)sphinx.addnodesdocument)}( rawsourcechildren]( translations LanguagesNode)}(hhh](h pending_xref)}(hhh]docutils.nodesTextChinese (Simplified)}parenthsba attributes}(ids]classes]names]dupnames]backrefs] refdomainstdreftypedoc reftarget*/translations/zh_CN/userspace-api/landlockmodnameN classnameN refexplicitutagnamehhh ubh)}(hhh]hChinese (Traditional)}hh2sbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget*/translations/zh_TW/userspace-api/landlockmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hItalian}hhFsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget*/translations/it_IT/userspace-api/landlockmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hJapanese}hhZsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget*/translations/ja_JP/userspace-api/landlockmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hKorean}hhnsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget*/translations/ko_KR/userspace-api/landlockmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hPortuguese (Brazilian)}hhsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget*/translations/pt_BR/userspace-api/landlockmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hSpanish}hhsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget*/translations/sp_SP/userspace-api/landlockmodnameN classnameN refexplicituh1hhh ubeh}(h]h ]h"]h$]h&]current_languageEnglishuh1h hh _documenthsourceNlineNubhcomment)}(h SPDX-License-Identifier: GPL-2.0h]h SPDX-License-Identifier: GPL-2.0}hhsbah}(h]h ]h"]h$]h&] xml:spacepreserveuh1hhhhhhD/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock.rsthKubh)}(h9Copyright © 2017-2020 Mickaël Salaün h]h9Copyright © 2017-2020 Mickaël Salaün }hhsbah}(h]h ]h"]h$]h&]hhuh1hhhhhhhhKubh)}(hCopyright © 2019-2020 ANSSIh]hCopyright © 2019-2020 ANSSI}hhsbah}(h]h ]h"]h$]h&]hhuh1hhhhhhhhKubh)}(h,Copyright © 2021-2022 Microsoft Corporationh]h,Copyright © 2021-2022 Microsoft Corporation}hhsbah}(h]h ]h"]h$]h&]hhuh1hhhhhhhhKubhsection)}(hhh](htitle)}(h%Landlock: unprivileged access controlh]h%Landlock: unprivileged access control}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhhhhhKubh field_list)}(hhh](hfield)}(hhh](h field_name)}(hAuthorh]hAuthor}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjhhhKubh field_body)}(hMickaël Salaünh]h paragraph)}(hj%h]hMickaël Salaün}(hj)hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhK hj#ubah}(h]h ]h"]h$]h&]uh1j!hjubeh}(h]h ]h"]h$]h&]uh1j hhhK hj hhubj )}(hhh](j)}(hDateh]hDate}(hjEhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjBhhhKubj")}(h June 2026 h]j()}(h June 2026h]h June 2026}(hjWhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhK hjSubah}(h]h ]h"]h$]h&]uh1j!hjBubeh}(h]h ]h"]h$]h&]uh1j hhhK hj hhubeh}(h]h ]h"]h$]h&]uh1jhhhhhhhK ubj()}(hXThe goal of Landlock is to enable restriction of ambient rights (e.g. global filesystem or network access) for a set of processes. Because Landlock is a stackable LSM, it makes it possible to create safe security sandboxes as new security layers in addition to the existing system-wide access-controls. This kind of sandbox is expected to help mitigate the security impact of bugs or unexpected/malicious behaviors in user space applications. Landlock empowers any process, including unprivileged ones, to securely restrict themselves.h]hXThe goal of Landlock is to enable restriction of ambient rights (e.g. global filesystem or network access) for a set of processes. Because Landlock is a stackable LSM, it makes it possible to create safe security sandboxes as new security layers in addition to the existing system-wide access-controls. This kind of sandbox is expected to help mitigate the security impact of bugs or unexpected/malicious behaviors in user space applications. Landlock empowers any process, including unprivileged ones, to securely restrict themselves.}(hjwhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhK hhhhubj()}(hXWe can quickly make sure that Landlock is enabled in the running system by looking for "landlock: Up and running" in kernel logs (as root): ``dmesg | grep landlock || journalctl -kb -g landlock`` . Developers can also easily check for Landlock support with a :ref:`related system call `. If Landlock is not currently supported, we need to :ref:`configure the kernel appropriately `.h](hWe can quickly make sure that Landlock is enabled in the running system by looking for “landlock: Up and running” in kernel logs (as root): }(hjhhhNhNubhliteral)}(h7``dmesg | grep landlock || journalctl -kb -g landlock``h]h3dmesg | grep landlock || journalctl -kb -g landlock}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh@ . Developers can also easily check for Landlock support with a }(hjhhhNhNubh)}(h2:ref:`related system call `h]hinline)}(hjh]hrelated system call}(hjhhhNhNubah}(h]h ](xrefstdstd-refeh"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]refdocuserspace-api/landlock refdomainjreftyperef refexplicitrefwarn reftargetlandlock_abi_versionsuh1hhhhKhjubh5. If Landlock is not currently supported, we need to }(hjhhhNhNubh)}(h::ref:`configure the kernel appropriately `h]j)}(hjh]h"configure the kernel appropriately}(hjhhhNhNubah}(h]h ](jstdstd-refeh"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]refdocj refdomainjreftyperef refexplicitrefwarnjkernel_supportuh1hhhhKhjubh.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhKhhhhubh)}(hhh](h)}(hLandlock rulesh]hLandlock rules}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKubj()}(hA Landlock rule describes an action on an object which the process intends to perform. A set of rules is aggregated in a ruleset, which can then restrict the thread enforcing it, and its future children.h]hA Landlock rule describes an action on an object which the process intends to perform. A set of rules is aggregated in a ruleset, which can then restrict the thread enforcing it, and its future children.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhK hjhhubj()}(h$The two existing types of rules are:h]h$The two existing types of rules are:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhK$hjhhubhdefinition_list)}(hhh](hdefinition_list_item)}(hFilesystem rules For these rules, the object is a file hierarchy, and the related filesystem actions are defined with `filesystem access rights`. h](hterm)}(hFilesystem rulesh]hFilesystem rules}(hj.hhhNhNubah}(h]h ]h"]h$]h&]uh1j,hhhK)hj(ubh definition)}(hhh]j()}(hFor these rules, the object is a file hierarchy, and the related filesystem actions are defined with `filesystem access rights`.h](heFor these rules, the object is a file hierarchy, and the related filesystem actions are defined with }(hjAhhhNhNubhtitle_reference)}(h`filesystem access rights`h]hfilesystem access rights}(hjKhhhNhNubah}(h]h ]h"]h$]h&]uh1jIhjAubh.}(hjAhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhK'hj>ubah}(h]h ]h"]h$]h&]uh1j<hj(ubeh}(h]h ]h"]h$]h&]uh1j&hhhK)hj#ubj')}(hNetwork rules (since ABI v4 for TCP and v10 for UDP) For these rules, the object is a TCP or UDP port, and the related actions are defined with `network access rights`. h](j-)}(h4Network rules (since ABI v4 for TCP and v10 for UDP)h]h4Network rules (since ABI v4 for TCP and v10 for UDP)}(hjshhhNhNubah}(h]h ]h"]h$]h&]uh1j,hhhK-hjoubj=)}(hhh]j()}(hsFor these rules, the object is a TCP or UDP port, and the related actions are defined with `network access rights`.h](h[For these rules, the object is a TCP or UDP port, and the related actions are defined with }(hjhhhNhNubjJ)}(h`network access rights`h]hnetwork access rights}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jIhjubh.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhK,hjubah}(h]h ]h"]h$]h&]uh1j<hjoubeh}(h]h ]h"]h$]h&]uh1j&hhhK-hj#hhubeh}(h]h ]h"]h$]h&]uh1j!hjhhhhhNubh)}(hhh](h)}(h(Defining and enforcing a security policyh]h(Defining and enforcing a security policy}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhK0ubj()}(h@We first need to define the ruleset that will contain our rules.h]h@We first need to define the ruleset that will contain our rules.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhK2hjhhubj()}(hFor this example, the ruleset will contain rules that only allow some filesystem read actions and some specific UDP and TCP actions. Filesystem write actions and other TCP/UDP actions will be denied.h]hFor this example, the ruleset will contain rules that only allow some filesystem read actions and some specific UDP and TCP actions. Filesystem write actions and other TCP/UDP actions will be denied.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhK4hjhhubj()}(hXThe ruleset then needs to handle all these kinds of actions. This is required for backward and forward compatibility (i.e. the kernel and user space may not know each other's supported restrictions), hence the need to be explicit about the denied-by-default access rights.h]hXThe ruleset then needs to handle all these kinds of actions. This is required for backward and forward compatibility (i.e. the kernel and user space may not know each other’s supported restrictions), hence the need to be explicit about the denied-by-default access rights.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhK8hjhhubh literal_block)}(hXstruct landlock_ruleset_attr ruleset_attr = { .handled_access_fs = LANDLOCK_ACCESS_FS_EXECUTE | LANDLOCK_ACCESS_FS_WRITE_FILE | LANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_READ_DIR | LANDLOCK_ACCESS_FS_REMOVE_DIR | LANDLOCK_ACCESS_FS_REMOVE_FILE | LANDLOCK_ACCESS_FS_MAKE_CHAR | LANDLOCK_ACCESS_FS_MAKE_DIR | LANDLOCK_ACCESS_FS_MAKE_REG | LANDLOCK_ACCESS_FS_MAKE_SOCK | LANDLOCK_ACCESS_FS_MAKE_FIFO | LANDLOCK_ACCESS_FS_MAKE_BLOCK | LANDLOCK_ACCESS_FS_MAKE_SYM | LANDLOCK_ACCESS_FS_REFER | LANDLOCK_ACCESS_FS_TRUNCATE | LANDLOCK_ACCESS_FS_IOCTL_DEV | LANDLOCK_ACCESS_FS_RESOLVE_UNIX, .handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP | LANDLOCK_ACCESS_NET_CONNECT_TCP | LANDLOCK_ACCESS_NET_BIND_UDP | LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP, .scoped = LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET | LANDLOCK_SCOPE_SIGNAL, };h]hXstruct landlock_ruleset_attr ruleset_attr = { .handled_access_fs = LANDLOCK_ACCESS_FS_EXECUTE | LANDLOCK_ACCESS_FS_WRITE_FILE | LANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_READ_DIR | LANDLOCK_ACCESS_FS_REMOVE_DIR | LANDLOCK_ACCESS_FS_REMOVE_FILE | LANDLOCK_ACCESS_FS_MAKE_CHAR | LANDLOCK_ACCESS_FS_MAKE_DIR | LANDLOCK_ACCESS_FS_MAKE_REG | LANDLOCK_ACCESS_FS_MAKE_SOCK | LANDLOCK_ACCESS_FS_MAKE_FIFO | LANDLOCK_ACCESS_FS_MAKE_BLOCK | LANDLOCK_ACCESS_FS_MAKE_SYM | LANDLOCK_ACCESS_FS_REFER | LANDLOCK_ACCESS_FS_TRUNCATE | LANDLOCK_ACCESS_FS_IOCTL_DEV | LANDLOCK_ACCESS_FS_RESOLVE_UNIX, .handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP | LANDLOCK_ACCESS_NET_CONNECT_TCP | LANDLOCK_ACCESS_NET_BIND_UDP | LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP, .scoped = LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET | LANDLOCK_SCOPE_SIGNAL, };}hjsbah}(h]h ]h"]h$]h&]hhƌforcelanguagechighlight_args}uh1jhhhK=hjhhubj()}(hBecause we may not know which kernel version an application will be executed on, it is safer to follow a best-effort security approach. Indeed, we should try to protect users as much as possible whatever the kernel they are using.h]hBecause we may not know which kernel version an application will be executed on, it is safer to follow a best-effort security approach. Indeed, we should try to protect users as much as possible whatever the kernel they are using.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhK\hjhhubj()}(hTo be compatible with older Linux versions, we detect the available Landlock ABI version, and only use the available subset of access rights:h]hTo be compatible with older Linux versions, we detect the available Landlock ABI version, and only use the available subset of access rights:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhKahjhhubj)}(hXint abi; abi = landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_VERSION); if (abi < 0) { /* Degrades gracefully if Landlock is not handled. */ perror("The running kernel does not enable to use Landlock"); return 0; } switch (abi) { case 1: /* Removes LANDLOCK_ACCESS_FS_REFER for ABI < 2 */ ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_REFER; __attribute__((fallthrough)); case 2: /* Removes LANDLOCK_ACCESS_FS_TRUNCATE for ABI < 3 */ ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_TRUNCATE; __attribute__((fallthrough)); case 3: /* Removes network support for ABI < 4 */ ruleset_attr.handled_access_net &= ~(LANDLOCK_ACCESS_NET_BIND_TCP | LANDLOCK_ACCESS_NET_CONNECT_TCP); __attribute__((fallthrough)); case 4: /* Removes LANDLOCK_ACCESS_FS_IOCTL_DEV for ABI < 5 */ ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_IOCTL_DEV; __attribute__((fallthrough)); case 5: /* Removes LANDLOCK_SCOPE_* for ABI < 6 */ ruleset_attr.scoped &= ~(LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET | LANDLOCK_SCOPE_SIGNAL); __attribute__((fallthrough)); case 6 ... 8: /* Removes LANDLOCK_ACCESS_FS_RESOLVE_UNIX for ABI < 9 */ ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_RESOLVE_UNIX; __attribute__((fallthrough)); case 9: /* Removes LANDLOCK_ACCESS_NET_*_UDP for ABI < 10 */ ruleset_attr.handled_access_net &= ~(LANDLOCK_ACCESS_NET_BIND_UDP | LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP); }h]hXint abi; abi = landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_VERSION); if (abi < 0) { /* Degrades gracefully if Landlock is not handled. */ perror("The running kernel does not enable to use Landlock"); return 0; } switch (abi) { case 1: /* Removes LANDLOCK_ACCESS_FS_REFER for ABI < 2 */ ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_REFER; __attribute__((fallthrough)); case 2: /* Removes LANDLOCK_ACCESS_FS_TRUNCATE for ABI < 3 */ ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_TRUNCATE; __attribute__((fallthrough)); case 3: /* Removes network support for ABI < 4 */ ruleset_attr.handled_access_net &= ~(LANDLOCK_ACCESS_NET_BIND_TCP | LANDLOCK_ACCESS_NET_CONNECT_TCP); __attribute__((fallthrough)); case 4: /* Removes LANDLOCK_ACCESS_FS_IOCTL_DEV for ABI < 5 */ ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_IOCTL_DEV; __attribute__((fallthrough)); case 5: /* Removes LANDLOCK_SCOPE_* for ABI < 6 */ ruleset_attr.scoped &= ~(LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET | LANDLOCK_SCOPE_SIGNAL); __attribute__((fallthrough)); case 6 ... 8: /* Removes LANDLOCK_ACCESS_FS_RESOLVE_UNIX for ABI < 9 */ ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_RESOLVE_UNIX; __attribute__((fallthrough)); case 9: /* Removes LANDLOCK_ACCESS_NET_*_UDP for ABI < 10 */ ruleset_attr.handled_access_net &= ~(LANDLOCK_ACCESS_NET_BIND_UDP | LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP); }}hj"sbah}(h]h ]h"]h$]h&]hhjjjj}uh1jhhhKdhjhhubj()}(hNThis enables the creation of an inclusive ruleset that will contain our rules.h]hNThis enables the creation of an inclusive ruleset that will contain our rules.}(hj1hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhKhjhhubj)}(hint ruleset_fd; ruleset_fd = landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); if (ruleset_fd < 0) { perror("Failed to create a ruleset"); return 1; }h]hint ruleset_fd; ruleset_fd = landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); if (ruleset_fd < 0) { perror("Failed to create a ruleset"); return 1; }}hj?sbah}(h]h ]h"]h$]h&]hhjjjj}uh1jhhhKhjhhubj()}(hXWe can now add a new rule to this ruleset thanks to the returned file descriptor referring to this ruleset. The rule will allow reading and executing the file hierarchy ``/usr``. Without another rule, write actions would then be denied by the ruleset. To add ``/usr`` to the ruleset, we open it with the ``O_PATH`` flag and fill the &struct landlock_path_beneath_attr with this file descriptor.h](hWe can now add a new rule to this ruleset thanks to the returned file descriptor referring to this ruleset. The rule will allow reading and executing the file hierarchy }(hjNhhhNhNubj)}(h``/usr``h]h/usr}(hjVhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjNubhT. Without another rule, write actions would then be denied by the ruleset. To add }(hjNhhhNhNubj)}(h``/usr``h]h/usr}(hjhhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjNubh% to the ruleset, we open it with the }(hjNhhhNhNubj)}(h ``O_PATH``h]hO_PATH}(hjzhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjNubhP flag and fill the &struct landlock_path_beneath_attr with this file descriptor.}(hjNhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhKhjhhubj)}(hXint err = 0; struct landlock_path_beneath_attr path_beneath = { .allowed_access = LANDLOCK_ACCESS_FS_EXECUTE | LANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_READ_DIR, }; path_beneath.allowed_access &= ruleset_attr.handled_access_fs; if (path_beneath.allowed_access) { path_beneath.parent_fd = open("/usr", O_PATH | O_CLOEXEC); if (path_beneath.parent_fd < 0) { perror("Failed to open file"); close(ruleset_fd); return 1; } err = landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH, &path_beneath, 0); close(path_beneath.parent_fd); if (err) { perror("Failed to update ruleset"); close(ruleset_fd); return 1; } }h]hXint err = 0; struct landlock_path_beneath_attr path_beneath = { .allowed_access = LANDLOCK_ACCESS_FS_EXECUTE | LANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_READ_DIR, }; path_beneath.allowed_access &= ruleset_attr.handled_access_fs; if (path_beneath.allowed_access) { path_beneath.parent_fd = open("/usr", O_PATH | O_CLOEXEC); if (path_beneath.parent_fd < 0) { perror("Failed to open file"); close(ruleset_fd); return 1; } err = landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH, &path_beneath, 0); close(path_beneath.parent_fd); if (err) { perror("Failed to update ruleset"); close(ruleset_fd); return 1; } }}hjsbah}(h]h ]h"]h$]h&]hhjjjj}uh1jhhhKhjhhubj()}(hXEAs shown above, masking the rule's ``allowed_access`` against the ruleset's ``handled_access_*`` is the recommended best-effort pattern: rights the running kernel does not support are dropped (the compatibility switch above already cleared them in ``handled_access_*``), and the rule is skipped if no supported right remains.h](h%As shown above, masking the rule’s }(hjhhhNhNubj)}(h``allowed_access``h]hallowed_access}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh against the ruleset’s }(hjhhhNhNubj)}(h``handled_access_*``h]hhandled_access_*}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh is the recommended best-effort pattern: rights the running kernel does not support are dropped (the compatibility switch above already cleared them in }(hjhhhNhNubj)}(h``handled_access_*``h]hhandled_access_*}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh9), and the rule is skipped if no supported right remains.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhKhjhhubj()}(hFor network access-control, we will add a set of rules to allow DNS queries, which requires both UDP and TCP. For TCP, we need to allow outbound connections to port 53, which can be handled and granted starting with ABI 4:h]hFor network access-control, we will add a set of rules to allow DNS queries, which requires both UDP and TCP. For TCP, we need to allow outbound connections to port 53, which can be handled and granted starting with ABI 4:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhKhjhhubj)}(hX9struct landlock_net_port_attr tcp_conn = { .allowed_access = LANDLOCK_ACCESS_NET_CONNECT_TCP, .port = 53, }; tcp_conn.allowed_access &= ruleset_attr.handled_access_net; if (tcp_conn.allowed_access) err = landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &tcp_conn, 0);h]hX9struct landlock_net_port_attr tcp_conn = { .allowed_access = LANDLOCK_ACCESS_NET_CONNECT_TCP, .port = 53, }; tcp_conn.allowed_access &= ruleset_attr.handled_access_net; if (tcp_conn.allowed_access) err = landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &tcp_conn, 0);}hjsbah}(h]h ]h"]h$]h&]hhjjjj}uh1jhhhKhjhhubj()}(hXWe also need to be able to send UDP datagrams to port 53, which requires granting ``LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP``. Since our DNS client will emit datagrams without explicitly binding to a specific source port, its UDP socket will automatically bind an ephemeral port. To allow this behaviour, we also need to grant ``LANDLOCK_ACCESS_NET_BIND_UDP`` on port 0, as if the program explicitly called :manpage:`bind(2)` on port 0.h](hRWe also need to be able to send UDP datagrams to port 53, which requires granting }(hjhhhNhNubj)}(h(``LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP``h]h$LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh. Since our DNS client will emit datagrams without explicitly binding to a specific source port, its UDP socket will automatically bind an ephemeral port. To allow this behaviour, we also need to grant }(hjhhhNhNubj)}(h ``LANDLOCK_ACCESS_NET_BIND_UDP``h]hLANDLOCK_ACCESS_NET_BIND_UDP}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh0 on port 0, as if the program explicitly called }(hjhhhNhNubhmanpage)}(h:manpage:`bind(2)`h]hbind(2)}(hj0hhhNhNubah}(h]h ]j.ah"]h$]h&]hhƌpathbind(2)pagebindsection2uh1j.hjubh on port 0.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhKhjhhubj)}(hX{struct landlock_net_port_attr udp_send = { .allowed_access = LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP, .port = 53, }; udp_send.allowed_access &= ruleset_attr.handled_access_net; if (udp_send.allowed_access) err = landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &udp_send, 0); [...] struct landlock_net_port_attr udp_bind = { .allowed_access = LANDLOCK_ACCESS_NET_BIND_UDP, .port = 0, }; udp_bind.allowed_access &= ruleset_attr.handled_access_net; if (udp_bind.allowed_access) err = landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &udp_bind, 0);h]hX{struct landlock_net_port_attr udp_send = { .allowed_access = LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP, .port = 53, }; udp_send.allowed_access &= ruleset_attr.handled_access_net; if (udp_send.allowed_access) err = landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &udp_send, 0); [...] struct landlock_net_port_attr udp_bind = { .allowed_access = LANDLOCK_ACCESS_NET_BIND_UDP, .port = 0, }; udp_bind.allowed_access &= ruleset_attr.handled_access_net; if (udp_bind.allowed_access) err = landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &udp_bind, 0);}hjNsbah}(h]h ]h"]h$]h&]hhjjjj}uh1jhhhKhjhhubj()}(hWhen passing a non-zero ``flags`` argument to ``landlock_restrict_self()``, a similar backwards compatibility check is needed for the restrict flags (see sys_landlock_restrict_self() documentation for available flags):h](hWhen passing a non-zero }(hj]hhhNhNubj)}(h ``flags``h]hflags}(hjehhhNhNubah}(h]h ]h"]h$]h&]uh1jhj]ubh argument to }(hj]hhhNhNubj)}(h``landlock_restrict_self()``h]hlandlock_restrict_self()}(hjwhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj]ubh, a similar backwards compatibility check is needed for the restrict flags (see sys_landlock_restrict_self() documentation for available flags):}(hj]hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhKhjhhubj)}(hX__u32 restrict_flags = LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON | LANDLOCK_RESTRICT_SELF_TSYNC; switch (abi) { case 1 ... 6: /* Removes logging flags for ABI < 7 */ restrict_flags &= ~(LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF | LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON | LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF); __attribute__((fallthrough)); case 7: /* * Removes multithreaded enforcement flag for ABI < 8 * * WARNING: Without this flag, calling landlock_restrict_self(2) is * only equivalent if the calling process is single-threaded. Below * ABI v8 (and as of ABI v8, when not using this flag), a Landlock * policy would only be enforced for the calling thread and its * children (and not for all threads, including parents and siblings). */ restrict_flags &= ~LANDLOCK_RESTRICT_SELF_TSYNC; }h]hX__u32 restrict_flags = LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON | LANDLOCK_RESTRICT_SELF_TSYNC; switch (abi) { case 1 ... 6: /* Removes logging flags for ABI < 7 */ restrict_flags &= ~(LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF | LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON | LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF); __attribute__((fallthrough)); case 7: /* * Removes multithreaded enforcement flag for ABI < 8 * * WARNING: Without this flag, calling landlock_restrict_self(2) is * only equivalent if the calling process is single-threaded. Below * ABI v8 (and as of ABI v8, when not using this flag), a Landlock * policy would only be enforced for the calling thread and its * children (and not for all threads, including parents and siblings). */ restrict_flags &= ~LANDLOCK_RESTRICT_SELF_TSYNC; }}hjsbah}(h]h ]h"]h$]h&]hhjjjj}uh1jhhhKhjhhubj()}(hX(The next step is to restrict the current thread from gaining more privileges (e.g. through a SUID binary). We now have a ruleset with the first rule allowing read and execute access to ``/usr`` while denying all other handled accesses for the filesystem, and two more rules allowing DNS queries.h](hThe next step is to restrict the current thread from gaining more privileges (e.g. through a SUID binary). We now have a ruleset with the first rule allowing read and execute access to }(hjhhhNhNubj)}(h``/usr``h]h/usr}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhf while denying all other handled accesses for the filesystem, and two more rules allowing DNS queries.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjhhubj)}(hif (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { perror("Failed to restrict privileges"); close(ruleset_fd); return 1; }h]hif (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { perror("Failed to restrict privileges"); close(ruleset_fd); return 1; }}hjsbah}(h]h ]h"]h$]h&]hhjjjj}uh1jhhhMhjhhubj()}(hCThe current thread is now ready to sandbox itself with the ruleset.h]hCThe current thread is now ready to sandbox itself with the ruleset.