sphinx.addnodesdocument)}( rawsourcechildren]( translations LanguagesNode)}(hhh](h pending_xref)}(hhh]docutils.nodesTextChinese (Simplified)}parenthsba attributes}(ids]classes]names]dupnames]backrefs] refdomainstdreftypedoc reftarget*/translations/zh_CN/userspace-api/landlockmodnameN classnameN refexplicitutagnamehhh ubh)}(hhh]hChinese (Traditional)}hh2sbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget*/translations/zh_TW/userspace-api/landlockmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hItalian}hhFsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget*/translations/it_IT/userspace-api/landlockmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hJapanese}hhZsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget*/translations/ja_JP/userspace-api/landlockmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hKorean}hhnsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget*/translations/ko_KR/userspace-api/landlockmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hPortuguese (Brazilian)}hhsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget*/translations/pt_BR/userspace-api/landlockmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hSpanish}hhsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget*/translations/sp_SP/userspace-api/landlockmodnameN classnameN refexplicituh1hhh ubeh}(h]h ]h"]h$]h&]current_languageEnglishuh1h hh _documenthsourceNlineNubhcomment)}(h SPDX-License-Identifier: GPL-2.0h]h SPDX-License-Identifier: GPL-2.0}hhsbah}(h]h ]h"]h$]h&] xml:spacepreserveuh1hhhhhhD/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock.rsthKubh)}(h9Copyright © 2017-2020 Mickaël Salaün h]h9Copyright © 2017-2020 Mickaël Salaün }hhsbah}(h]h ]h"]h$]h&]hhuh1hhhhhhhhKubh)}(hCopyright © 2019-2020 ANSSIh]hCopyright © 2019-2020 ANSSI}hhsbah}(h]h ]h"]h$]h&]hhuh1hhhhhhhhKubh)}(h,Copyright © 2021-2022 Microsoft Corporationh]h,Copyright © 2021-2022 Microsoft Corporation}hhsbah}(h]h ]h"]h$]h&]hhuh1hhhhhhhhKubhsection)}(hhh](htitle)}(h%Landlock: unprivileged access controlh]h%Landlock: unprivileged access control}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhhhhhKubh field_list)}(hhh](hfield)}(hhh](h field_name)}(hAuthorh]hAuthor}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjhhhKubh field_body)}(hMickaël Salaünh]h paragraph)}(hj%h]hMickaël Salaün}(hj)hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhK hj#ubah}(h]h ]h"]h$]h&]uh1j!hjubeh}(h]h ]h"]h$]h&]uh1j hhhK hj hhubj )}(hhh](j)}(hDateh]hDate}(hjEhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjBhhhKubj")}(h March 2026 h]j()}(h March 2026h]h March 2026}(hjWhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhK hjSubah}(h]h ]h"]h$]h&]uh1j!hjBubeh}(h]h ]h"]h$]h&]uh1j hhhK hj hhubeh}(h]h ]h"]h$]h&]uh1jhhhhhhhK ubj()}(hXThe goal of Landlock is to enable restriction of ambient rights (e.g. global filesystem or network access) for a set of processes. Because Landlock is a stackable LSM, it makes it possible to create safe security sandboxes as new security layers in addition to the existing system-wide access-controls. This kind of sandbox is expected to help mitigate the security impact of bugs or unexpected/malicious behaviors in user space applications. Landlock empowers any process, including unprivileged ones, to securely restrict themselves.h]hXThe goal of Landlock is to enable restriction of ambient rights (e.g. global filesystem or network access) for a set of processes. Because Landlock is a stackable LSM, it makes it possible to create safe security sandboxes as new security layers in addition to the existing system-wide access-controls. This kind of sandbox is expected to help mitigate the security impact of bugs or unexpected/malicious behaviors in user space applications. Landlock empowers any process, including unprivileged ones, to securely restrict themselves.}(hjwhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhK hhhhubj()}(hXWe can quickly make sure that Landlock is enabled in the running system by looking for "landlock: Up and running" in kernel logs (as root): ``dmesg | grep landlock || journalctl -kb -g landlock`` . Developers can also easily check for Landlock support with a :ref:`related system call `. If Landlock is not currently supported, we need to :ref:`configure the kernel appropriately `.h](hWe can quickly make sure that Landlock is enabled in the running system by looking for “landlock: Up and running” in kernel logs (as root): }(hjhhhNhNubhliteral)}(h7``dmesg | grep landlock || journalctl -kb -g landlock``h]h3dmesg | grep landlock || journalctl -kb -g landlock}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh@ . Developers can also easily check for Landlock support with a }(hjhhhNhNubh)}(h2:ref:`related system call `h]hinline)}(hjh]hrelated system call}(hjhhhNhNubah}(h]h ](xrefstdstd-refeh"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]refdocuserspace-api/landlock refdomainjreftyperef refexplicitrefwarn reftargetlandlock_abi_versionsuh1hhhhKhjubh5. If Landlock is not currently supported, we need to }(hjhhhNhNubh)}(h::ref:`configure the kernel appropriately `h]j)}(hjh]h"configure the kernel appropriately}(hjhhhNhNubah}(h]h ](jstdstd-refeh"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]refdocj refdomainjreftyperef refexplicitrefwarnjkernel_supportuh1hhhhKhjubh.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhKhhhhubh)}(hhh](h)}(hLandlock rulesh]hLandlock rules}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKubj()}(hA Landlock rule describes an action on an object which the process intends to perform. A set of rules is aggregated in a ruleset, which can then restrict the thread enforcing it, and its future children.h]hA Landlock rule describes an action on an object which the process intends to perform. A set of rules is aggregated in a ruleset, which can then restrict the thread enforcing it, and its future children.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhK hjhhubj()}(h$The two existing types of rules are:h]h$The two existing types of rules are:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhK$hjhhubhdefinition_list)}(hhh](hdefinition_list_item)}(hFilesystem rules For these rules, the object is a file hierarchy, and the related filesystem actions are defined with `filesystem access rights`. h](hterm)}(hFilesystem rulesh]hFilesystem rules}(hj.hhhNhNubah}(h]h ]h"]h$]h&]uh1j,hhhK)hj(ubh definition)}(hhh]j()}(hFor these rules, the object is a file hierarchy, and the related filesystem actions are defined with `filesystem access rights`.h](heFor these rules, the object is a file hierarchy, and the related filesystem actions are defined with }(hjAhhhNhNubhtitle_reference)}(h`filesystem access rights`h]hfilesystem access rights}(hjKhhhNhNubah}(h]h ]h"]h$]h&]uh1jIhjAubh.}(hjAhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhK'hj>ubah}(h]h ]h"]h$]h&]uh1j<hj(ubeh}(h]h ]h"]h$]h&]uh1j&hhhK)hj#ubj')}(hNetwork rules (since ABI v4) For these rules, the object is a TCP port, and the related actions are defined with `network access rights`. h](j-)}(hNetwork rules (since ABI v4)h]hNetwork rules (since ABI v4)}(hjshhhNhNubah}(h]h ]h"]h$]h&]uh1j,hhhK-hjoubj=)}(hhh]j()}(hlFor these rules, the object is a TCP port, and the related actions are defined with `network access rights`.h](hTFor these rules, the object is a TCP port, and the related actions are defined with }(hjhhhNhNubjJ)}(h`network access rights`h]hnetwork access rights}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jIhjubh.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhK,hjubah}(h]h ]h"]h$]h&]uh1j<hjoubeh}(h]h ]h"]h$]h&]uh1j&hhhK-hj#hhubeh}(h]h ]h"]h$]h&]uh1j!hjhhhhhNubh)}(hhh](h)}(h(Defining and enforcing a security policyh]h(Defining and enforcing a security policy}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhK0ubj()}(h@We first need to define the ruleset that will contain our rules.h]h@We first need to define the ruleset that will contain our rules.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhK2hjhhubj()}(hFor this example, the ruleset will contain rules that only allow filesystem read actions and establish a specific TCP connection. Filesystem write actions and other TCP actions will be denied.h]hFor this example, the ruleset will contain rules that only allow filesystem read actions and establish a specific TCP connection. Filesystem write actions and other TCP actions will be denied.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhK4hjhhubj()}(hXThe ruleset then needs to handle both these kinds of actions. This is required for backward and forward compatibility (i.e. the kernel and user space may not know each other's supported restrictions), hence the need to be explicit about the denied-by-default access rights.h]hXThe ruleset then needs to handle both these kinds of actions. This is required for backward and forward compatibility (i.e. the kernel and user space may not know each other’s supported restrictions), hence the need to be explicit about the denied-by-default access rights.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhK8hjhhubh literal_block)}(hXstruct landlock_ruleset_attr ruleset_attr = { .handled_access_fs = LANDLOCK_ACCESS_FS_EXECUTE | LANDLOCK_ACCESS_FS_WRITE_FILE | LANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_READ_DIR | LANDLOCK_ACCESS_FS_REMOVE_DIR | LANDLOCK_ACCESS_FS_REMOVE_FILE | LANDLOCK_ACCESS_FS_MAKE_CHAR | LANDLOCK_ACCESS_FS_MAKE_DIR | LANDLOCK_ACCESS_FS_MAKE_REG | LANDLOCK_ACCESS_FS_MAKE_SOCK | LANDLOCK_ACCESS_FS_MAKE_FIFO | LANDLOCK_ACCESS_FS_MAKE_BLOCK | LANDLOCK_ACCESS_FS_MAKE_SYM | LANDLOCK_ACCESS_FS_REFER | LANDLOCK_ACCESS_FS_TRUNCATE | LANDLOCK_ACCESS_FS_IOCTL_DEV | LANDLOCK_ACCESS_FS_RESOLVE_UNIX, .handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP | LANDLOCK_ACCESS_NET_CONNECT_TCP, .scoped = LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET | LANDLOCK_SCOPE_SIGNAL, };h]hXstruct landlock_ruleset_attr ruleset_attr = { .handled_access_fs = LANDLOCK_ACCESS_FS_EXECUTE | LANDLOCK_ACCESS_FS_WRITE_FILE | LANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_READ_DIR | LANDLOCK_ACCESS_FS_REMOVE_DIR | LANDLOCK_ACCESS_FS_REMOVE_FILE | LANDLOCK_ACCESS_FS_MAKE_CHAR | LANDLOCK_ACCESS_FS_MAKE_DIR | LANDLOCK_ACCESS_FS_MAKE_REG | LANDLOCK_ACCESS_FS_MAKE_SOCK | LANDLOCK_ACCESS_FS_MAKE_FIFO | LANDLOCK_ACCESS_FS_MAKE_BLOCK | LANDLOCK_ACCESS_FS_MAKE_SYM | LANDLOCK_ACCESS_FS_REFER | LANDLOCK_ACCESS_FS_TRUNCATE | LANDLOCK_ACCESS_FS_IOCTL_DEV | LANDLOCK_ACCESS_FS_RESOLVE_UNIX, .handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP | LANDLOCK_ACCESS_NET_CONNECT_TCP, .scoped = LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET | LANDLOCK_SCOPE_SIGNAL, };}hjsbah}(h]h ]h"]h$]h&]hhƌforcelanguagechighlight_args}uh1jhhhK=hjhhubj()}(hBecause we may not know which kernel version an application will be executed on, it is safer to follow a best-effort security approach. Indeed, we should try to protect users as much as possible whatever the kernel they are using.h]hBecause we may not know which kernel version an application will be executed on, it is safer to follow a best-effort security approach. Indeed, we should try to protect users as much as possible whatever the kernel they are using.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhKZhjhhubj()}(hTo be compatible with older Linux versions, we detect the available Landlock ABI version, and only use the available subset of access rights:h]hTo be compatible with older Linux versions, we detect the available Landlock ABI version, and only use the available subset of access rights:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhK_hjhhubj)}(hX+int abi; abi = landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_VERSION); if (abi < 0) { /* Degrades gracefully if Landlock is not handled. */ perror("The running kernel does not enable to use Landlock"); return 0; } switch (abi) { case 1: /* Removes LANDLOCK_ACCESS_FS_REFER for ABI < 2 */ ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_REFER; __attribute__((fallthrough)); case 2: /* Removes LANDLOCK_ACCESS_FS_TRUNCATE for ABI < 3 */ ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_TRUNCATE; __attribute__((fallthrough)); case 3: /* Removes network support for ABI < 4 */ ruleset_attr.handled_access_net &= ~(LANDLOCK_ACCESS_NET_BIND_TCP | LANDLOCK_ACCESS_NET_CONNECT_TCP); __attribute__((fallthrough)); case 4: /* Removes LANDLOCK_ACCESS_FS_IOCTL_DEV for ABI < 5 */ ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_IOCTL_DEV; __attribute__((fallthrough)); case 5: /* Removes LANDLOCK_SCOPE_* for ABI < 6 */ ruleset_attr.scoped &= ~(LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET | LANDLOCK_SCOPE_SIGNAL); __attribute__((fallthrough)); case 6 ... 8: /* Removes LANDLOCK_ACCESS_FS_RESOLVE_UNIX for ABI < 9 */ ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_RESOLVE_UNIX; }h]hX+int abi; abi = landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_VERSION); if (abi < 0) { /* Degrades gracefully if Landlock is not handled. */ perror("The running kernel does not enable to use Landlock"); return 0; } switch (abi) { case 1: /* Removes LANDLOCK_ACCESS_FS_REFER for ABI < 2 */ ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_REFER; __attribute__((fallthrough)); case 2: /* Removes LANDLOCK_ACCESS_FS_TRUNCATE for ABI < 3 */ ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_TRUNCATE; __attribute__((fallthrough)); case 3: /* Removes network support for ABI < 4 */ ruleset_attr.handled_access_net &= ~(LANDLOCK_ACCESS_NET_BIND_TCP | LANDLOCK_ACCESS_NET_CONNECT_TCP); __attribute__((fallthrough)); case 4: /* Removes LANDLOCK_ACCESS_FS_IOCTL_DEV for ABI < 5 */ ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_IOCTL_DEV; __attribute__((fallthrough)); case 5: /* Removes LANDLOCK_SCOPE_* for ABI < 6 */ ruleset_attr.scoped &= ~(LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET | LANDLOCK_SCOPE_SIGNAL); __attribute__((fallthrough)); case 6 ... 8: /* Removes LANDLOCK_ACCESS_FS_RESOLVE_UNIX for ABI < 9 */ ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_RESOLVE_UNIX; }}hj"sbah}(h]h ]h"]h$]h&]hhjjjj}uh1jhhhKbhjhhubj()}(hNThis enables the creation of an inclusive ruleset that will contain our rules.h]hNThis enables the creation of an inclusive ruleset that will contain our rules.}(hj1hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhKhjhhubj)}(hint ruleset_fd; ruleset_fd = landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); if (ruleset_fd < 0) { perror("Failed to create a ruleset"); return 1; }h]hint ruleset_fd; ruleset_fd = landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); if (ruleset_fd < 0) { perror("Failed to create a ruleset"); return 1; }}hj?sbah}(h]h ]h"]h$]h&]hhjjjj}uh1jhhhKhjhhubj()}(hXWe can now add a new rule to this ruleset thanks to the returned file descriptor referring to this ruleset. The rule will allow reading and executing the file hierarchy ``/usr``. Without another rule, write actions would then be denied by the ruleset. To add ``/usr`` to the ruleset, we open it with the ``O_PATH`` flag and fill the &struct landlock_path_beneath_attr with this file descriptor.h](hWe can now add a new rule to this ruleset thanks to the returned file descriptor referring to this ruleset. The rule will allow reading and executing the file hierarchy }(hjNhhhNhNubj)}(h``/usr``h]h/usr}(hjVhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjNubhT. Without another rule, write actions would then be denied by the ruleset. To add }(hjNhhhNhNubj)}(h``/usr``h]h/usr}(hjhhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjNubh% to the ruleset, we open it with the }(hjNhhhNhNubj)}(h ``O_PATH``h]hO_PATH}(hjzhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjNubhP flag and fill the &struct landlock_path_beneath_attr with this file descriptor.}(hjNhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhKhjhhubj)}(hXQint err; struct landlock_path_beneath_attr path_beneath = { .allowed_access = LANDLOCK_ACCESS_FS_EXECUTE | LANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_READ_DIR, }; path_beneath.parent_fd = open("/usr", O_PATH | O_CLOEXEC); if (path_beneath.parent_fd < 0) { perror("Failed to open file"); close(ruleset_fd); return 1; } err = landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH, &path_beneath, 0); close(path_beneath.parent_fd); if (err) { perror("Failed to update ruleset"); close(ruleset_fd); return 1; }h]hXQint err; struct landlock_path_beneath_attr path_beneath = { .allowed_access = LANDLOCK_ACCESS_FS_EXECUTE | LANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_READ_DIR, }; path_beneath.parent_fd = open("/usr", O_PATH | O_CLOEXEC); if (path_beneath.parent_fd < 0) { perror("Failed to open file"); close(ruleset_fd); return 1; } err = landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH, &path_beneath, 0); close(path_beneath.parent_fd); if (err) { perror("Failed to update ruleset"); close(ruleset_fd); return 1; }}hjsbah}(h]h ]h"]h$]h&]hhjjjj}uh1jhhhKhjhhubj()}(hX'It may also be required to create rules following the same logic as explained for the ruleset creation, by filtering access rights according to the Landlock ABI version. In this example, this is not required because all of the requested ``allowed_access`` rights are already available in ABI 1.h](hIt may also be required to create rules following the same logic as explained for the ruleset creation, by filtering access rights according to the Landlock ABI version. In this example, this is not required because all of the requested }(hjhhhNhNubj)}(h``allowed_access``h]hallowed_access}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh' rights are already available in ABI 1.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhKhjhhubj()}(hFor network access-control, we can add a set of rules that allow to use a port number for a specific action: HTTPS connections.h]hFor network access-control, we can add a set of rules that allow to use a port number for a specific action: HTTPS connections.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhKhjhhubj)}(hstruct landlock_net_port_attr net_port = { .allowed_access = LANDLOCK_ACCESS_NET_CONNECT_TCP, .port = 443, }; err = landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &net_port, 0);h]hstruct landlock_net_port_attr net_port = { .allowed_access = LANDLOCK_ACCESS_NET_CONNECT_TCP, .port = 443, }; err = landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &net_port, 0);}hjsbah}(h]h ]h"]h$]h&]hhjjjj}uh1jhhhKhjhhubj()}(hWhen passing a non-zero ``flags`` argument to ``landlock_restrict_self()``, a similar backwards compatibility check is needed for the restrict flags (see sys_landlock_restrict_self() documentation for available flags):h](hWhen passing a non-zero }(hjhhhNhNubj)}(h ``flags``h]hflags}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh argument to }(hjhhhNhNubj)}(h``landlock_restrict_self()``h]hlandlock_restrict_self()}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh, a similar backwards compatibility check is needed for the restrict flags (see sys_landlock_restrict_self() documentation for available flags):}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhKhjhhubj)}(hX__u32 restrict_flags = LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON | LANDLOCK_RESTRICT_SELF_TSYNC; switch (abi) { case 1 ... 6: /* Removes logging flags for ABI < 7 */ restrict_flags &= ~(LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF | LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON | LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF); __attribute__((fallthrough)); case 7: /* * Removes multithreaded enforcement flag for ABI < 8 * * WARNING: Without this flag, calling landlock_restrict_self(2) is * only equivalent if the calling process is single-threaded. Below * ABI v8 (and as of ABI v8, when not using this flag), a Landlock * policy would only be enforced for the calling thread and its * children (and not for all threads, including parents and siblings). */ restrict_flags &= ~LANDLOCK_RESTRICT_SELF_TSYNC; }h]hX__u32 restrict_flags = LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON | LANDLOCK_RESTRICT_SELF_TSYNC; switch (abi) { case 1 ... 6: /* Removes logging flags for ABI < 7 */ restrict_flags &= ~(LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF | LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON | LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF); __attribute__((fallthrough)); case 7: /* * Removes multithreaded enforcement flag for ABI < 8 * * WARNING: Without this flag, calling landlock_restrict_self(2) is * only equivalent if the calling process is single-threaded. Below * ABI v8 (and as of ABI v8, when not using this flag), a Landlock * policy would only be enforced for the calling thread and its * children (and not for all threads, including parents and siblings). */ restrict_flags &= ~LANDLOCK_RESTRICT_SELF_TSYNC; }}hjsbah}(h]h ]h"]h$]h&]hhjjjj}uh1jhhhKhjhhubj()}(hX-The next step is to restrict the current thread from gaining more privileges (e.g. through a SUID binary). We now have a ruleset with the first rule allowing read and execute access to ``/usr`` while denying all other handled accesses for the filesystem, and a second rule allowing HTTPS connections.h](hThe next step is to restrict the current thread from gaining more privileges (e.g. through a SUID binary). We now have a ruleset with the first rule allowing read and execute access to }(hjhhhNhNubj)}(h``/usr``h]h/usr}(hj'hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhk while denying all other handled accesses for the filesystem, and a second rule allowing HTTPS connections.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhKhjhhubj)}(hif (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { perror("Failed to restrict privileges"); close(ruleset_fd); return 1; }h]hif (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { perror("Failed to restrict privileges"); close(ruleset_fd); return 1; }}hj?sbah}(h]h ]h"]h$]h&]hhjjjj}uh1jhhhKhjhhubj()}(hCThe current thread is now ready to sandbox itself with the ruleset.h]hCThe current thread is now ready to sandbox itself with the ruleset.