_net_port_attr ` .h](j)}(h``LANDLOCK_RULE_NET_PORT``h]jz)}(hj#h]hLANDLOCK_RULE_NET_PORT}(hj#hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj#ubah}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:462: ./include/uapi/linux/landlock.hhKhj#ubj))}(hhh]j)}(hLType of a :c:type:`struct landlock_net_port_attr ` .h](h Type of a }(hj#hhhNhNubh)}(h@:c:type:`struct landlock_net_port_attr `h]jz)}(hj#h]hstruct landlock_net_port_attr}(hj#hhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jyhj#ubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnjCj jlandlock_net_port_attruh1hhj#hKhj#ubh .}(hj#hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhj#hKhj#ubah}(h]h ]h"]h$]h&]uh1j(hj#ubeh}(h]h ]h"]h$]h&]uh1jhj#hKhjd#ubeh}(h]h ]h"]h$]h&]uh1j hjH#ubeh}(h]h ] kernelindentah"]h$]h&]uh1jhj6hhhj"hNubj)}(h**Description**h]j)}(hj/$h]h Description}(hj1$hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj-$ubah}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:462: ./include/uapi/linux/landlock.hhKhj6hhubj)}(h$Argument of sys_landlock_add_rule().h]h$Argument of sys_landlock_add_rule().}(hjE$hhhNhNubah}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:462: ./include/uapi/linux/landlock.hhKhj6hhubj|)}(hhh]h}(h]h ]h"]h$]h&]entries](j%landlock_path_beneath_attr (C struct)c.landlock_path_beneath_attrhNtauh1j{hj6hhhj"hNubj)}(hhh](j)}(hlandlock_path_beneath_attrh]j)}(h!struct landlock_path_beneath_attrh](j)}(hj h]hstruct}(hjm$hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhji$hhhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:462: ./include/uapi/linux/landlock.hhKubj)}(h h]h }(hj{$hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhji$hhhjz$hKubj)}(hlandlock_path_beneath_attrh]j)}(hjg$h]hlandlock_path_beneath_attr}(hj$hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj$ubah}(h]h ](jjeh"]h$]h&]hhuh1jhji$hhhjz$hKubeh}(h]h ]h"]h$]h&]hhjuh1jjjhje$hhhjz$hKubah}(h]j`$ah ](jjeh"]h$]h&]jj)jhuh1jhjz$hKhjb$hhubj)}(hhh]j)}(hPath hierarchy definitionh]hPath hierarchy definition}(hj$hhhNhNubah}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:462: ./include/uapi/linux/landlock.hhKhj$hhubah}(h]h ]h"]h$]h&]uh1jhjb$hhhjz$hKubeh}(h]h ](jstructeh"]h$]h&]jjjj$jj$jjjuh1jhhhj6hj"hNubj)}(hXv**Definition**:: struct landlock_path_beneath_attr { __u64 allowed_access; __s32 parent_fd; }; **Members** ``allowed_access`` Bitmask of allowed actions for this file hierarchy (cf. `Filesystem flags`_). ``parent_fd`` File descriptor, preferably opened with ``O_PATH``, which identifies the parent directory of a file hierarchy, or just a file.h](j)}(h**Definition**::h](j)}(h**Definition**h]h Definition}(hj$hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj$ubh:}(hj$hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:462: ./include/uapi/linux/landlock.hhKhj$ubj)}(hUstruct landlock_path_beneath_attr { __u64 allowed_access; __s32 parent_fd; };h]hUstruct landlock_path_beneath_attr { __u64 allowed_access; __s32 parent_fd; };}hj$sbah}(h]h ]h"]h$]h&]hhuh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:462: ./include/uapi/linux/landlock.hhKhj$ubj)}(h **Members**h]j)}(hj$h]hMembers}(hj$hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj$ubah}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:462: ./include/uapi/linux/landlock.hhKhj$ubj)}(hhh](j)}(ha``allowed_access`` Bitmask of allowed actions for this file hierarchy (cf. `Filesystem flags`_). h](j)}(h``allowed_access``h]jz)}(hj%h]hallowed_access}(hj%hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj%ubah}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:462: ./include/uapi/linux/landlock.hhKhj%ubj))}(hhh]j)}(hMBitmask of allowed actions for this file hierarchy (cf. `Filesystem flags`_).h](h8Bitmask of allowed actions for this file hierarchy (cf. }(hj5%hhhNhNubj?)}(h`Filesystem flags`_h]hFilesystem flags}(hj=%hhhNhNubah}(h]h ]h"]h$]h&]nameFilesystem flagsjj#uh1j>hj5%jRKubh).}(hj5%hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:462: ./include/uapi/linux/landlock.hhKhj2%ubah}(h]h ]h"]h$]h&]uh1j(hj%ubeh}(h]h ]h"]h$]h&]uh1jhj1%hKhj%ubj)}(h``parent_fd`` File descriptor, preferably opened with ``O_PATH``, which identifies the parent directory of a file hierarchy, or just a file.h](j)}(h ``parent_fd``h]jz)}(hjj%h]h parent_fd}(hjl%hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjh%ubah}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:462: ./include/uapi/linux/landlock.hhKhjd%ubj))}(hhh]j)}(h~File descriptor, preferably opened with ``O_PATH``, which identifies the parent directory of a file hierarchy, or just a file.h](h(File descriptor, preferably opened with }(hj%hhhNhNubjz)}(h ``O_PATH``h]hO_PATH}(hj%hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj%ubhL, which identifies the parent directory of a file hierarchy, or just a file.}(hj%hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:462: ./include/uapi/linux/landlock.hhKhj%ubah}(h]h ]h"]h$]h&]uh1j(hjd%ubeh}(h]h ]h"]h$]h&]uh1jhj%hKhj%ubeh}(h]h ]h"]h$]h&]uh1j hj$ubeh}(h]h ] kernelindentah"]h$]h&]uh1jhj6hhhj"hNubj)}(h**Description**h]j)}(hj%h]h Description}(hj%hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj%ubah}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:462: ./include/uapi/linux/landlock.hhKhj6hhubj)}(h$Argument of sys_landlock_add_rule().h]h$Argument of sys_landlock_add_rule().}(hj%hhhNhNubah}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:462: ./include/uapi/linux/landlock.hhKhj6hhubj|)}(hhh]h}(h]h ]h"]h$]h&]entries](j!landlock_net_port_attr (C struct)c.landlock_net_port_attrhNtauh1j{hj6hhhj"hNubj)}(hhh](j)}(hlandlock_net_port_attrh]j)}(hstruct landlock_net_port_attrh](j)}(hj h]hstruct}(hj%hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj%hhhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:462: ./include/uapi/linux/landlock.hhKubj)}(h h]h }(hj &hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj%hhhj &hKubj)}(hlandlock_net_port_attrh]j)}(hj%h]hlandlock_net_port_attr}(hj&hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj&ubah}(h]h ](jjeh"]h$]h&]hhuh1jhj%hhhj &hKubeh}(h]h ]h"]h$]h&]hhjuh1jjjhj%hhhj &hKubah}(h]j%ah ](jjeh"]h$]h&]jj)jhuh1jhj &hKhj%hhubj)}(hhh]j)}(hNetwork port definitionh]hNetwork port definition}(hj?&hhhNhNubah}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:462: ./include/uapi/linux/landlock.hhKhj<&hhubah}(h]h ]h"]h$]h&]uh1jhj%hhhj &hKubeh}(h]h ](jstructeh"]h$]h&]jjjjW&jjW&jjjuh1jhhhj6hj"hNubj)}(hX**Definition**:: struct landlock_net_port_attr { __u64 allowed_access; __u64 port; }; **Members** ``allowed_access`` Bitmask of allowed network actions for a port (cf. `Network flags`_). ``port`` Network port in host endianness. It should be noted that port 0 passed to :manpage:`bind(2)` will bind to an available port from the ephemeral port range. This can be configured with the ``/proc/sys/net/ipv4/ip_local_port_range`` sysctl (also used for IPv6). A Landlock rule with port 0 and the ``LANDLOCK_ACCESS_NET_BIND_TCP`` right means that requesting to bind on port 0 is allowed and it will automatically translate to binding on the related port range.h](j)}(h**Definition**::h](j)}(h**Definition**h]h Definition}(hjc&hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj_&ubh:}(hj_&hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:462: ./include/uapi/linux/landlock.hhKhj[&ubj)}(hLstruct landlock_net_port_attr { __u64 allowed_access; __u64 port; };h]hLstruct landlock_net_port_attr { __u64 allowed_access; __u64 port; };}hj|&sbah}(h]h ]h"]h$]h&]hhuh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:462: ./include/uapi/linux/landlock.hhKhj[&ubj)}(h **Members**h]j)}(hj&h]hMembers}(hj&hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj&ubah}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:462: ./include/uapi/linux/landlock.hhKhj[&ubj)}(hhh](j)}(hY``allowed_access`` Bitmask of allowed network actions for a port (cf. `Network flags`_). h](j)}(h``allowed_access``h]jz)}(hj&h]hallowed_access}(hj&hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj&ubah}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:462: ./include/uapi/linux/landlock.hhKhj&ubj))}(hhh]j)}(hEBitmask of allowed network actions for a port (cf. `Network flags`_).h](h3Bitmask of allowed network actions for a port (cf. }(hj&hhhNhNubj?)