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMhjhhubj)}(hif (landlock_restrict_self(ruleset_fd, restrict_flags)) { perror("Failed to enforce ruleset"); close(ruleset_fd); return 1; } close(ruleset_fd);h]hif (landlock_restrict_self(ruleset_fd, restrict_flags)) { perror("Failed to enforce ruleset"); close(ruleset_fd); return 1; } close(ruleset_fd);}hjsbah}(h]h ]h"]h$]h&]hhjjjj}uh1jhhhM!hjhhubj()}(hXIf the ``landlock_restrict_self`` system call succeeds, the current thread is now restricted and this policy will be enforced on all its subsequently created children as well. Once a thread is landlocked, there is no way to remove its security policy; only adding more restrictions is allowed. These threads are now in a new Landlock domain, which is a merger of their parent one (if any) with the new ruleset.h](hIf the }(hjhhhNhNubj)}(h``landlock_restrict_self``h]hlandlock_restrict_self}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhX{ system call succeeds, the current thread is now restricted and this policy will be enforced on all its subsequently created children as well. Once a thread is landlocked, there is no way to remove its security policy; only adding more restrictions is allowed. These threads are now in a new Landlock domain, which is a merger of their parent one (if any) with the new ruleset.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhM*hjhhubj()}(hBFull working code can be found in `samples/landlock/sandboxer.c`_.h](h"Full working code can be found in }(hj hhhNhNubh reference)}(h`samples/landlock/sandboxer.c`_h]hsamples/landlock/sandboxer.c}(hjhhhNhNubah}(h]h ]h"]h$]h&]namesamples/landlock/sandboxer.crefuribhttps://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/samples/landlock/sandboxer.cuh1jhj resolvedKubh.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhM1hjhhubeh}(h](defining-and-enforcing-a-security-policyah ]h"](defining and enforcing a security policyah$]h&]uh1hhjhhhhhK0ubh)}(hhh](h)}(hGood practicesh]hGood practices}(hj<hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj9hhhhhM4ubj()}(hXIt is recommended to set access rights to file hierarchy leaves as much as possible. For instance, it is better to be able to have ``~/doc/`` as a read-only hierarchy and ``~/tmp/`` as a read-write hierarchy, compared to ``~/`` as a read-only hierarchy and ``~/tmp/`` as a read-write hierarchy. Following this good practice leads to self-sufficient hierarchies that do not depend on their location (i.e. parent directories). This is particularly relevant when we want to allow linking or renaming. Indeed, having consistent access rights per directory enables changing the location of such directories without relying on the destination directory access rights (except those that are required for this operation, see ``LANDLOCK_ACCESS_FS_REFER`` documentation).h](hIt is recommended to set access rights to file hierarchy leaves as much as possible. For instance, it is better to be able to have }(hjJhhhNhNubj)}(h ``~/doc/``h]h~/doc/}(hjRhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjJubh as a read-only hierarchy and }(hjJhhhNhNubj)}(h ``~/tmp/``h]h~/tmp/}(hjdhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjJubh( as a read-write hierarchy, compared to }(hjJhhhNhNubj)}(h``~/``h]h~/}(hjvhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjJubh as a read-only hierarchy and }(hjJhhhNhNubj)}(h ``~/tmp/``h]h~/tmp/}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjJubhX as a read-write hierarchy. Following this good practice leads to self-sufficient hierarchies that do not depend on their location (i.e. parent directories). This is particularly relevant when we want to allow linking or renaming. Indeed, having consistent access rights per directory enables changing the location of such directories without relying on the destination directory access rights (except those that are required for this operation, see }(hjJhhhNhNubj)}(h``LANDLOCK_ACCESS_FS_REFER``h]hLANDLOCK_ACCESS_FS_REFER}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjJubh documentation).}(hjJhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhM6hj9hhubj()}(hXHaving self-sufficient hierarchies also helps to tighten the required access rights to the minimal set of data. This also helps avoid sinkhole directories, i.e. directories where data can be linked to but not linked from. However, this depends on data organization, which might not be controlled by developers. In this case, granting read-write access to ``~/tmp/``, instead of write-only access, would potentially allow moving ``~/tmp/`` to a non-readable directory and still keep the ability to list the content of ``~/tmp/``.h](hXeHaving self-sufficient hierarchies also helps to tighten the required access rights to the minimal set of data. This also helps avoid sinkhole directories, i.e. directories where data can be linked to but not linked from. However, this depends on data organization, which might not be controlled by developers. In this case, granting read-write access to }(hjhhhNhNubj)}(h ``~/tmp/``h]h~/tmp/}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh?, instead of write-only access, would potentially allow moving }(hjhhhNhNubj)}(h ``~/tmp/``h]h~/tmp/}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhO to a non-readable directory and still keep the ability to list the content of }(hjhhhNhNubj)}(h ``~/tmp/``h]h~/tmp/}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMBhj9hhubeh}(h]good-practicesah ]h"]good practicesah$]h&]uh1hhjhhhhhM4ubh)}(hhh](h)}(h!Layers of file path access rightsh]h!Layers of file path access rights}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhMKubj()}(hX6Each time a thread enforces a ruleset on itself, it updates its Landlock domain with a new layer of policy. This complementary policy is stacked with any other rulesets potentially already restricting this thread. A sandboxed thread can then safely add more constraints to itself with a new enforced ruleset.h]hX6Each time a thread enforces a ruleset on itself, it updates its Landlock domain with a new layer of policy. This complementary policy is stacked with any other rulesets potentially already restricting this thread. A sandboxed thread can then safely add more constraints to itself with a new enforced ruleset.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMMhjhhubj()}(hX9One policy layer grants access to a file path if at least one of its rules encountered on the path grants the access. A sandboxed thread can only access a file path if all its enforced policy layers grant the access as well as all the other system access controls (e.g. filesystem DAC, other LSM policies, etc.).h]hX9One policy layer grants access to a file path if at least one of its rules encountered on the path grants the access. A sandboxed thread can only access a file path if all its enforced policy layers grant the access as well as all the other system access controls (e.g. filesystem DAC, other LSM policies, etc.).}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMRhjhhubeh}(h]!layers-of-file-path-access-rightsah ]h"]!layers of file path access rightsah$]h&]uh1hhjhhhhhMKubh)}(hhh](h)}(hBind mounts and OverlayFSh]hBind mounts and OverlayFS}(hj6hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj3hhhhhMYubj()}(hLandlock enables restricting access to file hierarchies, which means that these access rights can be propagated with bind mounts (cf. Documentation/filesystems/sharedsubtree.rst) but not with Documentation/filesystems/overlayfs.rst.h]hLandlock enables restricting access to file hierarchies, which means that these access rights can be propagated with bind mounts (cf. Documentation/filesystems/sharedsubtree.rst) but not with Documentation/filesystems/overlayfs.rst.}(hjDhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhM[hj3hhubj()}(hXA bind mount mirrors a source file hierarchy to a destination. The destination hierarchy is then composed of the exact same files, on which Landlock rules can be tied, either via the source or the destination path. These rules restrict access when they are encountered on a path, which means that they can restrict access to multiple file hierarchies at the same time, whether these hierarchies are the result of bind mounts or not.h]hXA bind mount mirrors a source file hierarchy to a destination. The destination hierarchy is then composed of the exact same files, on which Landlock rules can be tied, either via the source or the destination path. These rules restrict access when they are encountered on a path, which means that they can restrict access to multiple file hierarchies at the same time, whether these hierarchies are the result of bind mounts or not.}(hjRhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhM`hj3hhubj()}(hXAn OverlayFS mount point consists of upper and lower layers. These layers are combined in a merge directory, and that merged directory becomes available at the mount point. This merge hierarchy may include files from the upper and lower layers, but modifications performed on the merge hierarchy only reflect on the upper layer. From a Landlock policy point of view, all OverlayFS layers and merge hierarchies are standalone and each contains their own set of files and directories, which is different from bind mounts. A policy restricting an OverlayFS layer will not restrict the resulted merged hierarchy, and vice versa. Landlock users should then only think about file hierarchies they want to allow access to, regardless of the underlying filesystem.h]hXAn OverlayFS mount point consists of upper and lower layers. These layers are combined in a merge directory, and that merged directory becomes available at the mount point. This merge hierarchy may include files from the upper and lower layers, but modifications performed on the merge hierarchy only reflect on the upper layer. From a Landlock policy point of view, all OverlayFS layers and merge hierarchies are standalone and each contains their own set of files and directories, which is different from bind mounts. A policy restricting an OverlayFS layer will not restrict the resulted merged hierarchy, and vice versa. Landlock users should then only think about file hierarchies they want to allow access to, regardless of the underlying filesystem.}(hj`hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMghj3hhubeh}(h]bind-mounts-and-overlayfsah ]h"]bind mounts and overlayfsah$]h&]uh1hhjhhhhhMYubh)}(hhh](h)}(h Inheritanceh]h Inheritance}(hjyhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjvhhhhhMsubj()}(hXEvery new thread resulting from a :manpage:`clone(2)` inherits Landlock domain restrictions from its parent. This is similar to seccomp inheritance (cf. Documentation/userspace-api/seccomp_filter.rst) or any other LSM dealing with task's :manpage:`credentials(7)`. For instance, one process's thread may apply Landlock rules to itself, but they will not be automatically applied to other sibling threads (unlike POSIX thread credential changes, cf. :manpage:`nptl(7)`).h](h"Every new thread resulting from a }(hjhhhNhNubj/)}(h:manpage:`clone(2)`h]hclone(2)}(hjhhhNhNubah}(h]h ]j.ah"]h$]h&]hhj>clone(2)j@clonejBjCuh1j.hjubh inherits Landlock domain restrictions from its parent. This is similar to seccomp inheritance (cf. Documentation/userspace-api/seccomp_filter.rst) or any other LSM dealing with task’s }(hjhhhNhNubj/)}(h:manpage:`credentials(7)`h]hcredentials(7)}(hjhhhNhNubah}(h]h ]j.ah"]h$]h&]hhj>credentials(7)j@ credentialsjB7uh1j.hjubh. For instance, one process’s thread may apply Landlock rules to itself, but they will not be automatically applied to other sibling threads (unlike POSIX thread credential changes, cf. }(hjhhhNhNubj/)}(h:manpage:`nptl(7)`h]hnptl(7)}(hjhhhNhNubah}(h]h ]j.ah"]h$]h&]hhj>nptl(7)j@nptljBjuh1j.hjubh).}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMuhjvhhubj()}(hX?When a thread sandboxes itself, we have the guarantee that the related security policy will stay enforced on all this thread's descendants. This allows creating standalone and modular security policies per application, which will automatically be composed between themselves according to their runtime parent policies.h]hXAWhen a thread sandboxes itself, we have the guarantee that the related security policy will stay enforced on all this thread’s descendants. This allows creating standalone and modular security policies per application, which will automatically be composed between themselves according to their runtime parent policies.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhM}hjvhhubeh}(h] inheritanceah ]h"] inheritanceah$]h&]uh1hhjhhhhhMsubh)}(hhh](h)}(hPtrace restrictionsh]hPtrace restrictions}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhMubj()}(hXA sandboxed process has less privileges than a non-sandboxed process and must then be subject to additional restrictions when manipulating another process. To be allowed to use :manpage:`ptrace(2)` and related syscalls on a target process, a sandboxed process should have a superset of the target process's access rights, which means the tracee must be in a sub-domain of the tracer.h](hA sandboxed process has less privileges than a non-sandboxed process and must then be subject to additional restrictions when manipulating another process. To be allowed to use }(hjhhhNhNubj/)}(h:manpage:`ptrace(2)`h]h ptrace(2)}(hjhhhNhNubah}(h]h ]j.ah"]h$]h&]hhj> ptrace(2)j@ptracejBjCuh1j.hjubh and related syscalls on a target process, a sandboxed process should have a superset of the target process’s access rights, which means the tracee must be in a sub-domain of the tracer.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjhhubeh}(h]ptrace-restrictionsah ]h"]ptrace restrictionsah$]h&]uh1hhjhhhhhM referencedKubh)}(hhh](h)}(h IPC scopingh]h IPC scoping}(hj'hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj$hhhhhMubj()}(hX`Similar to the implicit `Ptrace restrictions`_, we may want to further restrict interactions between sandboxes. Therefore, at ruleset creation time, each Landlock domain can restrict the scope for certain operations, so that these operations can only reach out to processes within the same Landlock domain or in a nested Landlock domain (the "scope").h](hSimilar to the implicit }(hj5hhhNhNubj)}(h`Ptrace restrictions`_h]hPtrace restrictions}(hj=hhhNhNubah}(h]h ]h"]h$]h&]namePtrace restrictionsrefidjuh1jhj5j&KubhX6, we may want to further restrict interactions between sandboxes. Therefore, at ruleset creation time, each Landlock domain can restrict the scope for certain operations, so that these operations can only reach out to processes within the same Landlock domain or in a nested Landlock domain (the “scope”).}(hj5hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhj$hhubj()}(h'The operations which can be scoped are:h]h'The operations which can be scoped are:}(hjXhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMhj$hhubj")}(hhh](j')}(h``LANDLOCK_SCOPE_SIGNAL`` This limits the sending of signals to target processes which run within the same or a nested Landlock domain. h](j-)}(h``LANDLOCK_SCOPE_SIGNAL``h]j)}(hjoh]hLANDLOCK_SCOPE_SIGNAL}(hjqhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjmubah}(h]h ]h"]h$]h&]uh1j,hhhMhjiubj=)}(hhh]j()}(hmThis limits the sending of signals to target processes which run within the same or a nested Landlock domain.h]hmThis limits the sending of signals to target processes which run within the same or a nested Landlock domain.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMhjubah}(h]h ]h"]h$]h&]uh1j<hjiubeh}(h]h ]h"]h$]h&]uh1j&hhhMhjfubj')}(hXN``LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET`` This limits the set of abstract :manpage:`unix(7)` sockets to which we can :manpage:`connect(2)` to socket addresses which were created by a process in the same or a nested Landlock domain. A :manpage:`sendto(2)` on a non-connected datagram socket is treated as if it were doing an implicit :manpage:`connect(2)` and will be blocked if the remote end does not stem from the same or a nested Landlock domain. A :manpage:`sendto(2)` on a socket which was previously connected will not be restricted. This works for both datagram and stream sockets. h](j-)}(h'``LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET``h]j)}(hjh]h#LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1j,hhhMhjubj=)}(hhh](j()}(hThis limits the set of abstract :manpage:`unix(7)` sockets to which we can :manpage:`connect(2)` to socket addresses which were created by a process in the same or a nested Landlock domain.h](h This limits the set of abstract }(hjhhhNhNubj/)}(h:manpage:`unix(7)`h]hunix(7)}(hjhhhNhNubah}(h]h ]j.ah"]h$]h&]hhj>unix(7)j@unixjBjuh1j.hjubh sockets to which we can }(hjhhhNhNubj/)}(h:manpage:`connect(2)`h]h connect(2)}(hjhhhNhNubah}(h]h ]j.ah"]h$]h&]hhj> connect(2)j@connectjBjCuh1j.hjubh] to socket addresses which were created by a process in the same or a nested Landlock domain.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjubj()}(hA :manpage:`sendto(2)` on a non-connected datagram socket is treated as if it were doing an implicit :manpage:`connect(2)` and will be blocked if the remote end does not stem from the same or a nested Landlock domain.h](hA }(hjhhhNhNubj/)}(h:manpage:`sendto(2)`h]h sendto(2)}(hjhhhNhNubah}(h]h ]j.ah"]h$]h&]hhj> sendto(2)j@sendtojBjCuh1j.hjubhO on a non-connected datagram socket is treated as if it were doing an implicit }(hjhhhNhNubj/)}(h:manpage:`connect(2)`h]h connect(2)}(hjhhhNhNubah}(h]h ]j.ah"]h$]h&]hhj> connect(2)j@connectjBjCuh1j.hjubh_ and will be blocked if the remote end does not stem from the same or a nested Landlock domain.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjubj()}(hA :manpage:`sendto(2)` on a socket which was previously connected will not be restricted. This works for both datagram and stream sockets.h](hA }(hj+hhhNhNubj/)}(h:manpage:`sendto(2)`h]h sendto(2)}(hj3hhhNhNubah}(h]h ]j.ah"]h$]h&]hhj> sendto(2)j@sendtojBjCuh1j.hj+ubhu on a socket which was previously connected will not be restricted. This works for both datagram and stream sockets.}(hj+hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjubeh}(h]h ]h"]h$]h&]uh1j<hjubeh}(h]h ]h"]h$]h&]uh1j&hhhMhjfhhubeh}(h]h ]h"]h$]h&]uh1j!hj$hhhhhNubj()}(hIPC scoping does not support exceptions via :manpage:`landlock_add_rule(2)`. If an operation is scoped within a domain, no rules can be added to allow access to resources or processes outside of the scope.h](h,IPC scoping does not support exceptions via }(hj_hhhNhNubj/)}(h:manpage:`landlock_add_rule(2)`h]hlandlock_add_rule(2)}(hjghhhNhNubah}(h]h ]j.ah"]h$]h&]hhj>landlock_add_rule(2)j@landlock_add_rulejBjCuh1j.hj_ubh. If an operation is scoped within a domain, no rules can be added to allow access to resources or processes outside of the scope.}(hj_hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhj$hhubeh}(h] ipc-scopingah ]h"] ipc scopingah$]h&]uh1hhjhhhhhMubh)}(hhh](h)}(hTruncating filesh]hTruncating files}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhMubj()}(hXThe operations covered by ``LANDLOCK_ACCESS_FS_WRITE_FILE`` and ``LANDLOCK_ACCESS_FS_TRUNCATE`` both change the contents of a file and sometimes overlap in non-intuitive ways. It is strongly recommended to always specify both of these together (either granting both, or granting none).h](hThe operations covered by }(hjhhhNhNubj)}(h!``LANDLOCK_ACCESS_FS_WRITE_FILE``h]hLANDLOCK_ACCESS_FS_WRITE_FILE}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh and }(hjhhhNhNubj)}(h``LANDLOCK_ACCESS_FS_TRUNCATE``h]hLANDLOCK_ACCESS_FS_TRUNCATE}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh both change the contents of a file and sometimes overlap in non-intuitive ways. It is strongly recommended to always specify both of these together (either granting both, or granting none).}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjhhubj()}(hA particularly surprising example is :manpage:`creat(2)`. The name suggests that this system call requires the rights to create and write files. However, it also requires the truncate right if an existing file under the same name is already present.h](h%A particularly surprising example is }(hjhhhNhNubj/)}(h:manpage:`creat(2)`h]hcreat(2)}(hjhhhNhNubah}(h]h ]j.ah"]h$]h&]hhj>creat(2)j@creatjBjCuh1j.hjubh. The name suggests that this system call requires the rights to create and write files. However, it also requires the truncate right if an existing file under the same name is already present.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjhhubj()}(hIt should also be noted that truncating files does not require the ``LANDLOCK_ACCESS_FS_WRITE_FILE`` right. Apart from the :manpage:`truncate(2)` system call, this can also be done through :manpage:`open(2)` with the flags ``O_RDONLY | O_TRUNC``.h](hCIt should also be noted that truncating files does not require the }(hjhhhNhNubj)}(h!``LANDLOCK_ACCESS_FS_WRITE_FILE``h]hLANDLOCK_ACCESS_FS_WRITE_FILE}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh right. Apart from the }(hjhhhNhNubj/)}(h:manpage:`truncate(2)`h]h truncate(2)}(hj hhhNhNubah}(h]h ]j.ah"]h$]h&]hhj> truncate(2)j@truncatejBjCuh1j.hjubh, system call, this can also be done through }(hjhhhNhNubj/)}(h:manpage:`open(2)`h]hopen(2)}(hj hhhNhNubah}(h]h ]j.ah"]h$]h&]hhj>open(2)j@openjBjCuh1j.hjubh with the flags }(hjhhhNhNubj)}(h``O_RDONLY | O_TRUNC``h]hO_RDONLY | O_TRUNC}(hj0 hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjhhubj()}(hAt the same time, on some filesystems, :manpage:`fallocate(2)` offers a way to shorten file contents with ``FALLOC_FL_COLLAPSE_RANGE`` when the file is opened for writing, sidestepping the ``LANDLOCK_ACCESS_FS_TRUNCATE`` right.h](h'At the same time, on some filesystems, }(hjH hhhNhNubj/)}(h:manpage:`fallocate(2)`h]h fallocate(2)}(hjP hhhNhNubah}(h]h ]j.ah"]h$]h&]hhj> fallocate(2)j@ fallocatejBjCuh1j.hjH ubh, offers a way to shorten file contents with }(hjH hhhNhNubj)}(h``FALLOC_FL_COLLAPSE_RANGE``h]hFALLOC_FL_COLLAPSE_RANGE}(hjd hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjH ubh7 when the file is opened for writing, sidestepping the }(hjH hhhNhNubj)}(h``LANDLOCK_ACCESS_FS_TRUNCATE``h]hLANDLOCK_ACCESS_FS_TRUNCATE}(hjv hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjH ubh right.}(hjH hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjhhubj()}(hBThe truncate right is associated with the opened file (see below).h]hBThe truncate right is associated with the opened file (see below).}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMhjhhubeh}(h]truncating-filesah ]h"]truncating filesah$]h&]uh1hhjhhhhhMubh)}(hhh](h)}(h'Rights associated with file descriptorsh]h'Rights associated with file descriptors}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj hhhhhMubj()}(hXWhen opening a file, the availability of the ``LANDLOCK_ACCESS_FS_TRUNCATE`` and ``LANDLOCK_ACCESS_FS_IOCTL_DEV`` rights is associated with the newly created file descriptor and will be used for subsequent truncation and ioctl attempts using :manpage:`ftruncate(2)` and :manpage:`ioctl(2)`. The behavior is similar to opening a file for reading or writing, where permissions are checked during :manpage:`open(2)`, but not during the subsequent :manpage:`read(2)` and :manpage:`write(2)` calls.h](h-When opening a file, the availability of the }(hj hhhNhNubj)}(h``LANDLOCK_ACCESS_FS_TRUNCATE``h]hLANDLOCK_ACCESS_FS_TRUNCATE}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubh and }(hj hhhNhNubj)}(h ``LANDLOCK_ACCESS_FS_IOCTL_DEV``h]hLANDLOCK_ACCESS_FS_IOCTL_DEV}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubh rights is associated with the newly created file descriptor and will be used for subsequent truncation and ioctl attempts using }(hj hhhNhNubj/)}(h:manpage:`ftruncate(2)`h]h ftruncate(2)}(hj hhhNhNubah}(h]h ]j.ah"]h$]h&]hhj> ftruncate(2)j@ ftruncatejBjCuh1j.hj ubh and }(hj hhhNhNubj/)}(h:manpage:`ioctl(2)`h]hioctl(2)}(hj hhhNhNubah}(h]h ]j.ah"]h$]h&]hhj>ioctl(2)j@ioctljBjCuh1j.hj ubhj. The behavior is similar to opening a file for reading or writing, where permissions are checked during }(hj hhhNhNubj/)}(h:manpage:`open(2)`h]hopen(2)}(hj hhhNhNubah}(h]h ]j.ah"]h$]h&]hhj>open(2)j@openjBjCuh1j.hj ubh , but not during the subsequent }(hj hhhNhNubj/)}(h:manpage:`read(2)`h]hread(2)}(hj hhhNhNubah}(h]h ]j.ah"]h$]h&]hhj>read(2)j@readjBjCuh1j.hj ubh and }hj sbj/)}(h:manpage:`write(2)`h]hwrite(2)}(hj1 hhhNhNubah}(h]h ]j.ah"]h$]h&]hhj>write(2)j@writejBjCuh1j.hj ubh calls.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhj hhubj()}(hXAs a consequence, it is possible that a process has multiple open file descriptors referring to the same file, but Landlock enforces different things when operating with these file descriptors. This can happen when a Landlock ruleset gets enforced and the process keeps file descriptors which were opened both before and after the enforcement. It is also possible to pass such file descriptors between processes, keeping their Landlock properties, even when some of the involved processes do not have an enforced Landlock ruleset.h]hXAs a consequence, it is possible that a process has multiple open file descriptors referring to the same file, but Landlock enforces different things when operating with these file descriptors. This can happen when a Landlock ruleset gets enforced and the process keeps file descriptors which were opened both before and after the enforcement. It is also possible to pass such file descriptors between processes, keeping their Landlock properties, even when some of the involved processes do not have an enforced Landlock ruleset.