}(hjNhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhKhjhhubj)}(hif (landlock_restrict_self(ruleset_fd, restrict_flags)) { perror("Failed to enforce ruleset"); close(ruleset_fd); return 1; } close(ruleset_fd);h]hif (landlock_restrict_self(ruleset_fd, restrict_flags)) { perror("Failed to enforce ruleset"); close(ruleset_fd); return 1; } close(ruleset_fd);}hj\sbah}(h]h ]h"]h$]h&]hhjjjj}uh1jhhhKhjhhubj()}(hXIf the ``landlock_restrict_self`` system call succeeds, the current thread is now restricted and this policy will be enforced on all its subsequently created children as well. Once a thread is landlocked, there is no way to remove its security policy; only adding more restrictions is allowed. These threads are now in a new Landlock domain, which is a merger of their parent one (if any) with the new ruleset.h](hIf the }(hjkhhhNhNubj)}(h``landlock_restrict_self``h]hlandlock_restrict_self}(hjshhhNhNubah}(h]h ]h"]h$]h&]uh1jhjkubhX{ system call succeeds, the current thread is now restricted and this policy will be enforced on all its subsequently created children as well. Once a thread is landlocked, there is no way to remove its security policy; only adding more restrictions is allowed. These threads are now in a new Landlock domain, which is a merger of their parent one (if any) with the new ruleset.}(hjkhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhKhjhhubj()}(hBFull working code can be found in `samples/landlock/sandboxer.c`_.h](h"Full working code can be found in }(hjhhhNhNubh reference)}(h`samples/landlock/sandboxer.c`_h]hsamples/landlock/sandboxer.c}(hjhhhNhNubah}(h]h ]h"]h$]h&]namesamples/landlock/sandboxer.crefuribhttps://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/samples/landlock/sandboxer.cuh1jhjresolvedKubh.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjhhubeh}(h](defining-and-enforcing-a-security-policyah ]h"](defining and enforcing a security policyah$]h&]uh1hhjhhhhhK0ubh)}(hhh](h)}(hGood practicesh]hGood practices}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhMubj()}(hXIt is recommended to set access rights to file hierarchy leaves as much as possible. For instance, it is better to be able to have ``~/doc/`` as a read-only hierarchy and ``~/tmp/`` as a read-write hierarchy, compared to ``~/`` as a read-only hierarchy and ``~/tmp/`` as a read-write hierarchy. Following this good practice leads to self-sufficient hierarchies that do not depend on their location (i.e. parent directories). This is particularly relevant when we want to allow linking or renaming. Indeed, having consistent access rights per directory enables changing the location of such directories without relying on the destination directory access rights (except those that are required for this operation, see ``LANDLOCK_ACCESS_FS_REFER`` documentation).h](hIt is recommended to set access rights to file hierarchy leaves as much as possible. For instance, it is better to be able to have }(hjhhhNhNubj)}(h ``~/doc/``h]h~/doc/}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh as a read-only hierarchy and }(hjhhhNhNubj)}(h ``~/tmp/``h]h~/tmp/}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh( as a read-write hierarchy, compared to }(hjhhhNhNubj)}(h``~/``h]h~/}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh as a read-only hierarchy and }(hjhhhNhNubj)}(h ``~/tmp/``h]h~/tmp/}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhX as a read-write hierarchy. Following this good practice leads to self-sufficient hierarchies that do not depend on their location (i.e. parent directories). This is particularly relevant when we want to allow linking or renaming. Indeed, having consistent access rights per directory enables changing the location of such directories without relying on the destination directory access rights (except those that are required for this operation, see }(hjhhhNhNubj)}(h``LANDLOCK_ACCESS_FS_REFER``h]hLANDLOCK_ACCESS_FS_REFER}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh documentation).}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjhhubj()}(hXHaving self-sufficient hierarchies also helps to tighten the required access rights to the minimal set of data. This also helps avoid sinkhole directories, i.e. directories where data can be linked to but not linked from. However, this depends on data organization, which might not be controlled by developers. In this case, granting read-write access to ``~/tmp/``, instead of write-only access, would potentially allow moving ``~/tmp/`` to a non-readable directory and still keep the ability to list the content of ``~/tmp/``.h](hXeHaving self-sufficient hierarchies also helps to tighten the required access rights to the minimal set of data. This also helps avoid sinkhole directories, i.e. directories where data can be linked to but not linked from. However, this depends on data organization, which might not be controlled by developers. In this case, granting read-write access to }(hj3hhhNhNubj)}(h ``~/tmp/``h]h~/tmp/}(hj;hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj3ubh?, instead of write-only access, would potentially allow moving }(hj3hhhNhNubj)}(h ``~/tmp/``h]h~/tmp/}(hjMhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj3ubhO to a non-readable directory and still keep the ability to list the content of }(hj3hhhNhNubj)}(h ``~/tmp/``h]h~/tmp/}(hj_hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj3ubh.}(hj3hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjhhubeh}(h]good-practicesah ]h"]good practicesah$]h&]uh1hhjhhhhhMubh)}(hhh](h)}(h!Layers of file path access rightsh]h!Layers of file path access rights}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhMubj()}(hX6Each time a thread enforces a ruleset on itself, it updates its Landlock domain with a new layer of policy. This complementary policy is stacked with any other rulesets potentially already restricting this thread. A sandboxed thread can then safely add more constraints to itself with a new enforced ruleset.h]hX6Each time a thread enforces a ruleset on itself, it updates its Landlock domain with a new layer of policy. This complementary policy is stacked with any other rulesets potentially already restricting this thread. A sandboxed thread can then safely add more constraints to itself with a new enforced ruleset.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMhjhhubj()}(hX9One policy layer grants access to a file path if at least one of its rules encountered on the path grants the access. A sandboxed thread can only access a file path if all its enforced policy layers grant the access as well as all the other system access controls (e.g. filesystem DAC, other LSM policies, etc.).h]hX9One policy layer grants access to a file path if at least one of its rules encountered on the path grants the access. A sandboxed thread can only access a file path if all its enforced policy layers grant the access as well as all the other system access controls (e.g. filesystem DAC, other LSM policies, etc.).}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhM$hjhhubeh}(h]!layers-of-file-path-access-rightsah ]h"]!layers of file path access rightsah$]h&]uh1hhjhhhhhMubh)}(hhh](h)}(hBind mounts and OverlayFSh]hBind mounts and OverlayFS}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhM+ubj()}(hLandlock enables restricting access to file hierarchies, which means that these access rights can be propagated with bind mounts (cf. Documentation/filesystems/sharedsubtree.rst) but not with Documentation/filesystems/overlayfs.rst.h]hLandlock enables restricting access to file hierarchies, which means that these access rights can be propagated with bind mounts (cf. Documentation/filesystems/sharedsubtree.rst) but not with Documentation/filesystems/overlayfs.rst.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhM-hjhhubj()}(hXA bind mount mirrors a source file hierarchy to a destination. The destination hierarchy is then composed of the exact same files, on which Landlock rules can be tied, either via the source or the destination path. These rules restrict access when they are encountered on a path, which means that they can restrict access to multiple file hierarchies at the same time, whether these hierarchies are the result of bind mounts or not.h]hXA bind mount mirrors a source file hierarchy to a destination. The destination hierarchy is then composed of the exact same files, on which Landlock rules can be tied, either via the source or the destination path. These rules restrict access when they are encountered on a path, which means that they can restrict access to multiple file hierarchies at the same time, whether these hierarchies are the result of bind mounts or not.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhM2hjhhubj()}(hXAn OverlayFS mount point consists of upper and lower layers. These layers are combined in a merge directory, and that merged directory becomes available at the mount point. This merge hierarchy may include files from the upper and lower layers, but modifications performed on the merge hierarchy only reflect on the upper layer. From a Landlock policy point of view, all OverlayFS layers and merge hierarchies are standalone and each contains their own set of files and directories, which is different from bind mounts. A policy restricting an OverlayFS layer will not restrict the resulted merged hierarchy, and vice versa. Landlock users should then only think about file hierarchies they want to allow access to, regardless of the underlying filesystem.h]hXAn OverlayFS mount point consists of upper and lower layers. These layers are combined in a merge directory, and that merged directory becomes available at the mount point. This merge hierarchy may include files from the upper and lower layers, but modifications performed on the merge hierarchy only reflect on the upper layer. From a Landlock policy point of view, all OverlayFS layers and merge hierarchies are standalone and each contains their own set of files and directories, which is different from bind mounts. A policy restricting an OverlayFS layer will not restrict the resulted merged hierarchy, and vice versa. Landlock users should then only think about file hierarchies they want to allow access to, regardless of the underlying filesystem.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhM9hjhhubeh}(h]bind-mounts-and-overlayfsah ]h"]bind mounts and overlayfsah$]h&]uh1hhjhhhhhM+ubh)}(hhh](h)}(h Inheritanceh]h Inheritance}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhMEubj()}(hXEvery new thread resulting from a :manpage:`clone(2)` inherits Landlock domain restrictions from its parent. This is similar to seccomp inheritance (cf. Documentation/userspace-api/seccomp_filter.rst) or any other LSM dealing with task's :manpage:`credentials(7)`. For instance, one process's thread may apply Landlock rules to itself, but they will not be automatically applied to other sibling threads (unlike POSIX thread credential changes, cf. :manpage:`nptl(7)`).h](h"Every new thread resulting from a }(hjhhhNhNubhmanpage)}(h:manpage:`clone(2)`h]hclone(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhƌpathclone(2)pageclonesection2uh1jhjubh inherits Landlock domain restrictions from its parent. This is similar to seccomp inheritance (cf. Documentation/userspace-api/seccomp_filter.rst) or any other LSM dealing with task’s }(hjhhhNhNubj)}(h:manpage:`credentials(7)`h]hcredentials(7)}(hj*hhhNhNubah}(h]h ]jah"]h$]h&]hhj credentials(7)j" credentialsj$7uh1jhjubh. For instance, one process’s thread may apply Landlock rules to itself, but they will not be automatically applied to other sibling threads (unlike POSIX thread credential changes, cf. }(hjhhhNhNubj)}(h:manpage:`nptl(7)`h]hnptl(7)}(hj?hhhNhNubah}(h]h ]jah"]h$]h&]hhj nptl(7)j"nptlj$j:uh1jhjubh).}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMGhjhhubj()}(hX?When a thread sandboxes itself, we have the guarantee that the related security policy will stay enforced on all this thread's descendants. This allows creating standalone and modular security policies per application, which will automatically be composed between themselves according to their runtime parent policies.h]hXAWhen a thread sandboxes itself, we have the guarantee that the related security policy will stay enforced on all this thread’s descendants. This allows creating standalone and modular security policies per application, which will automatically be composed between themselves according to their runtime parent policies.}(hjYhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMOhjhhubeh}(h] inheritanceah ]h"] inheritanceah$]h&]uh1hhjhhhhhMEubh)}(hhh](h)}(hPtrace restrictionsh]hPtrace restrictions}(hjrhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjohhhhhMVubj()}(hXA sandboxed process has less privileges than a non-sandboxed process and must then be subject to additional restrictions when manipulating another process. To be allowed to use :manpage:`ptrace(2)` and related syscalls on a target process, a sandboxed process should have a superset of the target process's access rights, which means the tracee must be in a sub-domain of the tracer.h](hA sandboxed process has less privileges than a non-sandboxed process and must then be subject to additional restrictions when manipulating another process. To be allowed to use }(hjhhhNhNubj)}(h:manpage:`ptrace(2)`h]h ptrace(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj  ptrace(2)j"ptracej$j%uh1jhjubh and related syscalls on a target process, a sandboxed process should have a superset of the target process’s access rights, which means the tracee must be in a sub-domain of the tracer.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMXhjohhubeh}(h]ptrace-restrictionsah ]h"]ptrace restrictionsah$]h&]uh1hhjhhhhhMV referencedKubh)}(hhh](h)}(h IPC scopingh]h IPC scoping}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhM_ubj()}(hX`Similar to the implicit `Ptrace restrictions`_, we may want to further restrict interactions between sandboxes. Therefore, at ruleset creation time, each Landlock domain can restrict the scope for certain operations, so that these operations can only reach out to processes within the same Landlock domain or in a nested Landlock domain (the "scope").h](hSimilar to the implicit }(hjhhhNhNubj)}(h`Ptrace restrictions`_h]hPtrace restrictions}(hjhhhNhNubah}(h]h ]h"]h$]h&]namePtrace restrictionsrefidjuh1jhjjKubhX6, we may want to further restrict interactions between sandboxes. Therefore, at ruleset creation time, each Landlock domain can restrict the scope for certain operations, so that these operations can only reach out to processes within the same Landlock domain or in a nested Landlock domain (the “scope”).}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMahjhhubj()}(h'The operations which can be scoped are:h]h'The operations which can be scoped are:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMghjhhubj")}(hhh](j')}(h``LANDLOCK_SCOPE_SIGNAL`` This limits the sending of signals to target processes which run within the same or a nested Landlock domain. h](j-)}(h``LANDLOCK_SCOPE_SIGNAL``h]j)}(hjh]hLANDLOCK_SCOPE_SIGNAL}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1j,hhhMkhjubj=)}(hhh]j()}(hmThis limits the sending of signals to target processes which run within the same or a nested Landlock domain.h]hmThis limits the sending of signals to target processes which run within the same or a nested Landlock domain.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMjhj ubah}(h]h ]h"]h$]h&]uh1j<hjubeh}(h]h ]h"]h$]h&]uh1j&hhhMkhjubj')}(hXN``LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET`` This limits the set of abstract :manpage:`unix(7)` sockets to which we can :manpage:`connect(2)` to socket addresses which were created by a process in the same or a nested Landlock domain. A :manpage:`sendto(2)` on a non-connected datagram socket is treated as if it were doing an implicit :manpage:`connect(2)` and will be blocked if the remote end does not stem from the same or a nested Landlock domain. A :manpage:`sendto(2)` on a socket which was previously connected will not be restricted. This works for both datagram and stream sockets. h](j-)}(h'``LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET``h]j)}(hj.h]h#LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET}(hj0hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj,ubah}(h]h ]h"]h$]h&]uh1j,hhhMwhj(ubj=)}(hhh](j()}(hThis limits the set of abstract :manpage:`unix(7)` sockets to which we can :manpage:`connect(2)` to socket addresses which were created by a process in the same or a nested Landlock domain.h](h This limits the set of abstract }(hjFhhhNhNubj)}(h:manpage:`unix(7)`h]hunix(7)}(hjNhhhNhNubah}(h]h ]jah"]h$]h&]hhj unix(7)j"unixj$j:uh1jhjFubh sockets to which we can }(hjFhhhNhNubj)}(h:manpage:`connect(2)`h]h connect(2)}(hjbhhhNhNubah}(h]h ]jah"]h$]h&]hhj  connect(2)j"connectj$j%uh1jhjFubh] to socket addresses which were created by a process in the same or a nested Landlock domain.}(hjFhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMnhjCubj()}(hA :manpage:`sendto(2)` on a non-connected datagram socket is treated as if it were doing an implicit :manpage:`connect(2)` and will be blocked if the remote end does not stem from the same or a nested Landlock domain.h](hA }(hj|hhhNhNubj)}(h:manpage:`sendto(2)`h]h sendto(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj  sendto(2)j"sendtoj$j%uh1jhj|ubhO on a non-connected datagram socket is treated as if it were doing an implicit }(hj|hhhNhNubj)}(h:manpage:`connect(2)`h]h connect(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj  connect(2)j"connectj$j%uh1jhj|ubh_ and will be blocked if the remote end does not stem from the same or a nested Landlock domain.}(hj|hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMrhjCubj()}(hA :manpage:`sendto(2)` on a socket which was previously connected will not be restricted. This works for both datagram and stream sockets.h](hA }(hjhhhNhNubj)}(h:manpage:`sendto(2)`h]h sendto(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj  sendto(2)j"sendtoj$j%uh1jhjubhu on a socket which was previously connected will not be restricted. This works for both datagram and stream sockets.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMvhjCubeh}(h]h ]h"]h$]h&]uh1j<hj(ubeh}(h]h ]h"]h$]h&]uh1j&hhhMwhjhhubeh}(h]h ]h"]h$]h&]uh1j!hjhhhhhNubj()}(hIPC scoping does not support exceptions via :manpage:`landlock_add_rule(2)`. If an operation is scoped within a domain, no rules can be added to allow access to resources or processes outside of the scope.h](h,IPC scoping does not support exceptions via }(hjhhhNhNubj)}(h:manpage:`landlock_add_rule(2)`h]hlandlock_add_rule(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj landlock_add_rule(2)j"landlock_add_rulej$j%uh1jhjubh. If an operation is scoped within a domain, no rules can be added to allow access to resources or processes outside of the scope.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMyhjhhubeh}(h] ipc-scopingah ]h"] ipc scopingah$]h&]uh1hhjhhhhhM_ubh)}(hhh](h)}(hTruncating filesh]hTruncating files}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhM~ubj()}(hXThe operations covered by ``LANDLOCK_ACCESS_FS_WRITE_FILE`` and ``LANDLOCK_ACCESS_FS_TRUNCATE`` both change the contents of a file and sometimes overlap in non-intuitive ways. It is strongly recommended to always specify both of these together (either granting both, or granting none).h](hThe operations covered by }(hj!hhhNhNubj)}(h!``LANDLOCK_ACCESS_FS_WRITE_FILE``h]hLANDLOCK_ACCESS_FS_WRITE_FILE}(hj)hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj!ubh and }(hj!hhhNhNubj)}(h``LANDLOCK_ACCESS_FS_TRUNCATE``h]hLANDLOCK_ACCESS_FS_TRUNCATE}(hj;hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj!ubh both change the contents of a file and sometimes overlap in non-intuitive ways. It is strongly recommended to always specify both of these together (either granting both, or granting none).}(hj!hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjhhubj()}(hA particularly surprising example is :manpage:`creat(2)`. The name suggests that this system call requires the rights to create and write files. However, it also requires the truncate right if an existing file under the same name is already present.h](h%A particularly surprising example is }(hjShhhNhNubj)}(h:manpage:`creat(2)`h]hcreat(2)}(hj[hhhNhNubah}(h]h ]jah"]h$]h&]hhj creat(2)j"creatj$j%uh1jhjSubh. The name suggests that this system call requires the rights to create and write files. However, it also requires the truncate right if an existing file under the same name is already present.}(hjShhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjhhubj()}(hIt should also be noted that truncating files does not require the ``LANDLOCK_ACCESS_FS_WRITE_FILE`` right. Apart from the :manpage:`truncate(2)` system call, this can also be done through :manpage:`open(2)` with the flags ``O_RDONLY | O_TRUNC``.h](hCIt should also be noted that truncating files does not require the }(hjuhhhNhNubj)}(h!``LANDLOCK_ACCESS_FS_WRITE_FILE``h]hLANDLOCK_ACCESS_FS_WRITE_FILE}(hj}hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjuubh right. Apart from the }(hjuhhhNhNubj)}(h:manpage:`truncate(2)`h]h truncate(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj  truncate(2)j"truncatej$j%uh1jhjuubh, system call, this can also be done through }(hjuhhhNhNubj)}(h:manpage:`open(2)`h]hopen(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj open(2)j"openj$j%uh1jhjuubh with the flags }(hjuhhhNhNubj)}(h``O_RDONLY | O_TRUNC``h]hO_RDONLY | O_TRUNC}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjuubh.}(hjuhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjhhubj()}(hAt the same time, on some filesystems, :manpage:`fallocate(2)` offers a way to shorten file contents with ``FALLOC_FL_COLLAPSE_RANGE`` when the file is opened for writing, sidestepping the ``LANDLOCK_ACCESS_FS_TRUNCATE`` right.h](h'At the same time, on some filesystems, }(hjhhhNhNubj)}(h:manpage:`fallocate(2)`h]h fallocate(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj  fallocate(2)j" fallocatej$j%uh1jhjubh, offers a way to shorten file contents with }(hjhhhNhNubj)}(h``FALLOC_FL_COLLAPSE_RANGE``h]hFALLOC_FL_COLLAPSE_RANGE}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh7 when the file is opened for writing, sidestepping the }(hjhhhNhNubj)}(h``LANDLOCK_ACCESS_FS_TRUNCATE``h]hLANDLOCK_ACCESS_FS_TRUNCATE}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh right.