}(h`Network flags`_h]h Network flags}(hj&hhhNhNubah}(h]h ]h"]h$]h&]name Network flagsjjuh1j>hj&jRKubh).}(hj&hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:462: ./include/uapi/linux/landlock.hhKhj&ubah}(h]h ]h"]h$]h&]uh1j(hj&ubeh}(h]h ]h"]h$]h&]uh1jhj&hKhj&ubj)}(hX``port`` Network port in host endianness. It should be noted that port 0 passed to :manpage:`bind(2)` will bind to an available port from the ephemeral port range. This can be configured with the ``/proc/sys/net/ipv4/ip_local_port_range`` sysctl (also used for IPv6). A Landlock rule with port 0 and the ``LANDLOCK_ACCESS_NET_BIND_TCP`` right means that requesting to bind on port 0 is allowed and it will automatically translate to binding on the related port range.h](j)}(h``port``h]jz)}(hj&h]hport}(hj&hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj&ubah}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:462: ./include/uapi/linux/landlock.hhKhj&ubj))}(hhh](j)}(h Network port in host endianness.h]h Network port in host endianness.}(hj'hhhNhNubah}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:462: ./include/uapi/linux/landlock.hhKhj'ubj)}(hIt should be noted that port 0 passed to :manpage:`bind(2)` will bind to an available port from the ephemeral port range. This can be configured with the ``/proc/sys/net/ipv4/ip_local_port_range`` sysctl (also used for IPv6).h](h)It should be noted that port 0 passed to }(hj"'hhhNhNubj)}(h:manpage:`bind(2)`h]hbind(2)}(hj*'hhhNhNubah}(h]h ]jah"]h$]h&]hhjbind(2)jbindjjuh1jhj"'ubh` will bind to an available port from the ephemeral port range. This can be configured with the }(hj"'hhhNhNubjz)}(h*``/proc/sys/net/ipv4/ip_local_port_range``h]h&/proc/sys/net/ipv4/ip_local_port_range}(hj>'hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj"'ubh sysctl (also used for IPv6).}(hj"'hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:462: ./include/uapi/linux/landlock.hhKhj'ubj)}(hA Landlock rule with port 0 and the ``LANDLOCK_ACCESS_NET_BIND_TCP`` right means that requesting to bind on port 0 is allowed and it will automatically translate to binding on the related port range.h](h$A Landlock rule with port 0 and the }(hjW'hhhNhNubjz)}(h ``LANDLOCK_ACCESS_NET_BIND_TCP``h]hLANDLOCK_ACCESS_NET_BIND_TCP}(hj_'hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjW'ubh right means that requesting to bind on port 0 is allowed and it will automatically translate to binding on the related port range.}(hjW'hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:462: ./include/uapi/linux/landlock.hhKhj'ubeh}(h]h ]h"]h$]h&]uh1j(hj&ubeh}(h]h ]h"]h$]h&]uh1jhj'hKhj&ubeh}(h]h ]h"]h$]h&]uh1j hj[&ubeh}(h]h ] kernelindentah"]h$]h&]uh1jhj6hhhj"hNubj)}(h**Description**h]j)}(hj'h]h Description}(hj'hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj'ubah}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:462: ./include/uapi/linux/landlock.hhKhj6hhubj)}(h$Argument of sys_landlock_add_rule().h]h$Argument of sys_landlock_add_rule().}(hj'hhhNhNubah}(h]h ]h"]h$]h&]uh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:462: ./include/uapi/linux/landlock.hhKhj6hhubeh}(h]extending-a-rulesetah ]h"]extending a rulesetah$]h&]uh1hhj- hhhhhMubh)}(hhh](h)}(hEnforcing a ruleseth]hEnforcing a ruleset}(hj'hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj'hhhhhMubj|)}(hhh]h}(h]h ]h"]h$]h&]entries](j'sys_landlock_restrict_self (C function)c.sys_landlock_restrict_selfhNtauh1j{hj'hhhNhNubj)}(hhh](j)}(hIlong sys_landlock_restrict_self (const int ruleset_fd, const __u32 flags)h]j)}(hHlong sys_landlock_restrict_self(const int ruleset_fd, const __u32 flags)h](j)}(hlongh]hlong}(hj'hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj'hhhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:469: ./security/landlock/syscalls.chMubj)}(h h]h }(hj'hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj'hhhj'hMubj)}(hsys_landlock_restrict_selfh]j)}(hsys_landlock_restrict_selfh]hsys_landlock_restrict_self}(hj (hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj(ubah}(h]h ](jjeh"]h$]h&]hhuh1jhj'hhhj'hMubj)}(h)(const int ruleset_fd, const __u32 flags)h](j)}(hconst int ruleset_fdh](j)}(hjh]hconst}(hj'(hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj#(ubj)}(h h]h }(hj4(hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj#(ubj)}(hinth]hint}(hjB(hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj#(ubj)}(h h]h }(hjP(hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj#(ubj)}(h ruleset_fdh]h ruleset_fd}(hj^(hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj#(ubeh}(h]h ]h"]h$]h&]noemphhhuh1jhj(ubj)}(hconst __u32 flagsh](j)}(hjh]hconst}(hjw(hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjs(ubj)}(h h]h }(hj(hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjs(ubh)}(hhh]j)}(h__u32h]h__u32}(hj(hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj(ubah}(h]h ]h"]h$]h&] refdomainjreftypej? reftargetj(modnameN classnameNjCjF)}jI]jL)}j?j (sbc.sys_landlock_restrict_selfasbuh1hhjs(ubj)}(h h]h }(hj(hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjs(ubj)}(hflagsh]hflags}(hj(hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjs(ubeh}(h]h ]h"]h$]h&]noemphhhuh1jhj(ubeh}(h]h ]h"]h$]h&]hhuh1jhj'hhhj'hMubeh}(h]h ]h"]h$]h&]hhjuh1jjjhj'hhhj'hMubah}(h]j'ah ](jjeh"]h$]h&]jj)jhuh1jhj'hMhj'hhubj)}(hhh]j)}(h'Enforce a ruleset on the calling threadh]h'Enforce a ruleset on the calling thread}(hj(hhhNhNubah}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:469: ./security/landlock/syscalls.chMhj(hhubah}(h]h ]h"]h$]h&]uh1jhj'hhhj'hMubeh}(h]h ](jfunctioneh"]h$]h&]jjjj)jj)jjjuh1jhhhj'hNhNubj)}(hX**Parameters** ``const int ruleset_fd`` File descriptor tied to the ruleset to merge with the target. ``const __u32 flags`` Supported values: - ``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF`` - ``LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON`` - ``LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF`` **Description** This system call enables to enforce a Landlock ruleset on the current thread. Enforcing a ruleset requires that the task has ``CAP_SYS_ADMIN`` in its namespace or is running with no_new_privs. This avoids scenarios where unprivileged tasks can affect the behavior of privileged children. Possible returned errors are: - ``EOPNOTSUPP``: Landlock is supported by the kernel but disabled at boot time; - ``EINVAL``: **flags** contains an unknown bit. - ``EBADF``: **ruleset_fd** is not a file descriptor for the current thread; - ``EBADFD``: **ruleset_fd** is not a ruleset file descriptor; - ``EPERM``: **ruleset_fd** has no read access to the underlying ruleset, or the current thread is not running with no_new_privs, or it doesn't have ``CAP_SYS_ADMIN`` in its namespace. - ``E2BIG``: The maximum number of stacked rulesets is reached for the current thread. .. kernel-doc:: include/uapi/linux/landlock.h :identifiers: landlock_restrict_self_flagsh](j)}(h**Parameters**h]j)}(hj)h]h Parameters}(hj)hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj )ubah}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:469: ./security/landlock/syscalls.chMhj )ubj)}(hhh](j)}(hW``const int ruleset_fd`` File descriptor tied to the ruleset to merge with the target. h](j)}(h``const int ruleset_fd``h]jz)}(hj.)h]hconst int ruleset_fd}(hj0)hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj,)ubah}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:469: ./security/landlock/syscalls.chMhj()ubj))}(hhh]j)}(h=File descriptor tied to the ruleset to merge with the target.h]h=File descriptor tied to the ruleset to merge with the target.