}(hjK hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMhj hhubeh}(h]'rights-associated-with-file-descriptorsah ]h"]'rights associated with file descriptorsah$]h&]uh1hhjhhhhhMubeh}(h]landlock-rulesah ]h"]landlock rulesah$]h&]uh1hhhhhhhhKubh)}(hhh](h)}(h Compatibilityh]h Compatibility}(hjl hhhNhNubah}(h]h ]h"]h$]h&]uh1hhji hhhhhMubh)}(hhh](h)}(h"Backward and forward compatibilityh]h"Backward and forward compatibility}(hj} hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjz hhhhhMubj()}(hXLandlock is designed to be compatible with past and future versions of the kernel. This is achieved thanks to the system call attributes and the associated bitflags, particularly the ruleset's ``handled_access_fs``. Making handled access rights explicit enables the kernel and user space to have a clear contract with each other. This is required to make sure sandboxing will not get stricter with a system update, which could break applications.h](hLandlock is designed to be compatible with past and future versions of the kernel. This is achieved thanks to the system call attributes and the associated bitflags, particularly the ruleset’s }(hj hhhNhNubj)}(h``handled_access_fs``h]hhandled_access_fs}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubh. Making handled access rights explicit enables the kernel and user space to have a clear contract with each other. This is required to make sure sandboxing will not get stricter with a system update, which could break applications.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjz hhubj()}(hXDevelopers can subscribe to the `Landlock mailing list `_ to knowingly update and test their applications with the latest available features. In the interest of users, and because they may use different kernel versions, it is strongly encouraged to follow a best-effort security approach by checking the Landlock ABI version at runtime and only enforcing the supported features.h](h Developers can subscribe to the }(hj hhhNhNubj)}(hK`Landlock mailing list `_h]hLandlock mailing list}(hj hhhNhNubah}(h]h ]h"]h$]h&]nameLandlock mailing listj$0https://subspace.kernel.org/lists.linux.dev.htmluh1jhj ubhtarget)}(h3 h]h}(h]landlock-mailing-listah ]h"]landlock mailing listah$]h&]refurij uh1j j#Khj ubhXB to knowingly update and test their applications with the latest available features. In the interest of users, and because they may use different kernel versions, it is strongly encouraged to follow a best-effort security approach by checking the Landlock ABI version at runtime and only enforcing the supported features.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjz hhubj )}(h.. _landlock_abi_versions:h]h}(h]h ]h"]h$]h&]jMlandlock-abi-versionsuh1j hMhjz hhhhubeh}(h]"backward-and-forward-compatibilityah ]h"]"backward and forward compatibilityah$]h&]uh1hhji hhhhhMubh)}(hhh](h)}(hLandlock ABI versionsh]hLandlock ABI versions}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj hhhhhMubj()}(hXThe Landlock ABI version can be read with the sys_landlock_create_ruleset() system call:h]hXThe Landlock ABI version can be read with the sys_landlock_create_ruleset() system call:}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMhj hhubj)}(hXint abi; abi = landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_VERSION); if (abi < 0) { switch (errno) { case ENOSYS: printf("Landlock is not supported by the current kernel.\n"); break; case EOPNOTSUPP: printf("Landlock is currently disabled.\n"); break; } return 0; } if (abi >= 2) { printf("Landlock supports LANDLOCK_ACCESS_FS_REFER.\n"); }h]hXint abi; abi = landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_VERSION); if (abi < 0) { switch (errno) { case ENOSYS: printf("Landlock is not supported by the current kernel.\n"); break; case EOPNOTSUPP: printf("Landlock is currently disabled.\n"); break; } return 0; } if (abi >= 2) { printf("Landlock supports LANDLOCK_ACCESS_FS_REFER.\n"); }}hj sbah}(h]h ]h"]h$]h&]hhjjjj}uh1jhhhMhj hhubj()}(huAll Landlock kernel interfaces are supported by the first ABI version unless explicitly noted in their documentation.h]huAll Landlock kernel interfaces are supported by the first ABI version unless explicitly noted in their documentation.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMhj hhubeh}(h](j id1eh ]h"](landlock abi versionslandlock_abi_versionseh$]h&]uh1hhji hhhhhMexpect_referenced_by_name}j2 j sexpect_referenced_by_id}j j subh)}(hhh](h)}(hLandlock erratah]hLandlock errata}(hj< hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj9 hhhhhM ubj()}(hIn addition to ABI versions, Landlock provides an errata mechanism to track fixes for issues that may affect backwards compatibility or require userspace awareness. The errata bitmask can be queried using:h]hIn addition to ABI versions, Landlock provides an errata mechanism to track fixes for issues that may affect backwards compatibility or require userspace awareness. The errata bitmask can be queried using:}(hjJ hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhM hj9 hhubj)}(hint errata; errata = landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_ERRATA); if (errata < 0) { /* Landlock not available or disabled */ return 0; }h]hint errata; errata = landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_ERRATA); if (errata < 0) { /* Landlock not available or disabled */ return 0; }}hjX sbah}(h]h ]h"]h$]h&]hhjjjj}uh1jhhhMhj9 hhubj()}(hThe returned value is a bitmask where each bit represents a specific erratum. If bit N is set (``errata & (1 << (N - 1))``), then erratum N has been fixed in the running kernel.h](h_The returned value is a bitmask where each bit represents a specific erratum. If bit N is set (}(hjg hhhNhNubj)}(h``errata & (1 << (N - 1))``h]herrata & (1 << (N - 1))}(hjo hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjg ubh7), then erratum N has been fixed in the running kernel.}(hjg hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhj9 hhubhwarning)}(hXa**Most applications should NOT check errata.** In 99.9% of cases, checking errata is unnecessary, increases code complexity, and can potentially decrease protection if misused. For example, disabling the sandbox when an erratum is not fixed could leave the system less secure than using Landlock's best-effort protection. When in doubt, ignore errata.h]j()}(hXa**Most applications should NOT check errata.** In 99.9% of cases, checking errata is unnecessary, increases code complexity, and can potentially decrease protection if misused. For example, disabling the sandbox when an erratum is not fixed could leave the system less secure than using Landlock's best-effort protection. When in doubt, ignore errata.h](hstrong)}(h.**Most applications should NOT check errata.**h]h*Most applications should NOT check errata.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj ubhX5 In 99.9% of cases, checking errata is unnecessary, increases code complexity, and can potentially decrease protection if misused. For example, disabling the sandbox when an erratum is not fixed could leave the system less secure than using Landlock’s best-effort protection. When in doubt, ignore errata.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhM hj ubah}(h]h ]h"]h$]h&]uh1j hj9 hhhhhNubh)}(hhh](h)}(h$Erratum 1: TCP socket identificationh]h$Erratum 1: TCP socket identification}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj hNhNubj()}(hX]This fix addresses an issue where IPv4 and IPv6 stream sockets (e.g., SMC, MPTCP, or SCTP) were incorrectly restricted by TCP access rights during :manpage:`bind(2)` and :manpage:`connect(2)` operations. This change ensures that only TCP sockets are subject to TCP access rights, allowing other protocols to operate without unnecessary restrictions.h](hThis fix addresses an issue where IPv4 and IPv6 stream sockets (e.g., SMC, MPTCP, or SCTP) were incorrectly restricted by TCP access rights during }(hj hhhNhNubj/)}(h:manpage:`bind(2)`h]hbind(2)}(hj hhhNhNubah}(h]h ]j.ah"]h$]h&]hhj>bind(2)j@bindjBjCuh1j.hj ubh and }(hj hhhNhNubj/)}(h:manpage:`connect(2)`h]h connect(2)}(hj hhhNhNubah}(h]h ]j.ah"]h$]h&]hhj> connect(2)j@connectjBjCuh1j.hj ubh operations. This change ensures that only TCP sockets are subject to TCP access rights, allowing other protocols to operate without unnecessary restrictions.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hh/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:550: ./security/landlock/errata/abi-4.hhKhj ubj()}(hImpact:h]hImpact:}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hh/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:550: ./security/landlock/errata/abi-4.hhK hj ubj()}(hXIn kernels without this fix, using ``LANDLOCK_ACCESS_NET_BIND_TCP`` or ``LANDLOCK_ACCESS_NET_CONNECT_TCP`` would incorrectly restrict non-TCP stream protocols (SMC, MPTCP, SCTP), potentially breaking applications that rely on these protocols while using Landlock network restrictions.h](h#In kernels without this fix, using }(hj hhhNhNubj)}(h ``LANDLOCK_ACCESS_NET_BIND_TCP``h]hLANDLOCK_ACCESS_NET_BIND_TCP}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubh or }(hj hhhNhNubj)}(h#``LANDLOCK_ACCESS_NET_CONNECT_TCP``h]hLANDLOCK_ACCESS_NET_CONNECT_TCP}(hj" hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubh would incorrectly restrict non-TCP stream protocols (SMC, MPTCP, SCTP), potentially breaking applications that rely on these protocols while using Landlock network restrictions.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hh/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:550: ./security/landlock/errata/abi-4.hhKhj ubeh}(h]#erratum-1-tcp-socket-identificationah ]h"]$erratum 1: tcp socket identificationah$]h&]uh1hhj9 hhhNhNubh)}(hhh](h)}(h!Erratum 2: Scoped signal handlingh]h!Erratum 2: Scoped signal handling}(hjF hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjC hNhNubj()}(hXThis fix addresses an issue where signal scoping was overly restrictive, preventing sandboxed threads from signaling other threads within the same process if they belonged to different domains. Because threads are not security boundaries, user space might assume that all threads within the same process can send signals between themselves (see :manpage:`nptl(7)` and :manpage:`libpsx(3)`). Consistent with :manpage:`ptrace(2)` behavior, direct interaction between threads of the same process should always be allowed. This change ensures that any thread is allowed to send signals to any other thread within the same process, regardless of their domain.h](hXZThis fix addresses an issue where signal scoping was overly restrictive, preventing sandboxed threads from signaling other threads within the same process if they belonged to different domains. Because threads are not security boundaries, user space might assume that all threads within the same process can send signals between themselves (see }(hjT hhhNhNubj/)}(h:manpage:`nptl(7)`h]hnptl(7)}(hj\ hhhNhNubah}(h]h ]j.ah"]h$]h&]hhj>nptl(7)j@nptljBjuh1j.hjT ubh and }(hjT hhhNhNubj/)}(h:manpage:`libpsx(3)`h]h libpsx(3)}(hjp hhhNhNubah}(h]h ]j.ah"]h$]h&]hhj> libpsx(3)j@libpsxjB3uh1j.hjT ubh). Consistent with }(hjT hhhNhNubj/)}(h:manpage:`ptrace(2)`h]h ptrace(2)}(hj hhhNhNubah}(h]h ]j.ah"]h$]h&]hhj> ptrace(2)j@ptracejBjCuh1j.hjT ubh behavior, direct interaction between threads of the same process should always be allowed. This change ensures that any thread is allowed to send signals to any other thread within the same process, regardless of their domain.}(hjT hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hh/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:553: ./security/landlock/errata/abi-6.hhKhjC ubj()}(hImpact:h]hImpact:}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hh/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:553: ./security/landlock/errata/abi-6.hhKhjC ubj()}(hXThis problem only manifests when the userspace process is itself using :manpage:`libpsx(3)` or an equivalent mechanism to enforce a Landlock policy on multiple already-running threads at once. Programs which enforce a Landlock policy at startup time and only then become multithreaded are not affected. Without this fix, signal scoping could break multi-threaded applications that expect threads within the same process to freely signal each other.h](hGThis problem only manifests when the userspace process is itself using }(hj hhhNhNubj/)}(h:manpage:`libpsx(3)`h]h libpsx(3)}(hj hhhNhNubah}(h]h ]j.ah"]h$]h&]hhj> libpsx(3)j@libpsxjBj uh1j.hj ubhXg or an equivalent mechanism to enforce a Landlock policy on multiple already-running threads at once. Programs which enforce a Landlock policy at startup time and only then become multithreaded are not affected. Without this fix, signal scoping could break multi-threaded applications that expect threads within the same process to freely signal each other.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hh/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:553: ./security/landlock/errata/abi-6.hhKhjC ubeh}(h] erratum-2-scoped-signal-handlingah ]h"]!erratum 2: scoped signal handlingah$]h&]uh1hhj9 hhhNhNubh)}(hhh](h)}(h*Erratum 3: Disconnected directory handlingh]h*Erratum 3: Disconnected directory handling}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj hNhNubj()}(hX}This fix addresses an issue with disconnected directories that occur when a directory is moved outside the scope of a bind mount. The change ensures that evaluated access rights include both those from the disconnected file hierarchy down to its filesystem root and those from the related mount point hierarchy. This prevents access right widening through rename or link actions.h]hX}This fix addresses an issue with disconnected directories that occur when a directory is moved outside the scope of a bind mount. The change ensures that evaluated access rights include both those from the disconnected file hierarchy down to its filesystem root and those from the related mount point hierarchy. This prevents access right widening through rename or link actions.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hh/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:556: ./security/landlock/errata/abi-1.hhKhj ubj()}(hImpact:h]hImpact:}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hh/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:556: ./security/landlock/errata/abi-1.hhKhj ubj()}(hXFWithout this fix, it was possible to widen access rights through rename or link actions involving disconnected directories, potentially bypassing ``LANDLOCK_ACCESS_FS_REFER`` restrictions. This could allow privilege escalation in complex mount scenarios where directories become disconnected from their original mount points.h](hWithout this fix, it was possible to widen access rights through rename or link actions involving disconnected directories, potentially bypassing }(hj hhhNhNubj)}(h``LANDLOCK_ACCESS_FS_REFER``h]hLANDLOCK_ACCESS_FS_REFER}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubh restrictions. This could allow privilege escalation in complex mount scenarios where directories become disconnected from their original mount points.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hh/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:556: ./security/landlock/errata/abi-1.hhKhj ubeh}(h])erratum-3-disconnected-directory-handlingah ]h"]*erratum 3: disconnected directory handlingah$]h&]uh1hhj9 hhhNhNubh)}(hhh](h)}(hHow to check for erratah]hHow to check for errata}(hj5 hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj2 hhhhhM0ubj()}(h\If you determine that your application needs to check for specific errata, use this pattern:h]h\If you determine that your application needs to check for specific errata, use this pattern:}(hjC hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhM2hj2 hhubj)}(hXVint errata = landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_ERRATA); if (errata >= 0) { /* Check for specific erratum (1-indexed) */ if (errata & (1 << (erratum_number - 1))) { /* Erratum N is fixed in this kernel */ } else { /* Erratum N is NOT fixed - consider implications for your use case */ } }h]hXVint errata = landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_ERRATA); if (errata >= 0) { /* Check for specific erratum (1-indexed) */ if (errata & (1 << (erratum_number - 1))) { /* Erratum N is fixed in this kernel */ } else { /* Erratum N is NOT fixed - consider implications for your use case */ } }}hjQ sbah}(h]h ]h"]h$]h&]hhjjjj}uh1jhhhM5hj2 hhubj()}(h**Important:** Only check errata if your application specifically relies on behavior that changed due to the fix. The fixes generally make Landlock less restrictive or more correct, not more restrictive.h](j )}(h**Important:**h]h Important:}(hjd hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj` ubh Only check errata if your application specifically relies on behavior that changed due to the fix. The fixes generally make Landlock less restrictive or more correct, not more restrictive.}(hj` hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMAhj2 hhubeh}(h]how-to-check-for-errataah ]h"]how to check for errataah$]h&]uh1hhj9 hhhhhM0ubeh}(h]landlock-errataah ]h"]landlock errataah$]h&]uh1hhji hhhhhM ubeh}(h] compatibilityah ]h"] compatibilityah$]h&]uh1hhhhhhhhMubh)}(hhh](h)}(hKernel interfaceh]hKernel interface}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj hhhhhMFubh)}(hhh](h)}(h Access rightsh]h Access rights}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj hhhhhMIubj()}(hA set of actions on kernel objects may be defined by an attribute (e.g. :c:type:`struct landlock_path_beneath_attr `) including a bitmask of access.h](hHA set of actions on kernel objects may be defined by an attribute (e.g. }(hj hhhNhNubh)}(hH:c:type:`struct landlock_path_beneath_attr `h]j)}(hj h]h!struct landlock_path_beneath_attr}(hj hhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jhj ubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnjlandlock_path_beneath_attruh1hhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhMhj ubh ) including a bitmask of access.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hj hMhj hhubh)}(hhh](h)}(hFilesystem flagsh]hFilesystem flags}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj hNhNubj()}(hThese flags enable to restrict a sandboxed process to a set of actions on files and directories. Files or directories opened before the sandboxing are not subject to these restrictions.h]hThese flags enable to restrict a sandboxed process to a set of actions on files and directories. Files or directories opened before the sandboxing are not subject to these restrictions.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhMhj ubj()}(h0The following access rights apply only to files:h]h0The following access rights apply only to files:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhMhj ubh bullet_list)}(hhh](h list_item)}(h/``LANDLOCK_ACCESS_FS_EXECUTE``: Execute a file.h]j()}(hj h](j)}(h``LANDLOCK_ACCESS_FS_EXECUTE``h]hLANDLOCK_ACCESS_FS_EXECUTE}(hj%hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj"ubh: Execute a file.}(hj"hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhMhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hX``LANDLOCK_ACCESS_FS_WRITE_FILE``: Open a file with write access. When opening files for writing, you will often additionally need the ``LANDLOCK_ACCESS_FS_TRUNCATE`` right. In many cases, these system calls truncate existing files when overwriting them (e.g., :manpage:`creat(2)`).h]j()}(hX``LANDLOCK_ACCESS_FS_WRITE_FILE``: Open a file with write access. When opening files for writing, you will often additionally need the ``LANDLOCK_ACCESS_FS_TRUNCATE`` right. In many cases, these system calls truncate existing files when overwriting them (e.g., :manpage:`creat(2)`).h](j)}(h!``LANDLOCK_ACCESS_FS_WRITE_FILE``h]hLANDLOCK_ACCESS_FS_WRITE_FILE}(hjLhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjHubhg: Open a file with write access. When opening files for writing, you will often additionally need the }(hjHhhhNhNubj)}(h``LANDLOCK_ACCESS_FS_TRUNCATE``h]hLANDLOCK_ACCESS_FS_TRUNCATE}(hj^hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjHubh` right. In many cases, these system calls truncate existing files when overwriting them (e.g., }(hjHhhhNhNubj/)}(h:manpage:`creat(2)`h]hcreat(2)}(hjphhhNhNubah}(h]h ]j.ah"]h$]h&]hhj>creat(2)j@creatjBjCuh1j.hjHubh).}(hjHhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhMhjDubah}(h]h ]h"]h$]h&]uh1jhjubj)}(h?``LANDLOCK_ACCESS_FS_READ_FILE``: Open a file with read access.h]j()}(hjh](j)}(h ``LANDLOCK_ACCESS_FS_READ_FILE``h]hLANDLOCK_ACCESS_FS_READ_FILE}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh: Open a file with read access.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhM!hjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(h``LANDLOCK_ACCESS_FS_TRUNCATE``: Truncate a file with :manpage:`truncate(2)`, :manpage:`ftruncate(2)`, :manpage:`creat(2)`, or :manpage:`open(2)` with ``O_TRUNC``. This access right is available since the third version of the Landlock ABI.h]j()}(h``LANDLOCK_ACCESS_FS_TRUNCATE``: Truncate a file with :manpage:`truncate(2)`, :manpage:`ftruncate(2)`, :manpage:`creat(2)`, or :manpage:`open(2)` with ``O_TRUNC``. This access right is available since the third version of the Landlock ABI.h](j)}(h``LANDLOCK_ACCESS_FS_TRUNCATE``h]hLANDLOCK_ACCESS_FS_TRUNCATE}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh: Truncate a file with }(hjhhhNhNubj/)}(h:manpage:`truncate(2)`h]h truncate(2)}(hjhhhNhNubah}(h]h ]j.ah"]h$]h&]hhj> truncate(2)j@truncatejBjCuh1j.hjubh, }(hjhhhNhNubj/)}(h:manpage:`ftruncate(2)`h]h ftruncate(2)}(hjhhhNhNubah}(h]h ]j.ah"]h$]h&]hhj> ftruncate(2)j@ ftruncatejBjCuh1j.hjubh, }(hjhhhNhNubj/)}(h:manpage:`creat(2)`h]hcreat(2)}(hjhhhNhNubah}(h]h ]j.ah"]h$]h&]hhj>creat(2)j@creatjBjCuh1j.hjubh, or }(hjhhhNhNubj/)}(h:manpage:`open(2)`h]hopen(2)}(hj hhhNhNubah}(h]h ]j.ah"]h$]h&]hhj>open(2)j@openjBjCuh1j.hjubh with }(hjhhhNhNubj)}(h ``O_TRUNC``h]hO_TRUNC}(hj!hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhN. This access right is available since the third version of the Landlock ABI.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhM"hjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hX}``LANDLOCK_ACCESS_FS_IOCTL_DEV``: Invoke :manpage:`ioctl(2)` commands on an opened character or block device. This access right applies to all `ioctl(2)` commands implemented by device drivers. However, the following common IOCTL commands continue to be invokable independent of the ``LANDLOCK_ACCESS_FS_IOCTL_DEV`` right: * IOCTL commands targeting file descriptors (``FIOCLEX``, ``FIONCLEX``), * IOCTL commands targeting file descriptions (``FIONBIO``, ``FIOASYNC``), * IOCTL commands targeting file systems (``FIFREEZE``, ``FITHAW``, ``FIGETBSZ``, ``FS_IOC_GETFSUUID``, ``FS_IOC_GETFSSYSFSPATH``) * Some IOCTL commands which do not make sense when used with devices, but whose implementations are safe and return the right error codes (``FS_IOC_FIEMAP``, ``FICLONE``, ``FICLONERANGE``, ``FIDEDUPERANGE``) This access right is available since the fifth version of the Landlock ABI.h](j()}(hm``LANDLOCK_ACCESS_FS_IOCTL_DEV``: Invoke :manpage:`ioctl(2)` commands on an opened character or block device.h](j)}(h ``LANDLOCK_ACCESS_FS_IOCTL_DEV``h]hLANDLOCK_ACCESS_FS_IOCTL_DEV}(hjHhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjDubh : Invoke }(hjDhhhNhNubj/)}(h:manpage:`ioctl(2)`h]hioctl(2)}(hjZhhhNhNubah}(h]h ]j.ah"]h$]h&]hhj>ioctl(2)j@ioctljBjCuh1j.hjDubh1 commands on an opened character or block device.}(hjDhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhM&hj@ubj()}(hThis access right applies to all `ioctl(2)` commands implemented by device drivers. However, the following common IOCTL commands continue to be invokable independent of the ``LANDLOCK_ACCESS_FS_IOCTL_DEV`` right:h](h!This access right applies to all }(hjuhhhNhNubjJ)}(h `ioctl(2)`h]hioctl(2)}(hj}hhhNhNubah}(h]h ]h"]h$]h&]uh1jIhjuubh commands implemented by device drivers. However, the following common IOCTL commands continue to be invokable independent of the }(hjuhhhNhNubj)}(h ``LANDLOCK_ACCESS_FS_IOCTL_DEV``h]hLANDLOCK_ACCESS_FS_IOCTL_DEV}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjuubh right:}(hjuhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhM)hj@ubj)}(hhh](j)}(hFIOCTL commands targeting file descriptors (``FIOCLEX``, ``FIONCLEX``),h]j()}(hjh](h+IOCTL commands targeting file descriptors (}(hjhhhNhNubj)}(h ``FIOCLEX``h]hFIOCLEX}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh, }(hjhhhNhNubj)}(h ``FIONCLEX``h]hFIONCLEX}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh),}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhM-hjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hGIOCTL commands targeting file descriptions (``FIONBIO``, ``FIOASYNC``),h]j()}(hjh](h,IOCTL commands targeting file descriptions (}(hjhhhNhNubj)}(h ``FIONBIO``h]hFIONBIO}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh, }(hjhhhNhNubj)}(h ``FIOASYNC``h]hFIOASYNC}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh),}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhM.hjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hIOCTL commands targeting file systems (``FIFREEZE``, ``FITHAW``, ``FIGETBSZ``, ``FS_IOC_GETFSUUID``, ``FS_IOC_GETFSSYSFSPATH``)h]j()}(hIOCTL commands targeting file systems (``FIFREEZE``, ``FITHAW``, ``FIGETBSZ``, ``FS_IOC_GETFSUUID``, ``FS_IOC_GETFSSYSFSPATH``)h](h'IOCTL commands targeting file systems (}(hj'hhhNhNubj)}(h ``FIFREEZE``h]hFIFREEZE}(hj/hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj'ubh, }(hj'hhhNhNubj)}(h ``FITHAW``h]hFITHAW}(hjAhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj'ubh, }(hj'hhhNhNubj)}(h ``FIGETBSZ``h]hFIGETBSZ}(hjShhhNhNubah}(h]h ]h"]h$]h&]uh1jhj'ubh, }hj'sbj)}(h``FS_IOC_GETFSUUID``h]hFS_IOC_GETFSUUID}(hjehhhNhNubah}(h]h ]h"]h$]h&]uh1jhj'ubh, }hj'sbj)}(h``FS_IOC_GETFSSYSFSPATH``h]hFS_IOC_GETFSSYSFSPATH}(hjwhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj'ubh)}(hj'hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhM/hj#ubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hSome IOCTL commands which do not make sense when used with devices, but whose implementations are safe and return the right error codes (``FS_IOC_FIEMAP``, ``FICLONE``, ``FICLONERANGE``, ``FIDEDUPERANGE``) h]j()}(hSome IOCTL commands which do not make sense when used with devices, but whose implementations are safe and return the right error codes (``FS_IOC_FIEMAP``, ``FICLONE``, ``FICLONERANGE``, ``FIDEDUPERANGE``)h](hSome IOCTL commands which do not make sense when used with devices, but whose implementations are safe and return the right error codes (}(hjhhhNhNubj)}(h``FS_IOC_FIEMAP``h]h FS_IOC_FIEMAP}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh, }(hjhhhNhNubj)}(h ``FICLONE``h]hFICLONE}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh, }hjsbj)}(h``FICLONERANGE``h]h FICLONERANGE}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh, }hjsbj)}(h``FIDEDUPERANGE``h]h FIDEDUPERANGE}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh)}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhM1hjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]bullet*uh1jhjhM-hj@ubj()}(hKThis access right is available since the fifth version of the Landlock ABI.h]hKThis access right is available since the fifth version of the Landlock ABI.