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjhhubj()}(hBThe truncate right is associated with the opened file (see below).h]hBThe truncate right is associated with the opened file (see below).}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMhjhhubeh}(h]truncating-filesah ]h"]truncating filesah$]h&]uh1hhjhhhhhM~ubh)}(hhh](h)}(h'Rights associated with file descriptorsh]h'Rights associated with file descriptors}(hj. hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj+ hhhhhMubj()}(hXWhen opening a file, the availability of the ``LANDLOCK_ACCESS_FS_TRUNCATE`` and ``LANDLOCK_ACCESS_FS_IOCTL_DEV`` rights is associated with the newly created file descriptor and will be used for subsequent truncation and ioctl attempts using :manpage:`ftruncate(2)` and :manpage:`ioctl(2)`. The behavior is similar to opening a file for reading or writing, where permissions are checked during :manpage:`open(2)`, but not during the subsequent :manpage:`read(2)` and :manpage:`write(2)` calls.h](h-When opening a file, the availability of the }(hj< hhhNhNubj)}(h``LANDLOCK_ACCESS_FS_TRUNCATE``h]hLANDLOCK_ACCESS_FS_TRUNCATE}(hjD hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj< ubh and }(hj< hhhNhNubj)}(h ``LANDLOCK_ACCESS_FS_IOCTL_DEV``h]hLANDLOCK_ACCESS_FS_IOCTL_DEV}(hjV hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj< ubh rights is associated with the newly created file descriptor and will be used for subsequent truncation and ioctl attempts using }(hj< hhhNhNubj)}(h:manpage:`ftruncate(2)`h]h ftruncate(2)}(hjh hhhNhNubah}(h]h ]jah"]h$]h&]hhj  ftruncate(2)j" ftruncatej$j%uh1jhj< ubh and }(hj< hhhNhNubj)}(h:manpage:`ioctl(2)`h]hioctl(2)}(hj| hhhNhNubah}(h]h ]jah"]h$]h&]hhj ioctl(2)j"ioctlj$j%uh1jhj< ubhj. The behavior is similar to opening a file for reading or writing, where permissions are checked during }(hj< hhhNhNubj)}(h:manpage:`open(2)`h]hopen(2)}(hj hhhNhNubah}(h]h ]jah"]h$]h&]hhj open(2)j"openj$j%uh1jhj< ubh , but not during the subsequent }(hj< hhhNhNubj)}(h:manpage:`read(2)`h]hread(2)}(hj hhhNhNubah}(h]h ]jah"]h$]h&]hhj read(2)j"readj$j%uh1jhj< ubh and }hj< sbj)}(h:manpage:`write(2)`h]hwrite(2)}(hj hhhNhNubah}(h]h ]jah"]h$]h&]hhj write(2)j"writej$j%uh1jhj< ubh calls.}(hj< hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhj+ hhubj()}(hXAs a consequence, it is possible that a process has multiple open file descriptors referring to the same file, but Landlock enforces different things when operating with these file descriptors. This can happen when a Landlock ruleset gets enforced and the process keeps file descriptors which were opened both before and after the enforcement. It is also possible to pass such file descriptors between processes, keeping their Landlock properties, even when some of the involved processes do not have an enforced Landlock ruleset.h]hXAs a consequence, it is possible that a process has multiple open file descriptors referring to the same file, but Landlock enforces different things when operating with these file descriptors. This can happen when a Landlock ruleset gets enforced and the process keeps file descriptors which were opened both before and after the enforcement. It is also possible to pass such file descriptors between processes, keeping their Landlock properties, even when some of the involved processes do not have an enforced Landlock ruleset.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMhj+ hhubeh}(h]'rights-associated-with-file-descriptorsah ]h"]'rights associated with file descriptorsah$]h&]uh1hhjhhhhhMubeh}(h]landlock-rulesah ]h"]landlock rulesah$]h&]uh1hhhhhhhhKubh)}(hhh](h)}(h Compatibilityh]h Compatibility}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj hhhhhMubh)}(hhh](h)}(h"Backward and forward compatibilityh]h"Backward and forward compatibility}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj hhhhhMubj()}(hXLandlock is designed to be compatible with past and future versions of the kernel. This is achieved thanks to the system call attributes and the associated bitflags, particularly the ruleset's ``handled_access_fs``. Making handled access rights explicit enables the kernel and user space to have a clear contract with each other. This is required to make sure sandboxing will not get stricter with a system update, which could break applications.h](hLandlock is designed to be compatible with past and future versions of the kernel. This is achieved thanks to the system call attributes and the associated bitflags, particularly the ruleset’s }(hj hhhNhNubj)}(h``handled_access_fs``h]hhandled_access_fs}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubh. Making handled access rights explicit enables the kernel and user space to have a clear contract with each other. This is required to make sure sandboxing will not get stricter with a system update, which could break applications.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhj hhubj()}(hXDevelopers can subscribe to the `Landlock mailing list `_ to knowingly update and test their applications with the latest available features. In the interest of users, and because they may use different kernel versions, it is strongly encouraged to follow a best-effort security approach by checking the Landlock ABI version at runtime and only enforcing the supported features.h](h Developers can subscribe to the }(hj2 hhhNhNubj)}(hK`Landlock mailing list `_h]hLandlock mailing list}(hj: hhhNhNubah}(h]h ]h"]h$]h&]nameLandlock mailing listj0https://subspace.kernel.org/lists.linux.dev.htmluh1jhj2 ubhtarget)}(h3 h]h}(h]landlock-mailing-listah ]h"]landlock mailing listah$]h&]refurijJ uh1jK jKhj2 ubhXB to knowingly update and test their applications with the latest available features. In the interest of users, and because they may use different kernel versions, it is strongly encouraged to follow a best-effort security approach by checking the Landlock ABI version at runtime and only enforcing the supported features.}(hj2 hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhj hhubjL )}(h.. _landlock_abi_versions:h]h}(h]h ]h"]h$]h&]jlandlock-abi-versionsuh1jK hMhj hhhhubeh}(h]"backward-and-forward-compatibilityah ]h"]"backward and forward compatibilityah$]h&]uh1hhj hhhhhMubh)}(hhh](h)}(hLandlock ABI versionsh]hLandlock ABI versions}(hjz hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjw hhhhhMubj()}(hXThe Landlock ABI version can be read with the sys_landlock_create_ruleset() system call:h]hXThe Landlock ABI version can be read with the sys_landlock_create_ruleset() system call:}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMhjw hhubj)}(hXint abi; abi = landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_VERSION); if (abi < 0) { switch (errno) { case ENOSYS: printf("Landlock is not supported by the current kernel.\n"); break; case EOPNOTSUPP: printf("Landlock is currently disabled.\n"); break; } return 0; } if (abi >= 2) { printf("Landlock supports LANDLOCK_ACCESS_FS_REFER.\n"); }h]hXint abi; abi = landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_VERSION); if (abi < 0) { switch (errno) { case ENOSYS: printf("Landlock is not supported by the current kernel.\n"); break; case EOPNOTSUPP: printf("Landlock is currently disabled.\n"); break; } return 0; } if (abi >= 2) { printf("Landlock supports LANDLOCK_ACCESS_FS_REFER.\n"); }}hj sbah}(h]h ]h"]h$]h&]hhjjjj}uh1jhhhMhjw hhubj()}(huAll Landlock kernel interfaces are supported by the first ABI version unless explicitly noted in their documentation.h]huAll Landlock kernel interfaces are supported by the first ABI version unless explicitly noted in their documentation.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMhjw hhubeh}(h](jn id1eh ]h"](landlock abi versionslandlock_abi_versionseh$]h&]uh1hhj hhhhhMexpect_referenced_by_name}j jd sexpect_referenced_by_id}jn jd subh)}(hhh](h)}(hLandlock erratah]hLandlock errata}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj hhhhhMubj()}(hIn addition to ABI versions, Landlock provides an errata mechanism to track fixes for issues that may affect backwards compatibility or require userspace awareness. The errata bitmask can be queried using:h]hIn addition to ABI versions, Landlock provides an errata mechanism to track fixes for issues that may affect backwards compatibility or require userspace awareness. The errata bitmask can be queried using:}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMhj hhubj)}(hint errata; errata = landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_ERRATA); if (errata < 0) { /* Landlock not available or disabled */ return 0; }h]hint errata; errata = landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_ERRATA); if (errata < 0) { /* Landlock not available or disabled */ return 0; }}hj sbah}(h]h ]h"]h$]h&]hhjjjj}uh1jhhhMhj hhubj()}(hThe returned value is a bitmask where each bit represents a specific erratum. If bit N is set (``errata & (1 << (N - 1))``), then erratum N has been fixed in the running kernel.h](h_The returned value is a bitmask where each bit represents a specific erratum. If bit N is set (}(hj hhhNhNubj)}(h``errata & (1 << (N - 1))``h]herrata & (1 << (N - 1))}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubh7), then erratum N has been fixed in the running kernel.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhj hhubhwarning)}(hXa**Most applications should NOT check errata.** In 99.9% of cases, checking errata is unnecessary, increases code complexity, and can potentially decrease protection if misused. For example, disabling the sandbox when an erratum is not fixed could leave the system less secure than using Landlock's best-effort protection. When in doubt, ignore errata.h]j()}(hXa**Most applications should NOT check errata.** In 99.9% of cases, checking errata is unnecessary, increases code complexity, and can potentially decrease protection if misused. For example, disabling the sandbox when an erratum is not fixed could leave the system less secure than using Landlock's best-effort protection. When in doubt, ignore errata.h](hstrong)}(h.**Most applications should NOT check errata.**h]h*Most applications should NOT check errata.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj ubhX5 In 99.9% of cases, checking errata is unnecessary, increases code complexity, and can potentially decrease protection if misused. For example, disabling the sandbox when an erratum is not fixed could leave the system less secure than using Landlock’s best-effort protection. When in doubt, ignore errata.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhj ubah}(h]h ]h"]h$]h&]uh1j hj hhhhhNubh)}(hhh](h)}(h$Erratum 1: TCP socket identificationh]h$Erratum 1: TCP socket identification}(hj; hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj8 hNhNubj()}(hX]This fix addresses an issue where IPv4 and IPv6 stream sockets (e.g., SMC, MPTCP, or SCTP) were incorrectly restricted by TCP access rights during :manpage:`bind(2)` and :manpage:`connect(2)` operations. This change ensures that only TCP sockets are subject to TCP access rights, allowing other protocols to operate without unnecessary restrictions.h](hThis fix addresses an issue where IPv4 and IPv6 stream sockets (e.g., SMC, MPTCP, or SCTP) were incorrectly restricted by TCP access rights during }(hjI hhhNhNubj)}(h:manpage:`bind(2)`h]hbind(2)}(hjQ hhhNhNubah}(h]h ]jah"]h$]h&]hhj bind(2)j"bindj$j%uh1jhjI ubh and }(hjI hhhNhNubj)}(h:manpage:`connect(2)`h]h connect(2)}(hje hhhNhNubah}(h]h ]jah"]h$]h&]hhj  connect(2)j"connectj$j%uh1jhjI ubh operations. This change ensures that only TCP sockets are subject to TCP access rights, allowing other protocols to operate without unnecessary restrictions.}(hjI hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hh/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:504: ./security/landlock/errata/abi-4.hhKhj8 ubj()}(hImpact:h]hImpact:}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hh/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:504: ./security/landlock/errata/abi-4.hhK hj8 ubj()}(hXIn kernels without this fix, using ``LANDLOCK_ACCESS_NET_BIND_TCP`` or ``LANDLOCK_ACCESS_NET_CONNECT_TCP`` would incorrectly restrict non-TCP stream protocols (SMC, MPTCP, SCTP), potentially breaking applications that rely on these protocols while using Landlock network restrictions.h](h#In kernels without this fix, using }(hj hhhNhNubj)}(h ``LANDLOCK_ACCESS_NET_BIND_TCP``h]hLANDLOCK_ACCESS_NET_BIND_TCP}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubh or }(hj hhhNhNubj)}(h#``LANDLOCK_ACCESS_NET_CONNECT_TCP``h]hLANDLOCK_ACCESS_NET_CONNECT_TCP}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubh would incorrectly restrict non-TCP stream protocols (SMC, MPTCP, SCTP), potentially breaking applications that rely on these protocols while using Landlock network restrictions.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hh/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:504: ./security/landlock/errata/abi-4.hhKhj8 ubeh}(h]#erratum-1-tcp-socket-identificationah ]h"]$erratum 1: tcp socket identificationah$]h&]uh1hhj hhhNhNubh)}(hhh](h)}(h!Erratum 2: Scoped signal handlingh]h!Erratum 2: Scoped signal handling}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj hNhNubj()}(hXThis fix addresses an issue where signal scoping was overly restrictive, preventing sandboxed threads from signaling other threads within the same process if they belonged to different domains. Because threads are not security boundaries, user space might assume that all threads within the same process can send signals between themselves (see :manpage:`nptl(7)` and :manpage:`libpsx(3)`). Consistent with :manpage:`ptrace(2)` behavior, direct interaction between threads of the same process should always be allowed. This change ensures that any thread is allowed to send signals to any other thread within the same process, regardless of their domain.h](hXZThis fix addresses an issue where signal scoping was overly restrictive, preventing sandboxed threads from signaling other threads within the same process if they belonged to different domains. Because threads are not security boundaries, user space might assume that all threads within the same process can send signals between themselves (see }(hj hhhNhNubj)}(h:manpage:`nptl(7)`h]hnptl(7)}(hj hhhNhNubah}(h]h ]jah"]h$]h&]hhj nptl(7)j"nptlj$j:uh1jhj ubh and }(hj hhhNhNubj)}(h:manpage:`libpsx(3)`h]h libpsx(3)}(hj hhhNhNubah}(h]h ]jah"]h$]h&]hhj  libpsx(3)j"libpsxj$3uh1jhj ubh). Consistent with }(hj hhhNhNubj)}(h:manpage:`ptrace(2)`h]h ptrace(2)}(hj hhhNhNubah}(h]h ]jah"]h$]h&]hhj  ptrace(2)j"ptracej$j%uh1jhj ubh behavior, direct interaction between threads of the same process should always be allowed. This change ensures that any thread is allowed to send signals to any other thread within the same process, regardless of their domain.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hh/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:507: ./security/landlock/errata/abi-6.hhKhj ubj()}(hImpact:h]hImpact:}(hj' hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hh/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:507: ./security/landlock/errata/abi-6.hhKhj ubj()}(hXThis problem only manifests when the userspace process is itself using :manpage:`libpsx(3)` or an equivalent mechanism to enforce a Landlock policy on multiple already-running threads at once. Programs which enforce a Landlock policy at startup time and only then become multithreaded are not affected. Without this fix, signal scoping could break multi-threaded applications that expect threads within the same process to freely signal each other.h](hGThis problem only manifests when the userspace process is itself using }(hj6 hhhNhNubj)}(h:manpage:`libpsx(3)`h]h libpsx(3)}(hj> hhhNhNubah}(h]h ]jah"]h$]h&]hhj  libpsx(3)j"libpsxj$j uh1jhj6 ubhXg or an equivalent mechanism to enforce a Landlock policy on multiple already-running threads at once. Programs which enforce a Landlock policy at startup time and only then become multithreaded are not affected. Without this fix, signal scoping could break multi-threaded applications that expect threads within the same process to freely signal each other.}(hj6 hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hh/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:507: ./security/landlock/errata/abi-6.hhKhj ubeh}(h] erratum-2-scoped-signal-handlingah ]h"]!erratum 2: scoped signal handlingah$]h&]uh1hhj hhhNhNubh)}(hhh](h)}(h*Erratum 3: Disconnected directory handlingh]h*Erratum 3: Disconnected directory handling}(hjd hhhNhNubah}(h]h ]h"]h$]h&]uh1hhja hNhNubj()}(hX}This fix addresses an issue with disconnected directories that occur when a directory is moved outside the scope of a bind mount. The change ensures that evaluated access rights include both those from the disconnected file hierarchy down to its filesystem root and those from the related mount point hierarchy. This prevents access right widening through rename or link actions.h]hX}This fix addresses an issue with disconnected directories that occur when a directory is moved outside the scope of a bind mount. The change ensures that evaluated access rights include both those from the disconnected file hierarchy down to its filesystem root and those from the related mount point hierarchy. This prevents access right widening through rename or link actions.}(hjr hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hh/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:510: ./security/landlock/errata/abi-1.hhKhja ubj()}(hImpact:h]hImpact:}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hh/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:510: ./security/landlock/errata/abi-1.hhKhja ubj()}(hXFWithout this fix, it was possible to widen access rights through rename or link actions involving disconnected directories, potentially bypassing ``LANDLOCK_ACCESS_FS_REFER`` restrictions. This could allow privilege escalation in complex mount scenarios where directories become disconnected from their original mount points.h](hWithout this fix, it was possible to widen access rights through rename or link actions involving disconnected directories, potentially bypassing }(hj hhhNhNubj)}(h``LANDLOCK_ACCESS_FS_REFER``h]hLANDLOCK_ACCESS_FS_REFER}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubh restrictions. This could allow privilege escalation in complex mount scenarios where directories become disconnected from their original mount points.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hh/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:510: ./security/landlock/errata/abi-1.hhKhja ubeh}(h])erratum-3-disconnected-directory-handlingah ]h"]*erratum 3: disconnected directory handlingah$]h&]uh1hhj hhhNhNubh)}(hhh](h)}(hHow to check for erratah]hHow to check for errata}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj hhhhhMubj()}(h\If you determine that your application needs to check for specific errata, use this pattern:h]h\If you determine that your application needs to check for specific errata, use this pattern:}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMhj hhubj)}(hXVint errata = landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_ERRATA); if (errata >= 0) { /* Check for specific erratum (1-indexed) */ if (errata & (1 << (erratum_number - 1))) { /* Erratum N is fixed in this kernel */ } else { /* Erratum N is NOT fixed - consider implications for your use case */ } }h]hXVint errata = landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_ERRATA); if (errata >= 0) { /* Check for specific erratum (1-indexed) */ if (errata & (1 << (erratum_number - 1))) { /* Erratum N is fixed in this kernel */ } else { /* Erratum N is NOT fixed - consider implications for your use case */ } }}hj sbah}(h]h ]h"]h$]h&]hhjjjj}uh1jhhhMhj hhubj()}(h**Important:** Only check errata if your application specifically relies on behavior that changed due to the fix. The fixes generally make Landlock less restrictive or more correct, not more restrictive.h](j )}(h**Important:**h]h Important:}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj ubh Only check errata if your application specifically relies on behavior that changed due to the fix. The fixes generally make Landlock less restrictive or more correct, not more restrictive.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhj hhubeh}(h]how-to-check-for-errataah ]h"]how to check for errataah$]h&]uh1hhj hhhhhMubeh}(h]landlock-errataah ]h"]landlock errataah$]h&]uh1hhj hhhhhMubeh}(h] compatibilityah ]h"] compatibilityah$]h&]uh1hhhhhhhhMubh)}(hhh](h)}(hKernel interfaceh]hKernel interface}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj hhhhhMubh)}(hhh](h)}(h Access rightsh]h Access rights}(hj/ hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj, hhhhhMubj()}(hA set of actions on kernel objects may be defined by an attribute (e.g. :c:type:`struct landlock_path_beneath_attr `) including a bitmask of access.h](hHA set of actions on kernel objects may be defined by an attribute (e.g. }(hj= hhhNhNubh)}(hH:c:type:`struct landlock_path_beneath_attr `h]j)}(hjG h]h!struct landlock_path_beneath_attr}(hjI hhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jhjE ubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnjlandlock_path_beneath_attruh1hhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhKhj= ubh ) including a bitmask of access.}(hj= hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hjd hKhj, hhubh)}(hhh](h)}(hFilesystem flagsh]hFilesystem flags}(hjr hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjo hNhNubj()}(hThese flags enable to restrict a sandboxed process to a set of actions on files and directories. Files or directories opened before the sandboxing are not subject to these restrictions.h]hThese flags enable to restrict a sandboxed process to a set of actions on files and directories. Files or directories opened before the sandboxing are not subject to these restrictions.