}(hjG)hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjC)hMhjD)ubah}(h]h ]h"]h$]h&]uh1j(hj()ubeh}(h]h ]h"]h$]h&]uh1jhjC)hMhj%)ubj)}(h``const __u32 flags`` Supported values: - ``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF`` - ``LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON`` - ``LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF`` h](j)}(h``const __u32 flags``h]jz)}(hjg)h]hconst __u32 flags}(hji)hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhje)ubah}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:469: ./security/landlock/syscalls.chMhja)ubj))}(hhh](j)}(hSupported values:h]hSupported values:}(hj)hhhNhNubah}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:469: ./security/landlock/syscalls.chMhj})ubj )}(hhh](j )}(h,``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF``h]j)}(hj)h]jz)}(hj)h]h(LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF}(hj)hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj)ubah}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:469: ./security/landlock/syscalls.chMhj)ubah}(h]h ]h"]h$]h&]uh1j hj)ubj )}(h*``LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON``h]j)}(hj)h]jz)}(hj)h]h&LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON}(hj)hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj)ubah}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:469: ./security/landlock/syscalls.chMhj)ubah}(h]h ]h"]h$]h&]uh1j hj)ubj )}(h.``LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF`` h]j)}(h-``LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF``h]jz)}(hj)h]h)LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF}(hj)hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj)ubah}(h]h ]h"]h$]h&]uh1jhj|)hMhj)ubah}(h]h ]h"]h$]h&]uh1j hj)ubeh}(h]h ]h"]h$]h&]j j uh1j hj)hMhj})ubeh}(h]h ]h"]h$]h&]uh1j(hja)ubeh}(h]h ]h"]h$]h&]uh1jhj|)hMhj%)ubeh}(h]h ]h"]h$]h&]uh1j hj )ubj)}(h**Description**h]j)}(hj*h]h Description}(hj*hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj *ubah}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:469: ./security/landlock/syscalls.chMhj )ubj)}(hX!This system call enables to enforce a Landlock ruleset on the current thread. Enforcing a ruleset requires that the task has ``CAP_SYS_ADMIN`` in its namespace or is running with no_new_privs. This avoids scenarios where unprivileged tasks can affect the behavior of privileged children.h](h~This system call enables to enforce a Landlock ruleset on the current thread. Enforcing a ruleset requires that the task has }(hj%*hhhNhNubjz)}(h``CAP_SYS_ADMIN``h]h CAP_SYS_ADMIN}(hj-*hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj%*ubh in its namespace or is running with no_new_privs. This avoids scenarios where unprivileged tasks can affect the behavior of privileged children.}(hj%*hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:469: ./security/landlock/syscalls.chMhj )ubj)}(hPossible returned errors are:h]hPossible returned errors are:}(hjF*hhhNhNubah}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:469: ./security/landlock/syscalls.chMhj )ubj )}(hhh](j )}(hN``EOPNOTSUPP``: Landlock is supported by the kernel but disabled at boot time;h]j)}(hjZ*h](jz)}(h``EOPNOTSUPP``h]h EOPNOTSUPP}(hj_*hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj\*ubh@: Landlock is supported by the kernel but disabled at boot time;}(hj\*hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:469: ./security/landlock/syscalls.chMhjX*ubah}(h]h ]h"]h$]h&]uh1j hjU*ubj )}(h.``EINVAL``: **flags** contains an unknown bit.h]j)}(hj*h](jz)}(h ``EINVAL``h]hEINVAL}(hj*hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj*ubh: }(hj*hhhNhNubj)}(h **flags**h]hflags}(hj*hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj*ubh contains an unknown bit.}(hj*hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:469: ./security/landlock/syscalls.chMhj~*ubah}(h]h ]h"]h$]h&]uh1j hjU*ubj )}(hJ``EBADF``: **ruleset_fd** is not a file descriptor for the current thread;h]j)}(hj*h](jz)}(h ``EBADF``h]hEBADF}(hj*hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj*ubh: }(hj*hhhNhNubj)}(h**ruleset_fd**h]h ruleset_fd}(hj*hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj*ubh1 is not a file descriptor for the current thread;}(hj*hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:469: ./security/landlock/syscalls.chMhj*ubah}(h]h ]h"]h$]h&]uh1j hjU*ubj )}(h<``EBADFD``: **ruleset_fd** is not a ruleset file descriptor;h]j)}(hj*h](jz)}(h ``EBADFD``h]hEBADFD}(hj*hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj*ubh: }(hj*hhhNhNubj)}(h**ruleset_fd**h]h ruleset_fd}(hj+hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj*ubh" is not a ruleset file descriptor;}(hj*hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:469: ./security/landlock/syscalls.chMhj*ubah}(h]h ]h"]h$]h&]uh1j hjU*ubj )}(h``EPERM``: **ruleset_fd** has no read access to the underlying ruleset, or the current thread is not running with no_new_privs, or it doesn't have ``CAP_SYS_ADMIN`` in its namespace.h]j)}(h``EPERM``: **ruleset_fd** has no read access to the underlying ruleset, or the current thread is not running with no_new_privs, or it doesn't have ``CAP_SYS_ADMIN`` in its namespace.h](jz)}(h ``EPERM``h]hEPERM}(hj.+hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj*+ubh: }(hj*+hhhNhNubj)}(h**ruleset_fd**h]h ruleset_fd}(hj@+hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj*+ubh| has no read access to the underlying ruleset, or the current thread is not running with no_new_privs, or it doesn’t have }(hj*+hhhNhNubjz)}(h``CAP_SYS_ADMIN``h]h CAP_SYS_ADMIN}(hjR+hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj*+ubh in its namespace.}(hj*+hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:469: ./security/landlock/syscalls.chMhj&+ubah}(h]h ]h"]h$]h&]uh1j hjU*ubj )}(hU``E2BIG``: The maximum number of stacked rulesets is reached for the current thread. h]j)}(hT``E2BIG``: The maximum number of stacked rulesets is reached for the current thread.h](jz)}(h ``E2BIG``h]hE2BIG}(hjy+hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhju+ubhK: The maximum number of stacked rulesets is reached for the current thread.}(hju+hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:469: ./security/landlock/syscalls.chMhjq+ubah}(h]h ]h"]h$]h&]uh1j hjU*ubeh}(h]h ]h"]h$]h&]j j uh1j hjw*hMhj )ubj)}(h **Flags**h]j)}(hj+h]hFlags}(hj+hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj+ubah}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:38: ./include/uapi/linux/landlock.hhKIhj )ubj)}(hXBy default, denied accesses originating from programs that sandbox themselves are logged via the audit subsystem. Such events typically indicate unexpected behavior, such as bugs or exploitation attempts. However, to avoid excessive logging, access requests denied by a domain not created by the originating program are not logged by default. The rationale is that programs should know their own behavior, but not necessarily the behavior of other programs. This default configuration is suitable for most programs that sandbox themselves. For specific use cases, the following flags allow programs to modify this default logging behavior.h]hXBy default, denied accesses originating from programs that sandbox themselves are logged via the audit subsystem. Such events typically indicate unexpected behavior, such as bugs or exploitation attempts. However, to avoid excessive logging, access requests denied by a domain not created by the originating program are not logged by default. The rationale is that programs should know their own behavior, but not necessarily the behavior of other programs. This default configuration is suitable for most programs that sandbox themselves. For specific use cases, the following flags allow programs to modify this default logging behavior.