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhM5hj@ubeh}(h]h ]h"]h$]h&]uh1jhjubj)}(hX``LANDLOCK_ACCESS_FS_RESOLVE_UNIX``: Look up pathname UNIX domain sockets (:manpage:`unix(7)`). On UNIX domain sockets, this restricts both calls to :manpage:`connect(2)` as well as calls to :manpage:`sendmsg(2)` with an explicit recipient address. This access right only applies to connections to UNIX server sockets which were created outside of the newly created Landlock domain (e.g. from within a parent domain or from an unrestricted process). Newly created UNIX servers within the same Landlock domain continue to be accessible. In this regard, ``LANDLOCK_ACCESS_FS_RESOLVE_UNIX`` has the same semantics as the ``LANDLOCK_SCOPE_*`` flags. If a resolve attempt is denied, the operation returns an ``EACCES`` error, in line with other filesystem access rights (but different to denials for abstract UNIX domain sockets). This access right is available since the ninth version of the Landlock ABI. The rationale for this design is described in :ref:`Documentation/security/landlock.rst `. h](j()}(h``LANDLOCK_ACCESS_FS_RESOLVE_UNIX``: Look up pathname UNIX domain sockets (:manpage:`unix(7)`). On UNIX domain sockets, this restricts both calls to :manpage:`connect(2)` as well as calls to :manpage:`sendmsg(2)` with an explicit recipient address.h](j)}(h#``LANDLOCK_ACCESS_FS_RESOLVE_UNIX``h]hLANDLOCK_ACCESS_FS_RESOLVE_UNIX}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh(: Look up pathname UNIX domain sockets (}(hjhhhNhNubj/)}(h:manpage:`unix(7)`h]hunix(7)}(hj.hhhNhNubah}(h]h ]j.ah"]h$]h&]hhj>unix(7)j@unixjBjuh1j.hjubh9). On UNIX domain sockets, this restricts both calls to }(hjhhhNhNubj/)}(h:manpage:`connect(2)`h]h connect(2)}(hjBhhhNhNubah}(h]h ]j.ah"]h$]h&]hhj> connect(2)j@connectjBjCuh1j.hjubh as well as calls to }(hjhhhNhNubj/)}(h:manpage:`sendmsg(2)`h]h sendmsg(2)}(hjVhhhNhNubah}(h]h ]j.ah"]h$]h&]hhj> sendmsg(2)j@sendmsgjBjCuh1j.hjubh$ with an explicit recipient address.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhM7hjubj()}(hXThis access right only applies to connections to UNIX server sockets which were created outside of the newly created Landlock domain (e.g. from within a parent domain or from an unrestricted process). Newly created UNIX servers within the same Landlock domain continue to be accessible. In this regard, ``LANDLOCK_ACCESS_FS_RESOLVE_UNIX`` has the same semantics as the ``LANDLOCK_SCOPE_*`` flags.h](hX1This access right only applies to connections to UNIX server sockets which were created outside of the newly created Landlock domain (e.g. from within a parent domain or from an unrestricted process). Newly created UNIX servers within the same Landlock domain continue to be accessible. In this regard, }(hjqhhhNhNubj)}(h#``LANDLOCK_ACCESS_FS_RESOLVE_UNIX``h]hLANDLOCK_ACCESS_FS_RESOLVE_UNIX}(hjyhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjqubh has the same semantics as the }(hjqhhhNhNubj)}(h``LANDLOCK_SCOPE_*``h]hLANDLOCK_SCOPE_*}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjqubh flags.}(hjqhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhM<hjubj()}(hIf a resolve attempt is denied, the operation returns an ``EACCES`` error, in line with other filesystem access rights (but different to denials for abstract UNIX domain sockets).h](h9If a resolve attempt is denied, the operation returns an }(hjhhhNhNubj)}(h ``EACCES``h]hEACCES}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhp error, in line with other filesystem access rights (but different to denials for abstract UNIX domain sockets).}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhMChjubj()}(hKThis access right is available since the ninth version of the Landlock ABI.h]hKThis access right is available since the ninth version of the Landlock ABI.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhMGhjubj()}(htThe rationale for this design is described in :ref:`Documentation/security/landlock.rst `.h](h.The rationale for this design is described in }(hjhhhNhNubh)}(hE:ref:`Documentation/security/landlock.rst `h]j)}(hjh]h#Documentation/security/landlock.rst}(hjhhhNhNubah}(h]h ](jstdstd-refeh"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]refdocj refdomainjreftyperef refexplicitrefwarnjscoped-flags-interactionuh1hhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhMIhjubh.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hjhMIhjubeh}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]j-uh1jhj=hMhj ubj()}(hX'Whether an opened file can be truncated with :manpage:`ftruncate(2)` or used with `ioctl(2)` is determined during :manpage:`open(2)`, in the same way as read and write permissions are checked during :manpage:`open(2)` using ``LANDLOCK_ACCESS_FS_READ_FILE`` and ``LANDLOCK_ACCESS_FS_WRITE_FILE``.h](h-Whether an opened file can be truncated with }(hjhhhNhNubj/)}(h:manpage:`ftruncate(2)`h]h ftruncate(2)}(hjhhhNhNubah}(h]h ]j.ah"]h$]h&]hhj> ftruncate(2)j@ ftruncatejBjCuh1j.hjubh or used with }(hjhhhNhNubjJ)}(h `ioctl(2)`h]hioctl(2)}(hj0hhhNhNubah}(h]h ]h"]h$]h&]uh1jIhjubh is determined during }(hjhhhNhNubj/)}(h:manpage:`open(2)`h]hopen(2)}(hjBhhhNhNubah}(h]h ]j.ah"]h$]h&]hhj>open(2)j@openjBjCuh1j.hjubhC, in the same way as read and write permissions are checked during }(hjhhhNhNubj/)}(h:manpage:`open(2)`h]hopen(2)}(hjVhhhNhNubah}(h]h ]j.ah"]h$]h&]hhj>open(2)j@openjBjCuh1j.hjubh using }(hjhhhNhNubj)}(h ``LANDLOCK_ACCESS_FS_READ_FILE``h]hLANDLOCK_ACCESS_FS_READ_FILE}(hjjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh and }(hjhhhNhNubj)}(h!``LANDLOCK_ACCESS_FS_WRITE_FILE``h]hLANDLOCK_ACCESS_FS_WRITE_FILE}(hj|hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhMLhj ubj()}(hA directory can receive access rights related to files or directories. The following access right is applied to the directory itself, and the directories beneath it:h]hA directory can receive access rights related to files or directories. The following access right is applied to the directory itself, and the directories beneath it:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhMQhj ubj)}(hhh]j)}(hG``LANDLOCK_ACCESS_FS_READ_DIR``: Open a directory or list its content. h]j()}(hF``LANDLOCK_ACCESS_FS_READ_DIR``: Open a directory or list its content.h](j)}(h``LANDLOCK_ACCESS_FS_READ_DIR``h]hLANDLOCK_ACCESS_FS_READ_DIR}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh': Open a directory or list its content.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhMUhjubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]jjuh1jhjhMUhj ubj()}(hhHowever, the following access rights only apply to the content of a directory, not the directory itself:h]hhHowever, the following access rights only apply to the content of a directory, not the directory itself:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhMWhj ubj)}(hhh](j)}(hK``LANDLOCK_ACCESS_FS_REMOVE_DIR``: Remove an empty directory or rename one.h]j()}(hjh](j)}(h!``LANDLOCK_ACCESS_FS_REMOVE_DIR``h]hLANDLOCK_ACCESS_FS_REMOVE_DIR}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh*: Remove an empty directory or rename one.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhMZhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(h>``LANDLOCK_ACCESS_FS_REMOVE_FILE``: Unlink (or rename) a file.h]j()}(hjh](j)}(h"``LANDLOCK_ACCESS_FS_REMOVE_FILE``h]hLANDLOCK_ACCESS_FS_REMOVE_FILE}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh: Unlink (or rename) a file.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhM[hj ubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hP``LANDLOCK_ACCESS_FS_MAKE_CHAR``: Create (or rename or link) a character device.h]j()}(hP``LANDLOCK_ACCESS_FS_MAKE_CHAR``: Create (or rename or link) a character device.h](j)}(h ``LANDLOCK_ACCESS_FS_MAKE_CHAR``h]hLANDLOCK_ACCESS_FS_MAKE_CHAR}(hj:hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj6ubh0: Create (or rename or link) a character device.}(hj6hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhM\hj2ubah}(h]h ]h"]h$]h&]uh1jhjubj)}(h@``LANDLOCK_ACCESS_FS_MAKE_DIR``: Create (or rename) a directory.h]j()}(hj[h](j)}(h``LANDLOCK_ACCESS_FS_MAKE_DIR``h]hLANDLOCK_ACCESS_FS_MAKE_DIR}(hj`hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj]ubh!: Create (or rename) a directory.}(hj]hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhM^hjYubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hK``LANDLOCK_ACCESS_FS_MAKE_REG``: Create (or rename or link) a regular file.h]j()}(hjh](j)}(h``LANDLOCK_ACCESS_FS_MAKE_REG``h]hLANDLOCK_ACCESS_FS_MAKE_REG}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh,: Create (or rename or link) a regular file.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhM_hjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hR``LANDLOCK_ACCESS_FS_MAKE_SOCK``: Create (or rename or link) a UNIX domain socket.h]j()}(hR``LANDLOCK_ACCESS_FS_MAKE_SOCK``: Create (or rename or link) a UNIX domain socket.h](j)}(h ``LANDLOCK_ACCESS_FS_MAKE_SOCK``h]hLANDLOCK_ACCESS_FS_MAKE_SOCK}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh2: Create (or rename or link) a UNIX domain socket.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhM`hjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hJ``LANDLOCK_ACCESS_FS_MAKE_FIFO``: Create (or rename or link) a named pipe.h]j()}(hjh](j)}(h ``LANDLOCK_ACCESS_FS_MAKE_FIFO``h]hLANDLOCK_ACCESS_FS_MAKE_FIFO}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh*: Create (or rename or link) a named pipe.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhMbhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hM``LANDLOCK_ACCESS_FS_MAKE_BLOCK``: Create (or rename or link) a block device.h]j()}(hjh](j)}(h!``LANDLOCK_ACCESS_FS_MAKE_BLOCK``h]hLANDLOCK_ACCESS_FS_MAKE_BLOCK}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh,: Create (or rename or link) a block device.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhMchjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hL``LANDLOCK_ACCESS_FS_MAKE_SYM``: Create (or rename or link) a symbolic link.h]j()}(hjh](j)}(h``LANDLOCK_ACCESS_FS_MAKE_SYM``h]hLANDLOCK_ACCESS_FS_MAKE_SYM}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh-: Create (or rename or link) a symbolic link.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhMdhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hX``LANDLOCK_ACCESS_FS_REFER``: Link or rename a file from or to a different directory (i.e. reparent a file hierarchy). This access right is available since the second version of the Landlock ABI. This is the only access right which is denied by default by any ruleset, even if the right is not specified as handled at ruleset creation time. The only way to make a ruleset grant this right is to explicitly allow it for a specific directory by adding a matching rule to the ruleset. In particular, when using the first Landlock ABI version, Landlock will always deny attempts to reparent files between different directories. In addition to the source and destination directories having the ``LANDLOCK_ACCESS_FS_REFER`` access right, the attempted link or rename operation must meet the following constraints: * The reparented file may not gain more access rights in the destination directory than it previously had in the source directory. If this is attempted, the operation results in an ``EXDEV`` error. * When linking or renaming, the ``LANDLOCK_ACCESS_FS_MAKE_*`` right for the respective file type must be granted for the destination directory. Otherwise, the operation results in an ``EACCES`` error. * When renaming, the ``LANDLOCK_ACCESS_FS_REMOVE_*`` right for the respective file type must be granted for the source directory. Otherwise, the operation results in an ``EACCES`` error. If multiple requirements are not met, the ``EACCES`` error code takes precedence over ``EXDEV``. h](j()}(hv``LANDLOCK_ACCESS_FS_REFER``: Link or rename a file from or to a different directory (i.e. reparent a file hierarchy).h](j)}(h``LANDLOCK_ACCESS_FS_REFER``h]hLANDLOCK_ACCESS_FS_REFER}(hjFhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjBubhZ: Link or rename a file from or to a different directory (i.e. reparent a file hierarchy).}(hjBhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhMehj>ubj()}(hLThis access right is available since the second version of the Landlock ABI.h]hLThis access right is available since the second version of the Landlock ABI.}(hj_hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhMhhj>ubj()}(hXThis is the only access right which is denied by default by any ruleset, even if the right is not specified as handled at ruleset creation time. The only way to make a ruleset grant this right is to explicitly allow it for a specific directory by adding a matching rule to the ruleset.h]hXThis is the only access right which is denied by default by any ruleset, even if the right is not specified as handled at ruleset creation time. The only way to make a ruleset grant this right is to explicitly allow it for a specific directory by adding a matching rule to the ruleset.}(hjnhhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhMkhj>ubj()}(hIn particular, when using the first Landlock ABI version, Landlock will always deny attempts to reparent files between different directories.h]hIn particular, when using the first Landlock ABI version, Landlock will always deny attempts to reparent files between different directories.}(hj}hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhMphj>ubj()}(hIn addition to the source and destination directories having the ``LANDLOCK_ACCESS_FS_REFER`` access right, the attempted link or rename operation must meet the following constraints:h](hAIn addition to the source and destination directories having the }(hjhhhNhNubj)}(h``LANDLOCK_ACCESS_FS_REFER``h]hLANDLOCK_ACCESS_FS_REFER}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhZ access right, the attempted link or rename operation must meet the following constraints:}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhMshj>ubj)}(hhh](j)}(hThe reparented file may not gain more access rights in the destination directory than it previously had in the source directory. If this is attempted, the operation results in an ``EXDEV`` error. h]j()}(hThe reparented file may not gain more access rights in the destination directory than it previously had in the source directory. If this is attempted, the operation results in an ``EXDEV`` error.h](hThe reparented file may not gain more access rights in the destination directory than it previously had in the source directory. If this is attempted, the operation results in an }(hjhhhNhNubj)}(h ``EXDEV``h]hEXDEV}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh error.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhMwhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hWhen linking or renaming, the ``LANDLOCK_ACCESS_FS_MAKE_*`` right for the respective file type must be granted for the destination directory. Otherwise, the operation results in an ``EACCES`` error. h]j()}(hWhen linking or renaming, the ``LANDLOCK_ACCESS_FS_MAKE_*`` right for the respective file type must be granted for the destination directory. Otherwise, the operation results in an ``EACCES`` error.h](hWhen linking or renaming, the }(hjhhhNhNubj)}(h``LANDLOCK_ACCESS_FS_MAKE_*``h]hLANDLOCK_ACCESS_FS_MAKE_*}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhz right for the respective file type must be granted for the destination directory. Otherwise, the operation results in an }(hjhhhNhNubj)}(h ``EACCES``h]hEACCES}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh error.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhM{hjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hWhen renaming, the ``LANDLOCK_ACCESS_FS_REMOVE_*`` right for the respective file type must be granted for the source directory. Otherwise, the operation results in an ``EACCES`` error. h]j()}(hWhen renaming, the ``LANDLOCK_ACCESS_FS_REMOVE_*`` right for the respective file type must be granted for the source directory. Otherwise, the operation results in an ``EACCES`` error.h](hWhen renaming, the }(hjhhhNhNubj)}(h``LANDLOCK_ACCESS_FS_REMOVE_*``h]hLANDLOCK_ACCESS_FS_REMOVE_*}(hj$hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhv right for the respective file type must be granted for the source directory. Otherwise, the operation results in an }(hjhhhNhNubj)}(h ``EACCES``h]hEACCES}(hj6hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh error.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhMhjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]jjuh1jhjhMwhj>ubj()}(h`If multiple requirements are not met, the ``EACCES`` error code takes precedence over ``EXDEV``.h](h*If multiple requirements are not met, the }(hj[hhhNhNubj)}(h ``EACCES``h]hEACCES}(hjchhhNhNubah}(h]h ]h"]h$]h&]uh1jhj[ubh" error code takes precedence over }(hj[hhhNhNubj)}(h ``EXDEV``h]hEXDEV}(hjuhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj[ubh.}(hj[hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhMhj>ubeh}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]jjuh1jhjhMZhj ubj )}(hXfIt is currently not possible to restrict some file-related actions accessible through these syscall families: :manpage:`chdir(2)`, :manpage:`stat(2)`, :manpage:`flock(2)`, :manpage:`chmod(2)`, :manpage:`chown(2)`, :manpage:`setxattr(2)`, :manpage:`utime(2)`, :manpage:`fcntl(2)`, :manpage:`access(2)`. Future Landlock evolutions will enable to restrict them.h]j()}(hXfIt is currently not possible to restrict some file-related actions accessible through these syscall families: :manpage:`chdir(2)`, :manpage:`stat(2)`, :manpage:`flock(2)`, :manpage:`chmod(2)`, :manpage:`chown(2)`, :manpage:`setxattr(2)`, :manpage:`utime(2)`, :manpage:`fcntl(2)`, :manpage:`access(2)`. Future Landlock evolutions will enable to restrict them.h](hnIt is currently not possible to restrict some file-related actions accessible through these syscall families: }(hjhhhNhNubj/)}(h:manpage:`chdir(2)`h]hchdir(2)}(hjhhhNhNubah}(h]h ]j.ah"]h$]h&]hhj>chdir(2)j@chdirjBjCuh1j.hjubh, }(hjhhhNhNubj/)}(h:manpage:`stat(2)`h]hstat(2)}(hjhhhNhNubah}(h]h ]j.ah"]h$]h&]hhj>stat(2)j@statjBjCuh1j.hjubh, }(hjhhhNhNubj/)}(h:manpage:`flock(2)`h]hflock(2)}(hjhhhNhNubah}(h]h ]j.ah"]h$]h&]hhj>flock(2)j@flockjBjCuh1j.hjubh, }hjsbj/)}(h:manpage:`chmod(2)`h]hchmod(2)}(hjhhhNhNubah}(h]h ]j.ah"]h$]h&]hhj>chmod(2)j@chmodjBjCuh1j.hjubh, }hjsbj/)}(h:manpage:`chown(2)`h]hchown(2)}(hjhhhNhNubah}(h]h ]j.ah"]h$]h&]hhj>chown(2)j@chownjBjCuh1j.hjubh, }hjsbj/)}(h:manpage:`setxattr(2)`h]h setxattr(2)}(hj hhhNhNubah}(h]h ]j.ah"]h$]h&]hhj> setxattr(2)j@setxattrjBjCuh1j.hjubh, }hjsbj/)}(h:manpage:`utime(2)`h]hutime(2)}(hjhhhNhNubah}(h]h ]j.ah"]h$]h&]hhj>utime(2)j@utimejBjCuh1j.hjubh, }hjsbj/)}(h:manpage:`fcntl(2)`h]hfcntl(2)}(hj2hhhNhNubah}(h]h ]j.ah"]h$]h&]hhj>fcntl(2)j@fcntljBjCuh1j.hjubh, }hjsbj/)}(h:manpage:`access(2)`h]h access(2)}(hjFhhhNhNubah}(h]h ]j.ah"]h$]h&]hhj> access(2)j@accessjBjCuh1j.hjubh:. Future Landlock evolutions will enable to restrict them.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhMhjubah}(h]h ]h"]h$]h&]uh1j hj ubeh}(h]filesystem-flagsah ]h"]filesystem flagsah$]h&]uh1hhj hhhNhNj#Kubh)}(hhh](h)}(h Network flagsh]h Network flags}(hjrhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjohNhNubj()}(hOThese flags enable to restrict a sandboxed process to a set of network actions.h]hOThese flags enable to restrict a sandboxed process to a set of network actions.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhMhjoubj()}(h6The following access rights apply to TCP port numbers:h]h6The following access rights apply to TCP port numbers:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhMhjoubj)}(hhh](j)}(ht``LANDLOCK_ACCESS_NET_BIND_TCP``: Bind TCP sockets to the given local port. Support added in Landlock ABI version 4.h]j()}(ht``LANDLOCK_ACCESS_NET_BIND_TCP``: Bind TCP sockets to the given local port. Support added in Landlock ABI version 4.h](j)}(h ``LANDLOCK_ACCESS_NET_BIND_TCP``h]hLANDLOCK_ACCESS_NET_BIND_TCP}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhT: Bind TCP sockets to the given local port. Support added in Landlock ABI version 4.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhMhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(h|``LANDLOCK_ACCESS_NET_CONNECT_TCP``: Connect TCP sockets to the given remote port. Support added in Landlock ABI version 4. h]j()}(h{``LANDLOCK_ACCESS_NET_CONNECT_TCP``: Connect TCP sockets to the given remote port. Support added in Landlock ABI version 4.h](j)}(h#``LANDLOCK_ACCESS_NET_CONNECT_TCP``h]hLANDLOCK_ACCESS_NET_CONNECT_TCP}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhX: Connect TCP sockets to the given remote port. Support added in Landlock ABI version 4.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhMhjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]jjuh1jhjhMhjoubj()}(h#And similarly for UDP port numbers:h]h#And similarly for UDP port numbers:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhMhjoubj)}(hhh](j)}(hu``LANDLOCK_ACCESS_NET_BIND_UDP``: Bind UDP sockets to the given local port. Support added in Landlock ABI version 10.h]j()}(hu``LANDLOCK_ACCESS_NET_BIND_UDP``: Bind UDP sockets to the given local port. Support added in Landlock ABI version 10.h](j)}(h ``LANDLOCK_ACCESS_NET_BIND_UDP``h]hLANDLOCK_ACCESS_NET_BIND_UDP}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubhU: Bind UDP sockets to the given local port. Support added in Landlock ABI version 10.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhMhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(h``LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP``: Set the remote port of UDP sockets to the given port, or send datagrams to the given remote port ignoring any destination pre-set on a socket. Support added in Landlock ABI version 10. h]j()}(h``LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP``: Set the remote port of UDP sockets to the given port, or send datagrams to the given remote port ignoring any destination pre-set on a socket. Support added in Landlock ABI version 10.h](j)}(h(``LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP``h]h$LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP}(hj6hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj2ubh: Set the remote port of UDP sockets to the given port, or send datagrams to the given remote port ignoring any destination pre-set on a socket. Support added in Landlock ABI version 10.}(hj2hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhMhj.ubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]jjuh1jhj'hMhjoubhnote)}(hXmSetting a remote address or sending a first datagram auto-binds UDP sockets to an ephemeral local source port if not already bound. To allow this if both ``LANDLOCK_ACCESS_NET_BIND_UDP`` and ``LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP`` are handled, you need to either: - use a socket already bound to a port before the ruleset started being enforced; - or grant ``LANDLOCK_ACCESS_NET_BIND_UDP`` on port 0, meaning "any port in the ephemeral port range"; - or grant ``LANDLOCK_ACCESS_NET_BIND_UDP`` on a specific port, and call :manpage:`bind(2)` on that port before trying to :manpage:`connect(2)` or send datagrams.h](j()}(hXSetting a remote address or sending a first datagram auto-binds UDP sockets to an ephemeral local source port if not already bound. To allow this if both ``LANDLOCK_ACCESS_NET_BIND_UDP`` and ``LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP`` are handled, you need to either:h](hSetting a remote address or sending a first datagram auto-binds UDP sockets to an ephemeral local source port if not already bound. To allow this if both }(hjahhhNhNubj)}(h ``LANDLOCK_ACCESS_NET_BIND_UDP``h]hLANDLOCK_ACCESS_NET_BIND_UDP}(hjihhhNhNubah}(h]h ]h"]h$]h&]uh1jhjaubh and }(hjahhhNhNubj)}(h(``LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP``h]h$LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP}(hj{hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjaubh! are handled, you need to either:}(hjahhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhMhj]ubj)}(hhh](j)}(hOuse a socket already bound to a port before the ruleset started being enforced;h]j()}(hOuse a socket already bound to a port before the ruleset started being enforced;h]hOuse a socket already bound to a port before the ruleset started being enforced;}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhMhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hdor grant ``LANDLOCK_ACCESS_NET_BIND_UDP`` on port 0, meaning "any port in the ephemeral port range";h]j()}(hdor grant ``LANDLOCK_ACCESS_NET_BIND_UDP`` on port 0, meaning "any port in the ephemeral port range";h](h or grant }(hjhhhNhNubj)}(h ``LANDLOCK_ACCESS_NET_BIND_UDP``h]hLANDLOCK_ACCESS_NET_BIND_UDP}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh? on port 0, meaning “any port in the ephemeral port range”;}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhMhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hor grant ``LANDLOCK_ACCESS_NET_BIND_UDP`` on a specific port, and call :manpage:`bind(2)` on that port before trying to :manpage:`connect(2)` or send datagrams.h]j()}(hor grant ``LANDLOCK_ACCESS_NET_BIND_UDP`` on a specific port, and call :manpage:`bind(2)` on that port before trying to :manpage:`connect(2)` or send datagrams.h](h or grant }(hjhhhNhNubj)}(h ``LANDLOCK_ACCESS_NET_BIND_UDP``h]hLANDLOCK_ACCESS_NET_BIND_UDP}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh on a specific port, and call }(hjhhhNhNubj/)}(h:manpage:`bind(2)`h]hbind(2)}(hjhhhNhNubah}(h]h ]j.ah"]h$]h&]hhj>bind(2)j@bindjBjCuh1j.hjubh on that port before trying to }(hjhhhNhNubj/)}(h:manpage:`connect(2)`h]h connect(2)}(hj hhhNhNubah}(h]h ]j.ah"]h$]h&]hhj> connect(2)j@connectjBjCuh1j.hjubh or send datagrams.