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhKhjo ubj()}(h0The following access rights apply only to files:h]h0The following access rights apply only to files:}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhKhjo ubh bullet_list)}(hhh](h list_item)}(h/``LANDLOCK_ACCESS_FS_EXECUTE``: Execute a file.h]j()}(hj h](j)}(h``LANDLOCK_ACCESS_FS_EXECUTE``h]hLANDLOCK_ACCESS_FS_EXECUTE}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubh: Execute a file.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhKhj ubah}(h]h ]h"]h$]h&]uh1j hj ubj )}(hX``LANDLOCK_ACCESS_FS_WRITE_FILE``: Open a file with write access. When opening files for writing, you will often additionally need the ``LANDLOCK_ACCESS_FS_TRUNCATE`` right. In many cases, these system calls truncate existing files when overwriting them (e.g., :manpage:`creat(2)`).h]j()}(hX``LANDLOCK_ACCESS_FS_WRITE_FILE``: Open a file with write access. When opening files for writing, you will often additionally need the ``LANDLOCK_ACCESS_FS_TRUNCATE`` right. In many cases, these system calls truncate existing files when overwriting them (e.g., :manpage:`creat(2)`).h](j)}(h!``LANDLOCK_ACCESS_FS_WRITE_FILE``h]hLANDLOCK_ACCESS_FS_WRITE_FILE}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubhg: Open a file with write access. When opening files for writing, you will often additionally need the }(hj hhhNhNubj)}(h``LANDLOCK_ACCESS_FS_TRUNCATE``h]hLANDLOCK_ACCESS_FS_TRUNCATE}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubh` right. In many cases, these system calls truncate existing files when overwriting them (e.g., }(hj hhhNhNubj)}(h:manpage:`creat(2)`h]hcreat(2)}(hj hhhNhNubah}(h]h ]jah"]h$]h&]hhj creat(2)j"creatj$j%uh1jhj ubh).}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhKhj ubah}(h]h ]h"]h$]h&]uh1j hj ubj )}(h?``LANDLOCK_ACCESS_FS_READ_FILE``: Open a file with read access.h]j()}(hjh](j)}(h ``LANDLOCK_ACCESS_FS_READ_FILE``h]hLANDLOCK_ACCESS_FS_READ_FILE}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh: Open a file with read access.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhKhjubah}(h]h ]h"]h$]h&]uh1j hj ubj )}(h``LANDLOCK_ACCESS_FS_TRUNCATE``: Truncate a file with :manpage:`truncate(2)`, :manpage:`ftruncate(2)`, :manpage:`creat(2)`, or :manpage:`open(2)` with ``O_TRUNC``. This access right is available since the third version of the Landlock ABI.h]j()}(h``LANDLOCK_ACCESS_FS_TRUNCATE``: Truncate a file with :manpage:`truncate(2)`, :manpage:`ftruncate(2)`, :manpage:`creat(2)`, or :manpage:`open(2)` with ``O_TRUNC``. This access right is available since the third version of the Landlock ABI.h](j)}(h``LANDLOCK_ACCESS_FS_TRUNCATE``h]hLANDLOCK_ACCESS_FS_TRUNCATE}(hjFhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjBubh: Truncate a file with }(hjBhhhNhNubj)}(h:manpage:`truncate(2)`h]h truncate(2)}(hjXhhhNhNubah}(h]h ]jah"]h$]h&]hhj  truncate(2)j"truncatej$j%uh1jhjBubh, }(hjBhhhNhNubj)}(h:manpage:`ftruncate(2)`h]h ftruncate(2)}(hjlhhhNhNubah}(h]h ]jah"]h$]h&]hhj  ftruncate(2)j" ftruncatej$j%uh1jhjBubh, }(hjBhhhNhNubj)}(h:manpage:`creat(2)`h]hcreat(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj creat(2)j"creatj$j%uh1jhjBubh, or }(hjBhhhNhNubj)}(h:manpage:`open(2)`h]hopen(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj open(2)j"openj$j%uh1jhjBubh with }(hjBhhhNhNubj)}(h ``O_TRUNC``h]hO_TRUNC}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjBubhN. This access right is available since the third version of the Landlock ABI.}(hjBhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhKhj>ubah}(h]h ]h"]h$]h&]uh1j hj ubj )}(hX}``LANDLOCK_ACCESS_FS_IOCTL_DEV``: Invoke :manpage:`ioctl(2)` commands on an opened character or block device. This access right applies to all `ioctl(2)` commands implemented by device drivers. However, the following common IOCTL commands continue to be invokable independent of the ``LANDLOCK_ACCESS_FS_IOCTL_DEV`` right: * IOCTL commands targeting file descriptors (``FIOCLEX``, ``FIONCLEX``), * IOCTL commands targeting file descriptions (``FIONBIO``, ``FIOASYNC``), * IOCTL commands targeting file systems (``FIFREEZE``, ``FITHAW``, ``FIGETBSZ``, ``FS_IOC_GETFSUUID``, ``FS_IOC_GETFSSYSFSPATH``) * Some IOCTL commands which do not make sense when used with devices, but whose implementations are safe and return the right error codes (``FS_IOC_FIEMAP``, ``FICLONE``, ``FICLONERANGE``, ``FIDEDUPERANGE``) This access right is available since the fifth version of the Landlock ABI.h](j()}(hm``LANDLOCK_ACCESS_FS_IOCTL_DEV``: Invoke :manpage:`ioctl(2)` commands on an opened character or block device.h](j)}(h ``LANDLOCK_ACCESS_FS_IOCTL_DEV``h]hLANDLOCK_ACCESS_FS_IOCTL_DEV}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh : Invoke }(hjhhhNhNubj)}(h:manpage:`ioctl(2)`h]hioctl(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj ioctl(2)j"ioctlj$j%uh1jhjubh1 commands on an opened character or block device.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhKhjubj()}(hThis access right applies to all `ioctl(2)` commands implemented by device drivers. However, the following common IOCTL commands continue to be invokable independent of the ``LANDLOCK_ACCESS_FS_IOCTL_DEV`` right:h](h!This access right applies to all }(hjhhhNhNubjJ)}(h `ioctl(2)`h]hioctl(2)}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jIhjubh commands implemented by device drivers. However, the following common IOCTL commands continue to be invokable independent of the }(hjhhhNhNubj)}(h ``LANDLOCK_ACCESS_FS_IOCTL_DEV``h]hLANDLOCK_ACCESS_FS_IOCTL_DEV}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh right:}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhKhjubj )}(hhh](j )}(hFIOCTL commands targeting file descriptors (``FIOCLEX``, ``FIONCLEX``),h]j()}(hj4h](h+IOCTL commands targeting file descriptors (}(hj6hhhNhNubj)}(h ``FIOCLEX``h]hFIOCLEX}(hj=hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj6ubh, }(hj6hhhNhNubj)}(h ``FIONCLEX``h]hFIONCLEX}(hjOhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj6ubh),}(hj6hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhKhj2ubah}(h]h ]h"]h$]h&]uh1j hj/ubj )}(hGIOCTL commands targeting file descriptions (``FIONBIO``, ``FIOASYNC``),h]j()}(hjph](h,IOCTL commands targeting file descriptions (}(hjrhhhNhNubj)}(h ``FIONBIO``h]hFIONBIO}(hjyhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjrubh, }(hjrhhhNhNubj)}(h ``FIOASYNC``h]hFIOASYNC}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjrubh),}(hjrhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhKhjnubah}(h]h ]h"]h$]h&]uh1j hj/ubj )}(hIOCTL commands targeting file systems (``FIFREEZE``, ``FITHAW``, ``FIGETBSZ``, ``FS_IOC_GETFSUUID``, ``FS_IOC_GETFSSYSFSPATH``)h]j()}(hIOCTL commands targeting file systems (``FIFREEZE``, ``FITHAW``, ``FIGETBSZ``, ``FS_IOC_GETFSUUID``, ``FS_IOC_GETFSSYSFSPATH``)h](h'IOCTL commands targeting file systems (}(hjhhhNhNubj)}(h ``FIFREEZE``h]hFIFREEZE}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh, }(hjhhhNhNubj)}(h ``FITHAW``h]hFITHAW}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh, }(hjhhhNhNubj)}(h ``FIGETBSZ``h]hFIGETBSZ}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh, }hjsbj)}(h``FS_IOC_GETFSUUID``h]hFS_IOC_GETFSUUID}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh, }hjsbj)}(h``FS_IOC_GETFSSYSFSPATH``h]hFS_IOC_GETFSSYSFSPATH}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh)}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhKhjubah}(h]h ]h"]h$]h&]uh1j hj/ubj )}(hSome IOCTL commands which do not make sense when used with devices, but whose implementations are safe and return the right error codes (``FS_IOC_FIEMAP``, ``FICLONE``, ``FICLONERANGE``, ``FIDEDUPERANGE``) h]j()}(hSome IOCTL commands which do not make sense when used with devices, but whose implementations are safe and return the right error codes (``FS_IOC_FIEMAP``, ``FICLONE``, ``FICLONERANGE``, ``FIDEDUPERANGE``)h](hSome IOCTL commands which do not make sense when used with devices, but whose implementations are safe and return the right error codes (}(hj!hhhNhNubj)}(h``FS_IOC_FIEMAP``h]h FS_IOC_FIEMAP}(hj)hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj!ubh, }(hj!hhhNhNubj)}(h ``FICLONE``h]hFICLONE}(hj;hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj!ubh, }hj!sbj)}(h``FICLONERANGE``h]h FICLONERANGE}(hjMhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj!ubh, }hj!sbj)}(h``FIDEDUPERANGE``h]h FIDEDUPERANGE}(hj_hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj!ubh)}(hj!hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhKhjubah}(h]h ]h"]h$]h&]uh1j hj/ubeh}(h]h ]h"]h$]h&]bullet*uh1j hjghKhjubj()}(hKThis access right is available since the fifth version of the Landlock ABI.h]hKThis access right is available since the fifth version of the Landlock ABI.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhKhjubeh}(h]h ]h"]h$]h&]uh1j hj ubj )}(hX``LANDLOCK_ACCESS_FS_RESOLVE_UNIX``: Look up pathname UNIX domain sockets (:manpage:`unix(7)`). On UNIX domain sockets, this restricts both calls to :manpage:`connect(2)` as well as calls to :manpage:`sendmsg(2)` with an explicit recipient address. This access right only applies to connections to UNIX server sockets which were created outside of the newly created Landlock domain (e.g. from within a parent domain or from an unrestricted process). Newly created UNIX servers within the same Landlock domain continue to be accessible. In this regard, ``LANDLOCK_ACCESS_FS_RESOLVE_UNIX`` has the same semantics as the ``LANDLOCK_SCOPE_*`` flags. If a resolve attempt is denied, the operation returns an ``EACCES`` error, in line with other filesystem access rights (but different to denials for abstract UNIX domain sockets). This access right is available since the ninth version of the Landlock ABI. The rationale for this design is described in :ref:`Documentation/security/landlock.rst `. h](j()}(h``LANDLOCK_ACCESS_FS_RESOLVE_UNIX``: Look up pathname UNIX domain sockets (:manpage:`unix(7)`). On UNIX domain sockets, this restricts both calls to :manpage:`connect(2)` as well as calls to :manpage:`sendmsg(2)` with an explicit recipient address.h](j)}(h#``LANDLOCK_ACCESS_FS_RESOLVE_UNIX``h]hLANDLOCK_ACCESS_FS_RESOLVE_UNIX}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh(: Look up pathname UNIX domain sockets (}(hjhhhNhNubj)}(h:manpage:`unix(7)`h]hunix(7)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj unix(7)j"unixj$j:uh1jhjubh9). On UNIX domain sockets, this restricts both calls to }(hjhhhNhNubj)}(h:manpage:`connect(2)`h]h connect(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj  connect(2)j"connectj$j%uh1jhjubh as well as calls to }(hjhhhNhNubj)}(h:manpage:`sendmsg(2)`h]h sendmsg(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj  sendmsg(2)j"sendmsgj$j%uh1jhjubh$ with an explicit recipient address.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhKhjubj()}(hXThis access right only applies to connections to UNIX server sockets which were created outside of the newly created Landlock domain (e.g. from within a parent domain or from an unrestricted process). Newly created UNIX servers within the same Landlock domain continue to be accessible. In this regard, ``LANDLOCK_ACCESS_FS_RESOLVE_UNIX`` has the same semantics as the ``LANDLOCK_SCOPE_*`` flags.h](hX1This access right only applies to connections to UNIX server sockets which were created outside of the newly created Landlock domain (e.g. from within a parent domain or from an unrestricted process). Newly created UNIX servers within the same Landlock domain continue to be accessible. In this regard, }(hjhhhNhNubj)}(h#``LANDLOCK_ACCESS_FS_RESOLVE_UNIX``h]hLANDLOCK_ACCESS_FS_RESOLVE_UNIX}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh has the same semantics as the }(hjhhhNhNubj)}(h``LANDLOCK_SCOPE_*``h]hLANDLOCK_SCOPE_*}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh flags.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhMhjubj()}(hIf a resolve attempt is denied, the operation returns an ``EACCES`` error, in line with other filesystem access rights (but different to denials for abstract UNIX domain sockets).h](h9If a resolve attempt is denied, the operation returns an }(hj+hhhNhNubj)}(h ``EACCES``h]hEACCES}(hj3hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj+ubhp error, in line with other filesystem access rights (but different to denials for abstract UNIX domain sockets).}(hj+hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhMhjubj()}(hKThis access right is available since the ninth version of the Landlock ABI.h]hKThis access right is available since the ninth version of the Landlock ABI.}(hjLhhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhM hjubj()}(htThe rationale for this design is described in :ref:`Documentation/security/landlock.rst `.h](h.The rationale for this design is described in }(hj[hhhNhNubh)}(hE:ref:`Documentation/security/landlock.rst `h]j)}(hjeh]h#Documentation/security/landlock.rst}(hjghhhNhNubah}(h]h ](jstdstd-refeh"]h$]h&]uh1jhjcubah}(h]h ]h"]h$]h&]refdocj refdomainjqreftyperef refexplicitrefwarnjscoped-flags-interactionuh1hhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhM hj[ubh.}(hj[hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hjhM hjubeh}(h]h ]h"]h$]h&]uh1j hj ubeh}(h]h ]h"]h$]h&]j-uh1j hj hKhjo ubj()}(hX'Whether an opened file can be truncated with :manpage:`ftruncate(2)` or used with `ioctl(2)` is determined during :manpage:`open(2)`, in the same way as read and write permissions are checked during :manpage:`open(2)` using ``LANDLOCK_ACCESS_FS_READ_FILE`` and ``LANDLOCK_ACCESS_FS_WRITE_FILE``.h](h-Whether an opened file can be truncated with }(hjhhhNhNubj)}(h:manpage:`ftruncate(2)`h]h ftruncate(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj  ftruncate(2)j" ftruncatej$j%uh1jhjubh or used with }(hjhhhNhNubjJ)}(h `ioctl(2)`h]hioctl(2)}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jIhjubh is determined during }(hjhhhNhNubj)}(h:manpage:`open(2)`h]hopen(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj open(2)j"openj$j%uh1jhjubhC, in the same way as read and write permissions are checked during }(hjhhhNhNubj)}(h:manpage:`open(2)`h]hopen(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj open(2)j"openj$j%uh1jhjubh using }(hjhhhNhNubj)}(h ``LANDLOCK_ACCESS_FS_READ_FILE``h]hLANDLOCK_ACCESS_FS_READ_FILE}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh and }(hjhhhNhNubj)}(h!``LANDLOCK_ACCESS_FS_WRITE_FILE``h]hLANDLOCK_ACCESS_FS_WRITE_FILE}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhMhjo ubj()}(hA directory can receive access rights related to files or directories. The following access right is applied to the directory itself, and the directories beneath it:h]hA directory can receive access rights related to files or directories. The following access right is applied to the directory itself, and the directories beneath it:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhMhjo ubj )}(hhh]j )}(hG``LANDLOCK_ACCESS_FS_READ_DIR``: Open a directory or list its content. h]j()}(hF``LANDLOCK_ACCESS_FS_READ_DIR``: Open a directory or list its content.h](j)}(h``LANDLOCK_ACCESS_FS_READ_DIR``h]hLANDLOCK_ACCESS_FS_READ_DIR}(hj6hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj2ubh': Open a directory or list its content.}(hj2hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhMhj.ubah}(h]h ]h"]h$]h&]uh1j hj+ubah}(h]h ]h"]h$]h&]jjuh1j hjNhMhjo ubj()}(hhHowever, the following access rights only apply to the content of a directory, not the directory itself:h]hhHowever, the following access rights only apply to the content of a directory, not the directory itself:}(hj[hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhMhjo ubj )}(hhh](j )}(hK``LANDLOCK_ACCESS_FS_REMOVE_DIR``: Remove an empty directory or rename one.h]j()}(hjoh](j)}(h!``LANDLOCK_ACCESS_FS_REMOVE_DIR``h]hLANDLOCK_ACCESS_FS_REMOVE_DIR}(hjthhhNhNubah}(h]h ]h"]h$]h&]uh1jhjqubh*: Remove an empty directory or rename one.}(hjqhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhMhjmubah}(h]h ]h"]h$]h&]uh1j hjjubj )}(h>``LANDLOCK_ACCESS_FS_REMOVE_FILE``: Unlink (or rename) a file.h]j()}(hjh](j)}(h"``LANDLOCK_ACCESS_FS_REMOVE_FILE``h]hLANDLOCK_ACCESS_FS_REMOVE_FILE}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh: Unlink (or rename) a file.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhMhjubah}(h]h ]h"]h$]h&]uh1j hjjubj )}(hP``LANDLOCK_ACCESS_FS_MAKE_CHAR``: Create (or rename or link) a character device.h]j()}(hP``LANDLOCK_ACCESS_FS_MAKE_CHAR``: Create (or rename or link) a character device.h](j)}(h ``LANDLOCK_ACCESS_FS_MAKE_CHAR``h]hLANDLOCK_ACCESS_FS_MAKE_CHAR}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh0: Create (or rename or link) a character device.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhM hjubah}(h]h ]h"]h$]h&]uh1j hjjubj )}(h@``LANDLOCK_ACCESS_FS_MAKE_DIR``: Create (or rename) a directory.h]j()}(hjh](j)}(h``LANDLOCK_ACCESS_FS_MAKE_DIR``h]hLANDLOCK_ACCESS_FS_MAKE_DIR}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh!: Create (or rename) a directory.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhM"hjubah}(h]h ]h"]h$]h&]uh1j hjjubj )}(hK``LANDLOCK_ACCESS_FS_MAKE_REG``: Create (or rename or link) a regular file.h]j()}(hjh](j)}(h``LANDLOCK_ACCESS_FS_MAKE_REG``h]hLANDLOCK_ACCESS_FS_MAKE_REG}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubh,: Create (or rename or link) a regular file.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhM#hjubah}(h]h ]h"]h$]h&]uh1j hjjubj )}(hR``LANDLOCK_ACCESS_FS_MAKE_SOCK``: Create (or rename or link) a UNIX domain socket.h]j()}(hR``LANDLOCK_ACCESS_FS_MAKE_SOCK``: Create (or rename or link) a UNIX domain socket.h](j)}(h ``LANDLOCK_ACCESS_FS_MAKE_SOCK``h]hLANDLOCK_ACCESS_FS_MAKE_SOCK}(hj4hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj0ubh2: Create (or rename or link) a UNIX domain socket.}(hj0hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhM$hj,ubah}(h]h ]h"]h$]h&]uh1j hjjubj )}(hJ``LANDLOCK_ACCESS_FS_MAKE_FIFO``: Create (or rename or link) a named pipe.h]j()}(hjUh](j)}(h ``LANDLOCK_ACCESS_FS_MAKE_FIFO``h]hLANDLOCK_ACCESS_FS_MAKE_FIFO}(hjZhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjWubh*: Create (or rename or link) a named pipe.}(hjWhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhM&hjSubah}(h]h ]h"]h$]h&]uh1j hjjubj )}(hM``LANDLOCK_ACCESS_FS_MAKE_BLOCK``: Create (or rename or link) a block device.h]j()}(hj{h](j)}(h!``LANDLOCK_ACCESS_FS_MAKE_BLOCK``h]hLANDLOCK_ACCESS_FS_MAKE_BLOCK}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj}ubh,: Create (or rename or link) a block device.}(hj}hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhM'hjyubah}(h]h ]h"]h$]h&]uh1j hjjubj )}(hL``LANDLOCK_ACCESS_FS_MAKE_SYM``: Create (or rename or link) a symbolic link.h]j()}(hjh](j)}(h``LANDLOCK_ACCESS_FS_MAKE_SYM``h]hLANDLOCK_ACCESS_FS_MAKE_SYM}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh-: Create (or rename or link) a symbolic link.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhM(hjubah}(h]h ]h"]h$]h&]uh1j hjjubj )}(hX``LANDLOCK_ACCESS_FS_REFER``: Link or rename a file from or to a different directory (i.e. reparent a file hierarchy). This access right is available since the second version of the Landlock ABI. This is the only access right which is denied by default by any ruleset, even if the right is not specified as handled at ruleset creation time. The only way to make a ruleset grant this right is to explicitly allow it for a specific directory by adding a matching rule to the ruleset. In particular, when using the first Landlock ABI version, Landlock will always deny attempts to reparent files between different directories. In addition to the source and destination directories having the ``LANDLOCK_ACCESS_FS_REFER`` access right, the attempted link or rename operation must meet the following constraints: * The reparented file may not gain more access rights in the destination directory than it previously had in the source directory. If this is attempted, the operation results in an ``EXDEV`` error. * When linking or renaming, the ``LANDLOCK_ACCESS_FS_MAKE_*`` right for the respective file type must be granted for the destination directory. Otherwise, the operation results in an ``EACCES`` error. * When renaming, the ``LANDLOCK_ACCESS_FS_REMOVE_*`` right for the respective file type must be granted for the source directory. Otherwise, the operation results in an ``EACCES`` error. If multiple requirements are not met, the ``EACCES`` error code takes precedence over ``EXDEV``. h](j()}(hv``LANDLOCK_ACCESS_FS_REFER``: Link or rename a file from or to a different directory (i.e. reparent a file hierarchy).h](j)}(h``LANDLOCK_ACCESS_FS_REFER``h]hLANDLOCK_ACCESS_FS_REFER}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhZ: Link or rename a file from or to a different directory (i.e. reparent a file hierarchy).}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhM)hjubj()}(hLThis access right is available since the second version of the Landlock ABI.h]hLThis access right is available since the second version of the Landlock ABI.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhM,hjubj()}(hXThis is the only access right which is denied by default by any ruleset, even if the right is not specified as handled at ruleset creation time. The only way to make a ruleset grant this right is to explicitly allow it for a specific directory by adding a matching rule to the ruleset.h]hXThis is the only access right which is denied by default by any ruleset, even if the right is not specified as handled at ruleset creation time. The only way to make a ruleset grant this right is to explicitly allow it for a specific directory by adding a matching rule to the ruleset.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhM/hjubj()}(hIn particular, when using the first Landlock ABI version, Landlock will always deny attempts to reparent files between different directories.h]hIn particular, when using the first Landlock ABI version, Landlock will always deny attempts to reparent files between different directories.