}(hj+hhhNhNubah}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:38: ./include/uapi/linux/landlock.hhKKhj )ubj)}(hThe ``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF`` and ``LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON`` flags apply to the newly created Landlock domain.h](hThe }(hj+hhhNhNubjz)}(h,``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF``h]h(LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF}(hj+hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj+ubh and }(hj+hhhNhNubjz)}(h*``LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON``h]h&LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON}(hj+hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj+ubh2 flags apply to the newly created Landlock domain.}(hj+hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:38: ./include/uapi/linux/landlock.hhKUhj )ubj)}(hhh](j)}(hX``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF`` Disables logging of denied accesses originating from the thread creating the Landlock domain, as well as its children, as long as they continue running the same executable code (i.e., without an intervening :manpage:`execve(2)` call). This is intended for programs that execute unknown code without invoking :manpage:`execve(2)`, such as script interpreters. Programs that only sandbox themselves should not set this flag, so users can be notified of unauthorized access attempts via system logs. h](j)}(h,``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF``h]jz)}(hj,h]h(LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF}(hj,hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj+ubah}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:38: ./include/uapi/linux/landlock.hhKahj+ubj))}(hhh]j)}(hXDisables logging of denied accesses originating from the thread creating the Landlock domain, as well as its children, as long as they continue running the same executable code (i.e., without an intervening :manpage:`execve(2)` call). This is intended for programs that execute unknown code without invoking :manpage:`execve(2)`, such as script interpreters. Programs that only sandbox themselves should not set this flag, so users can be notified of unauthorized access attempts via system logs.h](hDisables logging of denied accesses originating from the thread creating the Landlock domain, as well as its children, as long as they continue running the same executable code (i.e., without an intervening }(hj,hhhNhNubj)}(h:manpage:`execve(2)`h]h execve(2)}(hj",hhhNhNubah}(h]h ]jah"]h$]h&]hhj execve(2)jexecvejjuh1jhj,ubhQ call). This is intended for programs that execute unknown code without invoking }(hj,hhhNhNubj)}(h:manpage:`execve(2)`h]h execve(2)}(hj6,hhhNhNubah}(h]h ]jah"]h$]h&]hhj execve(2)jexecvejjuh1jhj,ubh, such as script interpreters. Programs that only sandbox themselves should not set this flag, so users can be notified of unauthorized access attempts via system logs.}(hj,hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:38: ./include/uapi/linux/landlock.hhKZhj,ubah}(h]h ]h"]h$]h&]uh1j(hj+ubeh}(h]h ]h"]h$]h&]uh1jhj,hKahj+ubj)}(hX``LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON`` Enables logging of denied accesses after an :manpage:`execve(2)` call, providing visibility into unauthorized access attempts by newly executed programs within the created Landlock domain. This flag is recommended only when all potential executables in the domain are expected to comply with the access restrictions, as excessive audit log entries could make it more difficult to identify critical events. h](j)}(h*``LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON``h]jz)}(hjc,h]h&LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON}(hje,hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhja,ubah}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:38: ./include/uapi/linux/landlock.hhKihj],ubj))}(hhh]j)}(hXEnables logging of denied accesses after an :manpage:`execve(2)` call, providing visibility into unauthorized access attempts by newly executed programs within the created Landlock domain. This flag is recommended only when all potential executables in the domain are expected to comply with the access restrictions, as excessive audit log entries could make it more difficult to identify critical events.h](h,Enables logging of denied accesses after an }(hj|,hhhNhNubj)}(h:manpage:`execve(2)`h]h execve(2)}(hj,hhhNhNubah}(h]h ]jah"]h$]h&]hhj execve(2)jexecvejjuh1jhj|,ubhXU call, providing visibility into unauthorized access attempts by newly executed programs within the created Landlock domain. This flag is recommended only when all potential executables in the domain are expected to comply with the access restrictions, as excessive audit log entries could make it more difficult to identify critical events.}(hj|,hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:38: ./include/uapi/linux/landlock.hhKdhjy,ubah}(h]h ]h"]h$]h&]uh1j(hj],ubeh}(h]h ]h"]h$]h&]uh1jhjx,hKihj+ubj)}(hX``LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF`` Disables logging of denied accesses originating from nested Landlock domains created by the caller or its descendants. This flag should be set according to runtime configuration, not hardcoded, to avoid suppressing important security events. It is useful for container runtimes or sandboxing tools that may launch programs which themselves create Landlock domains and could otherwise generate excessive logs. Unlike ``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF``, this flag only affects future nested domains, not the one being created. It can also be used with a **ruleset_fd** value of -1 to mute subdomain logs without creating a domain. h](j)}(h-``LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF``h]jz)}(hj,h]h)LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF}(hj,hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj,ubah}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:38: ./include/uapi/linux/landlock.hhKuhj,ubj))}(hhh]j)}(hX~Disables logging of denied accesses originating from nested Landlock domains created by the caller or its descendants. This flag should be set according to runtime configuration, not hardcoded, to avoid suppressing important security events. It is useful for container runtimes or sandboxing tools that may launch programs which themselves create Landlock domains and could otherwise generate excessive logs. Unlike ``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF``, this flag only affects future nested domains, not the one being created. It can also be used with a **ruleset_fd** value of -1 to mute subdomain logs without creating a domain.h](hXDisables logging of denied accesses originating from nested Landlock domains created by the caller or its descendants. This flag should be set according to runtime configuration, not hardcoded, to avoid suppressing important security events. It is useful for container runtimes or sandboxing tools that may launch programs which themselves create Landlock domains and could otherwise generate excessive logs. Unlike }(hj,hhhNhNubjz)}(h,``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF``h]h(LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF}(hj,hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj,ubhf, this flag only affects future nested domains, not the one being created. It can also be used with a }(hj,hhhNhNubj)}(h**ruleset_fd**h]h ruleset_fd}(hj,hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj,ubh> value of -1 to mute subdomain logs without creating a domain.