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhMhjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]jjuh1jhjhMhj]ubeh}(h]h ]h"]h$]h&]uh1j[hjoubj\)}(hSending datagrams to an ``AF_UNSPEC`` destination address family is not supported for IPv6 UDP sockets: you will need to use a ``NULL`` address instead.h]j()}(hSending datagrams to an ``AF_UNSPEC`` destination address family is not supported for IPv6 UDP sockets: you will need to use a ``NULL`` address instead.h](hSending datagrams to an }(hj>hhhNhNubj)}(h ``AF_UNSPEC``h]h AF_UNSPEC}(hjFhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj>ubhZ destination address family is not supported for IPv6 UDP sockets: you will need to use a }(hj>hhhNhNubj)}(h``NULL``h]hNULL}(hjXhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj>ubh address instead.}(hj>hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhMhj:ubah}(h]h ]h"]h$]h&]uh1j[hjoubeh}(h] network-flagsah ]h"] network flagsah$]h&]uh1hhj hhhNhNj#Kubh)}(hhh](h)}(h Scope flagsh]h Scope flags}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhNhNubj()}(hThese flags enable to isolate a sandboxed process from a set of IPC actions. Setting a flag for a ruleset will isolate the Landlock domain to forbid connections to resources outside the domain.h]hThese flags enable to isolate a sandboxed process from a set of IPC actions. Setting a flag for a ruleset will isolate the Landlock domain to forbid connections to resources outside the domain.}(hjhhhNhNubaIh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhMhjubj()}(h/This is supported since Landlock ABI version 6.h]h/This is supported since Landlock ABI version 6.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhMhjubj()}(hScopes:h]hScopes:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhMhjubj)}(hhh](j)}(h``LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET``: Restrict a sandboxed process from connecting to an abstract UNIX socket created by a process outside the related Landlock domain (e.g., a parent domain or a non-sandboxed process).h]j()}(h``LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET``: Restrict a sandboxed process from connecting to an abstract UNIX socket created by a process outside the related Landlock domain (e.g., a parent domain or a non-sandboxed process).h](j)}(h'``LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET``h]h#LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh: Restrict a sandboxed process from connecting to an abstract UNIX socket created by a process outside the related Landlock domain (e.g., a parent domain or a non-sandboxed process).}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhMhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hv``LANDLOCK_SCOPE_SIGNAL``: Restrict a sandboxed process from sending a signal to another process outside the domain. h]j()}(ht``LANDLOCK_SCOPE_SIGNAL``: Restrict a sandboxed process from sending a signal to another process outside the domain.h](j)}(h``LANDLOCK_SCOPE_SIGNAL``h]hLANDLOCK_SCOPE_SIGNAL}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh[: Restrict a sandboxed process from sending a signal to another process outside the domain.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:587: ./include/uapi/linux/landlock.hhMhjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]jjuh1jhjhMhjubeh}(h] scope-flagsah ]h"] scope flagsah$]h&]uh1hhj hhhNhNj#Kubeh}(h] access-rightsah ]h"] access rightsah$]h&]uh1hhj hhhhhMIubh)}(hhh](h)}(hCreating a new ruleseth]hCreating a new ruleset}(hj'hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj$hhhhhMOubhindex)}(hhh]h}(h]h ]h"]h$]h&]entries](single(sys_landlock_create_ruleset (C function)c.sys_landlock_create_rulesethNtauh1j5hj$hhhNhNubhdesc)}(hhh](hdesc_signature)}(h~long sys_landlock_create_ruleset (const struct landlock_ruleset_attr __user *const attr, const size_t size, const __u32 flags)h]hdesc_signature_line)}(h}long sys_landlock_create_ruleset(const struct landlock_ruleset_attr __user *const attr, const size_t size, const __u32 flags)h](hdesc_sig_keyword_type)}(hlongh]hlong}(hjYhhhNhNubah}(h]h ]ktah"]h$]h&]uh1jWhjShhhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:593: ./security/landlock/syscalls.chKubhdesc_sig_space)}(h h]h }(hjkhhhNhNubah}(h]h ]wah"]h$]h&]uh1jihjShhhjhhKubh desc_name)}(hsys_landlock_create_ruleseth]h desc_sig_name)}(hsys_landlock_create_ruleseth]hsys_landlock_create_ruleset}(hjhhhNhNubah}(h]h ]nah"]h$]h&]uh1jhj|ubah}(h]h ](sig-namedescnameeh"]h$]h&]hhuh1jzhjShhhjhhKubhdesc_parameterlist)}(h](const struct landlock_ruleset_attr __user *const attr, const size_t size, const __u32 flags)h](hdesc_parameter)}(h5const struct landlock_ruleset_attr __user *const attrh](hdesc_sig_keyword)}(hconsth]hconst}(hjhhhNhNubah}(h]h ]kah"]h$]h&]uh1jhjubjj)}(h h]h }(hjhhhNhNubah}(h]h ]jvah"]h$]h&]uh1jihjubj)}(hstructh]hstruct}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubjj)}(h h]h }(hjhhhNhNubah}(h]h ]jvah"]h$]h&]uh1jihjubh)}(hhh]j)}(hlandlock_ruleset_attrh]hlandlock_ruleset_attr}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&] refdomainjreftype identifier reftargetjmodnameN classnameN c:parent_keysphinx.domains.c LookupKey)}data]j ASTIdentifier)}jjsbc.sys_landlock_create_rulesetasbuh1hhjubjj)}(h h]h }(hj hhhNhNubah}(h]h ]jvah"]h$]h&]uh1jihjubh__user}(hjhhhNhNubjj)}(h h]h }(hjhhhNhNubah}(h]h ]jvah"]h$]h&]uh1jihjubhdesc_sig_punctuation)}(hjh]h*}(hj-hhhNhNubah}(h]h ]pah"]h$]h&]uh1j+hjubj)}(hjh]hconst}(hj;hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubjj)}(h h]h }(hjHhhhNhNubah}(h]h ]jvah"]h$]h&]uh1jihjubj)}(hattrh]hattr}(hjVhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]noemphhhuh1jhjubj)}(hconst size_t sizeh](j)}(hjh]hconst}(hjohhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjkubjj)}(h h]h }(hj|hhhNhNubah}(h]h ]jvah"]h$]h&]uh1jihjkubh)}(hhh]j)}(hsize_th]hsize_t}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&] refdomainjreftypej reftargetjmodnameN classnameNjj)}j]jc.sys_landlock_create_rulesetasbuh1hhjkubjj)}(h h]h }(hjhhhNhNubah}(h]h ]jvah"]h$]h&]uh1jihjkubj)}(hsizeh]hsize}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjkubeh}(h]h ]h"]h$]h&]noemphhhuh1jhjubj)}(hconst __u32 flagsh](j)}(hjh]hconst}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubjj)}(h h]h }(hjhhhNhNubah}(h]h ]jvah"]h$]h&]uh1jihjubh)}(hhh]j)}(h__u32h]h__u32}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&] refdomainjreftypej reftargetjmodnameN classnameNjj)}j]jc.sys_landlock_create_rulesetasbuh1hhjubjj)}(h h]h }(hjhhhNhNubah}(h]h ]jvah"]h$]h&]uh1jihjubj)}(hflagsh]hflags}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]noemphhhuh1jhjubeh}(h]h ]h"]h$]h&]hhuh1jhjShhhjhhKubeh}(h]h ]h"]h$]h&]hhƌ add_permalinkuh1jQsphinx_line_type declaratorhjMhhhjhhKubah}(h]jDah ](sig sig-objecteh"]h$]h&] is_multiline _toc_parts) _toc_namehuh1jKhjhhKhjHhhubh desc_content)}(hhh]j()}(hCreate a new ruleseth]hCreate a new ruleset}(hjPhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:593: ./security/landlock/syscalls.chKhjMhhubah}(h]h ]h"]h$]h&]uh1jKhjHhhhjhhKubeh}(h]h ](jfunctioneh"]h$]h&]domainjobjtypejhdesctypejhnoindex noindexentrynocontentsentryuh1jFhhhj$hNhNubh container)}(hX#**Parameters** ``const struct landlock_ruleset_attr __user *const attr`` Pointer to a :c:type:`struct landlock_ruleset_attr ` identifying the scope of the new ruleset. ``const size_t size`` Size of the pointed :c:type:`struct landlock_ruleset_attr ` (needed for backward and forward compatibility). ``const __u32 flags`` Supported values: **Description** - ``LANDLOCK_CREATE_RULESET_VERSION`` - ``LANDLOCK_CREATE_RULESET_ERRATA`` This system call enables to create a new Landlock ruleset. If ``LANDLOCK_CREATE_RULESET_VERSION`` or ``LANDLOCK_CREATE_RULESET_ERRATA`` is set, then **attr** must be NULL and **size** must be 0. - ``EOPNOTSUPP``: Landlock is supported by the kernel but disabled at boot time; - ``EINVAL``: unknown **flags**, or unknown access, or unknown scope, or too small **size**; - ``EINVAL``: quiet_access_fs, quiet_access_net, or quiet_scoped is not a subset of the corresponding handled_access_fs, handled_access_net, or scoped; - ``E2BIG``: **attr** or **size** inconsistencies; - ``EFAULT``: **attr** or **size** inconsistencies; - ``ENOMSG``: empty :c:type:`landlock_ruleset_attr.handled_access_fs `. .. kernel-doc:: include/uapi/linux/landlock.h :identifiers: landlock_create_ruleset_flags **Return** The ruleset file descriptor on success, the Landlock ABI version if ``LANDLOCK_CREATE_RULESET_VERSION`` is set, the errata value if ``LANDLOCK_CREATE_RULESET_ERRATA`` is set, or -errno on failure. Possible returned errors are:h](j()}(h**Parameters**h]j )}(hjzh]h Parameters}(hj|hhhNhNubah}(h]h ]h"]h$]h&]uh1j hjxubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:593: ./security/landlock/syscalls.chKhjtubj")}(hhh](j')}(h``const struct landlock_ruleset_attr __user *const attr`` Pointer to a :c:type:`struct landlock_ruleset_attr ` identifying the scope of the new ruleset. h](j-)}(h9``const struct landlock_ruleset_attr __user *const attr``h]j)}(hjh]h5const struct landlock_ruleset_attr __user *const attr}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1j,hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:593: ./security/landlock/syscalls.chKhjubj=)}(hhh]j()}(huPointer to a :c:type:`struct landlock_ruleset_attr ` identifying the scope of the new ruleset.h](h Pointer to a }(hjhhhNhNubh)}(h>:c:type:`struct landlock_ruleset_attr `h]j)}(hjh]hstruct landlock_ruleset_attr}(hjhhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnjj)}j]sbjlandlock_ruleset_attruh1hhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:593: ./security/landlock/syscalls.chKhjubh* identifying the scope of the new ruleset.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hjhKhjubah}(h]h ]h"]h$]h&]uh1j<hjubeh}(h]h ]h"]h$]h&]uh1j&hjhKhjubj')}(h``const size_t size`` Size of the pointed :c:type:`struct landlock_ruleset_attr ` (needed for backward and forward compatibility). h](j-)}(h``const size_t size``h]j)}(hjh]hconst size_t size}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1j,hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:593: ./security/landlock/syscalls.chKhjubj=)}(hhh]j()}(hSize of the pointed :c:type:`struct landlock_ruleset_attr ` (needed for backward and forward compatibility).h](hSize of the pointed }(hjhhhNhNubh)}(h>:c:type:`struct landlock_ruleset_attr `h]j)}(hjh]hstruct landlock_ruleset_attr}(hjhhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnjjjlandlock_ruleset_attruh1hhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:593: ./security/landlock/syscalls.chKhjubh1 (needed for backward and forward compatibility).}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hj9hKhjubah}(h]h ]h"]h$]h&]uh1j<hjubeh}(h]h ]h"]h$]h&]uh1j&hjhKhjubj')}(h(``const __u32 flags`` Supported values: h](j-)}(h``const __u32 flags``h]j)}(hjVh]hconst __u32 flags}(hjXhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjTubah}(h]h ]h"]h$]h&]uh1j,hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:593: ./security/landlock/syscalls.chKhjPubj=)}(hhh]j()}(hSupported values:h]hSupported values:}(hjohhhNhNubah}(h]h ]h"]h$]h&]uh1j'hjkhKhjlubah}(h]h ]h"]h$]h&]uh1j<hjPubeh}(h]h ]h"]h$]h&]uh1j&hjkhKhjubeh}(h]h ]h"]h$]h&]uh1j!hjtubj()}(h**Description**h]j )}(hjh]h Description}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j hjubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:593: ./security/landlock/syscalls.chKhjtubh block_quote)}(hK- ``LANDLOCK_CREATE_RULESET_VERSION`` - ``LANDLOCK_CREATE_RULESET_ERRATA`` h]j)}(hhh](j)}(h#``LANDLOCK_CREATE_RULESET_VERSION``h]j()}(hjh]j)}(hjh]hLANDLOCK_CREATE_RULESET_VERSION}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:593: ./security/landlock/syscalls.chKhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(h#``LANDLOCK_CREATE_RULESET_ERRATA`` h]j()}(h"``LANDLOCK_CREATE_RULESET_ERRATA``h]j)}(hjh]hLANDLOCK_CREATE_RULESET_ERRATA}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:593: ./security/landlock/syscalls.chKhjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]jjuh1jhjhKhjubah}(h]h ]h"]h$]h&]uh1jhjhKhjtubj()}(h:This system call enables to create a new Landlock ruleset.h]h:This system call enables to create a new Landlock ruleset.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:593: ./security/landlock/syscalls.chKhjtubj()}(hIf ``LANDLOCK_CREATE_RULESET_VERSION`` or ``LANDLOCK_CREATE_RULESET_ERRATA`` is set, then **attr** must be NULL and **size** must be 0.h](hIf }(hjhhhNhNubj)}(h#``LANDLOCK_CREATE_RULESET_VERSION``h]hLANDLOCK_CREATE_RULESET_VERSION}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh or }(hjhhhNhNubj)}(h"``LANDLOCK_CREATE_RULESET_ERRATA``h]hLANDLOCK_CREATE_RULESET_ERRATA}(hj(hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh is set, then }(hjhhhNhNubj )}(h**attr**h]hattr}(hj:hhhNhNubah}(h]h ]h"]h$]h&]uh1j hjubh must be NULL and }(hjhhhNhNubj )}(h**size**h]hsize}(hjLhhhNhNubah}(h]h ]h"]h$]h&]uh1j hjubh must be 0.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:593: ./security/landlock/syscalls.chKhjtubj)}(hhh](j)}(hN``EOPNOTSUPP``: Landlock is supported by the kernel but disabled at boot time;h]j()}(hjjh](j)}(h``EOPNOTSUPP``h]h EOPNOTSUPP}(hjohhhNhNubah}(h]h ]h"]h$]h&]uh1jhjlubh@: Landlock is supported by the kernel but disabled at boot time;}(hjlhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:593: ./security/landlock/syscalls.chKhjhubah}(h]h ]h"]h$]h&]uh1jhjeubj)}(hZ``EINVAL``: unknown **flags**, or unknown access, or unknown scope, or too small **size**;h]j()}(hZ``EINVAL``: unknown **flags**, or unknown access, or unknown scope, or too small **size**;h](j)}(h ``EINVAL``h]hEINVAL}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh : unknown }(hjhhhNhNubj )}(h **flags**h]hflags}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j hjubh4, or unknown access, or unknown scope, or too small }(hjhhhNhNubj )}(h**size**h]hsize}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j hjubh;}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:593: ./security/landlock/syscalls.chKhjubah}(h]h ]h"]h$]h&]uh1jhjeubj)}(h``EINVAL``: quiet_access_fs, quiet_access_net, or quiet_scoped is not a subset of the corresponding handled_access_fs, handled_access_net, or scoped;h]j()}(h``EINVAL``: quiet_access_fs, quiet_access_net, or quiet_scoped is not a subset of the corresponding handled_access_fs, handled_access_net, or scoped;h](j)}(h ``EINVAL``h]hEINVAL}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh: quiet_access_fs, quiet_access_net, or quiet_scoped is not a subset of the corresponding handled_access_fs, handled_access_net, or scoped;}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:593: ./security/landlock/syscalls.chKhjubah}(h]h ]h"]h$]h&]uh1jhjeubj)}(h0``E2BIG``: **attr** or **size** inconsistencies;h]j()}(hjh](j)}(h ``E2BIG``h]hE2BIG}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh: }(hjhhhNhNubj )}(h**attr**h]hattr}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j hjubh or }(hjhhhNhNubj )}(h**size**h]hsize}(hj+hhhNhNubah}(h]h ]h"]h$]h&]uh1j hjubh inconsistencies;}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:593: ./security/landlock/syscalls.chKhjubah}(h]h ]h"]h$]h&]uh1jhjeubj)}(h1``EFAULT``: **attr** or **size** inconsistencies;h]j()}(hjLh](j)}(h ``EFAULT``h]hEFAULT}(hjQhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjNubh: }(hjNhhhNhNubj )}(h**attr**h]hattr}(hjchhhNhNubah}(h]h ]h"]h$]h&]uh1j hjNubh or }(hjNhhhNhNubj )}(h**size**h]hsize}(hjuhhhNhNubah}(h]h ]h"]h$]h&]uh1j hjNubh inconsistencies;}(hjNhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:593: ./security/landlock/syscalls.chKhjJubah}(h]h ]h"]h$]h&]uh1jhjeubj)}(h]``ENOMSG``: empty :c:type:`landlock_ruleset_attr.handled_access_fs `. h]j()}(h\``ENOMSG``: empty :c:type:`landlock_ruleset_attr.handled_access_fs `.h](j)}(h ``ENOMSG``h]hENOMSG}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh: empty }(hjhhhNhNubh)}(hI:c:type:`landlock_ruleset_attr.handled_access_fs `h]j)}(hjh]h'landlock_ruleset_attr.handled_access_fs}(hjhhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnjjjlandlock_ruleset_attruh1hhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:593: ./security/landlock/syscalls.chKhjubh.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hjhKhjubah}(h]h ]h"]h$]h&]uh1jhjeubeh}(h]h ]h"]h$]h&]jjuh1jhjhKhjtubj()}(h **Flags**h]j )}(hjh]hFlags}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j hjubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:41: ./include/uapi/linux/landlock.hhKThjtubj")}(hhh](j')}(hd``LANDLOCK_CREATE_RULESET_VERSION`` Get the highest supported Landlock ABI version (starting at 1). h](j-)}(h#``LANDLOCK_CREATE_RULESET_VERSION``h]j)}(hjh]hLANDLOCK_CREATE_RULESET_VERSION}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1j,hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:41: ./include/uapi/linux/landlock.hhKWhjubj=)}(hhh]j()}(h?Get the highest supported Landlock ABI version (starting at 1).h]h?Get the highest supported Landlock ABI version (starting at 1).}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hjhKWhjubah}(h]h ]h"]h$]h&]uh1j<hjubeh}(h]h ]h"]h$]h&]uh1j&hjhKWhjubj')}(hh``LANDLOCK_CREATE_RULESET_ERRATA`` Get a bitmask of fixed issues for the current Landlock ABI version. h](j-)}(h"``LANDLOCK_CREATE_RULESET_ERRATA``h]j)}(hj>h]hLANDLOCK_CREATE_RULESET_ERRATA}(hj@hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj<ubah}(h]h ]h"]h$]h&]uh1j,hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:41: ./include/uapi/linux/landlock.hhK[hj8ubj=)}(hhh]j()}(hCGet a bitmask of fixed issues for the current Landlock ABI version.h]hCGet a bitmask of fixed issues for the current Landlock ABI version.}(hjWhhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:41: ./include/uapi/linux/landlock.hhKZhjTubah}(h]h ]h"]h$]h&]uh1j<hj8ubeh}(h]h ]h"]h$]h&]uh1j&hjShK[hjubeh}(h]h ]h"]h$]h&]uh1j!hjtubj()}(h **Return**h]j )}(hjzh]hReturn}(hj|hhhNhNubah}(h]h ]h"]h$]h&]uh1j hjxubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:593: ./security/landlock/syscalls.chKhjtubj()}(hThe ruleset file descriptor on success, the Landlock ABI version if ``LANDLOCK_CREATE_RULESET_VERSION`` is set, the errata value if ``LANDLOCK_CREATE_RULESET_ERRATA`` is set, or -errno on failure. Possible returned errors are:h](hDThe ruleset file descriptor on success, the Landlock ABI version if }(hjhhhNhNubj)}(h#``LANDLOCK_CREATE_RULESET_VERSION``h]hLANDLOCK_CREATE_RULESET_VERSION}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh is set, the errata value if }(hjhhhNhNubj)}(h"``LANDLOCK_CREATE_RULESET_ERRATA``h]hLANDLOCK_CREATE_RULESET_ERRATA}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh= is set, or -errno on failure. Possible returned errors are:}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:593: ./security/landlock/syscalls.chKhjtubeh}(h]h ] kernelindentah"]h$]h&]uh1jrhj$hhhNhNubj6)}(hhh]h}(h]h ]h"]h$]h&]entries](jB landlock_ruleset_attr (C struct)c.landlock_ruleset_attrhNtauh1j5hj$hhhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:596: ./include/uapi/linux/landlock.hhNubjG)}(hhh](jL)}(hlandlock_ruleset_attrh]jR)}(hstruct landlock_ruleset_attrh](j)}(hjh]hstruct}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjhhhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:596: ./include/uapi/linux/landlock.hhKubjj)}(h h]h }(hjhhhNhNubah}(h]h ]jvah"]h$]h&]uh1jihjhhhjhKubj{)}(hlandlock_ruleset_attrh]j)}(hjh]hlandlock_ruleset_attr}(hj hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj ubah}(h]h ](jjeh"]h$]h&]hhuh1jzhjhhhjhKubeh}(h]h ]h"]h$]h&]hhj=uh1jQj>j?hjhhhjhKubah}(h]jah ](jCjDeh"]h$]h&]jHjI)jJhuh1jKhjhKhjhhubjL)}(hhh]j()}(hRuleset definition.h]hRuleset definition.}(hj& hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:596: ./include/uapi/linux/landlock.hhKhj# hhubah}(h]h ]h"]h$]h&]uh1jKhjhhhjhKubeh}(h]h ](jstructeh"]h$]h&]jljjmj> jnj> jojpjquh1jFhhhj$hjhNubjs)}(hXR**Definition**:: struct landlock_ruleset_attr { __u64 handled_access_fs; __u64 handled_access_net; __u64 scoped; __u64 quiet_access_fs; __u64 quiet_access_net; __u64 quiet_scoped; }; **Members** ``handled_access_fs`` Bitmask of handled filesystem actions (cf. `Filesystem flags`_). ``handled_access_net`` Bitmask of handled network actions (cf. `Network flags`_). ``scoped`` Bitmask of scopes (cf. `Scope flags`_) restricting a Landlock domain from accessing outside resources (e.g. IPCs). ``quiet_access_fs`` Bitmask of filesystem actions which should not be logged if per-object quiet flag is set. ``quiet_access_net`` Bitmask of network actions which should not be logged if per-object quiet flag is set. ``quiet_scoped`` Bitmask of scoped actions which should not be logged.h](j()}(h**Definition**::h](j )}(h**Definition**h]h Definition}(hjJ hhhNhNubah}(h]h ]h"]h$]h&]uh1j hjF ubh:}(hjF hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:596: ./include/uapi/linux/landlock.hhKhjB ubj)}(hstruct landlock_ruleset_attr { __u64 handled_access_fs; __u64 handled_access_net; __u64 scoped; __u64 quiet_access_fs; __u64 quiet_access_net; __u64 quiet_scoped; };h]hstruct landlock_ruleset_attr { __u64 handled_access_fs; __u64 handled_access_net; __u64 scoped; __u64 quiet_access_fs; __u64 quiet_access_net; __u64 quiet_scoped; };}hjc sbah}(h]h ]h"]h$]h&]hhuh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:596: ./include/uapi/linux/landlock.hhKhjB ubj()}(h **Members**h]j )}(hjt h]hMembers}(hjv hhhNhNubah}(h]h ]h"]h$]h&]uh1j hjr ubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:596: ./include/uapi/linux/landlock.hhKhjB ubj")}(hhh](j')}(hW``handled_access_fs`` Bitmask of handled filesystem actions (cf. `Filesystem flags`_). h](j-)}(h``handled_access_fs``h]j)}(hj h]hhandled_access_fs}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubah}(h]h ]h"]h$]h&]uh1j,he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:596: ./include/uapi/linux/landlock.hhK6hj ubj=)}(hhh]j()}(h@Bitmask of handled filesystem actions (cf. `Filesystem flags`_).h](h+Bitmask of handled filesystem actions (cf. }(hj hhhNhNubj)}(h`Filesystem flags`_h]hFilesystem flags}(hj hhhNhNubah}(h]h ]h"]h$]h&]nameFilesystem flagsjMjiuh1jhj j&Kubh).}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:596: ./include/uapi/linux/landlock.hhK5hj ubah}(h]h ]h"]h$]h&]uh1j<hj ubeh}(h]h ]h"]h$]h&]uh1j&hj hK6hj ubj')}(hR``handled_access_net`` Bitmask of handled network actions (cf. `Network flags`_). h](j-)}(h``handled_access_net``h]j)}(hj h]hhandled_access_net}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubah}(h]h ]h"]h$]h&]uh1j,he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:596: ./include/uapi/linux/landlock.hhK;hj ubj=)}(hhh]j()}(h:Bitmask of handled network actions (cf. `Network flags`_).h](h(Bitmask of handled network actions (cf. }(hj hhhNhNubj)}(h`Network flags`_h]h Network flags}(hj!hhhNhNubah}(h]h ]h"]h$]h&]name Network flagsjMjyuh1jhj j&Kubh).}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:596: ./include/uapi/linux/landlock.hhK:hj ubah}(h]h ]h"]h$]h&]uh1j<hj ubeh}(h]h ]h"]h$]h&]uh1j&hj hK;hj ubj')}(h~``scoped`` Bitmask of scopes (cf. `Scope flags`_) restricting a Landlock domain from accessing outside resources (e.g. IPCs). h](j-)}(h ``scoped``h]j)}(hj/!h]hscoped}(hj1!hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj-!ubah}(h]h ]h"]h$]h&]uh1j,he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:596: ./include/uapi/linux/landlock.hhKAhj)!ubj=)}(hhh]j()}(hrBitmask of scopes (cf. `Scope flags`_) restricting a Landlock domain from accessing outside resources (e.g. IPCs).h](hBitmask of scopes (cf. }(hjH!hhhNhNubj)}(h`Scope flags`_h]h Scope flags}(hjP!hhhNhNubah}(h]h ]h"]h$]h&]name Scope flagsjMjuh1jhjH!j&KubhM) restricting a Landlock domain from accessing outside resources (e.g. IPCs).}(hjH!hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:596: ./include/uapi/linux/landlock.hhK?hjE!ubah}(h]h ]h"]h$]h&]uh1j<hj)!ubeh}(h]h ]h"]h$]h&]uh1j&hjD!hKAhj ubj')}(hn``quiet_access_fs`` Bitmask of filesystem actions which should not be logged if per-object quiet flag is set. h](j-)}(h``quiet_access_fs``h]j)}(hj}!h]hquiet_access_fs}(hj!hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj{!ubah}(h]h ]h"]h$]h&]uh1j,he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:596: ./include/uapi/linux/landlock.hhKFhjw!ubj=)}(hhh]j()}(hYBitmask of filesystem actions which should not be logged if per-object quiet flag is set.h]hYBitmask of filesystem actions which should not be logged if per-object quiet flag is set.}(hj!hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:596: ./include/uapi/linux/landlock.hhKEhj!ubah}(h]h ]h"]h$]h&]uh1j<hjw!ubeh}(h]h ]h"]h$]h&]uh1j&hj!hKFhj ubj')}(hl``quiet_access_net`` Bitmask of network actions which should not be logged if per-object quiet flag is set. h](j-)}(h``quiet_access_net``h]j)}(hj!h]hquiet_access_net}(hj!hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj!ubah}(h]h ]h"]h$]h&]uh1j,he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:596: ./include/uapi/linux/landlock.hhKKhj!ubj=)}(hhh]j()}(hVBitmask of network actions which should not be logged if per-object quiet flag is set.h]hVBitmask of network actions which should not be logged if per-object quiet flag is set.}(hj!hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:596: ./include/uapi/linux/landlock.hhKJhj!ubah}(h]h ]h"]h$]h&]uh1j<hj!ubeh}(h]h ]h"]h$]h&]uh1j&hj!hKKhj ubj')}(hF``quiet_scoped`` Bitmask of scoped actions which should not be logged.h](j-)}(h``quiet_scoped``h]j)}(hj!h]h quiet_scoped}(hj!hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj!ubah}(h]h ]h"]h$]h&]uh1j,he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:596: ./include/uapi/linux/landlock.hhKNhj!ubj=)}(hhh]j()}(h5Bitmask of scoped actions which should not be logged.h]h5Bitmask of scoped actions which should not be logged.