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhM4hjubj()}(hIn addition to the source and destination directories having the ``LANDLOCK_ACCESS_FS_REFER`` access right, the attempted link or rename operation must meet the following constraints:h](hAIn addition to the source and destination directories having the }(hjhhhNhNubj)}(h``LANDLOCK_ACCESS_FS_REFER``h]hLANDLOCK_ACCESS_FS_REFER}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhZ access right, the attempted link or rename operation must meet the following constraints:}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhM7hjubj )}(hhh](j )}(hThe reparented file may not gain more access rights in the destination directory than it previously had in the source directory. If this is attempted, the operation results in an ``EXDEV`` error. h]j()}(hThe reparented file may not gain more access rights in the destination directory than it previously had in the source directory. If this is attempted, the operation results in an ``EXDEV`` error.h](hThe reparented file may not gain more access rights in the destination directory than it previously had in the source directory. If this is attempted, the operation results in an }(hj;hhhNhNubj)}(h ``EXDEV``h]hEXDEV}(hjChhhNhNubah}(h]h ]h"]h$]h&]uh1jhj;ubh error.}(hj;hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhM;hj7ubah}(h]h ]h"]h$]h&]uh1j hj4ubj )}(hWhen linking or renaming, the ``LANDLOCK_ACCESS_FS_MAKE_*`` right for the respective file type must be granted for the destination directory. Otherwise, the operation results in an ``EACCES`` error. h]j()}(hWhen linking or renaming, the ``LANDLOCK_ACCESS_FS_MAKE_*`` right for the respective file type must be granted for the destination directory. Otherwise, the operation results in an ``EACCES`` error.h](hWhen linking or renaming, the }(hjfhhhNhNubj)}(h``LANDLOCK_ACCESS_FS_MAKE_*``h]hLANDLOCK_ACCESS_FS_MAKE_*}(hjnhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjfubhz right for the respective file type must be granted for the destination directory. Otherwise, the operation results in an }(hjfhhhNhNubj)}(h ``EACCES``h]hEACCES}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjfubh error.}(hjfhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhM?hjbubah}(h]h ]h"]h$]h&]uh1j hj4ubj )}(hWhen renaming, the ``LANDLOCK_ACCESS_FS_REMOVE_*`` right for the respective file type must be granted for the source directory. Otherwise, the operation results in an ``EACCES`` error. h]j()}(hWhen renaming, the ``LANDLOCK_ACCESS_FS_REMOVE_*`` right for the respective file type must be granted for the source directory. Otherwise, the operation results in an ``EACCES`` error.h](hWhen renaming, the }(hjhhhNhNubj)}(h``LANDLOCK_ACCESS_FS_REMOVE_*``h]hLANDLOCK_ACCESS_FS_REMOVE_*}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhv right for the respective file type must be granted for the source directory. Otherwise, the operation results in an }(hjhhhNhNubj)}(h ``EACCES``h]hEACCES}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh error.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhMChjubah}(h]h ]h"]h$]h&]uh1j hj4ubeh}(h]h ]h"]h$]h&]jjuh1j hj[hM;hjubj()}(h`If multiple requirements are not met, the ``EACCES`` error code takes precedence over ``EXDEV``.h](h*If multiple requirements are not met, the }(hjhhhNhNubj)}(h ``EACCES``h]hEACCES}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh" error code takes precedence over }(hjhhhNhNubj)}(h ``EXDEV``h]hEXDEV}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhMGhjubeh}(h]h ]h"]h$]h&]uh1j hjjubeh}(h]h ]h"]h$]h&]jjuh1j hjhMhjo ubj )}(hXfIt is currently not possible to restrict some file-related actions accessible through these syscall families: :manpage:`chdir(2)`, :manpage:`stat(2)`, :manpage:`flock(2)`, :manpage:`chmod(2)`, :manpage:`chown(2)`, :manpage:`setxattr(2)`, :manpage:`utime(2)`, :manpage:`fcntl(2)`, :manpage:`access(2)`. Future Landlock evolutions will enable to restrict them.h]j()}(hXfIt is currently not possible to restrict some file-related actions accessible through these syscall families: :manpage:`chdir(2)`, :manpage:`stat(2)`, :manpage:`flock(2)`, :manpage:`chmod(2)`, :manpage:`chown(2)`, :manpage:`setxattr(2)`, :manpage:`utime(2)`, :manpage:`fcntl(2)`, :manpage:`access(2)`. Future Landlock evolutions will enable to restrict them.h](hnIt is currently not possible to restrict some file-related actions accessible through these syscall families: }(hj%hhhNhNubj)}(h:manpage:`chdir(2)`h]hchdir(2)}(hj-hhhNhNubah}(h]h ]jah"]h$]h&]hhj chdir(2)j"chdirj$j%uh1jhj%ubh, }(hj%hhhNhNubj)}(h:manpage:`stat(2)`h]hstat(2)}(hjAhhhNhNubah}(h]h ]jah"]h$]h&]hhj stat(2)j"statj$j%uh1jhj%ubh, }(hj%hhhNhNubj)}(h:manpage:`flock(2)`h]hflock(2)}(hjUhhhNhNubah}(h]h ]jah"]h$]h&]hhj flock(2)j"flockj$j%uh1jhj%ubh, }hj%sbj)}(h:manpage:`chmod(2)`h]hchmod(2)}(hjihhhNhNubah}(h]h ]jah"]h$]h&]hhj chmod(2)j"chmodj$j%uh1jhj%ubh, }hj%sbj)}(h:manpage:`chown(2)`h]hchown(2)}(hj}hhhNhNubah}(h]h ]jah"]h$]h&]hhj chown(2)j"chownj$j%uh1jhj%ubh, }hj%sbj)}(h:manpage:`setxattr(2)`h]h setxattr(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj  setxattr(2)j"setxattrj$j%uh1jhj%ubh, }hj%sbj)}(h:manpage:`utime(2)`h]hutime(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj utime(2)j"utimej$j%uh1jhj%ubh, }hj%sbj)}(h:manpage:`fcntl(2)`h]hfcntl(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj fcntl(2)j"fcntlj$j%uh1jhj%ubh, }hj%sbj)}(h:manpage:`access(2)`h]h access(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhj  access(2)j"accessj$j%uh1jhj%ubh:. Future Landlock evolutions will enable to restrict them.}(hj%hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhMLhj!ubah}(h]h ]h"]h$]h&]uh1j hjo ubeh}(h]filesystem-flagsah ]h"]filesystem flagsah$]h&]uh1hhj, hhhNhNjKubh)}(hhh](h)}(h Network flagsh]h Network flags}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhNhNubj()}(hOThese flags enable to restrict a sandboxed process to a set of network actions.h]hOThese flags enable to restrict a sandboxed process to a set of network actions.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhMmhjubj()}(h6The following access rights apply to TCP port numbers:h]h6The following access rights apply to TCP port numbers:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhMphjubj )}(hhh](j )}(ht``LANDLOCK_ACCESS_NET_BIND_TCP``: Bind TCP sockets to the given local port. Support added in Landlock ABI version 4.h]j()}(ht``LANDLOCK_ACCESS_NET_BIND_TCP``: Bind TCP sockets to the given local port. Support added in Landlock ABI version 4.h](j)}(h ``LANDLOCK_ACCESS_NET_BIND_TCP``h]hLANDLOCK_ACCESS_NET_BIND_TCP}(hj0hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj,ubhT: Bind TCP sockets to the given local port. Support added in Landlock ABI version 4.}(hj,hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhMrhj(ubah}(h]h ]h"]h$]h&]uh1j hj%ubj )}(h}``LANDLOCK_ACCESS_NET_CONNECT_TCP``: Connect TCP sockets to the given remote port. Support added in Landlock ABI version 4. h]j()}(h{``LANDLOCK_ACCESS_NET_CONNECT_TCP``: Connect TCP sockets to the given remote port. Support added in Landlock ABI version 4.h](j)}(h#``LANDLOCK_ACCESS_NET_CONNECT_TCP``h]hLANDLOCK_ACCESS_NET_CONNECT_TCP}(hjWhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjSubhX: Connect TCP sockets to the given remote port. Support added in Landlock ABI version 4.}(hjShhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhMthjOubah}(h]h ]h"]h$]h&]uh1j hj%ubeh}(h]h ]h"]h$]h&]jjuh1j hjHhMrhjubeh}(h] network-flagsah ]h"] network flagsah$]h&]uh1hhj, hhhNhNjKubh)}(hhh](h)}(h Scope flagsh]h Scope flags}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhNhNubj()}(hThese flags enable to isolate a sandboxed process from a set of IPC actions. Setting a flag for a ruleset will isolate the Landlock domain to forbid connections to resources outside the domain.h]hThese flags enable to isolate a sandboxed process from a set of IPC actions. Setting a flag for a ruleset will isolate the Landlock domain to forbid connections to resources outside the domain.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhMhjubj()}(h/This is supported since Landlock ABI version 6.h]h/This is supported since Landlock ABI version 6.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhMhjubj()}(hScopes:h]hScopes:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhMhjubj )}(hhh](j )}(h``LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET``: Restrict a sandboxed process from connecting to an abstract UNIX socket created by a process outside the related Landlock domain (e.g., a parent domain or a non-sandboxed process).h]j()}(h``LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET``: Restrict a sandboxed process from connecting to an abstract UNIX socket created by a process outside the related Landlock domain (e.g., a parent domain or a non-sandboxed process).h](j)}(h'``LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET``h]h#LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh: Restrict a sandboxed process from connecting to an abstract UNIX socket created by a process outside the related Landlock domain (e.g., a parent domain or a non-sandboxed process).}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhMhjubah}(h]h ]h"]h$]h&]uh1j hjubj )}(hv``LANDLOCK_SCOPE_SIGNAL``: Restrict a sandboxed process from sending a signal to another process outside the domain. h]j()}(ht``LANDLOCK_SCOPE_SIGNAL``: Restrict a sandboxed process from sending a signal to another process outside the domain.h](j)}(h``LANDLOCK_SCOPE_SIGNAL``h]hLANDLOCK_SCOPE_SIGNAL}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh[: Restrict a sandboxed process from sending a signal to another process outside the domain.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:541: ./include/uapi/linux/landlock.hhMhjubah}(h]h ]h"]h$]h&]uh1j hjubeh}(h]h ]h"]h$]h&]jjuh1j hjhMhjubeh}(h] scope-flagsah ]h"] scope flagsah$]h&]uh1hhj, hhhNhNjKubeh}(h] access-rightsah ]h"] access rightsah$]h&]uh1hhj hhhhhMubh)}(hhh](h)}(hCreating a new ruleseth]hCreating a new ruleset}(hj,hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj)hhhhhM!ubhindex)}(hhh]h}(h]h ]h"]h$]h&]entries](single(sys_landlock_create_ruleset (C function)c.sys_landlock_create_rulesethNtauh1j:hj)hhhNhNubhdesc)}(hhh](hdesc_signature)}(h~long sys_landlock_create_ruleset (const struct landlock_ruleset_attr __user *const attr, const size_t size, const __u32 flags)h]hdesc_signature_line)}(h}long sys_landlock_create_ruleset(const struct landlock_ruleset_attr __user *const attr, const size_t size, const __u32 flags)h](hdesc_sig_keyword_type)}(hlongh]hlong}(hj^hhhNhNubah}(h]h ]ktah"]h$]h&]uh1j\hjXhhhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:547: ./security/landlock/syscalls.chKubhdesc_sig_space)}(h h]h }(hjphhhNhNubah}(h]h ]wah"]h$]h&]uh1jnhjXhhhjmhKubh desc_name)}(hsys_landlock_create_ruleseth]h desc_sig_name)}(hsys_landlock_create_ruleseth]hsys_landlock_create_ruleset}(hjhhhNhNubah}(h]h ]nah"]h$]h&]uh1jhjubah}(h]h ](sig-namedescnameeh"]h$]h&]hhuh1jhjXhhhjmhKubhdesc_parameterlist)}(h](const struct landlock_ruleset_attr __user *const attr, const size_t size, const __u32 flags)h](hdesc_parameter)}(h5const struct landlock_ruleset_attr __user *const attrh](hdesc_sig_keyword)}(hconsth]hconst}(hjhhhNhNubah}(h]h ]kah"]h$]h&]uh1jhjubjo)}(h h]h }(hjhhhNhNubah}(h]h ]j{ah"]h$]h&]uh1jnhjubj)}(hstructh]hstruct}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubjo)}(h h]h }(hjhhhNhNubah}(h]h ]j{ah"]h$]h&]uh1jnhjubh)}(hhh]j)}(hlandlock_ruleset_attrh]hlandlock_ruleset_attr}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&] refdomainjreftype identifier reftargetjmodnameN classnameN c:parent_keysphinx.domains.c LookupKey)}data]j ASTIdentifier)}jjsbc.sys_landlock_create_rulesetasbuh1hhjubjo)}(h h]h }(hjhhhNhNubah}(h]h ]j{ah"]h$]h&]uh1jnhjubh__user}(hjhhhNhNubjo)}(h h]h }(hj"hhhNhNubah}(h]h ]j{ah"]h$]h&]uh1jnhjubhdesc_sig_punctuation)}(hjh]h*}(hj2hhhNhNubah}(h]h ]pah"]h$]h&]uh1j0hjubj)}(hjh]hconst}(hj@hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubjo)}(h h]h }(hjMhhhNhNubah}(h]h ]j{ah"]h$]h&]uh1jnhjubj)}(hattrh]hattr}(hj[hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]noemphhhuh1jhjubj)}(hconst size_t sizeh](j)}(hjh]hconst}(hjthhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjpubjo)}(h h]h }(hjhhhNhNubah}(h]h ]j{ah"]h$]h&]uh1jnhjpubh)}(hhh]j)}(hsize_th]hsize_t}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&] refdomainjreftypej reftargetjmodnameN classnameNjj)}j]j c.sys_landlock_create_rulesetasbuh1hhjpubjo)}(h h]h }(hjhhhNhNubah}(h]h ]j{ah"]h$]h&]uh1jnhjpubj)}(hsizeh]hsize}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjpubeh}(h]h ]h"]h$]h&]noemphhhuh1jhjubj)}(hconst __u32 flagsh](j)}(hjh]hconst}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubjo)}(h h]h }(hjhhhNhNubah}(h]h ]j{ah"]h$]h&]uh1jnhjubh)}(hhh]j)}(h__u32h]h__u32}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&] refdomainjreftypej reftargetjmodnameN classnameNjj)}j]j c.sys_landlock_create_rulesetasbuh1hhjubjo)}(h h]h }(hjhhhNhNubah}(h]h ]j{ah"]h$]h&]uh1jnhjubj)}(hflagsh]hflags}(hj!hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]noemphhhuh1jhjubeh}(h]h ]h"]h$]h&]hhuh1jhjXhhhjmhKubeh}(h]h ]h"]h$]h&]hhƌ add_permalinkuh1jVsphinx_line_type declaratorhjRhhhjmhKubah}(h]jIah ](sig sig-objecteh"]h$]h&] is_multiline _toc_parts) _toc_namehuh1jPhjmhKhjMhhubh desc_content)}(hhh]j()}(hCreate a new ruleseth]hCreate a new ruleset}(hjUhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:547: ./security/landlock/syscalls.chKhjRhhubah}(h]h ]h"]h$]h&]uh1jPhjMhhhjmhKubeh}(h]h ](jfunctioneh"]h$]h&]domainjobjtypejmdesctypejmnoindex noindexentrynocontentsentryuh1jKhhhj)hNhNubh container)}(hX**Parameters** ``const struct landlock_ruleset_attr __user *const attr`` Pointer to a :c:type:`struct landlock_ruleset_attr ` identifying the scope of the new ruleset. ``const size_t size`` Size of the pointed :c:type:`struct landlock_ruleset_attr ` (needed for backward and forward compatibility). ``const __u32 flags`` Supported values: **Description** - ``LANDLOCK_CREATE_RULESET_VERSION`` - ``LANDLOCK_CREATE_RULESET_ERRATA`` This system call enables to create a new Landlock ruleset. If ``LANDLOCK_CREATE_RULESET_VERSION`` or ``LANDLOCK_CREATE_RULESET_ERRATA`` is set, then **attr** must be NULL and **size** must be 0. - ``EOPNOTSUPP``: Landlock is supported by the kernel but disabled at boot time; - ``EINVAL``: unknown **flags**, or unknown access, or unknown scope, or too small **size**; - ``E2BIG``: **attr** or **size** inconsistencies; - ``EFAULT``: **attr** or **size** inconsistencies; - ``ENOMSG``: empty :c:type:`landlock_ruleset_attr.handled_access_fs `. .. kernel-doc:: include/uapi/linux/landlock.h :identifiers: landlock_create_ruleset_flags **Return** The ruleset file descriptor on success, the Landlock ABI version if ``LANDLOCK_CREATE_RULESET_VERSION`` is set, the errata value if ``LANDLOCK_CREATE_RULESET_ERRATA`` is set, or -errno on failure. Possible returned errors are:h](j()}(h**Parameters**h]j )}(hjh]h Parameters}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j hj}ubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:547: ./security/landlock/syscalls.chKhjyubj")}(hhh](j')}(h``const struct landlock_ruleset_attr __user *const attr`` Pointer to a :c:type:`struct landlock_ruleset_attr ` identifying the scope of the new ruleset. h](j-)}(h9``const struct landlock_ruleset_attr __user *const attr``h]j)}(hjh]h5const struct landlock_ruleset_attr __user *const attr}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1j,hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:547: ./security/landlock/syscalls.chKhjubj=)}(hhh]j()}(huPointer to a :c:type:`struct landlock_ruleset_attr ` identifying the scope of the new ruleset.h](h Pointer to a }(hjhhhNhNubh)}(h>:c:type:`struct landlock_ruleset_attr `h]j)}(hjh]hstruct landlock_ruleset_attr}(hjhhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnjj)}j]sbjlandlock_ruleset_attruh1hhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:547: ./security/landlock/syscalls.chKhjubh* identifying the scope of the new ruleset.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hjhKhjubah}(h]h ]h"]h$]h&]uh1j<hjubeh}(h]h ]h"]h$]h&]uh1j&hjhKhjubj')}(h``const size_t size`` Size of the pointed :c:type:`struct landlock_ruleset_attr ` (needed for backward and forward compatibility). h](j-)}(h``const size_t size``h]j)}(hjh]hconst size_t size}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1j,hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:547: ./security/landlock/syscalls.chKhjubj=)}(hhh]j()}(hSize of the pointed :c:type:`struct landlock_ruleset_attr ` (needed for backward and forward compatibility).h](hSize of the pointed }(hjhhhNhNubh)}(h>:c:type:`struct landlock_ruleset_attr `h]j)}(hj!h]hstruct landlock_ruleset_attr}(hj#hhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnjjjlandlock_ruleset_attruh1hhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:547: ./security/landlock/syscalls.chKhjubh1 (needed for backward and forward compatibility).}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hj>hKhjubah}(h]h ]h"]h$]h&]uh1j<hjubeh}(h]h ]h"]h$]h&]uh1j&hjhKhjubj')}(h(``const __u32 flags`` Supported values: h](j-)}(h``const __u32 flags``h]j)}(hj[h]hconst __u32 flags}(hj]hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjYubah}(h]h ]h"]h$]h&]uh1j,hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:547: ./security/landlock/syscalls.chKhjUubj=)}(hhh]j()}(hSupported values:h]hSupported values:}(hjthhhNhNubah}(h]h ]h"]h$]h&]uh1j'hjphKhjqubah}(h]h ]h"]h$]h&]uh1j<hjUubeh}(h]h ]h"]h$]h&]uh1j&hjphKhjubeh}(h]h ]h"]h$]h&]uh1j!hjyubj()}(h**Description**h]j )}(hjh]h Description}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j hjubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:547: ./security/landlock/syscalls.chKhjyubh block_quote)}(hK- ``LANDLOCK_CREATE_RULESET_VERSION`` - ``LANDLOCK_CREATE_RULESET_ERRATA`` h]j )}(hhh](j )}(h#``LANDLOCK_CREATE_RULESET_VERSION``h]j()}(hjh]j)}(hjh]hLANDLOCK_CREATE_RULESET_VERSION}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:547: ./security/landlock/syscalls.chKhjubah}(h]h ]h"]h$]h&]uh1j hjubj )}(h#``LANDLOCK_CREATE_RULESET_ERRATA`` h]j()}(h"``LANDLOCK_CREATE_RULESET_ERRATA``h]j)}(hjh]hLANDLOCK_CREATE_RULESET_ERRATA}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:547: ./security/landlock/syscalls.chKhjubah}(h]h ]h"]h$]h&]uh1j hjubeh}(h]h ]h"]h$]h&]jjuh1j hjhKhjubah}(h]h ]h"]h$]h&]uh1jhjhKhjyubj()}(h:This system call enables to create a new Landlock ruleset.h]h:This system call enables to create a new Landlock ruleset.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:547: ./security/landlock/syscalls.chKhjyubj()}(hIf ``LANDLOCK_CREATE_RULESET_VERSION`` or ``LANDLOCK_CREATE_RULESET_ERRATA`` is set, then **attr** must be NULL and **size** must be 0.h](hIf }(hjhhhNhNubj)}(h#``LANDLOCK_CREATE_RULESET_VERSION``h]hLANDLOCK_CREATE_RULESET_VERSION}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh or }(hjhhhNhNubj)}(h"``LANDLOCK_CREATE_RULESET_ERRATA``h]hLANDLOCK_CREATE_RULESET_ERRATA}(hj-hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh is set, then }(hjhhhNhNubj )}(h**attr**h]hattr}(hj?hhhNhNubah}(h]h ]h"]h$]h&]uh1j hjubh must be NULL and }(hjhhhNhNubj )}(h**size**h]hsize}(hjQhhhNhNubah}(h]h ]h"]h$]h&]uh1j hjubh must be 0.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:547: ./security/landlock/syscalls.chKhjyubj )}(hhh](j )}(hN``EOPNOTSUPP``: Landlock is supported by the kernel but disabled at boot time;h]j()}(hjoh](j)}(h``EOPNOTSUPP``h]h EOPNOTSUPP}(hjthhhNhNubah}(h]h ]h"]h$]h&]uh1jhjqubh@: Landlock is supported by the kernel but disabled at boot time;}(hjqhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:547: ./security/landlock/syscalls.chKhjmubah}(h]h ]h"]h$]h&]uh1j hjjubj )}(hZ``EINVAL``: unknown **flags**, or unknown access, or unknown scope, or too small **size**;h]j()}(hZ``EINVAL``: unknown **flags**, or unknown access, or unknown scope, or too small **size**;h](j)}(h ``EINVAL``h]hEINVAL}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh : unknown }(hjhhhNhNubj )}(h **flags**h]hflags}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j hjubh4, or unknown access, or unknown scope, or too small }(hjhhhNhNubj )}(h**size**h]hsize}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j hjubh;}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:547: ./security/landlock/syscalls.chKhjubah}(h]h ]h"]h$]h&]uh1j hjjubj )}(h0``E2BIG``: **attr** or **size** inconsistencies;h]j()}(hjh](j)}(h ``E2BIG``h]hE2BIG}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh: }(hjhhhNhNubj )}(h**attr**h]hattr}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j hjubh or }(hjhhhNhNubj )}(h**size**h]hsize}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j hjubh inconsistencies;}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:547: ./security/landlock/syscalls.chKhjubah}(h]h ]h"]h$]h&]uh1j hjjubj )}(h1``EFAULT``: **attr** or **size** inconsistencies;h]j()}(hj*h](j)}(h ``EFAULT``h]hEFAULT}(hj/hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj,ubh: }(hj,hhhNhNubj )}(h**attr**h]hattr}(hjAhhhNhNubah}(h]h ]h"]h$]h&]uh1j hj,ubh or }(hj,hhhNhNubj )}(h**size**h]hsize}(hjShhhNhNubah}(h]h ]h"]h$]h&]uh1j hj,ubh inconsistencies;}(hj,hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:547: ./security/landlock/syscalls.chKhj(ubah}(h]h ]h"]h$]h&]uh1j hjjubj )}(h]``ENOMSG``: empty :c:type:`landlock_ruleset_attr.handled_access_fs `. h]j()}(h\``ENOMSG``: empty :c:type:`landlock_ruleset_attr.handled_access_fs `.h](j)}(h ``ENOMSG``h]hENOMSG}(hjzhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjvubh: empty }(hjvhhhNhNubh)}(hI:c:type:`landlock_ruleset_attr.handled_access_fs `h]j)}(hjh]h'landlock_ruleset_attr.handled_access_fs}(hjhhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnjjjlandlock_ruleset_attruh1hhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:547: ./security/landlock/syscalls.chKhjvubh.