}(hj,hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:38: ./include/uapi/linux/landlock.hhKlhj,ubah}(h]h ]h"]h$]h&]uh1j(hj,ubeh}(h]h ]h"]h$]h&]uh1jhj,hKuhj+ubeh}(h]h ]h"]h$]h&]uh1j hj )ubeh}(h]h ] kernelindentah"]h$]h&]uh1jhj'hhhNhNubeh}(h]enforcing-a-rulesetah ]h"]enforcing a rulesetah$]h&]uh1hhj- hhhhhMubeh}(h]kernel-interfaceah ]h"]kernel interfaceah$]h&]uh1hhhhhhhhMubh)}(hhh](h)}(hCurrent limitationsh]hCurrent limitations}(hj)-hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj&-hhhhhMubh)}(hhh](h)}(h Filesystem topology modificationh]h Filesystem topology modification}(hj:-hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj7-hhhhhMubj)}(hThreads sandboxed with filesystem restrictions cannot modify filesystem topology, whether via :manpage:`mount(2)` or :manpage:`pivot_root(2)`. However, :manpage:`chroot(2)` calls are not denied.h](h^Threads sandboxed with filesystem restrictions cannot modify filesystem topology, whether via }(hjH-hhhNhNubj)}(h:manpage:`mount(2)`h]hmount(2)}(hjP-hhhNhNubah}(h]h ]jah"]h$]h&]hhjmount(2)jmountjjuh1jhjH-ubh or }(hjH-hhhNhNubj)}(h:manpage:`pivot_root(2)`h]h pivot_root(2)}(hjd-hhhNhNubah}(h]h ]jah"]h$]h&]hhj pivot_root(2)j pivot_rootjjuh1jhjH-ubh . However, }(hjH-hhhNhNubj)}(h:manpage:`chroot(2)`h]h chroot(2)}(hjx-hhhNhNubah}(h]h ]jah"]h$]h&]hhj chroot(2)jchrootjjuh1jhjH-ubh calls are not denied.}(hjH-hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhMhj7-hhubeh}(h] filesystem-topology-modificationah ]h"] filesystem topology modificationah$]h&]uh1hhj&-hhhhhMubh)}(hhh](h)}(hSpecial filesystemsh]hSpecial filesystems}(hj-hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj-hhhhhMubj)}(hXAccess to regular files and directories can be restricted by Landlock, according to the handled accesses of a ruleset. However, files that do not come from a user-visible filesystem (e.g. pipe, socket), but can still be accessed through ``/proc//fd/*``, cannot currently be explicitly restricted. Likewise, some special kernel filesystems such as nsfs, which can be accessed through ``/proc//ns/*``, cannot currently be explicitly restricted. However, thanks to the `ptrace restrictions`_, access to such sensitive ``/proc`` files are automatically restricted according to domain hierarchies. Future Landlock evolutions could still enable to explicitly restrict such paths with dedicated ruleset flags.h](hAccess to regular files and directories can be restricted by Landlock, according to the handled accesses of a ruleset. However, files that do not come from a user-visible filesystem (e.g. pipe, socket), but can still be accessed through }(hj-hhhNhNubjz)}(h``/proc//fd/*``h]h/proc//fd/*}(hj-hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj-ubh, cannot currently be explicitly restricted. Likewise, some special kernel filesystems such as nsfs, which can be accessed through }(hj-hhhNhNubjz)}(h``/proc//ns/*``h]h/proc//ns/*}(hj-hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj-ubhE, cannot currently be explicitly restricted. However, thanks to the }(hj-hhhNhNubj?)}(h`ptrace restrictions`_h]hptrace restrictions}(hj-hhhNhNubah}(h]h ]h"]h$]h&]nameptrace restrictionsjjOuh1j>hj-jRKubh, access to such sensitive }(hj-hhhNhNubjz)}(h ``/proc``h]h/proc}(hj-hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj-ubh files are automatically restricted according to domain hierarchies. Future Landlock evolutions could still enable to explicitly restrict such paths with dedicated ruleset flags.}(hj-hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhMhj-hhubeh}(h]special-filesystemsah ]h"]special filesystemsah$]h&]uh1hhj&-hhhhhMubh)}(hhh](h)}(hRuleset layersh]hRuleset layers}(hj.hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj .hhhhhMubj)}(hXThere is a limit of 16 layers of stacked rulesets. This can be an issue for a task willing to enforce a new ruleset in complement to its 16 inherited rulesets. Once this limit is reached, sys_landlock_restrict_self() returns E2BIG. It is then strongly suggested to carefully build rulesets once in the life of a thread, especially for applications able to launch other applications that may also want to sandbox themselves (e.g. shells, container managers, etc.).h]hXThere is a limit of 16 layers of stacked rulesets. This can be an issue for a task willing to enforce a new ruleset in complement to its 16 inherited rulesets. Once this limit is reached, sys_landlock_restrict_self() returns E2BIG. It is then strongly suggested to carefully build rulesets once in the life of a thread, especially for applications able to launch other applications that may also want to sandbox themselves (e.g. shells, container managers, etc.).}(hj.hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhMhj .hhubeh}(h]ruleset-layersah ]h"]ruleset layersah$]h&]uh1hhj&-hhhhhMubh)}(hhh](h)}(h Memory usageh]h Memory usage}(hj5.hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj2.hhhhhMubj)}(hKernel memory allocated to create rulesets is accounted and can be restricted by the Documentation/admin-guide/cgroup-v1/memory.rst.h]hKernel memory allocated to create rulesets is accounted and can be restricted by the Documentation/admin-guide/cgroup-v1/memory.rst.}(hjC.hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhMhj2.hhubeh}(h] memory-usageah ]h"] memory usageah$]h&]uh1hhj&-hhhhhMubh)}(hhh](h)}(h IOCTL supporth]h IOCTL support}(hj\.hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjY.hhhhhMubj)}(hThe ``LANDLOCK_ACCESS_FS_IOCTL_DEV`` right restricts the use of :manpage:`ioctl(2)`, but it only applies to *newly opened* device files. This means specifically that pre-existing file descriptors like stdin, stdout and stderr are unaffected.h](hThe }(hjj.hhhNhNubjz)}(h ``LANDLOCK_ACCESS_FS_IOCTL_DEV``h]hLANDLOCK_ACCESS_FS_IOCTL_DEV}(hjr.hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjj.ubh right restricts the use of }(hjj.hhhNhNubj)}(h:manpage:`ioctl(2)`h]hioctl(2)}(hj.hhhNhNubah}(h]h ]jah"]h$]h&]hhjioctl(2)jioctljjuh1jhjj.ubh, but it only applies to }(hjj.hhhNhNubj)}(h*newly opened*h]h newly opened}(hj.hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjj.ubhx device files. This means specifically that pre-existing file descriptors like stdin, stdout and stderr are unaffected.}(hjj.hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhMhjY.hhubj)}(hXUsers should be aware that TTY devices have traditionally permitted to control other processes on the same TTY through the ``TIOCSTI`` and ``TIOCLINUX`` IOCTL commands. Both of these require ``CAP_SYS_ADMIN`` on modern Linux systems, but the behavior is configurable for ``TIOCSTI``.h](h{Users should be aware that TTY devices have traditionally permitted to control other processes on the same TTY through the }(hj.hhhNhNubjz)}(h ``TIOCSTI``h]hTIOCSTI}(hj.hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj.ubh and }(hj.hhhNhNubjz)}(h ``TIOCLINUX``h]h TIOCLINUX}(hj.hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj.ubh( IOCTL commands. Both of these require }(hj.hhhNhNubjz)}(h``CAP_SYS_ADMIN``h]h CAP_SYS_ADMIN}(hj.hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj.ubh? on modern Linux systems, but the behavior is configurable for }(hj.hhhNhNubjz)}(h ``TIOCSTI``h]hTIOCSTI}(hj.hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj.ubh.}(hj.hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhM hjY.hhubj)}(hOn older systems, it is therefore recommended to close inherited TTY file descriptors, or to reopen them from ``/proc/self/fd/*`` without the ``LANDLOCK_ACCESS_FS_IOCTL_DEV`` right, if possible.h](hnOn older systems, it is therefore recommended to close inherited TTY file descriptors, or to reopen them from }(hj/hhhNhNubjz)}(h``/proc/self/fd/*``h]h/proc/self/fd/*}(hj/hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj/ubh without the }(hj/hhhNhNubjz)}(h ``LANDLOCK_ACCESS_FS_IOCTL_DEV``h]hLANDLOCK_ACCESS_FS_IOCTL_DEV}(hj /hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj/ubh right, if possible.