}(hj "hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:596: ./include/uapi/linux/landlock.hhKOhj"ubah}(h]h ]h"]h$]h&]uh1j<hj!ubeh}(h]h ]h"]h$]h&]uh1j&hj"hKNhj ubeh}(h]h ]h"]h$]h&]uh1j!hjB ubeh}(h]h ] kernelindentah"]h$]h&]uh1jrhj$hhhjhNubj()}(h**Description**h]j )}(hj4"h]h Description}(hj6"hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj2"ubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:596: ./include/uapi/linux/landlock.hhKRhj$hhubj()}(h*Argument of sys_landlock_create_ruleset().h]h*Argument of sys_landlock_create_ruleset().}(hjJ"hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:596: ./include/uapi/linux/landlock.hhKhj$hhubj()}(hX#This structure defines a set of *handled access rights*, a set of actions on different object types, which should be denied by default when the ruleset is enacted. Vice versa, access rights that are not specifically listed here are not going to be denied by this ruleset when it is enacted.h](h This structure defines a set of }(hjY"hhhNhNubhemphasis)}(h*handled access rights*h]hhandled access rights}(hjc"hhhNhNubah}(h]h ]h"]h$]h&]uh1ja"hjY"ubh, a set of actions on different object types, which should be denied by default when the ruleset is enacted. Vice versa, access rights that are not specifically listed here are not going to be denied by this ruleset when it is enacted.}(hjY"hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:596: ./include/uapi/linux/landlock.hhKhj$hhubj()}(hXFor historical reasons, the ``LANDLOCK_ACCESS_FS_REFER`` right is always denied by default, even when its bit is not set in **handled_access_fs**. In order to add new rules with this access right, the bit must still be set explicitly (cf. `Filesystem flags`_).h](hFor historical reasons, the }(hj|"hhhNhNubj)}(h``LANDLOCK_ACCESS_FS_REFER``h]hLANDLOCK_ACCESS_FS_REFER}(hj"hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj|"ubhD right is always denied by default, even when its bit is not set in }(hj|"hhhNhNubj )}(h**handled_access_fs**h]hhandled_access_fs}(hj"hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj|"ubh_. In order to add new rules with this access right, the bit must still be set explicitly (cf. }(hj|"hhhNhNubj)}(h`Filesystem flags`_h]hFilesystem flags}(hj"hhhNhNubah}(h]h ]h"]h$]h&]nameFilesystem flagsjMjiuh1jhj|"j&Kubh).}(hj|"hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:596: ./include/uapi/linux/landlock.hhKhj$hhubj()}(hX&The explicit listing of *handled access rights* is required for backwards compatibility reasons. In most use cases, processes that use Landlock will *handle* a wide range or all access rights that they know about at build time (and that they have tested with a kernel that supported them all).h](hThe explicit listing of }(hj"hhhNhNubjb")}(h*handled access rights*h]hhandled access rights}(hj"hhhNhNubah}(h]h ]h"]h$]h&]uh1ja"hj"ubhg is required for backwards compatibility reasons. In most use cases, processes that use Landlock will }(hj"hhhNhNubjb")}(h*handle*h]hhandle}(hj"hhhNhNubah}(h]h ]h"]h$]h&]uh1ja"hj"ubh a wide range or all access rights that they know about at build time (and that they have tested with a kernel that supported them all).}(hj"hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:596: ./include/uapi/linux/landlock.hhKhj$hhubj()}(hXh**quiet_access_fs** and **quiet_access_net** are bitmasks of actions for which a denial by this layer will not trigger a log if the corresponding object (or its children, for filesystem rules) is marked with the "quiet" bit via ``LANDLOCK_ADD_RULE_QUIET``, even if logging would normally take place per landlock_restrict_self() flags. **quiet_scoped** is similar, except that it does not require marking any objects as quiet - if the ruleset is created with any bits set in **quiet_scoped**, then denial of such scoped resources will not trigger any log. These 3 fields are available since Landlock ABI version 10.h](j )}(h**quiet_access_fs**h]hquiet_access_fs}(hj"hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj"ubh and }(hj"hhhNhNubj )}(h**quiet_access_net**h]hquiet_access_net}(hj #hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj"ubh are bitmasks of actions for which a denial by this layer will not trigger a log if the corresponding object (or its children, for filesystem rules) is marked with the “quiet” bit via }(hj"hhhNhNubj)}(h``LANDLOCK_ADD_RULE_QUIET``h]hLANDLOCK_ADD_RULE_QUIET}(hj#hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj"ubhQ, even if logging would normally take place per landlock_restrict_self() flags. }(hj"hhhNhNubj )}(h**quiet_scoped**h]h quiet_scoped}(hj0#hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj"ubh{ is similar, except that it does not require marking any objects as quiet - if the ruleset is created with any bits set in }(hj"hhhNhNubj )}(h**quiet_scoped**h]h quiet_scoped}(hjB#hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj"ubh}, then denial of such scoped resources will not trigger any log. These 3 fields are available since Landlock ABI version 10.}(hj"hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:596: ./include/uapi/linux/landlock.hhK"hj$hhubj()}(h**quiet_access_fs**, **quiet_access_net** and **quiet_scoped** must be a subset of **handled_access_fs**, **handled_access_net** and **scoped** respectively.h](j )}(h**quiet_access_fs**h]hquiet_access_fs}(hj_#hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj[#ubh, }(hj[#hhhNhNubj )}(h**quiet_access_net**h]hquiet_access_net}(hjq#hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj[#ubh and }(hj[#hhhNhNubj )}(h**quiet_scoped**h]h quiet_scoped}(hj#hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj[#ubh must be a subset of }(hj[#hhhNhNubj )}(h**handled_access_fs**h]hhandled_access_fs}(hj#hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj[#ubh, }hj[#sbj )}(h**handled_access_net**h]hhandled_access_net}(hj#hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj[#ubh and }hj[#sbj )}(h **scoped**h]hscoped}(hj#hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj[#ubh respectively.}(hj[#hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:596: ./include/uapi/linux/landlock.hhK,hj$hhubj()}(h4This structure can grow in future Landlock versions.h]h4This structure can grow in future Landlock versions.}(hj#hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:596: ./include/uapi/linux/landlock.hhK/hj$hhubeh}(h]creating-a-new-rulesetah ]h"]creating a new rulesetah$]h&]uh1hhj hhhhhMOubh)}(hhh](h)}(hExtending a ruleseth]hExtending a ruleset}(hj#hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj#hhhhhMXubj6)}(hhh]h}(h]h ]h"]h$]h&]entries](jB"sys_landlock_add_rule (C function)c.sys_landlock_add_rulehNtauh1j5hj#hhhNhNubjG)}(hhh](jL)}(hlong sys_landlock_add_rule (const int ruleset_fd, const enum landlock_rule_type rule_type, const void __user *const rule_attr, const __u32 flags)h]jR)}(hlong sys_landlock_add_rule(const int ruleset_fd, const enum landlock_rule_type rule_type, const void __user *const rule_attr, const __u32 flags)h](jX)}(hlongh]hlong}(hj$hhhNhNubah}(h]h ]jdah"]h$]h&]uh1jWhj$hhhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:602: ./security/landlock/syscalls.chMubjj)}(h h]h }(hj"$hhhNhNubah}(h]h ]jvah"]h$]h&]uh1jihj$hhhj!$hMubj{)}(hsys_landlock_add_ruleh]j)}(hsys_landlock_add_ruleh]hsys_landlock_add_rule}(hj4$hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj0$ubah}(h]h ](jjeh"]h$]h&]hhuh1jzhj$hhhj!$hMubj)}(hv(const int ruleset_fd, const enum landlock_rule_type rule_type, const void __user *const rule_attr, const __u32 flags)h](j)}(hconst int ruleset_fdh](j)}(hjh]hconst}(hjP$hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjL$ubjj)}(h h]h }(hj]$hhhNhNubah}(h]h ]jvah"]h$]h&]uh1jihjL$ubjX)}(hinth]hint}(hjk$hhhNhNubah}(h]h ]jdah"]h$]h&]uh1jWhjL$ubjj)}(h h]h }(hjy$hhhNhNubah}(h]h ]jvah"]h$]h&]uh1jihjL$ubj)}(h ruleset_fdh]h ruleset_fd}(hj$hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjL$ubeh}(h]h ]h"]h$]h&]noemphhhuh1jhjH$ubj)}(h'const enum landlock_rule_type rule_typeh](j)}(hjh]hconst}(hj$hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj$ubjj)}(h h]h }(hj$hhhNhNubah}(h]h ]jvah"]h$]h&]uh1jihj$ubj)}(henumh]henum}(hj$hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj$ubjj)}(h h]h }(hj$hhhNhNubah}(h]h ]jvah"]h$]h&]uh1jihj$ubh)}(hhh]j)}(hlandlock_rule_typeh]hlandlock_rule_type}(hj$hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj$ubah}(h]h ]h"]h$]h&] refdomainjreftypej reftargetj$modnameN classnameNjj)}j]j)}jj6$sbc.sys_landlock_add_ruleasbuh1hhj$ubjj)}(h h]h }(hj$hhhNhNubah}(h]h ]jvah"]h$]h&]uh1jihj$ubj)}(h rule_typeh]h rule_type}(hj%hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj$ubeh}(h]h ]h"]h$]h&]noemphhhuh1jhjH$ubj)}(h"const void __user *const rule_attrh](j)}(hjh]hconst}(hj!%hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj%ubjj)}(h h]h }(hj.%hhhNhNubah}(h]h ]jvah"]h$]h&]uh1jihj%ubjX)}(hvoidh]hvoid}(hj<%hhhNhNubah}(h]h ]jdah"]h$]h&]uh1jWhj%ubjj)}(h h]h }(hjJ%hhhNhNubah}(h]h ]jvah"]h$]h&]uh1jihj%ubh__user}(hj%hhhNhNubjj)}(h h]h }(hj\%hhhNhNubah}(h]h ]jvah"]h$]h&]uh1jihj%ubj,)}(hjh]h*}(hjj%hhhNhNubah}(h]h ]j7ah"]h$]h&]uh1j+hj%ubj)}(hjh]hconst}(hjw%hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj%ubjj)}(h h]h }(hj%hhhNhNubah}(h]h ]jvah"]h$]h&]uh1jihj%ubj)}(h rule_attrh]h rule_attr}(hj%hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj%ubeh}(h]h ]h"]h$]h&]noemphhhuh1jhjH$ubj)}(hconst __u32 flagsh](j)}(hjh]hconst}(hj%hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj%ubjj)}(h h]h }(hj%hhhNhNubah}(h]h ]jvah"]h$]h&]uh1jihj%ubh)}(hhh]j)}(h__u32h]h__u32}(hj%hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj%ubah}(h]h ]h"]h$]h&] refdomainjreftypej reftargetj%modnameN classnameNjj)}j]j$c.sys_landlock_add_ruleasbuh1hhj%ubjj)}(h h]h }(hj%hhhNhNubah}(h]h ]jvah"]h$]h&]uh1jihj%ubj)}(hflagsh]hflags}(hj%hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj%ubeh}(h]h ]h"]h$]h&]noemphhhuh1jhjH$ubeh}(h]h ]h"]h$]h&]hhuh1jhj$hhhj!$hMubeh}(h]h ]h"]h$]h&]hhj=uh1jQj>j?hj $hhhj!$hMubah}(h]j$ah ](jCjDeh"]h$]h&]jHjI)jJhuh1jKhj!$hMhj$hhubjL)}(hhh]j()}(hAdd a new rule to a ruleseth]hAdd a new rule to a ruleset}(hj&hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:602: ./security/landlock/syscalls.chMhj&hhubah}(h]h ]h"]h$]h&]uh1jKhj$hhhj!$hMubeh}(h]h ](jfunctioneh"]h$]h&]jljjmj7&jnj7&jojpjquh1jFhhhj#hNhNubjs)}(hX**Parameters** ``const int ruleset_fd`` File descriptor tied to the ruleset that should be extended with the new rule. ``const enum landlock_rule_type rule_type`` Identify the structure type pointed to by **rule_attr**: ``LANDLOCK_RULE_PATH_BENEATH`` or ``LANDLOCK_RULE_NET_PORT``. ``const void __user *const rule_attr`` Pointer to a rule (matching the **rule_type**). ``const __u32 flags`` Must be 0 or ``LANDLOCK_ADD_RULE_QUIET``. **Description** This system call enables to define a new rule and add it to an existing ruleset. - ``EOPNOTSUPP``: Landlock is supported by the kernel but disabled at boot time; - ``EAFNOSUPPORT``: **rule_type** is ``LANDLOCK_RULE_NET_PORT`` but TCP/IP is not supported by the running kernel; - ``EINVAL``: **flags** is not valid; - ``EINVAL``: The rule accesses are inconsistent (i.e. :c:type:`landlock_path_beneath_attr.allowed_access ` or :c:type:`landlock_net_port_attr.allowed_access ` is not a subset of the ruleset handled accesses) - ``EINVAL``: :c:type:`landlock_net_port_attr.port ` is greater than 65535; - ``EINVAL``: LANDLOCK_ADD_RULE_QUIET is passed but the ruleset has no quiet access bits set for the corresponding rule type. - ``ENOMSG``: Empty accesses (e.g. :c:type:`landlock_path_beneath_attr.allowed_access ` is 0) and no flags; - ``EBADF``: **ruleset_fd** is not a file descriptor for the current thread, or a member of **rule_attr** is not a file descriptor as expected; - ``EBADFD``: **ruleset_fd** is not a ruleset file descriptor, or a member of **rule_attr** is not the expected file descriptor type; - ``EPERM``: **ruleset_fd** has no write access to the underlying ruleset; - ``EFAULT``: **rule_attr** was not a valid address. .. kernel-doc:: include/uapi/linux/landlock.h :identifiers: landlock_add_rule_flags **Return** 0 on success, or -errno on failure. Possible returned errors are:h](j()}(h**Parameters**h]j )}(hjA&h]h Parameters}(hjC&hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj?&ubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:602: ./security/landlock/syscalls.chMhj;&ubj")}(hhh](j')}(hh``const int ruleset_fd`` File descriptor tied to the ruleset that should be extended with the new rule. h](j-)}(h``const int ruleset_fd``h]j)}(hj`&h]hconst int ruleset_fd}(hjb&hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj^&ubah}(h]h ]h"]h$]h&]uh1j,hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:602: ./security/landlock/syscalls.chMhjZ&ubj=)}(hhh]j()}(hNFile descriptor tied to the ruleset that should be extended with the new rule.h]hNFile descriptor tied to the ruleset that should be extended with the new rule.}(hjy&hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:602: ./security/landlock/syscalls.chMhjv&ubah}(h]h ]h"]h$]h&]uh1j<hjZ&ubeh}(h]h ]h"]h$]h&]uh1j&hju&hMhjW&ubj')}(h``const enum landlock_rule_type rule_type`` Identify the structure type pointed to by **rule_attr**: ``LANDLOCK_RULE_PATH_BENEATH`` or ``LANDLOCK_RULE_NET_PORT``. h](j-)}(h+``const enum landlock_rule_type rule_type``h]j)}(hj&h]h'const enum landlock_rule_type rule_type}(hj&hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj&ubah}(h]h ]h"]h$]h&]uh1j,hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:602: ./security/landlock/syscalls.chMhj&ubj=)}(hhh]j()}(hvIdentify the structure type pointed to by **rule_attr**: ``LANDLOCK_RULE_PATH_BENEATH`` or ``LANDLOCK_RULE_NET_PORT``.h](h*Identify the structure type pointed to by }(hj&hhhNhNubj )}(h **rule_attr**h]h rule_attr}(hj&hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj&ubh: }(hj&hhhNhNubj)}(h``LANDLOCK_RULE_PATH_BENEATH``h]hLANDLOCK_RULE_PATH_BENEATH}(hj&hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj&ubh or }(hj&hhhNhNubj)}(h``LANDLOCK_RULE_NET_PORT``h]hLANDLOCK_RULE_NET_PORT}(hj&hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj&ubh.}(hj&hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:602: ./security/landlock/syscalls.chMhj&ubah}(h]h ]h"]h$]h&]uh1j<hj&ubeh}(h]h ]h"]h$]h&]uh1j&hj&hMhjW&ubj')}(hW``const void __user *const rule_attr`` Pointer to a rule (matching the **rule_type**). h](j-)}(h&``const void __user *const rule_attr``h]j)}(hj 'h]h"const void __user *const rule_attr}(hj 'hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj'ubah}(h]h ]h"]h$]h&]uh1j,hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:602: ./security/landlock/syscalls.chMhj'ubj=)}(hhh]j()}(h/Pointer to a rule (matching the **rule_type**).h](h Pointer to a rule (matching the }(hj#'hhhNhNubj )}(h **rule_type**h]h rule_type}(hj+'hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj#'ubh).}(hj#'hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hj'hMhj 'ubah}(h]h ]h"]h$]h&]uh1j<hj'ubeh}(h]h ]h"]h$]h&]uh1j&hj'hMhjW&ubj')}(h@``const __u32 flags`` Must be 0 or ``LANDLOCK_ADD_RULE_QUIET``. h](j-)}(h``const __u32 flags``h]j)}(hjU'h]hconst __u32 flags}(hjW'hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjS'ubah}(h]h ]h"]h$]h&]uh1j,hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:602: ./security/landlock/syscalls.chMhjO'ubj=)}(hhh]j()}(h)Must be 0 or ``LANDLOCK_ADD_RULE_QUIET``.h](h Must be 0 or }(hjn'hhhNhNubj)}(h``LANDLOCK_ADD_RULE_QUIET``h]hLANDLOCK_ADD_RULE_QUIET}(hjv'hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjn'ubh.}(hjn'hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hjj'hMhjk'ubah}(h]h ]h"]h$]h&]uh1j<hjO'ubeh}(h]h ]h"]h$]h&]uh1j&hjj'hMhjW&ubeh}(h]h ]h"]h$]h&]uh1j!hj;&ubj()}(h**Description**h]j )}(hj'h]h Description}(hj'hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj'ubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:602: ./security/landlock/syscalls.chMhj;&ubj()}(hPThis system call enables to define a new rule and add it to an existing ruleset.h]hPThis system call enables to define a new rule and add it to an existing ruleset.}(hj'hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:602: ./security/landlock/syscalls.chMhj;&ubj)}(hhh](j)}(hN``EOPNOTSUPP``: Landlock is supported by the kernel but disabled at boot time;h]j()}(hj'h](j)}(h``EOPNOTSUPP``h]h EOPNOTSUPP}(hj'hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj'ubh@: Landlock is supported by the kernel but disabled at boot time;}(hj'hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:602: ./security/landlock/syscalls.chMhj'ubah}(h]h ]h"]h$]h&]uh1jhj'ubj)}(hp``EAFNOSUPPORT``: **rule_type** is ``LANDLOCK_RULE_NET_PORT`` but TCP/IP is not supported by the running kernel;h]j()}(hp``EAFNOSUPPORT``: **rule_type** is ``LANDLOCK_RULE_NET_PORT`` but TCP/IP is not supported by the running kernel;h](j)}(h``EAFNOSUPPORT``h]h EAFNOSUPPORT}(hj'hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj'ubh: }(hj'hhhNhNubj )}(h **rule_type**h]h rule_type}(hj (hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj'ubh is }(hj'hhhNhNubj)}(h``LANDLOCK_RULE_NET_PORT``h]hLANDLOCK_RULE_NET_PORT}(hj(hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj'ubh3 but TCP/IP is not supported by the running kernel;}(hj'hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:602: ./security/landlock/syscalls.chMhj'ubah}(h]h ]h"]h$]h&]uh1jhj'ubj)}(h#``EINVAL``: **flags** is not valid;h]j()}(hj=(h](j)}(h ``EINVAL``h]hEINVAL}(hjB(hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj?(ubh: }(hj?(hhhNhNubj )}(h **flags**h]hflags}(hjT(hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj?(ubh is not valid;}(hj?(hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:602: ./security/landlock/syscalls.chMhj;(ubah}(h]h ]h"]h$]h&]uh1jhj'ubj)}(hX``EINVAL``: The rule accesses are inconsistent (i.e. :c:type:`landlock_path_beneath_attr.allowed_access ` or :c:type:`landlock_net_port_attr.allowed_access ` is not a subset of the ruleset handled accesses)h]j()}(hX``EINVAL``: The rule accesses are inconsistent (i.e. :c:type:`landlock_path_beneath_attr.allowed_access ` or :c:type:`landlock_net_port_attr.allowed_access ` is not a subset of the ruleset handled accesses)h](j)}(h ``EINVAL``h]hEINVAL}(hj{(hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjw(ubh+: The rule accesses are inconsistent (i.e. }(hjw(hhhNhNubh)}(hP:c:type:`landlock_path_beneath_attr.allowed_access `h]j)}(hj(h]h)landlock_path_beneath_attr.allowed_access}(hj(hhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jhj(ubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnjjjlandlock_path_beneath_attruh1hhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:602: ./security/landlock/syscalls.chMhjw(ubh or }(hjw(hhhNhNubh)}(hH:c:type:`landlock_net_port_attr.allowed_access `h]j)}(hj(h]h%landlock_net_port_attr.allowed_access}(hj(hhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jhj(ubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnjjjlandlock_net_port_attruh1hhj(hMhjw(ubh1 is not a subset of the ruleset handled accesses)}(hjw(hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hj(hMhjs(ubah}(h]h ]h"]h$]h&]uh1jhj'ubj)}(ha``EINVAL``: :c:type:`landlock_net_port_attr.port ` is greater than 65535;h]j()}(hj(h](j)}(h ``EINVAL``h]hEINVAL}(hj(hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj(ubh: }(hj(hhhNhNubh)}(h>:c:type:`landlock_net_port_attr.port `h]j)}(hj(h]hlandlock_net_port_attr.port}(hj(hhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jhj(ubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnjjjlandlock_net_port_attruh1hhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:602: ./security/landlock/syscalls.chMhj(ubh is greater than 65535;}(hj(hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hj)hMhj(ubah}(h]h ]h"]h$]h&]uh1jhj'ubj)}(h{``EINVAL``: LANDLOCK_ADD_RULE_QUIET is passed but the ruleset has no quiet access bits set for the corresponding rule type.h]j()}(h{``EINVAL``: LANDLOCK_ADD_RULE_QUIET is passed but the ruleset has no quiet access bits set for the corresponding rule type.h](j)}(h ``EINVAL``h]hEINVAL}(hj1)hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj-)ubhq: LANDLOCK_ADD_RULE_QUIET is passed but the ruleset has no quiet access bits set for the corresponding rule type.}(hj-)hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:602: ./security/landlock/syscalls.chMhj))ubah}(h]h ]h"]h$]h&]uh1jhj'ubj)}(h``ENOMSG``: Empty accesses (e.g. :c:type:`landlock_path_beneath_attr.allowed_access ` is 0) and no flags;h]j()}(h``ENOMSG``: Empty accesses (e.g. :c:type:`landlock_path_beneath_attr.allowed_access ` is 0) and no flags;h](j)}(h ``ENOMSG``h]hENOMSG}(hjX)hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjT)ubh: Empty accesses (e.g. }(hjT)hhhNhNubh)}(hP:c:type:`landlock_path_beneath_attr.allowed_access `h]j)}(hjl)h]h)landlock_path_beneath_attr.allowed_access}(hjn)hhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jhjj)ubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnjjjlandlock_path_beneath_attruh1hhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:602: ./security/landlock/syscalls.chMhjT)ubh is 0) and no flags;}(hjT)hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hj)hMhjP)ubah}(h]h ]h"]h$]h&]uh1jhj'ubj)}(h``EBADF``: **ruleset_fd** is not a file descriptor for the current thread, or a member of **rule_attr** is not a file descriptor as expected;h]j()}(h``EBADF``: **ruleset_fd** is not a file descriptor for the current thread, or a member of **rule_attr** is not a file descriptor as expected;h](j)}(h ``EBADF``h]hEBADF}(hj)hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj)ubh: }(hj)hhhNhNubj )}(h**ruleset_fd**h]h ruleset_fd}(hj)hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj)ubhA is not a file descriptor for the current thread, or a member of }(hj)hhhNhNubj )}(h **rule_attr**h]h rule_attr}(hj)hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj)ubh& is not a file descriptor as expected;}(hj)hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:602: ./security/landlock/syscalls.chMhj)ubah}(h]h ]h"]h$]h&]uh1jhj'ubj)}(h``EBADFD``: **ruleset_fd** is not a ruleset file descriptor, or a member of **rule_attr** is not the expected file descriptor type;h]j()}(h``EBADFD``: **ruleset_fd** is not a ruleset file descriptor, or a member of **rule_attr** is not the expected file descriptor type;h](j)}(h ``EBADFD``h]hEBADFD}(hj)hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj)ubh: }(hj)hhhNhNubj )}(h**ruleset_fd**h]h ruleset_fd}(hj)hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj)ubh2 is not a ruleset file descriptor, or a member of }(hj)hhhNhNubj )}(h **rule_attr**h]h rule_attr}(hj*hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj)ubh* is not the expected file descriptor type;}(hj)hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:602: ./security/landlock/syscalls.chMhj)ubah}(h]h ]h"]h$]h&]uh1jhj'ubj)}(hH``EPERM``: **ruleset_fd** has no write access to the underlying ruleset;h]j()}(hj2*h](j)}(h ``EPERM``h]hEPERM}(hj7*hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj4*ubh: }(hj4*hhhNhNubj )}(h**ruleset_fd**h]h ruleset_fd}(hjI*hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj4*ubh/ has no write access to the underlying ruleset;}(hj4*hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:602: ./security/landlock/syscalls.chMhj0*ubah}(h]h ]h"]h$]h&]uh1jhj'ubj)}(h3``EFAULT``: **rule_attr** was not a valid address. h]j()}(h2``EFAULT``: **rule_attr** was not a valid address.h](j)}(h ``EFAULT``h]hEFAULT}(hjp*hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjl*ubh: }(hjl*hhhNhNubj )}(h **rule_attr**h]h rule_attr}(hj*hhhNhNubah}(h]h ]h"]h$]h&]uh1j hjl*ubh was not a valid address.}(hjl*hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:602: ./security/landlock/syscalls.chMhjh*ubah}(h]h ]h"]h$]h&]uh1jhj'ubeh}(h]h ]h"]h$]h&]jjuh1jhj'hMhj;&ubj()}(h **Flags**h]j )}(hj*h]hFlags}(hj*hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj*ubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:49: ./include/uapi/linux/landlock.hhKdhj;&ubj")}(hhh]j')}(hX``LANDLOCK_ADD_RULE_QUIET`` Together with the quiet_* fields in struct landlock_ruleset_attr, this flag controls whether Landlock will log audit messages when access to the objects covered by this rule is denied by this layer. If logging is enabled, when Landlock denies an access, it will suppress the log if all of the following are true: - this layer is the innermost layer that denied the access; - all accesses denied by this layer are part of the quiet_* fields in the related struct landlock_ruleset_attr; - the object (or one of its parents, for filesystem rules) is marked as "quiet" via ``LANDLOCK_ADD_RULE_QUIET``. Because logging is only suppressed by a layer if the layer denies access, a sandboxed program cannot use this flag to "hide" access denials, without denying itself the access in the first place. The effect of this flag does not depend on the value of allowed_access in the passed in rule_attr. When this flag is present, the caller is also allowed to pass in an empty allowed_access. h](j-)}(h``LANDLOCK_ADD_RULE_QUIET``h]j)}(hj*h]hLANDLOCK_ADD_RULE_QUIET}(hj*hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj*ubah}(h]h ]h"]h$]h&]uh1j,hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:49: ./include/uapi/linux/landlock.hhK|hj*ubj=)}(hhh](j()}(hTogether with the quiet_* fields in struct landlock_ruleset_attr, this flag controls whether Landlock will log audit messages when access to the objects covered by this rule is denied by this layer.h]hTogether with the quiet_* fields in struct landlock_ruleset_attr, this flag controls whether Landlock will log audit messages when access to the objects covered by this rule is denied by this layer.