}(hjvhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hjhKhjrubah}(h]h ]h"]h$]h&]uh1j hjjubeh}(h]h ]h"]h$]h&]jjuh1j hjhKhjyubj()}(h **Flags**h]j )}(hjh]hFlags}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j hjubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:38: ./include/uapi/linux/landlock.hhK9hjyubj")}(hhh](j')}(hd``LANDLOCK_CREATE_RULESET_VERSION`` Get the highest supported Landlock ABI version (starting at 1). h](j-)}(h#``LANDLOCK_CREATE_RULESET_VERSION``h]j)}(hjh]hLANDLOCK_CREATE_RULESET_VERSION}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1j,hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:38: ./include/uapi/linux/landlock.hhK` or :c:type:`landlock_net_port_attr.allowed_access ` is not a subset of the ruleset handled accesses) - ``EINVAL``: :c:type:`landlock_net_port_attr.port ` is greater than 65535; - ``ENOMSG``: Empty accesses (e.g. :c:type:`landlock_path_beneath_attr.allowed_access ` is 0); - ``EBADF``: **ruleset_fd** is not a file descriptor for the current thread, or a member of **rule_attr** is not a file descriptor as expected; - ``EBADFD``: **ruleset_fd** is not a ruleset file descriptor, or a member of **rule_attr** is not the expected file descriptor type; - ``EPERM``: **ruleset_fd** has no write access to the underlying ruleset; - ``EFAULT``: **rule_attr** was not a valid address. **Return** 0 on success, or -errno on failure. Possible returned errors are:h](j()}(h**Parameters**h]j )}(hj"h]h Parameters}(hj"hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj"ubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:556: ./security/landlock/syscalls.chMhj"ubj")}(hhh](j')}(hh``const int ruleset_fd`` File descriptor tied to the ruleset that should be extended with the new rule. h](j-)}(h``const int ruleset_fd``h]j)}(hj"h]hconst int ruleset_fd}(hj"hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj"ubah}(h]h ]h"]h$]h&]uh1j,hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:556: ./security/landlock/syscalls.chMhj"ubj=)}(hhh]j()}(hNFile descriptor tied to the ruleset that should be extended with the new rule.h]hNFile descriptor tied to the ruleset that should be extended with the new rule.}(hj"hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:556: ./security/landlock/syscalls.chMhj"ubah}(h]h ]h"]h$]h&]uh1j<hj"ubeh}(h]h ]h"]h$]h&]uh1j&hj"hMhj"ubj')}(h``const enum landlock_rule_type rule_type`` Identify the structure type pointed to by **rule_attr**: ``LANDLOCK_RULE_PATH_BENEATH`` or ``LANDLOCK_RULE_NET_PORT``. h](j-)}(h+``const enum landlock_rule_type rule_type``h]j)}(hj"h]h'const enum landlock_rule_type rule_type}(hj"hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj"ubah}(h]h ]h"]h$]h&]uh1j,hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:556: ./security/landlock/syscalls.chMhj"ubj=)}(hhh]j()}(hvIdentify the structure type pointed to by **rule_attr**: ``LANDLOCK_RULE_PATH_BENEATH`` or ``LANDLOCK_RULE_NET_PORT``.h](h*Identify the structure type pointed to by }(hj#hhhNhNubj )}(h **rule_attr**h]h rule_attr}(hj#hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj#ubh: }(hj#hhhNhNubj)}(h``LANDLOCK_RULE_PATH_BENEATH``h]hLANDLOCK_RULE_PATH_BENEATH}(hj!#hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj#ubh or }(hj#hhhNhNubj)}(h``LANDLOCK_RULE_NET_PORT``h]hLANDLOCK_RULE_NET_PORT}(hj3#hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj#ubh.}(hj#hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:556: ./security/landlock/syscalls.chMhj#ubah}(h]h ]h"]h$]h&]uh1j<hj"ubeh}(h]h ]h"]h$]h&]uh1j&hj#hMhj"ubj')}(hW``const void __user *const rule_attr`` Pointer to a rule (matching the **rule_type**). h](j-)}(h&``const void __user *const rule_attr``h]j)}(hj^#h]h"const void __user *const rule_attr}(hj`#hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj\#ubah}(h]h ]h"]h$]h&]uh1j,hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:556: ./security/landlock/syscalls.chMhjX#ubj=)}(hhh]j()}(h/Pointer to a rule (matching the **rule_type**).h](h Pointer to a rule (matching the }(hjw#hhhNhNubj )}(h **rule_type**h]h rule_type}(hj#hhhNhNubah}(h]h ]h"]h$]h&]uh1j hjw#ubh).}(hjw#hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hjs#hMhjt#ubah}(h]h ]h"]h$]h&]uh1j<hjX#ubeh}(h]h ]h"]h$]h&]uh1j&hjs#hMhj"ubj')}(h!``const __u32 flags`` Must be 0. h](j-)}(h``const __u32 flags``h]j)}(hj#h]hconst __u32 flags}(hj#hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj#ubah}(h]h ]h"]h$]h&]uh1j,hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:556: ./security/landlock/syscalls.chMhj#ubj=)}(hhh]j()}(h Must be 0.h]h Must be 0.}(hj#hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hj#hMhj#ubah}(h]h ]h"]h$]h&]uh1j<hj#ubeh}(h]h ]h"]h$]h&]uh1j&hj#hMhj"ubeh}(h]h ]h"]h$]h&]uh1j!hj"ubj()}(h**Description**h]j )}(hj#h]h Description}(hj#hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj#ubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:556: ./security/landlock/syscalls.chMhj"ubj()}(hPThis system call enables to define a new rule and add it to an existing ruleset.h]hPThis system call enables to define a new rule and add it to an existing ruleset.}(hj#hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:556: ./security/landlock/syscalls.chMhj"ubj )}(hhh](j )}(hN``EOPNOTSUPP``: Landlock is supported by the kernel but disabled at boot time;h]j()}(hj$h](j)}(h``EOPNOTSUPP``h]h EOPNOTSUPP}(hj$hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj$ubh@: Landlock is supported by the kernel but disabled at boot time;}(hj$hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:556: ./security/landlock/syscalls.chMhj $ubah}(h]h ]h"]h$]h&]uh1j hj $ubj )}(hp``EAFNOSUPPORT``: **rule_type** is ``LANDLOCK_RULE_NET_PORT`` but TCP/IP is not supported by the running kernel;h]j()}(hp``EAFNOSUPPORT``: **rule_type** is ``LANDLOCK_RULE_NET_PORT`` but TCP/IP is not supported by the running kernel;h](j)}(h``EAFNOSUPPORT``h]h EAFNOSUPPORT}(hj:$hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj6$ubh: }(hj6$hhhNhNubj )}(h **rule_type**h]h rule_type}(hjL$hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj6$ubh is }(hj6$hhhNhNubj)}(h``LANDLOCK_RULE_NET_PORT``h]hLANDLOCK_RULE_NET_PORT}(hj^$hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj6$ubh3 but TCP/IP is not supported by the running kernel;}(hj6$hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:556: ./security/landlock/syscalls.chMhj2$ubah}(h]h ]h"]h$]h&]uh1j hj $ubj )}(h``EINVAL``: **flags** is not 0;h]j()}(hj$h](j)}(h ``EINVAL``h]hEINVAL}(hj$hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj$ubh: }(hj$hhhNhNubj )}(h **flags**h]hflags}(hj$hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj$ubh is not 0;}(hj$hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:556: ./security/landlock/syscalls.chMhj}$ubah}(h]h ]h"]h$]h&]uh1j hj $ubj )}(hX``EINVAL``: The rule accesses are inconsistent (i.e. :c:type:`landlock_path_beneath_attr.allowed_access ` or :c:type:`landlock_net_port_attr.allowed_access ` is not a subset of the ruleset handled accesses)h]j()}(hX``EINVAL``: The rule accesses are inconsistent (i.e. :c:type:`landlock_path_beneath_attr.allowed_access ` or :c:type:`landlock_net_port_attr.allowed_access ` is not a subset of the ruleset handled accesses)h](j)}(h ``EINVAL``h]hEINVAL}(hj$hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj$ubh+: The rule accesses are inconsistent (i.e. }(hj$hhhNhNubh)}(hP:c:type:`landlock_path_beneath_attr.allowed_access `h]j)}(hj$h]h)landlock_path_beneath_attr.allowed_access}(hj$hhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jhj$ubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnjjjlandlock_path_beneath_attruh1hhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:556: ./security/landlock/syscalls.chMhj$ubh or }(hj$hhhNhNubh)}(hH:c:type:`landlock_net_port_attr.allowed_access `h]j)}(hj$h]h%landlock_net_port_attr.allowed_access}(hj$hhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jhj$ubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnjjjlandlock_net_port_attruh1hhj$hMhj$ubh1 is not a subset of the ruleset handled accesses)}(hj$hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hj$hMhj$ubah}(h]h ]h"]h$]h&]uh1j hj $ubj )}(ha``EINVAL``: :c:type:`landlock_net_port_attr.port ` is greater than 65535;h]j()}(hj$%h](j)}(h ``EINVAL``h]hEINVAL}(hj)%hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj&%ubh: }(hj&%hhhNhNubh)}(h>:c:type:`landlock_net_port_attr.port `h]j)}(hj=%h]hlandlock_net_port_attr.port}(hj?%hhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jhj;%ubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnjjjlandlock_net_port_attruh1hhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:556: ./security/landlock/syscalls.chMhj&%ubh is greater than 65535;}(hj&%hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hjZ%hMhj"%ubah}(h]h ]h"]h$]h&]uh1j hj $ubj )}(hx``ENOMSG``: Empty accesses (e.g. :c:type:`landlock_path_beneath_attr.allowed_access ` is 0);h]j()}(hx``ENOMSG``: Empty accesses (e.g. :c:type:`landlock_path_beneath_attr.allowed_access ` is 0);h](j)}(h ``ENOMSG``h]hENOMSG}(hjs%hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjo%ubh: Empty accesses (e.g. }(hjo%hhhNhNubh)}(hP:c:type:`landlock_path_beneath_attr.allowed_access `h]j)}(hj%h]h)landlock_path_beneath_attr.allowed_access}(hj%hhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jhj%ubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnjjjlandlock_path_beneath_attruh1hhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:556: ./security/landlock/syscalls.chMhjo%ubh is 0);}(hjo%hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hj%hMhjk%ubah}(h]h ]h"]h$]h&]uh1j hj $ubj )}(h``EBADF``: **ruleset_fd** is not a file descriptor for the current thread, or a member of **rule_attr** is not a file descriptor as expected;h]j()}(h``EBADF``: **ruleset_fd** is not a file descriptor for the current thread, or a member of **rule_attr** is not a file descriptor as expected;h](j)}(h ``EBADF``h]hEBADF}(hj%hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj%ubh: }(hj%hhhNhNubj )}(h**ruleset_fd**h]h ruleset_fd}(hj%hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj%ubhA is not a file descriptor for the current thread, or a member of }(hj%hhhNhNubj )}(h **rule_attr**h]h rule_attr}(hj%hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj%ubh& is not a file descriptor as expected;}(hj%hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:556: ./security/landlock/syscalls.chMhj%ubah}(h]h ]h"]h$]h&]uh1j hj $ubj )}(h``EBADFD``: **ruleset_fd** is not a ruleset file descriptor, or a member of **rule_attr** is not the expected file descriptor type;h]j()}(h``EBADFD``: **ruleset_fd** is not a ruleset file descriptor, or a member of **rule_attr** is not the expected file descriptor type;h](j)}(h ``EBADFD``h]hEBADFD}(hj&hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj&ubh: }(hj&hhhNhNubj )}(h**ruleset_fd**h]h ruleset_fd}(hj&hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj&ubh2 is not a ruleset file descriptor, or a member of }(hj&hhhNhNubj )}(h **rule_attr**h]h rule_attr}(hj,&hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj&ubh* is not the expected file descriptor type;}(hj&hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:556: ./security/landlock/syscalls.chMhj&ubah}(h]h ]h"]h$]h&]uh1j hj $ubj )}(hH``EPERM``: **ruleset_fd** has no write access to the underlying ruleset;h]j()}(hjM&h](j)}(h ``EPERM``h]hEPERM}(hjR&hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjO&ubh: }(hjO&hhhNhNubj )}(h**ruleset_fd**h]h ruleset_fd}(hjd&hhhNhNubah}(h]h ]h"]h$]h&]uh1j hjO&ubh/ has no write access to the underlying ruleset;}(hjO&hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:556: ./security/landlock/syscalls.chMhjK&ubah}(h]h ]h"]h$]h&]uh1j hj $ubj )}(h3``EFAULT``: **rule_attr** was not a valid address. h]j()}(h2``EFAULT``: **rule_attr** was not a valid address.h](j)}(h ``EFAULT``h]hEFAULT}(hj&hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj&ubh: }(hj&hhhNhNubj )}(h **rule_attr**h]h rule_attr}(hj&hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj&ubh was not a valid address.}(hj&hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:556: ./security/landlock/syscalls.chMhj&ubah}(h]h ]h"]h$]h&]uh1j hj $ubeh}(h]h ]h"]h$]h&]jjuh1j hj+$hMhj"ubj()}(h **Return**h]j )}(hj&h]hReturn}(hj&hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj&ubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:556: ./security/landlock/syscalls.chMhj"ubj()}(hB0 on success, or -errno on failure. Possible returned errors are:h]hB0 on success, or -errno on failure. Possible returned errors are:}(hj&hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:556: ./security/landlock/syscalls.chMhj"ubeh}(h]h ] kernelindentah"]h$]h&]uh1jwhj= hhhNhNubj;)}(hhh]h}(h]h ]h"]h$]h&]entries](jGlandlock_rule_type (C enum)c.landlock_rule_typehNtauh1j:hj= hhhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:559: ./include/uapi/linux/landlock.hhNubjL)}(hhh](jQ)}(hlandlock_rule_typeh]jW)}(henum landlock_rule_typeh](j)}(hj!h]henum}(hj 'hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj'hhhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:559: ./include/uapi/linux/landlock.hhKubjo)}(h h]h }(hj'hhhNhNubah}(h]h ]j{ah"]h$]h&]uh1jnhj'hhhj'hKubj)}(hlandlock_rule_typeh]j)}(hj'h]hlandlock_rule_type}(hj*'hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj&'ubah}(h]h ](jjeh"]h$]h&]hhuh1jhj'hhhj'hKubeh}(h]h ]h"]h$]h&]hhjBuh1jVjCjDhj'hhhj'hKubah}(h]j&ah ](jHjIeh"]h$]h&]jMjN)jOhuh1jPhj'hKhj&hhubjQ)}(hhh]j()}(hLandlock rule typeh]hLandlock rule type}(hjL'hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:559: ./include/uapi/linux/landlock.hhKhjI'hhubah}(h]h ]h"]h$]h&]uh1jPhj&hhhj'hKubeh}(h]h ](jenumeh"]h$]h&]jqjjrjd'jsjd'jtjujvuh1jKhhhj= hj&hNubjx)}(h**Constants** ``LANDLOCK_RULE_PATH_BENEATH`` Type of a :c:type:`struct landlock_path_beneath_attr ` . ``LANDLOCK_RULE_NET_PORT`` Type of a :c:type:`struct landlock_net_port_attr ` .h](j()}(h **Constants**h]j )}(hjn'h]h Constants}(hjp'hhhNhNubah}(h]h ]h"]h$]h&]uh1j hjl'ubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:559: ./include/uapi/linux/landlock.hhKhjh'ubj")}(hhh](j')}(ht``LANDLOCK_RULE_PATH_BENEATH`` Type of a :c:type:`struct landlock_path_beneath_attr ` . h](j-)}(h``LANDLOCK_RULE_PATH_BENEATH``h]j)}(hj'h]hLANDLOCK_RULE_PATH_BENEATH}(hj'hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj'ubah}(h]h ]h"]h$]h&]uh1j,he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:559: ./include/uapi/linux/landlock.hhKhj'ubj=)}(hhh]j()}(hTType of a :c:type:`struct landlock_path_beneath_attr ` .h](h Type of a }(hj'hhhNhNubh)}(hH:c:type:`struct landlock_path_beneath_attr `h]j)}(hj'h]h!struct landlock_path_beneath_attr}(hj'hhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jhj'ubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnjjjlandlock_path_beneath_attruh1hhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:559: ./include/uapi/linux/landlock.hhKhj'ubh .}(hj'hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hj'hKhj'ubah}(h]h ]h"]h$]h&]uh1j<hj'ubeh}(h]h ]h"]h$]h&]uh1j&hj'hKhj'ubj')}(hg``LANDLOCK_RULE_NET_PORT`` Type of a :c:type:`struct landlock_net_port_attr ` .h](j-)}(h``LANDLOCK_RULE_NET_PORT``h]j)}(hj'h]hLANDLOCK_RULE_NET_PORT}(hj'hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj'ubah}(h]h ]h"]h$]h&]uh1j,he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:559: ./include/uapi/linux/landlock.hhKhj'ubj=)}(hhh]j()}(hLType of a :c:type:`struct landlock_net_port_attr ` .h](h Type of a }(hj(hhhNhNubh)}(h@:c:type:`struct landlock_net_port_attr `h]j)}(hj (h]hstruct landlock_net_port_attr}(hj(hhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jhj (ubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnjjjlandlock_net_port_attruh1hhj'hKhj(ubh .}(hj(hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hj'hKhj(ubah}(h]h ]h"]h$]h&]uh1j<hj'ubeh}(h]h ]h"]h$]h&]uh1j&hj'hKhj'ubeh}(h]h ]h"]h$]h&]uh1j!hjh'ubeh}(h]h ] kernelindentah"]h$]h&]uh1jwhj= hhhj&hNubj()}(h**Description**h]j )}(hjO(h]h Description}(hjQ(hhhNhNubah}(h]h ]h"]h$]h&]uh1j hjM(ubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:559: ./include/uapi/linux/landlock.hhKhj= hhubj()}(h$Argument of sys_landlock_add_rule().h]h$Argument of sys_landlock_add_rule().}(hje(hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:559: ./include/uapi/linux/landlock.hhKhj= hhubj;)}(hhh]h}(h]h ]h"]h$]h&]entries](jG%landlock_path_beneath_attr (C struct)c.landlock_path_beneath_attrhNtauh1j:hj= hhhj&hNubjL)}(hhh](jQ)}(hlandlock_path_beneath_attrh]jW)}(h!struct landlock_path_beneath_attrh](j)}(hjh]hstruct}(hj(hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj(hhhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:559: ./include/uapi/linux/landlock.hhKubjo)}(h h]h }(hj(hhhNhNubah}(h]h ]j{ah"]h$]h&]uh1jnhj(hhhj(hKubj)}(hlandlock_path_beneath_attrh]j)}(hj(h]hlandlock_path_beneath_attr}(hj(hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj(ubah}(h]h ](jjeh"]h$]h&]hhuh1jhj(hhhj(hKubeh}(h]h ]h"]h$]h&]hhjBuh1jVjCjDhj(hhhj(hKubah}(h]j(ah ](jHjIeh"]h$]h&]jMjN)jOhuh1jPhj(hKhj(hhubjQ)}(hhh]j()}(hPath hierarchy definitionh]hPath hierarchy definition}(hj(hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:559: ./include/uapi/linux/landlock.hhKhj(hhubah}(h]h ]h"]h$]h&]uh1jPhj(hhhj(hKubeh}(h]h ](jstructeh"]h$]h&]jqjjrj(jsj(jtjujvuh1jKhhhj= hj&hNubjx)}(hXv**Definition**:: struct landlock_path_beneath_attr { __u64 allowed_access; __s32 parent_fd; }; **Members** ``allowed_access`` Bitmask of allowed actions for this file hierarchy (cf. `Filesystem flags`_). ``parent_fd`` File descriptor, preferably opened with ``O_PATH``, which identifies the parent directory of a file hierarchy, or just a file.h](j()}(h**Definition**::h](j )}(h**Definition**h]h Definition}(hj(hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj(ubh:}(hj(hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:559: ./include/uapi/linux/landlock.hhKhj(ubj)}(hUstruct landlock_path_beneath_attr { __u64 allowed_access; __s32 parent_fd; };h]hUstruct landlock_path_beneath_attr { __u64 allowed_access; __s32 parent_fd; };}hj )sbah}(h]h ]h"]h$]h&]hhuh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:559: ./include/uapi/linux/landlock.hhKhj(ubj()}(h **Members**h]j )}(hj)h]hMembers}(hj)hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj)ubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:559: ./include/uapi/linux/landlock.hhKhj(ubj")}(hhh](j')}(ha``allowed_access`` Bitmask of allowed actions for this file hierarchy (cf. `Filesystem flags`_). h](j-)}(h``allowed_access``h]j)}(hj<)h]hallowed_access}(hj>)hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj:)ubah}(h]h ]h"]h$]h&]uh1j,he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:559: ./include/uapi/linux/landlock.hhKhj6)ubj=)}(hhh]j()}(hMBitmask of allowed actions for this file hierarchy (cf. `Filesystem flags`_).h](h8Bitmask of allowed actions for this file hierarchy (cf. }(hjU)hhhNhNubj)}(h`Filesystem flags`_h]hFilesystem flags}(hj])hhhNhNubah}(h]h ]h"]h$]h&]nameFilesystem flagsjjuh1jhjU)jKubh).}(hjU)hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:559: ./include/uapi/linux/landlock.hhKhjR)ubah}(h]h ]h"]h$]h&]uh1j<hj6)ubeh}(h]h ]h"]h$]h&]uh1j&hjQ)hKhj3)ubj')}(h``parent_fd`` File descriptor, preferably opened with ``O_PATH``, which identifies the parent directory of a file hierarchy, or just a file.h](j-)}(h ``parent_fd``h]j)}(hj)h]h parent_fd}(hj)hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj)ubah}(h]h ]h"]h$]h&]uh1j,he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:559: ./include/uapi/linux/landlock.hhKhj)ubj=)}(hhh]j()}(h~File descriptor, preferably opened with ``O_PATH``, which identifies the parent directory of a file hierarchy, or just a file.h](h(File descriptor, preferably opened with }(hj)hhhNhNubj)}(h ``O_PATH``h]hO_PATH}(hj)hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj)ubhL, which identifies the parent directory of a file hierarchy, or just a file.}(hj)hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:559: ./include/uapi/linux/landlock.hhKhj)ubah}(h]h ]h"]h$]h&]uh1j<hj)ubeh}(h]h ]h"]h$]h&]uh1j&hj)hKhj3)ubeh}(h]h ]h"]h$]h&]uh1j!hj(ubeh}(h]h ] kernelindentah"]h$]h&]uh1jwhj= hhhj&hNubj()}(h**Description**h]j )}(hj)h]h Description}(hj)hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj)ubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:559: ./include/uapi/linux/landlock.hhKhj= hhubj()}(h$Argument of sys_landlock_add_rule().h]h$Argument of sys_landlock_add_rule().}(hj)hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:559: ./include/uapi/linux/landlock.hhKhj= hhubj;)}(hhh]h}(h]h ]h"]h$]h&]entries](jG!landlock_net_port_attr (C struct)c.landlock_net_port_attrhNtauh1j:hj= hhhj&hNubjL)}(hhh](jQ)}(hlandlock_net_port_attrh]jW)}(hstruct landlock_net_port_attrh](j)}(hjh]hstruct}(hj*hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj*hhhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:559: ./include/uapi/linux/landlock.hhKubjo)}(h h]h }(hj+*hhhNhNubah}(h]h ]j{ah"]h$]h&]uh1jnhj*hhhj**hKubj)}(hlandlock_net_port_attrh]j)}(hj*h]hlandlock_net_port_attr}(hj=*hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj9*ubah}(h]h ](jjeh"]h$]h&]hhuh1jhj*hhhj**hKubeh}(h]h ]h"]h$]h&]hhjBuh1jVjCjDhj*hhhj**hKubah}(h]j*ah ](jHjIeh"]h$]h&]jMjN)jOhuh1jPhj**hKhj*hhubjQ)}(hhh]j()}(hNetwork port definitionh]hNetwork port definition}(hj_*hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:559: ./include/uapi/linux/landlock.hhKhj\*hhubah}(h]h ]h"]h$]h&]uh1jPhj*hhhj**hKubeh}(h]h ](jstructeh"]h$]h&]jqjjrjw*jsjw*jtjujvuh1jKhhhj= hj&hNubjx)}(hX**Definition**:: struct landlock_net_port_attr { __u64 allowed_access; __u64 port; }; **Members** ``allowed_access`` Bitmask of allowed network actions for a port (cf. `Network flags`_). ``port`` Network port in host endianness. It should be noted that port 0 passed to :manpage:`bind(2)` will bind to an available port from the ephemeral port range. This can be configured with the ``/proc/sys/net/ipv4/ip_local_port_range`` sysctl (also used for IPv6), and within that range, on a per-socket basis with ``setsockopt(IP_LOCAL_PORT_RANGE)``. A Landlock rule with port 0 and the ``LANDLOCK_ACCESS_NET_BIND_TCP`` right means that requesting to bind on port 0 is allowed and it will automatically translate to binding on a kernel-assigned ephemeral port.h](j()}(h**Definition**::h](j )}(h**Definition**h]h Definition}(hj*hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj*ubh:}(hj*hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:559: ./include/uapi/linux/landlock.hhKhj{*ubj)}(hLstruct landlock_net_port_attr { __u64 allowed_access; __u64 port; };h]hLstruct landlock_net_port_attr { __u64 allowed_access; __u64 port; };}hj*sbah}(h]h ]h"]h$]h&]hhuh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:559: ./include/uapi/linux/landlock.hhKhj{*ubj()}(h **Members**h]j )}(hj*h]hMembers}(hj*hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj*ubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:559: ./include/uapi/linux/landlock.hhKhj{*ubj")}(hhh](j')}(hY``allowed_access`` Bitmask of allowed network actions for a port (cf. `Network flags`_). h](j-)}(h``allowed_access``h]j)}(hj*h]hallowed_access}(hj*hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj*ubah}(h]h ]h"]h$]h&]uh1j,he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:559: ./include/uapi/linux/landlock.hhKhj*ubj=)}(hhh]j()}(hEBitmask of allowed network actions for a port (cf. `Network flags`_).h](h3Bitmask of allowed network actions for a port (cf. }(hj*hhhNhNubj)}(h`Network flags`_h]h Network flags}(hj*hhhNhNubah}(h]h ]h"]h$]h&]name Network flagsjj~uh1jhj*jKubh).