}(hj/hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhMhjY.hhubj)}(hX1Landlock's IOCTL support is coarse-grained at the moment, but may become more fine-grained in the future. Until then, users are advised to establish the guarantees that they need through the file hierarchy, by only allowing the ``LANDLOCK_ACCESS_FS_IOCTL_DEV`` right on files where it is really required.h](hLandlock’s IOCTL support is coarse-grained at the moment, but may become more fine-grained in the future. Until then, users are advised to establish the guarantees that they need through the file hierarchy, by only allowing the }(hj8/hhhNhNubjz)}(h ``LANDLOCK_ACCESS_FS_IOCTL_DEV``h]hLANDLOCK_ACCESS_FS_IOCTL_DEV}(hj@/hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj8/ubh, right on files where it is really required.}(hj8/hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhMhjY.hhubeh}(h] ioctl-supportah ]h"] ioctl supportah$]h&]uh1hhj&-hhhhhMubeh}(h]current-limitationsah ]h"]current limitationsah$]h&]uh1hhhhhhhhMubh)}(hhh](h)}(hPrevious limitationsh]hPrevious limitations}(hjk/hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjh/hhhhhMubh)}(hhh](h)}(h#File renaming and linking (ABI < 2)h]h#File renaming and linking (ABI < 2)}(hj|/hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjy/hhhhhMubj)}(hXBecause Landlock targets unprivileged access controls, it needs to properly handle composition of rules. Such property also implies rules nesting. Properly handling multiple layers of rulesets, each one of them able to restrict access to files, also implies inheritance of the ruleset restrictions from a parent to its hierarchy. Because files are identified and restricted by their hierarchy, moving or linking a file from one directory to another implies propagation of the hierarchy constraints, or restriction of these actions according to the potentially lost constraints. To protect against privilege escalations through renaming or linking, and for the sake of simplicity, Landlock previously limited linking and renaming to the same directory. Starting with the Landlock ABI version 2, it is now possible to securely control renaming and linking thanks to the new ``LANDLOCK_ACCESS_FS_REFER`` access right.h](hXkBecause Landlock targets unprivileged access controls, it needs to properly handle composition of rules. Such property also implies rules nesting. Properly handling multiple layers of rulesets, each one of them able to restrict access to files, also implies inheritance of the ruleset restrictions from a parent to its hierarchy. Because files are identified and restricted by their hierarchy, moving or linking a file from one directory to another implies propagation of the hierarchy constraints, or restriction of these actions according to the potentially lost constraints. To protect against privilege escalations through renaming or linking, and for the sake of simplicity, Landlock previously limited linking and renaming to the same directory. Starting with the Landlock ABI version 2, it is now possible to securely control renaming and linking thanks to the new }(hj/hhhNhNubjz)}(h``LANDLOCK_ACCESS_FS_REFER``h]hLANDLOCK_ACCESS_FS_REFER}(hj/hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj/ubh access right.}(hj/hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhMhjy/hhubeh}(h]file-renaming-and-linking-abi-2ah ]h"]#file renaming and linking (abi < 2)ah$]h&]uh1hhjh/hhhhhMubh)}(hhh](h)}(hFile truncation (ABI < 3)h]hFile truncation (ABI < 3)}(hj/hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj/hhhhhM,ubj)}(hFile truncation could not be denied before the third Landlock ABI, so it is always allowed when using a kernel that only supports the first or second ABI.h]hFile truncation could not be denied before the third Landlock ABI, so it is always allowed when using a kernel that only supports the first or second ABI.}(hj/hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhM.hj/hhubj)}(hStarting with the Landlock ABI version 3, it is now possible to securely control truncation thanks to the new ``LANDLOCK_ACCESS_FS_TRUNCATE`` access right.h](hnStarting with the Landlock ABI version 3, it is now possible to securely control truncation thanks to the new }(hj/hhhNhNubjz)}(h``LANDLOCK_ACCESS_FS_TRUNCATE``h]hLANDLOCK_ACCESS_FS_TRUNCATE}(hj/hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj/ubh access right.}(hj/hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhM1hj/hhubeh}(h]file-truncation-abi-3ah ]h"]file truncation (abi < 3)ah$]h&]uh1hhjh/hhhhhM,ubh)}(hhh](h)}(hTCP bind and connect (ABI < 4)h]hTCP bind and connect (ABI < 4)}(hj/hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj/hhhhhM5ubj)}(hStarting with the Landlock ABI version 4, it is now possible to restrict TCP bind and connect actions to only a set of allowed ports thanks to the new ``LANDLOCK_ACCESS_NET_BIND_TCP`` and ``LANDLOCK_ACCESS_NET_CONNECT_TCP`` access rights.h](hStarting with the Landlock ABI version 4, it is now possible to restrict TCP bind and connect actions to only a set of allowed ports thanks to the new }(hj 0hhhNhNubjz)}(h ``LANDLOCK_ACCESS_NET_BIND_TCP``h]hLANDLOCK_ACCESS_NET_BIND_TCP}(hj0hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj 0ubh and }(hj 0hhhNhNubjz)}(h#``LANDLOCK_ACCESS_NET_CONNECT_TCP``h]hLANDLOCK_ACCESS_NET_CONNECT_TCP}(hj$0hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj 0ubh access rights.}(hj 0hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhM7hj/hhubeh}(h]tcp-bind-and-connect-abi-4ah ]h"]tcp bind and connect (abi < 4)ah$]h&]uh1hhjh/hhhhhM5ubh)}(hhh](h)}(hDevice IOCTL (ABI < 5)h]hDevice IOCTL (ABI < 5)}(hjG0hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjD0hhhhhM=ubj)}(hIOCTL operations could not be denied before the fifth Landlock ABI, so :manpage:`ioctl(2)` is always allowed when using a kernel that only supports an earlier ABI.h](hGIOCTL operations could not be denied before the fifth Landlock ABI, so }(hjU0hhhNhNubj)}(h:manpage:`ioctl(2)`h]hioctl(2)}(hj]0hhhNhNubah}(h]h ]jah"]h$]h&]hhjioctl(2)jioctljjuh1jhjU0ubhI is always allowed when using a kernel that only supports an earlier ABI.}(hjU0hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhM?hjD0hhubj)}(hStarting with the Landlock ABI version 5, it is possible to restrict the use of :manpage:`ioctl(2)` on character and block devices using the new ``LANDLOCK_ACCESS_FS_IOCTL_DEV`` right.h](hPStarting with the Landlock ABI version 5, it is possible to restrict the use of }(hjw0hhhNhNubj)}(h:manpage:`ioctl(2)`h]hioctl(2)}(hj0hhhNhNubah}(h]h ]jah"]h$]h&]hhjioctl(2)jioctljjuh1jhjw0ubh. on character and block devices using the new }(hjw0hhhNhNubjz)}(h ``LANDLOCK_ACCESS_FS_IOCTL_DEV``h]hLANDLOCK_ACCESS_FS_IOCTL_DEV}(hj0hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjw0ubh right.}(hjw0hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhMChjD0hhubeh}(h]device-ioctl-abi-5ah ]h"]device ioctl (abi < 5)ah$]h&]uh1hhjh/hhhhhM=ubh)}(hhh](h)}(hAbstract UNIX socket (ABI < 6)h]hAbstract UNIX socket (ABI < 6)}(hj0hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj0hhhhhMHubj)}(hStarting with the Landlock ABI version 6, it is possible to restrict connections to an abstract :manpage:`unix(7)` socket by setting ``LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET`` to the ``scoped`` ruleset attribute.h](h`Starting with the Landlock ABI version 6, it is possible to restrict connections to an abstract }(hj0hhhNhNubj)}(h:manpage:`unix(7)`h]hunix(7)}(hj0hhhNhNubah}(h]h ]jah"]h$]h&]hhjunix(7)junixjjuh1jhj0ubh socket by setting }(hj0hhhNhNubjz)}(h'``LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET``h]h#LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET}(hj0hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj0ubh to the }(hj0hhhNhNubjz)}(h ``scoped``h]hscoped}(hj0hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj0ubh ruleset attribute.