}(hj*hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:49: ./include/uapi/linux/landlock.hhKghj*ubj()}(hqIf logging is enabled, when Landlock denies an access, it will suppress the log if all of the following are true:h]hqIf logging is enabled, when Landlock denies an access, it will suppress the log if all of the following are true:}(hj*hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:49: ./include/uapi/linux/landlock.hhKkhj*ubj)}(hhh](j)}(h9this layer is the innermost layer that denied the access;h]j()}(hj+h]h9this layer is the innermost layer that denied the access;}(hj+hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:49: ./include/uapi/linux/landlock.hhKnhj+ubah}(h]h ]h"]h$]h&]uh1jhj*ubj)}(hmall accesses denied by this layer are part of the quiet_* fields in the related struct landlock_ruleset_attr;h]j()}(hmall accesses denied by this layer are part of the quiet_* fields in the related struct landlock_ruleset_attr;h]hmall accesses denied by this layer are part of the quiet_* fields in the related struct landlock_ruleset_attr;}(hj+hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:49: ./include/uapi/linux/landlock.hhKohj+ubah}(h]h ]h"]h$]h&]uh1jhj*ubj)}(hothe object (or one of its parents, for filesystem rules) is marked as "quiet" via ``LANDLOCK_ADD_RULE_QUIET``. h]j()}(hnthe object (or one of its parents, for filesystem rules) is marked as "quiet" via ``LANDLOCK_ADD_RULE_QUIET``.h](hVthe object (or one of its parents, for filesystem rules) is marked as “quiet” via }(hj7+hhhNhNubj)}(h``LANDLOCK_ADD_RULE_QUIET``h]hLANDLOCK_ADD_RULE_QUIET}(hj?+hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj7+ubh.}(hj7+hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:49: ./include/uapi/linux/landlock.hhKqhj3+ubah}(h]h ]h"]h$]h&]uh1jhj*ubeh}(h]h ]h"]h$]h&]jjuh1jhj+hKnhj*ubj()}(hBecause logging is only suppressed by a layer if the layer denies access, a sandboxed program cannot use this flag to "hide" access denials, without denying itself the access in the first place.h]hBecause logging is only suppressed by a layer if the layer denies access, a sandboxed program cannot use this flag to “hide” access denials, without denying itself the access in the first place.}(hjd+hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:49: ./include/uapi/linux/landlock.hhKthj*ubj()}(hThe effect of this flag does not depend on the value of allowed_access in the passed in rule_attr. When this flag is present, the caller is also allowed to pass in an empty allowed_access.h]hThe effect of this flag does not depend on the value of allowed_access in the passed in rule_attr. When this flag is present, the caller is also allowed to pass in an empty allowed_access.}(hjs+hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:49: ./include/uapi/linux/landlock.hhKxhj*ubeh}(h]h ]h"]h$]h&]uh1j<hj*ubeh}(h]h ]h"]h$]h&]uh1j&hj*hK|hj*ubah}(h]h ]h"]h$]h&]uh1j!hj;&ubj()}(h **Return**h]j )}(hj+h]hReturn}(hj+hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj+ubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:602: ./security/landlock/syscalls.chMhj;&ubj()}(hB0 on success, or -errno on failure. Possible returned errors are:h]hB0 on success, or -errno on failure. Possible returned errors are:}(hj+hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:602: ./security/landlock/syscalls.chMhj;&ubeh}(h]h ] kernelindentah"]h$]h&]uh1jrhj#hhhNhNubj6)}(hhh]h}(h]h ]h"]h$]h&]entries](jBlandlock_rule_type (C enum)c.landlock_rule_typehNtauh1j5hj#hhhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:605: ./include/uapi/linux/landlock.hhNubjG)}(hhh](jL)}(hlandlock_rule_typeh]jR)}(henum landlock_rule_typeh](j)}(hj$h]henum}(hj+hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj+hhhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:605: ./include/uapi/linux/landlock.hhKubjj)}(h h]h }(hj+hhhNhNubah}(h]h ]jvah"]h$]h&]uh1jihj+hhhj+hKubj{)}(hlandlock_rule_typeh]j)}(hj+h]hlandlock_rule_type}(hj+hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj+ubah}(h]h ](jjeh"]h$]h&]hhuh1jzhj+hhhj+hKubeh}(h]h ]h"]h$]h&]hhj=uh1jQj>j?hj+hhhj+hKubah}(h]j+ah ](jCjDeh"]h$]h&]jHjI)jJhuh1jKhj+hKhj+hhubjL)}(hhh]j()}(hLandlock rule typeh]hLandlock rule type}(hj,hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:605: ./include/uapi/linux/landlock.hhKhj,hhubah}(h]h ]h"]h$]h&]uh1jKhj+hhhj+hKubeh}(h]h ](jenumeh"]h$]h&]jljjmj6,jnj6,jojpjquh1jFhhhj#hj+hNubjs)}(h**Constants** ``LANDLOCK_RULE_PATH_BENEATH`` Type of a :c:type:`struct landlock_path_beneath_attr ` . ``LANDLOCK_RULE_NET_PORT`` Type of a :c:type:`struct landlock_net_port_attr ` .h](j()}(h **Constants**h]j )}(hj@,h]h Constants}(hjB,hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj>,ubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:605: ./include/uapi/linux/landlock.hhKhj:,ubj")}(hhh](j')}(ht``LANDLOCK_RULE_PATH_BENEATH`` Type of a :c:type:`struct landlock_path_beneath_attr ` . h](j-)}(h``LANDLOCK_RULE_PATH_BENEATH``h]j)}(hj_,h]hLANDLOCK_RULE_PATH_BENEATH}(hja,hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj],ubah}(h]h ]h"]h$]h&]uh1j,he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:605: ./include/uapi/linux/landlock.hhKhjY,ubj=)}(hhh]j()}(hTType of a :c:type:`struct landlock_path_beneath_attr ` .h](h Type of a }(hjx,hhhNhNubh)}(hH:c:type:`struct landlock_path_beneath_attr `h]j)}(hj,h]h!struct landlock_path_beneath_attr}(hj,hhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jhj,ubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnjjjlandlock_path_beneath_attruh1hhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:605: ./include/uapi/linux/landlock.hhKhjx,ubh .}(hjx,hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hj,hKhju,ubah}(h]h ]h"]h$]h&]uh1j<hjY,ubeh}(h]h ]h"]h$]h&]uh1j&hjt,hKhjV,ubj')}(hg``LANDLOCK_RULE_NET_PORT`` Type of a :c:type:`struct landlock_net_port_attr ` .h](j-)}(h``LANDLOCK_RULE_NET_PORT``h]j)}(hj,h]hLANDLOCK_RULE_NET_PORT}(hj,hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj,ubah}(h]h ]h"]h$]h&]uh1j,he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:605: ./include/uapi/linux/landlock.hhKhj,ubj=)}(hhh]j()}(hLType of a :c:type:`struct landlock_net_port_attr ` .h](h Type of a }(hj,hhhNhNubh)}(h@:c:type:`struct landlock_net_port_attr `h]j)}(hj,h]hstruct landlock_net_port_attr}(hj,hhhNhNubah}(h]h ](jjc-typeeh"]h$]h&]uh1jhj,ubah}(h]h ]h"]h$]h&]refdocj refdomainjreftypetype refexplicitrefwarnjjjlandlock_net_port_attruh1hhj,hKhj,ubh .}(hj,hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hj,hKhj,ubah}(h]h ]h"]h$]h&]uh1j<hj,ubeh}(h]h ]h"]h$]h&]uh1j&hj,hKhjV,ubeh}(h]h ]h"]h$]h&]uh1j!hj:,ubeh}(h]h ] kernelindentah"]h$]h&]uh1jrhj#hhhj+hNubj()}(h**Description**h]j )}(hj!-h]h Description}(hj#-hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj-ubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:605: ./include/uapi/linux/landlock.hhKhj#hhubj()}(h$Argument of sys_landlock_add_rule().h]h$Argument of sys_landlock_add_rule().}(hj7-hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:605: ./include/uapi/linux/landlock.hhKhj#hhubj6)}(hhh]h}(h]h ]h"]h$]h&]entries](jB%landlock_path_beneath_attr (C struct)c.landlock_path_beneath_attrhNtauh1j5hj#hhhj+hNubjG)}(hhh](jL)}(hlandlock_path_beneath_attrh]jR)}(h!struct landlock_path_beneath_attrh](j)}(hjh]hstruct}(hj_-hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj[-hhhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:605: ./include/uapi/linux/landlock.hhKubjj)}(h h]h }(hjm-hhhNhNubah}(h]h ]jvah"]h$]h&]uh1jihj[-hhhjl-hKubj{)}(hlandlock_path_beneath_attrh]j)}(hjY-h]hlandlock_path_beneath_attr}(hj-hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj{-ubah}(h]h ](jjeh"]h$]h&]hhuh1jzhj[-hhhjl-hKubeh}(h]h ]h"]h$]h&]hhj=uh1jQj>j?hjW-hhhjl-hKubah}(h]jR-ah ](jCjDeh"]h$]h&]jHjI)jJhuh1jKhjl-hKhjT-hhubjL)}(hhh]j()}(hPath hierarchy definitionh]hPath hierarchy definition}(hj-hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:605: ./include/uapi/linux/landlock.hhKhj-hhubah}(h]h ]h"]h$]h&]uh1jKhjT-hhhjl-hKubeh}(h]h ](jstructeh"]h$]h&]jljjmj-jnj-jojpjquh1jFhhhj#hj+hNubjs)}(hXv**Definition**:: struct landlock_path_beneath_attr { __u64 allowed_access; __s32 parent_fd; }; **Members** ``allowed_access`` Bitmask of allowed actions for this file hierarchy (cf. `Filesystem flags`_). ``parent_fd`` File descriptor, preferably opened with ``O_PATH``, which identifies the parent directory of a file hierarchy, or just a file.h](j()}(h**Definition**::h](j )}(h**Definition**h]h Definition}(hj-hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj-ubh:}(hj-hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:605: ./include/uapi/linux/landlock.hhKhj-ubj)}(hUstruct landlock_path_beneath_attr { __u64 allowed_access; __s32 parent_fd; };h]hUstruct landlock_path_beneath_attr { __u64 allowed_access; __s32 parent_fd; };}hj-sbah}(h]h ]h"]h$]h&]hhuh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:605: ./include/uapi/linux/landlock.hhKhj-ubj()}(h **Members**h]j )}(hj-h]hMembers}(hj-hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj-ubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:605: ./include/uapi/linux/landlock.hhKhj-ubj")}(hhh](j')}(ha``allowed_access`` Bitmask of allowed actions for this file hierarchy (cf. `Filesystem flags`_). h](j-)}(h``allowed_access``h]j)}(hj.h]hallowed_access}(hj.hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj .ubah}(h]h ]h"]h$]h&]uh1j,he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:605: ./include/uapi/linux/landlock.hhKhj.ubj=)}(hhh]j()}(hMBitmask of allowed actions for this file hierarchy (cf. `Filesystem flags`_).h](h8Bitmask of allowed actions for this file hierarchy (cf. }(hj'.hhhNhNubj)}(h`Filesystem flags`_h]hFilesystem flags}(hj/.hhhNhNubah}(h]h ]h"]h$]h&]nameFilesystem flagsjMjiuh1jhj'.j&Kubh).}(hj'.hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:605: ./include/uapi/linux/landlock.hhKhj$.ubah}(h]h ]h"]h$]h&]uh1j<hj.ubeh}(h]h ]h"]h$]h&]uh1j&hj#.hKhj.ubj')}(h``parent_fd`` File descriptor, preferably opened with ``O_PATH``, which identifies the parent directory of a file hierarchy, or just a file.h](j-)}(h ``parent_fd``h]j)}(hj\.h]h parent_fd}(hj^.hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjZ.ubah}(h]h ]h"]h$]h&]uh1j,he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:605: ./include/uapi/linux/landlock.hhKhjV.ubj=)}(hhh]j()}(h~File descriptor, preferably opened with ``O_PATH``, which identifies the parent directory of a file hierarchy, or just a file.h](h(File descriptor, preferably opened with }(hju.hhhNhNubj)}(h ``O_PATH``h]hO_PATH}(hj}.hhhNhNubah}(h]h ]h"]h$]h&]uh1jhju.ubhL, which identifies the parent directory of a file hierarchy, or just a file.}(hju.hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:605: ./include/uapi/linux/landlock.hhKhjr.ubah}(h]h ]h"]h$]h&]uh1j<hjV.ubeh}(h]h ]h"]h$]h&]uh1j&hjq.hKhj.ubeh}(h]h ]h"]h$]h&]uh1j!hj-ubeh}(h]h ] kernelindentah"]h$]h&]uh1jrhj#hhhj+hNubj()}(h**Description**h]j )}(hj.h]h Description}(hj.hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj.ubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:605: ./include/uapi/linux/landlock.hhKhj#hhubj()}(h$Argument of sys_landlock_add_rule().h]h$Argument of sys_landlock_add_rule().}(hj.hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:605: ./include/uapi/linux/landlock.hhKhj#hhubj6)}(hhh]h}(h]h ]h"]h$]h&]entries](jB!landlock_net_port_attr (C struct)c.landlock_net_port_attrhNtauh1j5hj#hhhj+hNubjG)}(hhh](jL)}(hlandlock_net_port_attrh]jR)}(hstruct landlock_net_port_attrh](j)}(hjh]hstruct}(hj.hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj.hhhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:605: ./include/uapi/linux/landlock.hhKubjj)}(h h]h }(hj.hhhNhNubah}(h]h ]jvah"]h$]h&]uh1jihj.hhhj.hKubj{)}(hlandlock_net_port_attrh]j)}(hj.h]hlandlock_net_port_attr}(hj/hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj /ubah}(h]h ](jjeh"]h$]h&]hhuh1jzhj.hhhj.hKubeh}(h]h ]h"]h$]h&]hhj=uh1jQj>j?hj.hhhj.hKubah}(h]j.ah ](jCjDeh"]h$]h&]jHjI)jJhuh1jKhj.hKhj.hhubjL)}(hhh]j()}(hNetwork port definitionh]hNetwork port definition}(hj1/hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:605: ./include/uapi/linux/landlock.hhKhj./hhubah}(h]h ]h"]h$]h&]uh1jKhj.hhhj.hKubeh}(h]h ](jstructeh"]h$]h&]jljjmjI/jnjI/jojpjquh1jFhhhj#hj+hNubjs)}(hXB**Definition**:: struct landlock_net_port_attr { __u64 allowed_access; __u64 port; }; **Members** ``allowed_access`` Bitmask of allowed network actions for a port (cf. `Network flags`_). ``port`` Network port in host endianness. It should be noted that port 0 passed to :manpage:`bind(2)` will bind to an available port from the ephemeral port range. This can be configured with the ``/proc/sys/net/ipv4/ip_local_port_range`` sysctl (also used for IPv6), and within that range, on a per-socket basis with ``setsockopt(IP_LOCAL_PORT_RANGE)``. A Landlock rule with port 0 and the ``LANDLOCK_ACCESS_NET_BIND_TCP`` or ``LANDLOCK_ACCESS_NET_BIND_UDP`` right means that requesting to bind on port 0 is allowed and it will automatically translate to binding on a kernel-assigned ephemeral port.h](j()}(h**Definition**::h](j )}(h**Definition**h]h Definition}(hjU/hhhNhNubah}(h]h ]h"]h$]h&]uh1j hjQ/ubh:}(hjQ/hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:605: ./include/uapi/linux/landlock.hhKhjM/ubj)}(hLstruct landlock_net_port_attr { __u64 allowed_access; __u64 port; };h]hLstruct landlock_net_port_attr { __u64 allowed_access; __u64 port; };}hjn/sbah}(h]h ]h"]h$]h&]hhuh1jhe/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:605: ./include/uapi/linux/landlock.hhKhjM/ubj()}(h **Members**h]j )}(hj/h]hMembers}(hj/hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj}/ubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:605: ./include/uapi/linux/landlock.hhKhjM/ubj")}(hhh](j')}(hY``allowed_access`` Bitmask of allowed network actions for a port (cf. `Network flags`_). h](j-)}(h``allowed_access``h]j)}(hj/h]hallowed_access}(hj/hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj/ubah}(h]h ]h"]h$]h&]uh1j,he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:605: ./include/uapi/linux/landlock.hhKhj/ubj=)}(hhh]j()}(hEBitmask of allowed network actions for a port (cf. `Network flags`_).h](h3Bitmask of allowed network actions for a port (cf. }(hj/hhhNhNubj)}(h`Network flags`_h]h Network flags}(hj/hhhNhNubah}(h]h ]h"]h$]h&]name Network flagsjMjyuh1jhj/j&Kubh).}(hj/hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:605: ./include/uapi/linux/landlock.hhKhj/ubah}(h]h ]h"]h$]h&]uh1j<hj/ubeh}(h]h ]h"]h$]h&]uh1j&hj/hKhj/ubj')}(hX[``port`` Network port in host endianness. It should be noted that port 0 passed to :manpage:`bind(2)` will bind to an available port from the ephemeral port range. This can be configured with the ``/proc/sys/net/ipv4/ip_local_port_range`` sysctl (also used for IPv6), and within that range, on a per-socket basis with ``setsockopt(IP_LOCAL_PORT_RANGE)``. A Landlock rule with port 0 and the ``LANDLOCK_ACCESS_NET_BIND_TCP`` or ``LANDLOCK_ACCESS_NET_BIND_UDP`` right means that requesting to bind on port 0 is allowed and it will automatically translate to binding on a kernel-assigned ephemeral port.h](j-)}(h``port``h]j)}(hj/h]hport}(hj/hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj/ubah}(h]h ]h"]h$]h&]uh1j,he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:605: ./include/uapi/linux/landlock.hhM hj/ubj=)}(hhh](j()}(h Network port in host endianness.h]h Network port in host endianness.}(hj0hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:605: ./include/uapi/linux/landlock.hhMhj0ubj()}(hX9It should be noted that port 0 passed to :manpage:`bind(2)` will bind to an available port from the ephemeral port range. This can be configured with the ``/proc/sys/net/ipv4/ip_local_port_range`` sysctl (also used for IPv6), and within that range, on a per-socket basis with ``setsockopt(IP_LOCAL_PORT_RANGE)``.h](h)It should be noted that port 0 passed to }(hj0hhhNhNubj/)}(h:manpage:`bind(2)`h]hbind(2)}(hj0hhhNhNubah}(h]h ]j.ah"]h$]h&]hhj>bind(2)j@bindjBjCuh1j.hj0ubh` will bind to an available port from the ephemeral port range. This can be configured with the }(hj0hhhNhNubj)}(h*``/proc/sys/net/ipv4/ip_local_port_range``h]h&/proc/sys/net/ipv4/ip_local_port_range}(hj00hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj0ubhP sysctl (also used for IPv6), and within that range, on a per-socket basis with }(hj0hhhNhNubj)}(h#``setsockopt(IP_LOCAL_PORT_RANGE)``h]hsetsockopt(IP_LOCAL_PORT_RANGE)}(hjB0hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj0ubh.}(hj0hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:605: ./include/uapi/linux/landlock.hhMhj0ubj()}(hA Landlock rule with port 0 and the ``LANDLOCK_ACCESS_NET_BIND_TCP`` or ``LANDLOCK_ACCESS_NET_BIND_UDP`` right means that requesting to bind on port 0 is allowed and it will automatically translate to binding on a kernel-assigned ephemeral port.h](h$A Landlock rule with port 0 and the }(hj[0hhhNhNubj)}(h ``LANDLOCK_ACCESS_NET_BIND_TCP``h]hLANDLOCK_ACCESS_NET_BIND_TCP}(hjc0hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj[0ubh or }(hj[0hhhNhNubj)}(h ``LANDLOCK_ACCESS_NET_BIND_UDP``h]hLANDLOCK_ACCESS_NET_BIND_UDP}(hju0hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj[0ubh right means that requesting to bind on port 0 is allowed and it will automatically translate to binding on a kernel-assigned ephemeral port.}(hj[0hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:605: ./include/uapi/linux/landlock.hhMhj0ubeh}(h]h ]h"]h$]h&]uh1j<hj/ubeh}(h]h ]h"]h$]h&]uh1j&hj0hM hj/ubeh}(h]h ]h"]h$]h&]uh1j!hjM/ubeh}(h]h ] kernelindentah"]h$]h&]uh1jrhj#hhhj+hNubj()}(h**Description**h]j )}(hj0h]h Description}(hj0hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj0ubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:605: ./include/uapi/linux/landlock.hhMhj#hhubj()}(h$Argument of sys_landlock_add_rule().h]h$Argument of sys_landlock_add_rule().}(hj0hhhNhNubah}(h]h ]h"]h$]h&]uh1j'he/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:605: ./include/uapi/linux/landlock.hhKhj#hhubeh}(h]extending-a-rulesetah ]h"]extending a rulesetah$]h&]uh1hhj hhhhhMXubh)}(hhh](h)}(hEnforcing a ruleseth]hEnforcing a ruleset}(hj0hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj0hhhhhMbubj6)}(hhh]h}(h]h ]h"]h$]h&]entries](jB'sys_landlock_restrict_self (C function)c.sys_landlock_restrict_selfhNtauh1j5hj0hhhNhNubjG)}(hhh](jL)}(hIlong sys_landlock_restrict_self (const int ruleset_fd, const __u32 flags)h]jR)}(hHlong sys_landlock_restrict_self(const int ruleset_fd, const __u32 flags)h](jX)}(hlongh]hlong}(hj1hhhNhNubah}(h]h ]jdah"]h$]h&]uh1jWhj0hhhd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:612: ./security/landlock/syscalls.chMubjj)}(h h]h }(hj1hhhNhNubah}(h]h ]jvah"]h$]h&]uh1jihj0hhhj1hMubj{)}(hsys_landlock_restrict_selfh]j)}(hsys_landlock_restrict_selfh]hsys_landlock_restrict_self}(hj!1hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj1ubah}(h]h ](jjeh"]h$]h&]hhuh1jzhj0hhhj1hMubj)}(h)(const int ruleset_fd, const __u32 flags)h](j)}(hconst int ruleset_fdh](j)}(hjh]hconst}(hj=1hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj91ubjj)}(h h]h }(hjJ1hhhNhNubah}(h]h ]jvah"]h$]h&]uh1jihj91ubjX)}(hinth]hint}(hjX1hhhNhNubah}(h]h ]jdah"]h$]h&]uh1jWhj91ubjj)}(h h]h }(hjf1hhhNhNubah}(h]h ]jvah"]h$]h&]uh1jihj91ubj)}(h ruleset_fdh]h ruleset_fd}(hjt1hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj91ubeh}(h]h ]h"]h$]h&]noemphhhuh1jhj51ubj)}(hconst __u32 flagsh](j)}(hjh]hconst}(hj1hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj1ubjj)}(h h]h }(hj1hhhNhNubah}(h]h ]jvah"]h$]h&]uh1jihj1ubh)}(hhh]j)}(h__u32h]h__u32}(hj1hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj1ubah}(h]h ]h"]h$]h&] refdomainjreftypej reftargetj1modnameN classnameNjj)}j]j)}jj#1sbc.sys_landlock_restrict_selfasbuh1hhj1ubjj)}(h h]h }(hj1hhhNhNubah}(h]h ]jvah"]h$]h&]uh1jihj1ubj)}(hflagsh]hflags}(hj1hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj1ubeh}(h]h ]h"]h$]h&]noemphhhuh1jhj51ubeh}(h]h ]h"]h$]h&]hhuh1jhj0hhhj1hMubeh}(h]h ]h"]h$]h&]hhj=uh1jQj>j?hj0hhhj1hMubah}(h]j0ah ](jCjDeh"]h$]h&]jHjI)jJhuh1jKhj1hMhj0hhubjL)}(hhh]j()}(h'Enforce a ruleset on the calling threadh]h'Enforce a ruleset on the calling thread}(hj2hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:612: ./security/landlock/syscalls.chMhj2hhubah}(h]h ]h"]h$]h&]uh1jKhj0hhhj1hMubeh}(h]h ](jfunctioneh"]h$]h&]jljjmj2jnj2jojpjquh1jFhhhj0hNhNubjs)}(hX`**Parameters** ``const int ruleset_fd`` File descriptor tied to the ruleset to merge with the target. ``const __u32 flags`` Supported values: **Description** - ``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF`` - ``LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON`` - ``LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF`` - ``LANDLOCK_RESTRICT_SELF_TSYNC`` This system call enforces a Landlock ruleset on the current thread. Enforcing a ruleset requires that the task has ``CAP_SYS_ADMIN`` in its namespace or is running with no_new_privs. This avoids scenarios where unprivileged tasks can affect the behavior of privileged children. - ``EOPNOTSUPP``: Landlock is supported by the kernel but disabled at boot time; - ``EINVAL``: **flags** contains an unknown bit. - ``EBADF``: **ruleset_fd** is not a file descriptor for the current thread; - ``EBADFD``: **ruleset_fd** is not a ruleset file descriptor; - ``EPERM``: **ruleset_fd** has no read access to the underlying ruleset, or the current thread is not running with no_new_privs, or it doesn't have ``CAP_SYS_ADMIN`` in its namespace. - ``E2BIG``: The maximum number of stacked rulesets is reached for the current thread. .. kernel-doc:: include/uapi/linux/landlock.h :identifiers: landlock_restrict_self_flags **Return** 0 on success, or -errno on failure. Possible returned errors are:h](j()}(h**Parameters**h]j )}(hj%2h]h Parameters}(hj'2hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj#2ubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:612: ./security/landlock/syscalls.chMhj2ubj")}(hhh](j')}(hW``const int ruleset_fd`` File descriptor tied to the ruleset to merge with the target. h](j-)}(h``const int ruleset_fd``h]j)}(hjD2h]hconst int ruleset_fd}(hjF2hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjB2ubah}(h]h ]h"]h$]h&]uh1j,hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:612: ./security/landlock/syscalls.chMhj>2ubj=)}(hhh]j()}(h=File descriptor tied to the ruleset to merge with the target.h]h=File descriptor tied to the ruleset to merge with the target.}(hj]2hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hjY2hMhjZ2ubah}(h]h ]h"]h$]h&]uh1j<hj>2ubeh}(h]h ]h"]h$]h&]uh1j&hjY2hMhj;2ubj')}(h(``const __u32 flags`` Supported values: h](j-)}(h``const __u32 flags``h]j)}(hj}2h]hconst __u32 flags}(hj2hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj{2ubah}(h]h ]h"]h$]h&]uh1j,hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:612: ./security/landlock/syscalls.chMhjw2ubj=)}(hhh]j()}(hSupported values:h]hSupported values:}(hj2hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hj2hMhj2ubah}(h]h ]h"]h$]h&]uh1j<hjw2ubeh}(h]h ]h"]h$]h&]uh1j&hj2hMhj;2ubeh}(h]h ]h"]h$]h&]uh1j!hj2ubj()}(h**Description**h]j )}(hj2h]h Description}(hj2hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj2ubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:612: ./security/landlock/syscalls.chMhj2ubj)}(h- ``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF`` - ``LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON`` - ``LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF`` - ``LANDLOCK_RESTRICT_SELF_TSYNC`` h]j)}(hhh](j)}(h,``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF``h]j()}(hj2h]j)}(hj2h]h(LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF}(hj2hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj2ubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:612: ./security/landlock/syscalls.chMhj2ubah}(h]h ]h"]h$]h&]uh1jhj2ubj)}(h*``LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON``h]j()}(hj2h]j)}(hj2h]h&LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON}(hj2hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj2ubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:612: ./security/landlock/syscalls.chMhj2ubah}(h]h ]h"]h$]h&]uh1jhj2ubj)}(h-``LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF``h]j()}(hj3h]j)}(hj3h]h)LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF}(hj3hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj3ubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:612: ./security/landlock/syscalls.chMhj3ubah}(h]h ]h"]h$]h&]uh1jhj2ubj)}(h!``LANDLOCK_RESTRICT_SELF_TSYNC`` h]j()}(h ``LANDLOCK_RESTRICT_SELF_TSYNC``h]j)}(hj>3h]hLANDLOCK_RESTRICT_SELF_TSYNC}(hj@3hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj<3ubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:612: ./security/landlock/syscalls.chMhj83ubah}(h]h ]h"]h$]h&]uh1jhj2ubeh}(h]h ]h"]h$]h&]jjuh1jhj2hMhj2ubah}(h]h ]h"]h$]h&]uh1jhj2hMhj2ubj()}(hXThis system call enforces a Landlock ruleset on the current thread. Enforcing a ruleset requires that the task has ``CAP_SYS_ADMIN`` in its namespace or is running with no_new_privs. This avoids scenarios where unprivileged tasks can affect the behavior of privileged children.h](hsThis system call enforces a Landlock ruleset on the current thread. Enforcing a ruleset requires that the task has }(hjf3hhhNhNubj)}(h``CAP_SYS_ADMIN``h]h CAP_SYS_ADMIN}(hjn3hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjf3ubh in its namespace or is running with no_new_privs. This avoids scenarios where unprivileged tasks can affect the behavior of privileged children.}(hjf3hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:612: ./security/landlock/syscalls.chMhj2ubj)}(hhh](j)}(hN``EOPNOTSUPP``: Landlock is supported by the kernel but disabled at boot time;h]j()}(hj3h](j)}(h``EOPNOTSUPP``h]h EOPNOTSUPP}(hj3hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj3ubh@: Landlock is supported by the kernel but disabled at boot time;}(hj3hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:612: ./security/landlock/syscalls.chMhj3ubah}(h]h ]h"]h$]h&]uh1jhj3ubj)}(h.``EINVAL``: **flags** contains an unknown bit.h]j()}(hj3h](j)}(h ``EINVAL``h]hEINVAL}(hj3hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj3ubh: }(hj3hhhNhNubj )}(h **flags**h]hflags}(hj3hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj3ubh contains an unknown bit.