}(hj*hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:559: ./include/uapi/linux/landlock.hhKhj*ubah}(h]h ]h"]h$]h&]uh1j<hj*ubeh}(h]h ]h"]h$]h&]uh1j&hj*hKhj*ubj')}(hX7``port`` Network port in host endianness. It should be noted that port 0 passed to :manpage:`bind(2)` will bind to an available port from the ephemeral port range. This can be configured with the ``/proc/sys/net/ipv4/ip_local_port_range`` sysctl (also used for IPv6), and within that range, on a per-socket basis with ``setsockopt(IP_LOCAL_PORT_RANGE)``. A Landlock rule with port 0 and the ``LANDLOCK_ACCESS_NET_BIND_TCP`` right means that requesting to bind on port 0 is allowed and it will automatically translate to binding on a kernel-assigned ephemeral port.h](j-)}(h``port``h]j)}(hj+h]hport}(hj+hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj+ubah}(h]h ]h"]h$]h&]uh1j,he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:559: ./include/uapi/linux/landlock.hhKhj+ubj=)}(hhh](j()}(h Network port in host endianness.h]h Network port in host endianness.}(hj3+hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:559: ./include/uapi/linux/landlock.hhKhj0+ubj()}(hX9It should be noted that port 0 passed to :manpage:`bind(2)` will bind to an available port from the ephemeral port range. This can be configured with the ``/proc/sys/net/ipv4/ip_local_port_range`` sysctl (also used for IPv6), and within that range, on a per-socket basis with ``setsockopt(IP_LOCAL_PORT_RANGE)``.h](h)It should be noted that port 0 passed to }(hjB+hhhNhNubj)}(h:manpage:`bind(2)`h]hbind(2)}(hjJ+hhhNhNubah}(h]h ]jah"]h$]h&]hhj bind(2)j"bindj$j%uh1jhjB+ubh` will bind to an available port from the ephemeral port range. This can be configured with the }(hjB+hhhNhNubj)}(h*``/proc/sys/net/ipv4/ip_local_port_range``h]h&/proc/sys/net/ipv4/ip_local_port_range}(hj^+hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjB+ubhP sysctl (also used for IPv6), and within that range, on a per-socket basis with }(hjB+hhhNhNubj)}(h#``setsockopt(IP_LOCAL_PORT_RANGE)``h]hsetsockopt(IP_LOCAL_PORT_RANGE)}(hjp+hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjB+ubh.}(hjB+hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:559: ./include/uapi/linux/landlock.hhKhj0+ubj()}(hA Landlock rule with port 0 and the ``LANDLOCK_ACCESS_NET_BIND_TCP`` right means that requesting to bind on port 0 is allowed and it will automatically translate to binding on a kernel-assigned ephemeral port.h](h$A Landlock rule with port 0 and the }(hj+hhhNhNubj)}(h ``LANDLOCK_ACCESS_NET_BIND_TCP``h]hLANDLOCK_ACCESS_NET_BIND_TCP}(hj+hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj+ubh right means that requesting to bind on port 0 is allowed and it will automatically translate to binding on a kernel-assigned ephemeral port.}(hj+hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:559: ./include/uapi/linux/landlock.hhKhj0+ubeh}(h]h ]h"]h$]h&]uh1j<hj+ubeh}(h]h ]h"]h$]h&]uh1j&hj/+hKhj*ubeh}(h]h ]h"]h$]h&]uh1j!hj{*ubeh}(h]h ] kernelindentah"]h$]h&]uh1jwhj= hhhj&hNubj()}(h**Description**h]j )}(hj+h]h Description}(hj+hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj+ubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:559: ./include/uapi/linux/landlock.hhKhj= hhubj()}(h$Argument of sys_landlock_add_rule().h]h$Argument of sys_landlock_add_rule().}(hj+hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:559: ./include/uapi/linux/landlock.hhKhj= hhubeh}(h]extending-a-rulesetah ]h"]extending a rulesetah$]h&]uh1hhj hhhhhM*ubh)}(hhh](h)}(hEnforcing a ruleseth]hEnforcing a ruleset}(hj+hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj+hhhhhM4ubj;)}(hhh]h}(h]h ]h"]h$]h&]entries](jG'sys_landlock_restrict_self (C function)c.sys_landlock_restrict_selfhNtauh1j:hj+hhhNhNubjL)}(hhh](jQ)}(hIlong sys_landlock_restrict_self (const int ruleset_fd, const __u32 flags)h]jW)}(hHlong sys_landlock_restrict_self(const int ruleset_fd, const __u32 flags)h](j])}(hlongh]hlong}(hj,hhhNhNubah}(h]h ]jiah"]h$]h&]uh1j\hj,hhhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:566: ./security/landlock/syscalls.chMubjo)}(h h]h }(hj+,hhhNhNubah}(h]h ]j{ah"]h$]h&]uh1jnhj,hhhj*,hMubj)}(hsys_landlock_restrict_selfMh]j)}(hsys_landlock_restrict_selfh]hsys_landlock_restrict_self}(hj=,hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj9,ubah}(h]h ](jjeh"]h$]h&]hhuh1jhj,hhhj*,hMubj)}(h)(const int ruleset_fd, const __u32 flags)h](j)}(hconst int ruleset_fdh](j)}(hjh]hconst}(hjY,hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjU,ubjo)}(h h]h }(hjf,hhhNhNubah}(h]h ]j{ah"]h$]h&]uh1jnhjU,ubj])}(hinth]hint}(hjt,hhhNhNubah}(h]h ]jiah"]h$]h&]uh1j\hjU,ubjo)}(h h]h }(hj,hhhNhNubah}(h]h ]j{ah"]h$]h&]uh1jnhjU,ubj)}(h ruleset_fdh]h ruleset_fd}(hj,hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjU,ubeh}(h]h ]h"]h$]h&]noemphhhuh1jhjQ,ubj)}(hconst __u32 flagsh](j)}(hjh]hconst}(hj,hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj,ubjo)}(h h]h }(hj,hhhNhNubah}(h]h ]j{ah"]h$]h&]uh1jnhj,ubh)}(hhh]j)}(h__u32h]h__u32}(hj,hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj,ubah}(h]h ]h"]h$]h&] refdomainjreftypej reftargetj,modnameN classnameNjj)}j]j )}jj?,sbc.sys_landlock_restrict_selfasbuh1hhj,ubjo)}(h h]h }(hj,hhhNhNubah}(h]h ]j{ah"]h$]h&]uh1jnhj,ubj)}(hflagsh]hflags}(hj,hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj,ubeh}(h]h ]h"]h$]h&]noemphhhuh1jhjQ,ubeh}(h]h ]h"]h$]h&]hhuh1jhj,hhhj*,hMubeh}(h]h ]h"]h$]h&]hhjBuh1jVjCjDhj,hhhj*,hMubah}(h]j,ah ](jHjIeh"]h$]h&]jMjN)jOhuh1jPhj*,hMhj,hhubjQ)}(hhh]j()}(h'Enforce a ruleset on the calling threadh]h'Enforce a ruleset on the calling thread}(hj-hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:566: ./security/landlock/syscalls.chMhj-hhubah}(h]h ]h"]h$]h&]uh1jPhj,hhhj*,hMubeh}(h]h ](jfunctioneh"]h$]h&]jqjjrj7-jsj7-jtjujvuh1jKhhhj+hNhNubjx)}(hX`**Parameters** ``const int ruleset_fd`` File descriptor tied to the ruleset to merge with the target. ``const __u32 flags`` Supported values: **Description** - ``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF`` - ``LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON`` - ``LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF`` - ``LANDLOCK_RESTRICT_SELF_TSYNC`` This system call enforces a Landlock ruleset on the current thread. Enforcing a ruleset requires that the task has ``CAP_SYS_ADMIN`` in its namespace or is running with no_new_privs. This avoids scenarios where unprivileged tasks can affect the behavior of privileged children. - ``EOPNOTSUPP``: Landlock is supported by the kernel but disabled at boot time; - ``EINVAL``: **flags** contains an unknown bit. - ``EBADF``: **ruleset_fd** is not a file descriptor for the current thread; - ``EBADFD``: **ruleset_fd** is not a ruleset file descriptor; - ``EPERM``: **ruleset_fd** has no read access to the underlying ruleset, or the current thread is not running with no_new_privs, or it doesn't have ``CAP_SYS_ADMIN`` in its namespace. - ``E2BIG``: The maximum number of stacked rulesets is reached for the current thread. .. kernel-doc:: include/uapi/linux/landlock.h :identifiers: landlock_restrict_self_flags **Return** 0 on success, or -errno on failure. Possible returned errors are:h](j()}(h**Parameters**h]j )}(hjA-h]h Parameters}(hjC-hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj?-ubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:566: ./security/landlock/syscalls.chMhj;-ubj")}(hhh](j')}(hW``const int ruleset_fd`` File descriptor tied to the ruleset to merge with the target. h](j-)}(h``const int ruleset_fd``h]j)}(hj`-h]hconst int ruleset_fd}(hjb-hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj^-ubah}(h]h ]h"]h$]h&]uh1j,hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:566: ./security/landlock/syscalls.chMhjZ-ubj=)}(hhh]j()}(h=File descriptor tied to the ruleset to merge with the target.h]h=File descriptor tied to the ruleset to merge with the target.}(hjy-hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hju-hMhjv-ubah}(h]h ]h"]h$]h&]uh1j<hjZ-ubeh}(h]h ]h"]h$]h&]uh1j&hju-hMhjW-ubj')}(h(``const __u32 flags`` Supported values: h](j-)}(h``const __u32 flags``h]j)}(hj-h]hconst __u32 flags}(hj-hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj-ubah}(h]h ]h"]h$]h&]uh1j,hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:566: ./security/landlock/syscalls.chMhj-ubj=)}(hhh]j()}(hSupported values:h]hSupported values:}(hj-hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hj-hMhj-ubah}(h]h ]h"]h$]h&]uh1j<hj-ubeh}(h]h ]h"]h$]h&]uh1j&hj-hMhjW-ubeh}(h]h ]h"]h$]h&]uh1j!hj;-ubj()}(h**Description**h]j )}(hj-h]h Description}(hj-hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj-ubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:566: ./security/landlock/syscalls.chMhj;-ubj)}(h- ``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF`` - ``LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON`` - ``LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF`` - ``LANDLOCK_RESTRICT_SELF_TSYNC`` h]j )}(hhh](j )}(h,``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF``h]j()}(hj-h]j)}(hj-h]h(LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF}(hj-hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj-ubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:566: ./security/landlock/syscalls.chMhj-ubah}(h]h ]h"]h$]h&]uh1j hj-ubj )}(h*``LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON``h]j()}(hj.h]j)}(hj.h]h&LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON}(hj.hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj.ubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:566: ./security/landlock/syscalls.chMhj.ubah}(h]h ]h"]h$]h&]uh1j hj-ubj )}(h-``LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF``h]j()}(hj5.h]j)}(hj5.h]h)LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF}(hj:.hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj7.ubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:566: ./security/landlock/syscalls.chMhj3.ubah}(h]h ]h"]h$]h&]uh1j hj-ubj )}(h!``LANDLOCK_RESTRICT_SELF_TSYNC`` h]j()}(h ``LANDLOCK_RESTRICT_SELF_TSYNC``h]j)}(hjZ.h]hLANDLOCK_RESTRICT_SELF_TSYNC}(hj\.hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjX.ubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:566: ./security/landlock/syscalls.chMhjT.ubah}(h]h ]h"]h$]h&]uh1j hj-ubeh}(h]h ]h"]h$]h&]jjuh1j hj .hMhj-ubah}(h]h ]h"]h$]h&]uh1jhj .hMhj;-ubj()}(hXThis system call enforces a Landlock ruleset on the current thread. Enforcing a ruleset requires that the task has ``CAP_SYS_ADMIN`` in its namespace or is running with no_new_privs. This avoids scenarios where unprivileged tasks can affect the behavior of privileged children.h](hsThis system call enforces a Landlock ruleset on the current thread. Enforcing a ruleset requires that the task has }(hj.hhhNhNubj)}(h``CAP_SYS_ADMIN``h]h CAP_SYS_ADMIN}(hj.hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj.ubh in its namespace or is running with no_new_privs. This avoids scenarios where unprivileged tasks can affect the behavior of privileged children.}(hj.hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:566: ./security/landlock/syscalls.chMhj;-ubj )}(hhh](j )}(hN``EOPNOTSUPP``: Landlock is supported by the kernel but disabled at boot time;h]j()}(hj.h](j)}(h``EOPNOTSUPP``h]h EOPNOTSUPP}(hj.hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj.ubh@: Landlock is supported by the kernel but disabled at boot time;}(hj.hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:566: ./security/landlock/syscalls.chMhj.ubah}(h]h ]h"]h$]h&]uh1j hj.ubj )}(h.``EINVAL``: **flags** contains an unknown bit.h]j()}(hj.h](j)}(h ``EINVAL``h]hEINVAL}(hj.hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj.ubh: }(hj.hhhNhNubj )}(h **flags**h]hflags}(hj.hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj.ubh contains an unknown bit.}(hj.hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:566: ./security/landlock/syscalls.chMhj.ubah}(h]h ]h"]h$]h&]uh1j hj.ubj )}(hJ``EBADF``: **ruleset_fd** is not a file descriptor for the current thread;h]j()}(hj/h](j)}(h ``EBADF``h]hEBADF}(hj /hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj/ubh: }(hj/hhhNhNubj )}(h**ruleset_fd**h]h ruleset_fd}(hj/hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj/ubh1 is not a file descriptor for the current thread;}(hj/hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:566: ./security/landlock/syscalls.chMhj/ubah}(h]h ]h"]h$]h&]uh1j hj.ubj )}(h<``EBADFD``: **ruleset_fd** is not a ruleset file descriptor;h]j()}(hj>/h](j)}(h ``EBADFD``h]hEBADFD}(hjC/hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj@/ubh: }(hj@/hhhNhNubj )}(h**ruleset_fd**h]h ruleset_fd}(hjU/hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj@/ubh" is not a ruleset file descriptor;}(hj@/hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:566: ./security/landlock/syscalls.chMhj/fd/*``, cannot currently be explicitly restricted. Likewise, some special kernel filesystems such as nsfs, which can be accessed through ``/proc//ns/*``, cannot currently be explicitly restricted. However, thanks to the `ptrace restrictions`_, access to such sensitive ``/proc`` files are automatically restricted according to domain hierarchies. Future Landlock evolutions could still enable to explicitly restrict such paths with dedicated ruleset flags.h](hAccess to regular files and directories can be restricted by Landlock, according to the handled accesses of a ruleset. However, files that do not come from a user-visible filesystem (e.g. pipe, socket), but can still be accessed through }(hj2hhhNhNubj)}(h``/proc//fd/*``h]h/proc//fd/*}(hj2hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj2ubh, cannot currently be explicitly restricted. Likewise, some special kernel filesystems such as nsfs, which can be accessed through }(hj2hhhNhNubj)}(h``/proc//ns/*``h]h/proc//ns/*}(hj2hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj2ubhE, cannot currently be explicitly restricted. However, thanks to the }(hj2hhhNhNubj)}(h`ptrace restrictions`_h]hptrace restrictions}(hj2hhhNhNubah}(h]h ]h"]h$]h&]nameptrace restrictionsjjuh1jhj2jKubh, access to such sensitive }(hj2hhhNhNubj)}(h ``/proc``h]h/proc}(hj2hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj2ubh files are automatically restricted according to domain hierarchies. Future Landlock evolutions could still enable to explicitly restrict such paths with dedicated ruleset flags.}(hj2hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMFhj2hhubeh}(h]special-filesystemsah ]h"]special filesystemsah$]h&]uh1hhj 2hhhhhMDubh)}(hhh](h)}(hRuleset layersh]hRuleset layers}(hj3hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj3hhhhhMRubj()}(hXThere is a limit of 16 layers of stacked rulesets. This can be an issue for a task willing to enforce a new ruleset in complement to its 16 inherited rulesets. Once this limit is reached, sys_landlock_restrict_self() returns E2BIG. It is then strongly suggested to carefully build rulesets once in the life of a thread, especially for applications able to launch other applications that may also want to sandbox themselves (e.g. shells, container managers, etc.).h]hXThere is a limit of 16 layers of stacked rulesets. This can be an issue for a task willing to enforce a new ruleset in complement to its 16 inherited rulesets. Once this limit is reached, sys_landlock_restrict_self() returns E2BIG. It is then strongly suggested to carefully build rulesets once in the life of a thread, especially for applications able to launch other applications that may also want to sandbox themselves (e.g. shells, container managers, etc.).}(hj3hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMThj3hhubeh}(h]ruleset-layersah ]h"]ruleset layersah$]h&]uh1hhj 2hhhhhMRubh)}(hhh](h)}(h Memory usageh]h Memory usage}(hj/3hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj,3hhhhhM]ubj()}(hKernel memory allocated to create rulesets is accounted and can be restricted by the Documentation/admin-guide/cgroup-v1/memory.rst.h]hKernel memory allocated to create rulesets is accounted and can be restricted by the Documentation/admin-guide/cgroup-v1/memory.rst.}(hj=3hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhM_hj,3hhubeh}(h] memory-usageah ]h"] memory usageah$]h&]uh1hhj 2hhhhhM]ubh)}(hhh](h)}(h IOCTL supporth]h IOCTL support}(hjV3hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjS3hhhhhMcubj()}(hThe ``LANDLOCK_ACCESS_FS_IOCTL_DEV`` right restricts the use of :manpage:`ioctl(2)`, but it only applies to *newly opened* device files. This means specifically that pre-existing file descriptors like stdin, stdout and stderr are unaffected.h](hThe }(hjd3hhhNhNubj)}(h ``LANDLOCK_ACCESS_FS_IOCTL_DEV``h]hLANDLOCK_ACCESS_FS_IOCTL_DEV}(hjl3hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjd3ubh right restricts the use of }(hjd3hhhNhNubj)}(h:manpage:`ioctl(2)`h]hioctl(2)}(hj~3hhhNhNubah}(h]h ]jah"]h$]h&]hhj ioctl(2)j"ioctlj$j%uh1jhjd3ubh, but it only applies to }(hjd3hhhNhNubj)}(h*newly opened*h]h newly opened}(hj3hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjd3ubhx device files. This means specifically that pre-existing file descriptors like stdin, stdout and stderr are unaffected.}(hjd3hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMehjS3hhubj()}(hXUsers should be aware that TTY devices have traditionally permitted to control other processes on the same TTY through the ``TIOCSTI`` and ``TIOCLINUX`` IOCTL commands. Both of these require ``CAP_SYS_ADMIN`` on modern Linux systems, but the behavior is configurable for ``TIOCSTI``.h](h{Users should be aware that TTY devices have traditionally permitted to control other processes on the same TTY through the }(hj3hhhNhNubj)}(h ``TIOCSTI``h]hTIOCSTI}(hj3hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj3ubh and }(hj3hhhNhNubj)}(h ``TIOCLINUX``h]h TIOCLINUX}(hj3hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj3ubh( IOCTL commands. Both of these require }(hj3hhhNhNubj)}(h``CAP_SYS_ADMIN``h]h CAP_SYS_ADMIN}(hj3hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj3ubh? on modern Linux systems, but the behavior is configurable for }(hj3hhhNhNubj)}(h ``TIOCSTI``h]hTIOCSTI}(hj3hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj3ubh.}(hj3hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMjhjS3hhubj()}(hOn older systems, it is therefore recommended to close inherited TTY file descriptors, or to reopen them from ``/proc/self/fd/*`` without the ``LANDLOCK_ACCESS_FS_IOCTL_DEV`` right, if possible.h](hnOn older systems, it is therefore recommended to close inherited TTY file descriptors, or to reopen them from }(hj4hhhNhNubj)}(h``/proc/self/fd/*``h]h/proc/self/fd/*}(hj4hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj4ubh without the }(hj4hhhNhNubj)}(h ``LANDLOCK_ACCESS_FS_IOCTL_DEV``h]hLANDLOCK_ACCESS_FS_IOCTL_DEV}(hj4hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj4ubh right, if possible.}(hj4hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMohjS3hhubj()}(hX1Landlock's IOCTL support is coarse-grained at the moment, but may become more fine-grained in the future. Until then, users are advised to establish the guarantees that they need through the file hierarchy, by only allowing the ``LANDLOCK_ACCESS_FS_IOCTL_DEV`` right on files where it is really required.h](hLandlock’s IOCTL support is coarse-grained at the moment, but may become more fine-grained in the future. Until then, users are advised to establish the guarantees that they need through the file hierarchy, by only allowing the }(hj24hhhNhNubj)}(h ``LANDLOCK_ACCESS_FS_IOCTL_DEV``h]hLANDLOCK_ACCESS_FS_IOCTL_DEV}(hj:4hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj24ubh, right on files where it is really required.}(hj24hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMshjS3hhubeh}(h] ioctl-supportah ]h"] ioctl supportah$]h&]uh1hhj 2hhhhhMcubeh}(h]current-limitationsah ]h"]current limitationsah$]h&]uh1hhhhhhhhM:ubh)}(hhh](h)}(hPrevious limitationsh]hPrevious limitations}(hje4hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjb4hhhhhMyubh)}(hhh](h)}(h#File renaming and linking (ABI < 2)h]h#File renaming and linking (ABI < 2)}(hjv4hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjs4hhhhhM|ubj()}(hXBecause Landlock targets unprivileged access controls, it needs to properly handle composition of rules. Such property also implies rules nesting. Properly handling multiple layers of rulesets, each one of them able to restrict access to files, also implies inheritance of the ruleset restrictions from a parent to its hierarchy. Because files are identified and restricted by their hierarchy, moving or linking a file from one directory to another implies propagation of the hierarchy constraints, or restriction of these actions according to the potentially lost constraints. To protect against privilege escalations through renaming or linking, and for the sake of simplicity, Landlock previously limited linking and renaming to the same directory. Starting with the Landlock ABI version 2, it is now possible to securely control renaming and linking thanks to the new ``LANDLOCK_ACCESS_FS_REFER`` access right.h](hXkBecause Landlock targets unprivileged access controls, it needs to properly handle composition of rules. Such property also implies rules nesting. Properly handling multiple layers of rulesets, each one of them able to restrict access to files, also implies inheritance of the ruleset restrictions from a parent to its hierarchy. Because files are identified and restricted by their hierarchy, moving or linking a file from one directory to another implies propagation of the hierarchy constraints, or restriction of these actions according to the potentially lost constraints. To protect against privilege escalations through renaming or linking, and for the sake of simplicity, Landlock previously limited linking and renaming to the same directory. Starting with the Landlock ABI version 2, it is now possible to securely control renaming and linking thanks to the new }(hj4hhhNhNubj)}(h``LANDLOCK_ACCESS_FS_REFER``h]hLANDLOCK_ACCESS_FS_REFER}(hj4hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj4ubh access right.