}(hj0hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhMJhj0hhubeh}(h]abstract-unix-socket-abi-6ah ]h"]abstract unix socket (abi < 6)ah$]h&]uh1hhjh/hhhhhMHubh)}(hhh](h)}(hSignal (ABI < 6)h]hSignal (ABI < 6)}(hj1hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj1hhhhhMOubj)}(hStarting with the Landlock ABI version 6, it is possible to restrict :manpage:`signal(7)` sending by setting ``LANDLOCK_SCOPE_SIGNAL`` to the ``scoped`` ruleset attribute.h](hEStarting with the Landlock ABI version 6, it is possible to restrict }(hj#1hhhNhNubj)}(h:manpage:`signal(7)`h]h signal(7)}(hj+1hhhNhNubah}(h]h ]jah"]h$]h&]hhj signal(7)jsignaljjuh1jhj#1ubh sending by setting }(hj#1hhhNhNubjz)}(h``LANDLOCK_SCOPE_SIGNAL``h]hLANDLOCK_SCOPE_SIGNAL}(hj?1hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj#1ubh to the }(hj#1hhhNhNubjz)}(h ``scoped``h]hscoped}(hjQ1hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj#1ubh ruleset attribute.}(hj#1hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhMQhj1hhubeh}(h] signal-abi-6ah ]h"]signal (abi < 6)ah$]h&]uh1hhjh/hhhhhMOubh)}(hhh](h)}(hLogging (ABI < 7)h]hLogging (ABI < 7)}(hjt1hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjq1hhhhhMVubj)}(hXrStarting with the Landlock ABI version 7, it is possible to control logging of Landlock audit events with the ``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF``, ``LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON``, and ``LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF`` flags passed to sys_landlock_restrict_self(). See Documentation/admin-guide/LSM/landlock.rst for more details on audit.h](hnStarting with the Landlock ABI version 7, it is possible to control logging of Landlock audit events with the }(hj1hhhNhNubjz)}(h,``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF``h]h(LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF}(hj1hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj1ubh, }(hj1hhhNhNubjz)}(h*``LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON``h]h&LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON}(hj1hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj1ubh, and }(hj1hhhNhNubjz)}(h-``LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF``h]h)LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF}(hj1hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj1ubhy flags passed to sys_landlock_restrict_self(). See Documentation/admin-guide/LSM/landlock.rst for more details on audit.}(hj1hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhMXhjq1hhubj )}(h.. _kernel_support:h]h}(h]h ]h"]h$]h&]jkernel-supportuh1j hM_hjq1hhhhubeh}(h] logging-abi-7ah ]h"]logging (abi < 7)ah$]h&]uh1hhjh/hhhhhMVubeh}(h]previous-limitationsah ]h"]previous limitationsah$]h&]uh1hhhhhhhhMubh)}(hhh](h)}(hKernel supporth]hKernel support}(hj1hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj1hhhhhMbubh)}(hhh](h)}(hBuild time configurationh]hBuild time configuration}(hj1hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj1hhhhhMeubj)}(hXLandlock was first introduced in Linux 5.13 but it must be configured at build time with ``CONFIG_SECURITY_LANDLOCK=y``. Landlock must also be enabled at boot time like other security modules. The list of security modules enabled by default is set with ``CONFIG_LSM``. The kernel configuration should then contain ``CONFIG_LSM=landlock,[...]`` with ``[...]`` as the list of other potentially useful security modules for the running system (see the ``CONFIG_LSM`` help).h](hYLandlock was first introduced in Linux 5.13 but it must be configured at build time with }(hj2hhhNhNubjz)}(h``CONFIG_SECURITY_LANDLOCK=y``h]hCONFIG_SECURITY_LANDLOCK=y}(hj 2hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj2ubh. Landlock must also be enabled at boot time like other security modules. The list of security modules enabled by default is set with }(hj2hhhNhNubjz)}(h``CONFIG_LSM``h]h CONFIG_LSM}(hj2hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj2ubh0. The kernel configuration should then contain }(hj2hhhNhNubjz)}(h``CONFIG_LSM=landlock,[...]``h]hCONFIG_LSM=landlock,[...]}(hj/2hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj2ubh with }(hj2hhhNhNubjz)}(h ``[...]``h]h[...]}(hjA2hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj2ubh[ as the list of other potentially useful security modules for the running system (see the }(hj2hhhNhNubjz)}(h``CONFIG_LSM``h]h CONFIG_LSM}(hjS2hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj2ubh help).}(hj2hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhMghj1hhubeh}(h]build-time-configurationah ]h"]build time configurationah$]h&]uh1hhj1hhhhhMeubh)}(hhh](h)}(hBoot time configurationh]hBoot time configuration}(hjv2hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjs2hhhhhMpubj)}(hIf the running kernel does not have ``landlock`` in ``CONFIG_LSM``, then we can enable Landlock by adding ``lsm=landlock,[...]`` to Documentation/admin-guide/kernel-parameters.rst in the boot loader configuration.h](h$If the running kernel does not have }(hj2hhhNhNubjz)}(h ``landlock``h]hlandlock}(hj2hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj2ubh in }(hj2hhhNhNubjz)}(h``CONFIG_LSM``h]h CONFIG_LSM}(hj2hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj2ubh(, then we can enable Landlock by adding }(hj2hhhNhNubjz)}(h``lsm=landlock,[...]``h]hlsm=landlock,[...]}(hj2hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj2ubhU to Documentation/admin-guide/kernel-parameters.rst in the boot loader configuration.}(hj2hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhMrhjs2hhubj)}(h6For example, if the current built-in configuration is:h]h6For example, if the current built-in configuration is:}(hj2hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhMwhjs2hhubj)}(h~$ zgrep -h "^CONFIG_LSM=" "/boot/config-$(uname -r)" /proc/config.gz 2>/dev/null CONFIG_LSM="lockdown,yama,integrity,apparmor"h]h~$ zgrep -h "^CONFIG_LSM=" "/boot/config-$(uname -r)" /proc/config.gz 2>/dev/null CONFIG_LSM="lockdown,yama,integrity,apparmor"}hj2sbah}(h]h ]h"]h$]h&]hhjjconsolej}uh1jhhhMyhjs2hhubj)}(h:...and if the cmdline doesn't contain ``landlock`` either:h](h(...and if the cmdline doesn’t contain }(hj2hhhNhNubjz)}(h ``landlock``h]hlandlock}(hj2hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj2ubh either:}(hj2hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhM~hjs2hhubj)}(hW$ sed -n 's/.*\(\The kernel may be configured at build time to always load the }(hjt3hhhNhNubjz)}(h ``lockdown``h]hlockdown}(hj|3hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjt3ubh and }(hjt3hhhNhNubjz)}(h``capability``h]h capability}(hj3hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjt3ubhE LSMs. In that case, these LSMs will appear at the beginning of the }(hjt3hhhNhNubjz)}(h``LSM: initializing``h]hLSM: initializing}(hj3hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhjt3ubhF log line as well, even if they are not configured in the boot loader.}(hjt3hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhMhjs2hhubeh}(h]boot-time-configurationah ]h"]boot time configurationah$]h&]uh1hhj1hhhhhMpubh)}(hhh](h)}(hNetwork supporth]hNetwork support}(hj3hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj3hhhhhMubj)}(hXBTo be able to explicitly allow TCP operations (e.g., adding a network rule with ``LANDLOCK_ACCESS_NET_BIND_TCP``), the kernel must support TCP (``CONFIG_INET=y``). Otherwise, sys_landlock_add_rule() returns an ``EAFNOSUPPORT`` error, which can safely be ignored because this kind of TCP operation is already not possible.h](hPTo be able to explicitly allow TCP operations (e.g., adding a network rule with }(hj3hhhNhNubjz)}(h ``LANDLOCK_ACCESS_NET_BIND_TCP``h]hLANDLOCK_ACCESS_NET_BIND_TCP}(hj3hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj3ubh ), the kernel must support TCP (}(hj3hhhNhNubjz)}(h``CONFIG_INET=y``h]h CONFIG_INET=y}(hj3hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj3ubh2). Otherwise, sys_landlock_add_rule() returns an }(hj3hhhNhNubjz)}(h``EAFNOSUPPORT``h]h EAFNOSUPPORT}(hj3hhhNhNubah}(h]h ]h"]h$]h&]uh1jyhj3ubh_ error, which can safely be ignored because this kind of TCP operation is already not possible.}(hj3hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhMhj3hhubeh}(h]network-supportah ]h"]network supportah$]h&]uh1hhj1hhhhhMubeh}(h](j1id2eh ]h"](kernel supportkernel_supporteh$]h&]uh1hhhhhhhhMbj! }j#4j1sj# }j1j1subh)}(hhh](h)}(hQuestions and answersh]hQuestions and answers}(hj+4hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj(4hhhhhMubh)}(hhh](h)}(h'What about user space sandbox managers?h]h'What about user space sandbox managers?}(hj<4hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj94hhhhhMubj)}(hX6Using user space processes to enforce restrictions on kernel resources can lead to race conditions or inconsistent evaluations (i.e. `Incorrect mirroring of the OS code and state `_).h](hUsing user space processes to enforce restrictions on kernel resources can lead to race conditions or inconsistent evaluations (i.e. }(hjJ4hhhNhNubj?)}(h`Incorrect mirroring of the OS code and state `_h]h,Incorrect mirroring of the OS code and state}(hjR4hhhNhNubah}(h]h ]h"]h$]h&]name,Incorrect mirroring of the OS code and statejP}https://www.ndss-symposium.org/ndss2003/traps-and-pitfalls-practical-problems-system-call-interposition-based-security-tools/uh1j>hjJ4ubj )}(h h]h}(h],incorrect-mirroring-of-the-os-code-and-stateah ]h"],incorrect mirroring of the os code and stateah$]h&]refurijb4uh1j jUKhjJ4ubh).}(hjJ4hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhMhj94hhubeh}(h]&what-about-user-space-sandbox-managersah ]h"]'what about user space sandbox managers?ah$]h&]uh1hhj(4hhhhhMubh)}(hhh](h)}(h%What about namespaces and containers?h]h%What about namespaces and containers?}(hj4hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj4hhhhhMubj)}(hXjNamespaces can help create sandboxes but they are not designed for access-control and then miss useful features for such use case (e.g. no fine-grained restrictions). Moreover, their complexity can lead to security issues, especially when untrusted processes can manipulate them (cf. `Controlling access to user namespaces `_).h](hXNamespaces can help create sandboxes but they are not designed for access-control and then miss useful features for such use case (e.g. no fine-grained restrictions). Moreover, their complexity can lead to security issues, especially when untrusted processes can manipulate them (cf. }(hj4hhhNhNubj?)}(hK`Controlling access to user namespaces `_h]h%Controlling access to user namespaces}(hj4hhhNhNubah}(h]h ]h"]h$]h&]name%Controlling access to user namespacesjP https://lwn.net/Articles/673597/uh1j>hj4ubj )}(h# h]h}(h]%controlling-access-to-user-namespacesah ]h"]%controlling access to user namespacesah$]h&]refurij4uh1j jUKhj4ubh).}(hj4hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhMhj4hhubeh}(h]$what-about-namespaces-and-containersah ]h"]%what about namespaces and containers?ah$]h&]uh1hhj(4hhhhhMubh)}(hhh](h)}(h&How to disable Landlock audit records?h]h&How to disable Landlock audit records?}(hj4hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj4hhhhhMubj)}(hdYou might want to put in place filters as explained here: Documentation/admin-guide/LSM/landlock.rsth]hdYou might want to put in place filters as explained here: Documentation/admin-guide/LSM/landlock.rst}(hj4hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhMhj4hhubeh}(h]%how-to-disable-landlock-audit-recordsah ]h"]&how to disable landlock audit records?ah$]h&]uh1hhj(4hhhhhMubeh}(h]questions-and-answersah ]h"]questions and answersah$]h&]uh1hhhhhhhhMubh)}(hhh](h)}(hAdditional documentationh]hAdditional documentation}(hj4hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj4hhhhhMubj )}(hhh](j )}(h*Documentation/admin-guide/LSM/landlock.rsth]j)}(hj5h]h*Documentation/admin-guide/LSM/landlock.rst}(hj5hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhMhj5ubah}(h]h ]h"]h$]h&]uh1j hj 5hhhhhNubj )}(h#Documentation/security/landlock.rsth]j)}(hj'5h]h#Documentation/security/landlock.rst}(hj)5hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhMhj%5ubah}(h]h ]h"]h$]h&]uh1j hj 5hhhhhNubj )}(hhttps://landlock.io h]j)}(hhttps://landlock.ioh]j?)}(hjB5h]hhttps://landlock.io}(hjD5hhhNhNubah}(h]h ]h"]h$]h&]refurijB5uh1j>hj@5ubah}(h]h ]h"]h$]h&]uh1jhhhMhj<5ubah}(h]h ]h"]h$]h&]uh1j hj 5hhhhhNubeh}(h]h ]h"]h$]h&]j j(uh1j hhhMhj4hhubh)}(hLinksh]hLinks}hjd5sbah}(h]h ]h"]h$]h&]hhuh1hhj4hhhhhMubj )}(h.. _samples/landlock/sandboxer.c: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/samples/landlock/sandboxer.ch]h}(h]samples-landlock-sandboxer-cah ]h"]samples/landlock/sandboxer.cah$]h&]jPjQuh1j hMhj4hhhhjUKubeh}(h]additional-documentationah ]h"]additional documentationah$]h&]uh1hhhhhhhhMubeh}(h]$landlock-unprivileged-access-controlah ]h"]%landlock: unprivileged access controlah$]h&]uh1hhhhhhhhKubeh}(h]h ]h"]h$]h&]sourcehuh1hcurrent_sourceN current_lineNsettingsdocutils.frontendValues)}(hN generatorN datestampN source_linkN source_urlN toc_backlinksentryfootnote_backlinksK sectnum_xformKstrip_commentsNstrip_elements_with_classesN strip_classesN report_levelK halt_levelKexit_status_levelKdebugNwarning_streamN tracebackinput_encoding utf-8-siginput_encoding_error_handlerstrictoutput_encodingutf-8output_encoding_error_handlerj5error_encodingutf-8error_encoding_error_handlerbackslashreplace language_codeenrecord_dependenciesNconfigN id_prefixhauto_id_prefixid dump_settingsNdump_internalsNdump_transformsNdump_pseudo_xmlNexpose_internalsNstrict_visitorN_disable_configN_sourceh _destinationN _config_files]7/var/lib/git/docbuild/linux/Documentation/docutils.confafile_insertion_enabled raw_enabledKline_length_limitM'pep_referencesN pep_base_urlhttps://peps.python.org/pep_file_url_templatepep-%04drfc_referencesN rfc_base_url&https://datatracker.ietf.org/doc/html/ tab_widthKtrim_footnote_reference_spacesyntax_highlightlong smart_quotessmartquotes_locales]character_level_inline_markupdoctitle_xform docinfo_xformKsectsubtitle_xform image_loadinglinkembed_stylesheetcloak_email_addressessection_self_linkenvNubreporterNindirect_targets]substitution_defs}substitution_names}refnames}(samples/landlock/sandboxer.c]j@aptrace restrictions](joj-efilesystem flags](jjj=%e network flags](jj&e scope flags]j'aurefids}(j ]j aj1]j1aunameids}(j5j5jR jO jbj_j'j$j\jYjjjjjRjOjjjjjJ jG j* j' j j j j j j j j j#-j -jgjdj&j#jjj_j\j3j0j'j'j-j-je/jb/j-j-j.j.j/.j,.jV.jS.j]/jZ/j1j1j/j/j/j/jA0j>0j0j0j1j 1jn1jk1j1j1j#4j1j"4j4jp2jm2j3j3j4j4j4j4j4j|4jl4ji4j4j4j4j4j4j4j5j5j{5jx5u nametypes}(j5jR jbj'j\jjjRjjjJ j* j j j j j#-jgj&jj_j3j'j-je/j-j.j/.jV.j]/j1j/j/jA0j0j1jn1j1j#4j"4jp2j3j4j4j4jl4j4j4j4j5j{5uh}(j5hjO jj_jj$jejYj*jj_jjjOjjjVjjjG jj' jU j jf j j j j j j j -j- jdj> j#j jj)j\jj0jjjjjjj'j6jSjXj"j"j`$je$j%j%j-j'j'j'jb/j&-j-j7-j.j-j,.j .jS.j2.jZ/jY.j1jh/j/jy/j/j/j>0j/j0jD0j 1j0jk1j1j1jq1j1j1j4j1jm2j1j3js2j4j3j4j(4j|4j94ji4jc4j4j4j4j4j4j4j5j4jx5jr5u footnote_refs} citation_refs} autofootnotes]autofootnote_refs]symbol_footnotes]symbol_footnote_refs] footnotes] citations]autofootnote_startKsymbol_footnote_startK id_counter collectionsCounter}j5KsRparse_messages]transform_messages](hsystem_message)}(hhh]j)}(hhh]h;Hyperlink target "landlock-abi-versions" is not referenced.}hj&6sbah}(h]h ]h"]h$]h&]uh1jhj#6ubah}(h]h ]h"]h$]h&]levelKtypeINFOsourcehlineMuh1j!6ubj"6)}(hhh]j)}(hhh]h4Hyperlink target "kernel-support" is not referenced.}hjA6sbah}(h]h ]h"]h$]h&]uh1jhj>6ubah}(h]h ]h"]h$]h&]levelKtypej;6sourcehlineM_uh1j!6ube transformerN include_log] decorationNhhub.