}(hj4hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhM~hjs4hhubeh}(h]file-renaming-and-linking-abi-2ah ]h"]#file renaming and linking (abi < 2)ah$]h&]uh1hhjb4hhhhhM|ubh)}(hhh](h)}(hFile truncation (ABI < 3)h]hFile truncation (ABI < 3)}(hj4hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj4hhhhhMubj()}(hFile truncation could not be denied before the third Landlock ABI, so it is always allowed when using a kernel that only supports the first or second ABI.h]hFile truncation could not be denied before the third Landlock ABI, so it is always allowed when using a kernel that only supports the first or second ABI.}(hj4hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMhj4hhubj()}(hStarting with the Landlock ABI version 3, it is now possible to securely control truncation thanks to the new ``LANDLOCK_ACCESS_FS_TRUNCATE`` access right.h](hnStarting with the Landlock ABI version 3, it is now possible to securely control truncation thanks to the new }(hj4hhhNhNubj)}(h``LANDLOCK_ACCESS_FS_TRUNCATE``h]hLANDLOCK_ACCESS_FS_TRUNCATE}(hj4hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj4ubh access right.}(hj4hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhj4hhubeh}(h]file-truncation-abi-3ah ]h"]file truncation (abi < 3)ah$]h&]uh1hhjb4hhhhhMubh)}(hhh](h)}(hTCP bind and connect (ABI < 4)h]hTCP bind and connect (ABI < 4)}(hj4hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj4hhhhhMubj()}(hStarting with the Landlock ABI version 4, it is now possible to restrict TCP bind and connect actions to only a set of allowed ports thanks to the new ``LANDLOCK_ACCESS_NET_BIND_TCP`` and ``LANDLOCK_ACCESS_NET_CONNECT_TCP`` access rights.h](hStarting with the Landlock ABI version 4, it is now possible to restrict TCP bind and connect actions to only a set of allowed ports thanks to the new }(hj5hhhNhNubj)}(h ``LANDLOCK_ACCESS_NET_BIND_TCP``h]hLANDLOCK_ACCESS_NET_BIND_TCP}(hj 5hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj5ubh and }(hj5hhhNhNubj)}(h#``LANDLOCK_ACCESS_NET_CONNECT_TCP``h]hLANDLOCK_ACCESS_NET_CONNECT_TCP}(hj5hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj5ubh access rights.}(hj5hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhj4hhubeh}(h]tcp-bind-and-connect-abi-4ah ]h"]tcp bind and connect (abi < 4)ah$]h&]uh1hhjb4hhhhhMubh)}(hhh](h)}(hDevice IOCTL (ABI < 5)h]hDevice IOCTL (ABI < 5)}(hjA5hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj>5hhhhhMubj()}(hIOCTL operations could not be denied before the fifth Landlock ABI, so :manpage:`ioctl(2)` is always allowed when using a kernel that only supports an earlier ABI.h](hGIOCTL operations could not be denied before the fifth Landlock ABI, so }(hjO5hhhNhNubj)}(h:manpage:`ioctl(2)`h]hioctl(2)}(hjW5hhhNhNubah}(h]h ]jah"]h$]h&]hhj ioctl(2)j"ioctlj$j%uh1jhjO5ubhI is always allowed when using a kernel that only supports an earlier ABI.}(hjO5hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhj>5hhubj()}(hStarting with the Landlock ABI version 5, it is possible to restrict the use of :manpage:`ioctl(2)` on character and block devices using the new ``LANDLOCK_ACCESS_FS_IOCTL_DEV`` right.h](hPStarting with the Landlock ABI version 5, it is possible to restrict the use of }(hjq5hhhNhNubj)}(h:manpage:`ioctl(2)`h]hioctl(2)}(hjy5hhhNhNubah}(h]h ]jah"]h$]h&]hhj ioctl(2)j"ioctlj$j%uh1jhjq5ubh. on character and block devices using the new }(hjq5hhhNhNubj)}(h ``LANDLOCK_ACCESS_FS_IOCTL_DEV``h]hLANDLOCK_ACCESS_FS_IOCTL_DEV}(hj5hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjq5ubh right.}(hjq5hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhj>5hhubeh}(h]device-ioctl-abi-5ah ]h"]device ioctl (abi < 5)ah$]h&]uh1hhjb4hhhhhMubh)}(hhh](h)}(hAbstract UNIX socket (ABI < 6)h]hAbstract UNIX socket (ABI < 6)}(hj5hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj5hhhhhMubj()}(hStarting with the Landlock ABI version 6, it is possible to restrict connections to an abstract :manpage:`unix(7)` socket by setting ``LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET`` to the ``scoped`` ruleset attribute.h](h`Starting with the Landlock ABI version 6, it is possible to restrict connections to an abstract }(hj5hhhNhNubj)}(h:manpage:`unix(7)`h]hunix(7)}(hj5hhhNhNubah}(h]h ]jah"]h$]h&]hhj unix(7)j"unixj$j:uh1jhj5ubh socket by setting }(hj5hhhNhNubj)}(h'``LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET``h]h#LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET}(hj5hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj5ubh to the }(hj5hhhNhNubj)}(h ``scoped``h]hscoped}(hj5hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj5ubh ruleset attribute.}(hj5hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhj5hhubeh}(h]abstract-unix-socket-abi-6ah ]h"]abstract unix socket (abi < 6)ah$]h&]uh1hhjb4hhhhhMubh)}(hhh](h)}(hSignal (ABI < 6)h]hSignal (ABI < 6)}(hj6hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj 6hhhhhMubj()}(hStarting with the Landlock ABI version 6, it is possible to restrict :manpage:`signal(7)` sending by setting ``LANDLOCK_SCOPE_SIGNAL`` to the ``scoped`` ruleset attribute.h](hEStarting with the Landlock ABI version 6, it is possible to restrict }(hj6hhhNhNubj)}(h:manpage:`signal(7)`h]h signal(7)}(hj%6hhhNhNubah}(h]h ]jah"]h$]h&]hhj  signal(7)j"signalj$j:uh1jhj6ubh sending by setting }(hj6hhhNhNubj)}(h``LANDLOCK_SCOPE_SIGNAL``h]hLANDLOCK_SCOPE_SIGNAL}(hj96hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj6ubh to the }(hj6hhhNhNubj)}(h ``scoped``h]hscoped}(hjK6hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj6ubh ruleset attribute.}(hj6hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhj 6hhubeh}(h] signal-abi-6ah ]h"]signal (abi < 6)ah$]h&]uh1hhjb4hhhhhMubh)}(hhh](h)}(hLogging (ABI < 7)h]hLogging (ABI < 7)}(hjn6hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjk6hhhhhMubj()}(hXrStarting with the Landlock ABI version 7, it is possible to control logging of Landlock audit events with the ``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF``, ``LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON``, and ``LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF`` flags passed to sys_landlock_restrict_self(). See Documentation/admin-guide/LSM/landlock.rst for more details on audit.h](hnStarting with the Landlock ABI version 7, it is possible to control logging of Landlock audit events with the }(hj|6hhhNhNubj)}(h,``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF``h]h(LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF}(hj6hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj|6ubh, }(hj|6hhhNhNubj)}(h*``LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON``h]h&LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON}(hj6hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj|6ubh, and }(hj|6hhhNhNubj)}(h-``LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF``h]h)LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF}(hj6hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj|6ubhy flags passed to sys_landlock_restrict_self(). See Documentation/admin-guide/LSM/landlock.rst for more details on audit.}(hj|6hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjk6hhubeh}(h] logging-abi-7ah ]h"]logging (abi < 7)ah$]h&]uh1hhjb4hhhhhMubh)}(hhh](h)}(h Thread synchronization (ABI < 8)h]h Thread synchronization (ABI < 8)}(hj6hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj6hhhhhMubj()}(hStarting with the Landlock ABI version 8, it is now possible to enforce Landlock rulesets across all threads of the calling process using the ``LANDLOCK_RESTRICT_SELF_TSYNC`` flag passed to sys_landlock_restrict_self().h](hStarting with the Landlock ABI version 8, it is now possible to enforce Landlock rulesets across all threads of the calling process using the }(hj6hhhNhNubj)}(h ``LANDLOCK_RESTRICT_SELF_TSYNC``h]hLANDLOCK_RESTRICT_SELF_TSYNC}(hj6hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj6ubh- flag passed to sys_landlock_restrict_self().}(hj6hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhj6hhubeh}(h]thread-synchronization-abi-8ah ]h"] thread synchronization (abi < 8)ah$]h&]uh1hhjb4hhhhhMubh)}(hhh](h)}(hPathname UNIX sockets (ABI < 9)h]hPathname UNIX sockets (ABI < 9)}(hj7hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj7hhhhhMubj()}(hStarting with the Landlock ABI version 9, it is possible to restrict connections to pathname UNIX domain sockets (:manpage:`unix(7)`) using the new ``LANDLOCK_ACCESS_FS_RESOLVE_UNIX`` right.h](hrStarting with the Landlock ABI version 9, it is possible to restrict connections to pathname UNIX domain sockets (}(hj7hhhNhNubj)}(h:manpage:`unix(7)`h]hunix(7)}(hj7hhhNhNubah}(h]h ]jah"]h$]h&]hhj unix(7)j"unixj$j:uh1jhj7ubh) using the new }(hj7hhhNhNubj)}(h#``LANDLOCK_ACCESS_FS_RESOLVE_UNIX``h]hLANDLOCK_ACCESS_FS_RESOLVE_UNIX}(hj.7hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj7ubh right.}(hj7hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhj7hhubjL )}(h.. _kernel_support:h]h}(h]h ]h"]h$]h&]jkernel-supportuh1jK hMhj7hhhhubeh}(h]pathname-unix-sockets-abi-9ah ]h"]pathname unix sockets (abi < 9)ah$]h&]uh1hhjb4hhhhhMubeh}(h]previous-limitationsah ]h"]previous limitationsah$]h&]uh1hhhhhhhhMyubh)}(hhh](h)}(hKernel supporth]hKernel support}(hjd7hhhNhNubah}(h]h ]h"]h$]h&]uh1hhja7hhhhhMubh)}(hhh](h)}(hBuild time configurationh]hBuild time configuration}(hju7hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjr7hhhhhMubj()}(hXLandlock was first introduced in Linux 5.13 but it must be configured at build time with ``CONFIG_SECURITY_LANDLOCK=y``. Landlock must also be enabled at boot time like other security modules. The list of security modules enabled by default is set with ``CONFIG_LSM``. The kernel configuration should then contain ``CONFIG_LSM=landlock,[...]`` with ``[...]`` as the list of other potentially useful security modules for the running system (see the ``CONFIG_LSM`` help).h](hYLandlock was first introduced in Linux 5.13 but it must be configured at build time with }(hj7hhhNhNubj)}(h``CONFIG_SECURITY_LANDLOCK=y``h]hCONFIG_SECURITY_LANDLOCK=y}(hj7hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj7ubh. Landlock must also be enabled at boot time like other security modules. The list of security modules enabled by default is set with }(hj7hhhNhNubj)}(h``CONFIG_LSM``h]h CONFIG_LSM}(hj7hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj7ubh0. The kernel configuration should then contain }(hj7hhhNhNubj)}(h``CONFIG_LSM=landlock,[...]``h]hCONFIG_LSM=landlock,[...]}(hj7hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj7ubh with }(hj7hhhNhNubj)}(h ``[...]``h]h[...]}(hj7hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj7ubh[ as the list of other potentially useful security modules for the running system (see the }(hj7hhhNhNubj)}(h``CONFIG_LSM``h]h CONFIG_LSM}(hj7hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj7ubh help).}(hj7hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjr7hhubeh}(h]build-time-configurationah ]h"]build time configurationah$]h&]uh1hhja7hhhhhMubh)}(hhh](h)}(hBoot time configurationh]hBoot time configuration}(hj7hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj7hhhhhMubj()}(hIf the running kernel does not have ``landlock`` in ``CONFIG_LSM``, then we can enable Landlock by adding ``lsm=landlock,[...]`` to Documentation/admin-guide/kernel-parameters.rst in the boot loader configuration.h](h$If the running kernel does not have }(hj8hhhNhNubj)}(h ``landlock``h]hlandlock}(hj 8hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj8ubh in }(hj8hhhNhNubj)}(h``CONFIG_LSM``h]h CONFIG_LSM}(hj8hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj8ubh(, then we can enable Landlock by adding }(hj8hhhNhNubj)}(h``lsm=landlock,[...]``h]hlsm=landlock,[...]}(hj08hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj8ubhU to Documentation/admin-guide/kernel-parameters.rst in the boot loader configuration.}(hj8hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhj7hhubj()}(h6For example, if the current built-in configuration is:h]h6For example, if the current built-in configuration is:}(hjH8hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMhj7hhubj)}(h~$ zgrep -h "^CONFIG_LSM=" "/boot/config-$(uname -r)" /proc/config.gz 2>/dev/null CONFIG_LSM="lockdown,yama,integrity,apparmor"h]h~$ zgrep -h "^CONFIG_LSM=" "/boot/config-$(uname -r)" /proc/config.gz 2>/dev/null CONFIG_LSM="lockdown,yama,integrity,apparmor"}hjV8sbah}(h]h ]h"]h$]h&]hhjjconsolej}uh1jhhhMhj7hhubj()}(h:...and if the cmdline doesn't contain ``landlock`` either:h](h(...and if the cmdline doesn’t contain }(hjf8hhhNhNubj)}(h ``landlock``h]hlandlock}(hjn8hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjf8ubh either:}(hjf8hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhj7hhubj)}(hW$ sed -n 's/.*\(\The kernel may be configured at build time to always load the }(hj8hhhNhNubj)}(h ``lockdown``h]hlockdown}(hj8hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj8ubh and }(hj8hhhNhNubj)}(h``capability``h]h capability}(hj9hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj8ubhE LSMs. In that case, these LSMs will appear at the beginning of the }(hj8hhhNhNubj)}(h``LSM: initializing``h]hLSM: initializing}(hj 9hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj8ubhF log line as well, even if they are not configured in the boot loader.}(hj8hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhj7hhubeh}(h]boot-time-configurationah ]h"]boot time configurationah$]h&]uh1hhja7hhhhhMubh)}(hhh](h)}(hNetwork supporth]hNetwork support}(hjC9hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj@9hhhhhM ubj()}(hXBTo be able to explicitly allow TCP operations (e.g., adding a network rule with ``LANDLOCK_ACCESS_NET_BIND_TCP``), the kernel must support TCP (``CONFIG_INET=y``). Otherwise, sys_landlock_add_rule() returns an ``EAFNOSUPPORT`` error, which can safely be ignored because this kind of TCP operation is already not possible.h](hPTo be able to explicitly allow TCP operations (e.g., adding a network rule with }(hjQ9hhhNhNubj)}(h ``LANDLOCK_ACCESS_NET_BIND_TCP``h]hLANDLOCK_ACCESS_NET_BIND_TCP}(hjY9hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjQ9ubh ), the kernel must support TCP (}(hjQ9hhhNhNubj)}(h``CONFIG_INET=y``h]h CONFIG_INET=y}(hjk9hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjQ9ubh2). Otherwise, sys_landlock_add_rule() returns an }(hjQ9hhhNhNubj)}(h``EAFNOSUPPORT``h]h EAFNOSUPPORT}(hj}9hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjQ9ubh_ error, which can safely be ignored because this kind of TCP operation is already not possible.}(hjQ9hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhM hj@9hhubeh}(h]network-supportah ]h"]network supportah$]h&]uh1hhja7hhhhhM ubeh}(h](jP7id2eh ]h"](kernel supportkernel_supporteh$]h&]uh1hhhhhhhhMj }j9jF7sj }jP7jF7subh)}(hhh](h)}(hQuestions and answersh]hQuestions and answers}(hj9hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj9hhhhhMubh)}(hhh](h)}(h'What about user space sandbox managers?h]h'What about user space sandbox managers?}(hj9hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj9hhhhhMubj()}(hX6Using user space processes to enforce restrictions on kernel resources can lead to race conditions or inconsistent evaluations (i.e. `Incorrect mirroring of the OS code and state `_).h](hUsing user space processes to enforce restrictions on kernel resources can lead to race conditions or inconsistent evaluations (i.e. }(hj9hhhNhNubj)}(h`Incorrect mirroring of the OS code and state `_h]h,Incorrect mirroring of the OS code and state}(hj9hhhNhNubah}(h]h ]h"]h$]h&]name,Incorrect mirroring of the OS code and statej}https://www.ndss-symposium.org/ndss2003/traps-and-pitfalls-practical-problems-system-call-interposition-based-security-tools/uh1jhj9ubjL )}(h h]h}(h],incorrect-mirroring-of-the-os-code-and-stateah ]h"],incorrect mirroring of the os code and stateah$]h&]refurij9uh1jK jKhj9ubh).}(hj9hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhj9hhubeh}(h]&what-about-user-space-sandbox-managersah ]h"]'what about user space sandbox managers?ah$]h&]uh1hhj9hhhhhMubh)}(hhh](h)}(h%What about namespaces and containers?h]h%What about namespaces and containers?}(hj:hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj:hhhhhMubj()}(hXjNamespaces can help create sandboxes but they are not designed for access-control and then miss useful features for such use case (e.g. no fine-grained restrictions). Moreover, their complexity can lead to security issues, especially when untrusted processes can manipulate them (cf. `Controlling access to user namespaces `_).h](hXNamespaces can help create sandboxes but they are not designed for access-control and then miss useful features for such use case (e.g. no fine-grained restrictions). Moreover, their complexity can lead to security issues, especially when untrusted processes can manipulate them (cf. }(hj:hhhNhNubj)}(hK`Controlling access to user namespaces `_h]h%Controlling access to user namespaces}(hj:hhhNhNubah}(h]h ]h"]h$]h&]name%Controlling access to user namespacesj https://lwn.net/Articles/673597/uh1jhj:ubjL )}(h# h]h}(h]%controlling-access-to-user-namespacesah ]h"]%controlling access to user namespacesah$]h&]refurij+:uh1jK jKhj:ubh).}(hj:hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhM!hj:hhubeh}(h]$what-about-namespaces-and-containersah ]h"]%what about namespaces and containers?ah$]h&]uh1hhj9hhhhhMubh)}(hhh](h)}(h&How to disable Landlock audit records?h]h&How to disable Landlock audit records?}(hjN:hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjK:hhhhhM(ubj()}(hdYou might want to put in place filters as explained here: Documentation/admin-guide/LSM/landlock.rsth]hdYou might want to put in place filters as explained here: Documentation/admin-guide/LSM/landlock.rst}(hj\:hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhM*hjK:hhubeh}(h]%how-to-disable-landlock-audit-recordsah ]h"]&how to disable landlock audit records?ah$]h&]uh1hhj9hhhhhM(ubeh}(h]questions-and-answersah ]h"]questions and answersah$]h&]uh1hhhhhhhhMubh)}(hhh](h)}(hAdditional documentationh]hAdditional documentation}(hj}:hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjz:hhhhhM.ubj )}(hhh](j )}(h*Documentation/admin-guide/LSM/landlock.rsth]j()}(hj:h]h*Documentation/admin-guide/LSM/landlock.rst}(hj:hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhM0hj:ubah}(h]h ]h"]h$]h&]uh1j hj:hhhhhNubj )}(h#Documentation/security/landlock.rsth]j()}(hj:h]h#Documentation/security/landlock.rst}(hj:hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhM1hj:ubah}(h]h ]h"]h$]h&]uh1j hj:hhhhhNubj )}(hhttps://landlock.io h]j()}(hhttps://landlock.ioh]j)}(hj:h]hhttps://landlock.io}(hj:hhhNhNubah}(h]h ]h"]h$]h&]refurij:uh1jhj:ubah}(h]h ]h"]h$]h&]uh1j'hhhM2hj:ubah}(h]h ]h"]h$]h&]uh1j hj:hhhhhNubeh}(h]h ]h"]h$]h&]jjuh1j hhhM0hjz:hhubh)}(hLinksh]hLinks}hj:sbah}(h]h ]h"]h$]h&]hhuh1hhjz:hhhhhM4ubjL )}(h.. _samples/landlock/sandboxer.c: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/samples/landlock/sandboxer.ch]h}(h]samples-landlock-sandboxer-cah ]h"]samples/landlock/sandboxer.cah$]h&]jjuh1jK hM5hjz:hhhhjKubeh}(h]additional-documentationah ]h"]additional documentationah$]h&]uh1hhhhhhhhM.ubeh}(h]$landlock-unprivileged-access-controlah ]h"]%landlock: unprivileged access controlah$]h&]uh1hhhhhhhhKubeh}(h]h ]h"]h$]h&]sourcehuh1hcurrent_sourceN current_lineNsettingsdocutils.frontendValues)}(hN generatorN datestampN source_linkN source_urlN toc_backlinksentryfootnote_backlinksK sectnum_xformKstrip_commentsNstrip_elements_with_classesN strip_classesN report_levelK halt_levelKexit_status_levelKdebugNwarning_streamN tracebackinput_encoding utf-8-siginput_encoding_error_handlerstrictoutput_encodingutf-8output_encoding_error_handlerj1;error_encodingutf-8error_encoding_error_handlerbackslashreplace language_codeenrecord_dependenciesNconfigN id_prefixhauto_id_prefixid dump_settingsNdump_internalsNdump_transformsNdump_pseudo_xmlNexpose_internalsNstrict_visitorN_disable_configN_sourcehnj _destinationN _config_files]7/var/lib/git/docbuild/linux/Documentation/docutils.confafile_insertion_enabled raw_enabledKline_length_limitM'pep_referencesN pep_base_urlhttps://peps.python.org/pep_file_url_templatepep-%04drfc_referencesN rfc_base_url&https://datatracker.ietf.org/doc/html/ tab_widthKtrim_footnote_reference_spacesyntax_highlightlong smart_quotessmartquotes_locales]character_level_inline_markupdoctitle_xform docinfo_xformKsectsubtitle_xform image_loadinglinkembed_stylesheetcloak_email_addressessection_self_linkenvNubreporterNindirect_targets]substitution_defs}substitution_names}refnames}(samples/landlock/sandboxer.c]japtrace restrictions](jj2efilesystem flags](jjj])e network flags](jj*e scope flags]j.aurefids}(jn ]jd ajP7]jF7aunameids}(j ;j;j j jjj|jyjjjjjljijjj j j( j% j j j j jt jq jV jS j jn j j j j j j j^ j[ j j j j j2j2j&j#jjjj~jjj: j7 j+j+j2j2j_4j\4j2j2j3j2j)3j&3jP3jM3jW4jT4j^7j[7j4j4j4j4j;5j85j5j5j 6j6jh6je6j6j6j6j6jV7jS7j9jP7j9j9j7j7j=9j:9j9j9jw:jt:j9j9j9j9jH:jE:j5:j2:jo:jl:j;j;j:j:u nametypes}(j ;j jj|jjjljj j( j j jt jV j j j j j^ j j j2j&jjjj: j+j2j_4j2j3j)3jP3jW4j^7j4j4j;5j5j 6jh6j6j6jV7j9j9j7j=9j9jw:j9j9jH:j5:jo:j;j:uh}(j;hj jjjjyjjjjjjijjjoj jj% jj j+ j j jq j jS jM jn jw j jw j j j j8 j[ j j ja j j j2j j#j, jjo j~jjjj7 j)jIjRjjj+j= jZ j_ j&j'j(j(j*j*j2j+j,j,j\4j 2j2j12j2j2j&3j3jM3j,3jT4jS3j[7jb4j4js4j4j4j85j4j5j>5j6j5je6j 6j6jk6j6j6jS7j7jP7ja7j9ja7j7jr7j:9j7j9j@9jt:j9j9j9j9j9jE:j:j2:j,:jl:jK:j;jz:j:j:u footnote_refs} citation_refs} autofootnotes]autofootnote_refs]symbol_footnotes]symbol_footnote_refs] footnotes] citations]autofootnote_startKsymbol_footnote_startK id_counter collectionsCounter}j?;KsRparse_messages]transform_messages](hsystem_message)}(hhh]j()}(hhh]h;Hyperlink target "landlock-abi-versions" is not referenced.}hj;sbah}(h]h ]h"]h$]h&]uh1j'hj;ubah}(h]h ]h"]h$]h&]levelKtypeINFOsourcehnjlineMuh1j;ubj;)}(hhh]j()}(hhh]h4Hyperlink target "kernel-support" is not referenced.}hj;sbah}(h]h ]h"]h$]h&]uh1j'hj;ubah}(h]h ]h"]h$]h&]levelKtypej;sourcehnjlineMuh1j;ube transformerN include_log] decorationNhhub.