}(hj3hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:612: ./security/landlock/syscalls.chMhj3ubah}(h]h ]h"]h$]h&]uh1jhj3ubj)}(hJ``EBADF``: **ruleset_fd** is not a file descriptor for the current thread;h]j()}(hj3h](j)}(h ``EBADF``h]hEBADF}(hj3hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj3ubh: }(hj3hhhNhNubj )}(h**ruleset_fd**h]h ruleset_fd}(hj4hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj3ubh1 is not a file descriptor for the current thread;}(hj3hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:612: ./security/landlock/syscalls.chMhj3ubah}(h]h ]h"]h$]h&]uh1jhj3ubj)}(h<``EBADFD``: **ruleset_fd** is not a ruleset file descriptor;h]j()}(hj"4h](j)}(h ``EBADFD``h]hEBADFD}(hj'4hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj$4ubh: }(hj$4hhhNhNubj )}(h**ruleset_fd**h]h ruleset_fd}(hj94hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj$4ubh" is not a ruleset file descriptor;}(hj$4hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:612: ./security/landlock/syscalls.chMhj 4ubah}(h]h ]h"]h$]h&]uh1jhj3ubj)}(h``EPERM``: **ruleset_fd** has no read access to the underlying ruleset, or the current thread is not running with no_new_privs, or it doesn't have ``CAP_SYS_ADMIN`` in its namespace.h]j()}(h``EPERM``: **ruleset_fd** has no read access to the underlying ruleset, or the current thread is not running with no_new_privs, or it doesn't have ``CAP_SYS_ADMIN`` in its namespace.h](j)}(h ``EPERM``h]hEPERM}(hj`4hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj\4ubh: }(hj\4hhhNhNubj )}(h**ruleset_fd**h]h ruleset_fd}(hjr4hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj\4ubh| has no read access to the underlying ruleset, or the current thread is not running with no_new_privs, or it doesn’t have }(hj\4hhhNhNubj)}(h``CAP_SYS_ADMIN``h]h CAP_SYS_ADMIN}(hj4hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj\4ubh in its namespace.}(hj\4hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:612: ./security/landlock/syscalls.chMhjX4ubah}(h]h ]h"]h$]h&]uh1jhj3ubj)}(hU``E2BIG``: The maximum number of stacked rulesets is reached for the current thread. h]j()}(hT``E2BIG``: The maximum number of stacked rulesets is reached for the current thread.h](j)}(h ``E2BIG``h]hE2BIG}(hj4hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj4ubhK: The maximum number of stacked rulesets is reached for the current thread.}(hj4hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:612: ./security/landlock/syscalls.chMhj4ubah}(h]h ]h"]h$]h&]uh1jhj3ubeh}(h]h ]h"]h$]h&]jjuh1jhj3hMhj2ubj()}(h **Flags**h]j )}(hj4h]hFlags}(hj4hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj4ubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:38: ./include/uapi/linux/landlock.hhKhj2ubj()}(hXBy default, denied accesses originating from programs that sandbox themselves are logged via the audit subsystem. Such events typically indicate unexpected behavior, such as bugs or exploitation attempts. However, to avoid excessive logging, access requests denied by a domain not created by the originating program are not logged by default. The rationale is that programs should know their own behavior, but not necessarily the behavior of other programs. This default configuration is suitable for most programs that sandbox themselves. For specific use cases, the following flags allow programs to modify this default logging behavior.h]hXBy default, denied accesses originating from programs that sandbox themselves are logged via the audit subsystem. Such events typically indicate unexpected behavior, such as bugs or exploitation attempts. However, to avoid excessive logging, access requests denied by a domain not created by the originating program are not logged by default. The rationale is that programs should know their own behavior, but not necessarily the behavior of other programs. This default configuration is suitable for most programs that sandbox themselves. For specific use cases, the following flags allow programs to modify this default logging behavior.}(hj4hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:38: ./include/uapi/linux/landlock.hhKhj2ubj()}(hThe ``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF`` and ``LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON`` flags apply to the newly created Landlock domain.h](hThe }(hj4hhhNhNubj)}(h,``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF``h]h(LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF}(hj4hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj4ubh and }(hj4hhhNhNubj)}(h*``LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON``h]h&LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON}(hj5hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj4ubh2 flags apply to the newly created Landlock domain.}(hj4hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:38: ./include/uapi/linux/landlock.hhKhj2ubj")}(hhh](j')}(hX``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF`` Disables logging of denied accesses originating from the thread creating the Landlock domain, as well as its children, as long as they continue running the same executable code (i.e., without an intervening :manpage:`execve(2)` call). This is intended for programs that execute unknown code without invoking :manpage:`execve(2)`, such as script interpreters. Programs that only sandbox themselves should not set this flag, so users can be notified of unauthorized access attempts via system logs. h](j-)}(h,``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF``h]j)}(hj35h]h(LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF}(hj55hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj15ubah}(h]h ]h"]h$]h&]uh1j,hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:38: ./include/uapi/linux/landlock.hhKhj-5ubj=)}(hhh]j()}(hXDisables logging of denied accesses originating from the thread creating the Landlock domain, as well as its children, as long as they continue running the same executable code (i.e., without an intervening :manpage:`execve(2)` call). This is intended for programs that execute unknown code without invoking :manpage:`execve(2)`, such as script interpreters. Programs that only sandbox themselves should not set this flag, so users can be notified of unauthorized access attempts via system logs.h](hDisables logging of denied accesses originating from the thread creating the Landlock domain, as well as its children, as long as they continue running the same executable code (i.e., without an intervening }(hjL5hhhNhNubj/)}(h:manpage:`execve(2)`h]h execve(2)}(hjT5hhhNhNubah}(h]h ]j.ah"]h$]h&]hhj> execve(2)j@execvejBjCuh1j.hjL5ubhQ call). This is intended for programs that execute unknown code without invoking }(hjL5hhhNhNubj/)}(h:manpage:`execve(2)`h]h execve(2)}(hjh5hhhNhNubah}(h]h ]j.ah"]h$]h&]hhj> execve(2)j@execvejBjCuh1j.hjL5ubh, such as script interpreters. Programs that only sandbox themselves should not set this flag, so users can be notified of unauthorized access attempts via system logs.}(hjL5hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:38: ./include/uapi/linux/landlock.hhKhjI5ubah}(h]h ]h"]h$]h&]uh1j<hj-5ubeh}(h]h ]h"]h$]h&]uh1j&hjH5hKhj*5ubj')}(hX``LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON`` Enables logging of denied accesses after an :manpage:`execve(2)` call, providing visibility into unauthorized access attempts by newly executed programs within the created Landlock domain. This flag is recommended only when all potential executables in the domain are expected to comply with the access restrictions, as excessive audit log entries could make it more difficult to identify critical events. h](j-)}(h*``LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON``h]j)}(hj5h]h&LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON}(hj5hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj5ubah}(h]h ]h"]h$]h&]uh1j,hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:38: ./include/uapi/linux/landlock.hhKhj5ubj=)}(hhh]j()}(hXEnables logging of denied accesses after an :manpage:`execve(2)` call, providing visibility into unauthorized access attempts by newly executed programs within the created Landlock domain. This flag is recommended only when all potential executables in the domain are expected to comply with the access restrictions, as excessive audit log entries could make it more difficult to identify critical events.h](h,Enables logging of denied accesses after an }(hj5hhhNhNubj/)}(h:manpage:`execve(2)`h]h execve(2)}(hj5hhhNhNubah}(h]h ]j.ah"]h$]h&]hhj> execve(2)j@execvejBjCuh1j.hj5ubhXU call, providing visibility into unauthorized access attempts by newly executed programs within the created Landlock domain. This flag is recommended only when all potential executables in the domain are expected to comply with the access restrictions, as excessive audit log entries could make it more difficult to identify critical events.}(hj5hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:38: ./include/uapi/linux/landlock.hhKhj5ubah}(h]h ]h"]h$]h&]uh1j<hj5ubeh}(h]h ]h"]h$]h&]uh1j&hj5hKhj*5ubj')}(hXL``LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF`` Disables logging of denied accesses originating from nested Landlock domains created by the caller or its descendants. This flag should be set according to runtime configuration, not hardcoded, to avoid suppressing important security events. It is useful for container runtimes or sandboxing tools that may launch programs which themselves create Landlock domains and could otherwise generate excessive logs. Unlike ``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF``, this flag only affects future nested domains, not the one being created. It can also be used with a **ruleset_fd** value of -1 to mute subdomain logs without creating a domain. When combined with ``LANDLOCK_RESTRICT_SELF_TSYNC`` and a **ruleset_fd** value of -1, this configuration is propagated to all threads of the current process. h](j-)}(h-``LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF``h]j)}(hj5h]h)LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF}(hj5hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj5ubah}(h]h ]h"]h$]h&]uh1j,hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:38: ./include/uapi/linux/landlock.hhKhj5ubj=)}(hhh]j()}(hXDisables logging of denied accesses originating from nested Landlock domains created by the caller or its descendants. This flag should be set according to runtime configuration, not hardcoded, to avoid suppressing important security events. It is useful for container runtimes or sandboxing tools that may launch programs which themselves create Landlock domains and could otherwise generate excessive logs. Unlike ``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF``, this flag only affects future nested domains, not the one being created. It can also be used with a **ruleset_fd** value of -1 to mute subdomain logs without creating a domain. When combined with ``LANDLOCK_RESTRICT_SELF_TSYNC`` and a **ruleset_fd** value of -1, this configuration is propagated to all threads of the current process.h](hXDisables logging of denied accesses originating from nested Landlock domains created by the caller or its descendants. This flag should be set according to runtime configuration, not hardcoded, to avoid suppressing important security events. It is useful for container runtimes or sandboxing tools that may launch programs which themselves create Landlock domains and could otherwise generate excessive logs. Unlike }(hj5hhhNhNubj)}(h,``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF``h]h(LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF}(hj6hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj5ubhf, this flag only affects future nested domains, not the one being created. It can also be used with a }(hj5hhhNhNubj )}(h**ruleset_fd**h]h ruleset_fd}(hj6hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj5ubhS value of -1 to mute subdomain logs without creating a domain. When combined with }(hj5hhhNhNubj)}(h ``LANDLOCK_RESTRICT_SELF_TSYNC``h]hLANDLOCK_RESTRICT_SELF_TSYNC}(hj(6hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj5ubh and a }(hj5hhhNhNubj )}(h**ruleset_fd**h]h ruleset_fd}(hj:6hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj5ubhU value of -1, this configuration is propagated to all threads of the current process.}(hj5hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:38: ./include/uapi/linux/landlock.hhKhj5ubah}(h]h ]h"]h$]h&]uh1j<hj5ubeh}(h]h ]h"]h$]h&]uh1j&hj5hKhj*5ubeh}(h]h ]h"]h$]h&]uh1j!hj2ubj()}(hJThe following flag supports policy enforcement in multithreaded processes:h]hJThe following flag supports policy enforcement in multithreaded processes:}(hje6hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:38: ./include/uapi/linux/landlock.hhKhj2ubj")}(hhh]j')}(hX``LANDLOCK_RESTRICT_SELF_TSYNC`` Applies the new Landlock configuration atomically to all threads of the current process, including the Landlock domain and logging configuration. This overrides the Landlock configuration of sibling threads, irrespective of previously established Landlock domains and logging configurations on these threads. If the calling thread is running with no_new_privs, this operation enables no_new_privs on the sibling threads as well. h](j-)}(h ``LANDLOCK_RESTRICT_SELF_TSYNC``h]j)}(hj}6h]hLANDLOCK_RESTRICT_SELF_TSYNC}(hj6hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj{6ubah}(h]h ]h"]h$]h&]uh1j,hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:38: ./include/uapi/linux/landlock.hhKhjw6ubj=)}(hhh](j()}(hX4Applies the new Landlock configuration atomically to all threads of the current process, including the Landlock domain and logging configuration. This overrides the Landlock configuration of sibling threads, irrespective of previously established Landlock domains and logging configurations on these threads.h]hX4Applies the new Landlock configuration atomically to all threads of the current process, including the Landlock domain and logging configuration. This overrides the Landlock configuration of sibling threads, irrespective of previously established Landlock domains and logging configurations on these threads.}(hj6hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:38: ./include/uapi/linux/landlock.hhKhj6ubj()}(hwIf the calling thread is running with no_new_privs, this operation enables no_new_privs on the sibling threads as well.h]hwIf the calling thread is running with no_new_privs, this operation enables no_new_privs on the sibling threads as well.}(hj6hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:38: ./include/uapi/linux/landlock.hhKhj6ubeh}(h]h ]h"]h$]h&]uh1j<hjw6ubeh}(h]h ]h"]h$]h&]uh1j&hj6hKhjt6ubah}(h]h ]h"]h$]h&]uh1j!hj2ubj()}(h **Return**h]j )}(hj6h]hReturn}(hj6hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj6ubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:612: ./security/landlock/syscalls.chM hj2ubj()}(hB0 on success, or -errno on failure. Possible returned errors are:h]hB0 on success, or -errno on failure. Possible returned errors are:}(hj6hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hd/var/lib/git/docbuild/linux/Documentation/userspace-api/landlock:612: ./security/landlock/syscalls.chMhj2ubeh}(h]h ] kernelindentah"]h$]h&]uh1jrhj0hhhNhNubeh}(h]enforcing-a-rulesetah ]h"]enforcing a rulesetah$]h&]uh1hhj hhhhhMbubeh}(h]kernel-interfaceah ]h"]kernel interfaceah$]h&]uh1hhhhhhhhMFubh)}(hhh](h)}(hCurrent limitationsh]hCurrent limitations}(hj7hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj7hhhhhMhubh)}(hhh](h)}(h Filesystem topology modificationh]h Filesystem topology modification}(hj7hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj7hhhhhMkubj()}(hThreads sandboxed with filesystem restrictions cannot modify filesystem topology, whether via :manpage:`mount(2)` or :manpage:`pivot_root(2)`. However, :manpage:`chroot(2)` calls are not denied.h](h^Threads sandboxed with filesystem restrictions cannot modify filesystem topology, whether via }(hj&7hhhNhNubj/)}(h:manpage:`mount(2)`h]hmount(2)}(hj.7hhhNhNubah}(h]h ]j.ah"]h$]h&]hhj>mount(2)j@mountjBjCuh1j.hj&7ubh or }(hj&7hhhNhNubj/)}(h:manpage:`pivot_root(2)`h]h pivot_root(2)}(hjB7hhhNhNubah}(h]h ]j.ah"]h$]h&]hhj> pivot_root(2)j@ pivot_rootjBjCuh1j.hj&7ubh . However, }(hj&7hhhNhNubj/)}(h:manpage:`chroot(2)`h]h chroot(2)}(hjV7hhhNhNubah}(h]h ]j.ah"]h$]h&]hhj> chroot(2)j@chrootjBjCuh1j.hj&7ubh calls are not denied.}(hj&7hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMmhj7hhubeh}(h] filesystem-topology-modificationah ]h"] filesystem topology modificationah$]h&]uh1hhj7hhhhhMkubh)}(hhh](h)}(hSpecial filesystemsh]hSpecial filesystems}(hj{7hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjx7hhhhhMrubj()}(hXAccess to regular files and directories can be restricted by Landlock, according to the handled accesses of a ruleset. However, files that do not come from a user-visible filesystem (e.g. pipe, socket), but can still be accessed through ``/proc//fd/*``, cannot currently be explicitly restricted. Likewise, some special kernel filesystems such as nsfs, which can be accessed through ``/proc//ns/*``, cannot currently be explicitly restricted. However, thanks to the `ptrace restrictions`_, access to such sensitive ``/proc`` files are automatically restricted according to domain hierarchies. Future Landlock evolutions could still enable to explicitly restrict such paths with dedicated ruleset flags.h](hAccess to regular files and directories can be restricted by Landlock, according to the handled accesses of a ruleset. However, files that do not come from a user-visible filesystem (e.g. pipe, socket), but can still be accessed through }(hj7hhhNhNubj)}(h``/proc//fd/*``h]h/proc//fd/*}(hj7hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj7ubh, cannot currently be explicitly restricted. Likewise, some special kernel filesystems such as nsfs, which can be accessed through }(hj7hhhNhNubj)}(h``/proc//ns/*``h]h/proc//ns/*}(hj7hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj7ubhE, cannot currently be explicitly restricted. However, thanks to the }(hj7hhhNhNubj)}(h`ptrace restrictions`_h]hptrace restrictions}(hj7hhhNhNubah}(h]h ]h"]h$]h&]nameptrace restrictionsjMjuh1jhj7j&Kubh, access to such sensitive }(hj7hhhNhNubj)}(h ``/proc``h]h/proc}(hj7hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj7ubh files are automatically restricted according to domain hierarchies. Future Landlock evolutions could still enable to explicitly restrict such paths with dedicated ruleset flags.}(hj7hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMthjx7hhubeh}(h]special-filesystemsah ]h"]special filesystemsah$]h&]uh1hhj7hhhhhMrubh)}(hhh](h)}(hRuleset layersh]hRuleset layers}(hj7hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj7hhhhhMubj()}(hXThere is a limit of 16 layers of stacked rulesets. This can be an issue for a task willing to enforce a new ruleset in complement to its 16 inherited rulesets. Once this limit is reached, sys_landlock_restrict_self() returns E2BIG. It is then strongly suggested to carefully build rulesets once in the life of a thread, especially for applications able to launch other applications that may also want to sandbox themselves (e.g. shells, container managers, etc.).h]hXThere is a limit of 16 layers of stacked rulesets. This can be an issue for a task willing to enforce a new ruleset in complement to its 16 inherited rulesets. Once this limit is reached, sys_landlock_restrict_self() returns E2BIG. It is then strongly suggested to carefully build rulesets once in the life of a thread, especially for applications able to launch other applications that may also want to sandbox themselves (e.g. shells, container managers, etc.).}(hj7hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMhj7hhubeh}(h]ruleset-layersah ]h"]ruleset layersah$]h&]uh1hhj7hhhhhMubh)}(hhh](h)}(h Memory usageh]h Memory usage}(hj8hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj8hhhhhMubj()}(hKernel memory allocated to create rulesets is accounted and can be restricted by the Documentation/admin-guide/cgroup-v1/memory.rst.h]hKernel memory allocated to create rulesets is accounted and can be restricted by the Documentation/admin-guide/cgroup-v1/memory.rst.}(hj!8hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMhj8hhubeh}(h] memory-usageah ]h"] memory usageah$]h&]uh1hhj7hhhhhMubh)}(hhh](h)}(h IOCTL supporth]h IOCTL support}(hj:8hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj78hhhhhMubj()}(hThe ``LANDLOCK_ACCESS_FS_IOCTL_DEV`` right restricts the use of :manpage:`ioctl(2)`, but it only applies to *newly opened* device files. This means specifically that pre-existing file descriptors like stdin, stdout and stderr are unaffected.h](hThe }(hjH8hhhNhNubj)}(h ``LANDLOCK_ACCESS_FS_IOCTL_DEV``h]hLANDLOCK_ACCESS_FS_IOCTL_DEV}(hjP8hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjH8ubh right restricts the use of }(hjH8hhhNhNubj/)}(h:manpage:`ioctl(2)`h]hioctl(2)}(hjb8hhhNhNubah}(h]h ]j.ah"]h$]h&]hhj>ioctl(2)j@ioctljBjCuh1j.hjH8ubh, but it only applies to }(hjH8hhhNhNubjb")}(h*newly opened*h]h newly opened}(hjv8hhhNhNubah}(h]h ]h"]h$]h&]uh1ja"hjH8ubhx device files. This means specifically that pre-existing file descriptors like stdin, stdout and stderr are unaffected.}(hjH8hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhj78hhubj()}(hXUsers should be aware that TTY devices have traditionally permitted to control other processes on the same TTY through the ``TIOCSTI`` and ``TIOCLINUX`` IOCTL commands. Both of these require ``CAP_SYS_ADMIN`` on modern Linux systems, but the behavior is configurable for ``TIOCSTI``.h](h{Users should be aware that TTY devices have traditionally permitted to control other processes on the same TTY through the }(hj8hhhNhNubj)}(h ``TIOCSTI``h]hTIOCSTI}(hj8hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj8ubh and }(hj8hhhNhNubj)}(h ``TIOCLINUX``h]h TIOCLINUX}(hj8hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj8ubh( IOCTL commands. Both of these require }(hj8hhhNhNubj)}(h``CAP_SYS_ADMIN``h]h CAP_SYS_ADMIN}(hj8hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj8ubh? on modern Linux systems, but the behavior is configurable for }(hj8hhhNhNubj)}(h ``TIOCSTI``h]hTIOCSTI}(hj8hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj8ubh.}(hj8hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhj78hhubj()}(hOn older systems, it is therefore recommended to close inherited TTY file descriptors, or to reopen them from ``/proc/self/fd/*`` without the ``LANDLOCK_ACCESS_FS_IOCTL_DEV`` right, if possible.h](hnOn older systems, it is therefore recommended to close inherited TTY file descriptors, or to reopen them from }(hj8hhhNhNubj)}(h``/proc/self/fd/*``h]h/proc/self/fd/*}(hj8hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj8ubh without the }(hj8hhhNhNubj)}(h ``LANDLOCK_ACCESS_FS_IOCTL_DEV``h]hLANDLOCK_ACCESS_FS_IOCTL_DEV}(hj8hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj8ubh right, if possible.}(hj8hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhj78hhubj()}(hX1Landlock's IOCTL support is coarse-grained at the moment, but may become more fine-grained in the future. Until then, users are advised to establish the guarantees that they need through the file hierarchy, by only allowing the ``LANDLOCK_ACCESS_FS_IOCTL_DEV`` right on files where it is really required.h](hLandlock’s IOCTL support is coarse-grained at the moment, but may become more fine-grained in the future. Until then, users are advised to establish the guarantees that they need through the file hierarchy, by only allowing the }(hj9hhhNhNubj)}(h ``LANDLOCK_ACCESS_FS_IOCTL_DEV``h]hLANDLOCK_ACCESS_FS_IOCTL_DEV}(hj9hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj9ubh, right on files where it is really required.}(hj9hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhj78hhubeh}(h] ioctl-supportah ]h"] ioctl supportah$]h&]uh1hhj7hhhhhMubeh}(h]current-limitationsah ]h"]current limitationsah$]h&]uh1hhhhhhhhMhubh)}(hhh](h)}(hPrevious limitationsh]hPrevious limitations}(hjI9hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjF9hhhhhMubh)}(hhh](h)}(h#File renaming and linking (ABI < 2)h]h#File renaming and linking (ABI < 2)}(hjZ9hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjW9hhhhhMubj()}(hXBecause Landlock targets unprivileged access controls, it needs to properly handle composition of rules. Such property also implies rules nesting. Properly handling multiple layers of rulesets, each one of them able to restrict access to files, also implies inheritance of the ruleset restrictions from a parent to its hierarchy. Because files are identified and restricted by their hierarchy, moving or linking a file from one directory to another implies propagation of the hierarchy constraints, or restriction of these actions according to the potentially lost constraints. To protect against privilege escalations through renaming or linking, and for the sake of simplicity, Landlock previously limited linking and renaming to the same directory. Starting with the Landlock ABI version 2, it is now possible to securely control renaming and linking thanks to the new ``LANDLOCK_ACCESS_FS_REFER`` access right.th](hXkBecause Landlock targets unprivileged access controls, it needs to properly handle composition of rules. Such property also implies rules nesting. Properly handling multiple layers of rulesets, each one of them able to restrict access to files, also implies inheritance of the ruleset restrictions from a parent to its hierarchy. Because files are identified and restricted by their hierarchy, moving or linking a file from one directory to another implies propagation of the hierarchy constraints, or restriction of these actions according to the potentially lost constraints. To protect against privilege escalations through renaming or linking, and for the sake of simplicity, Landlock previously limited linking and renaming to the same directory. Starting with the Landlock ABI version 2, it is now possible to securely control renaming and linking thanks to the new }(hjh9hhhNhNubj)}(h``LANDLOCK_ACCESS_FS_REFER``h]hLANDLOCK_ACCESS_FS_REFER}(hjp9hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjh9ubh access right.}(hjh9hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjW9hhubeh}(h]file-renaming-and-linking-abi-2ah ]h"]#file renaming and linking (abi < 2)ah$]h&]uh1hhjF9hhhhhMubh)}(hhh](h)}(hFile truncation (ABI < 3)h]hFile truncation (ABI < 3)}(hj9hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj9hhhhhMubj()}(hFile truncation could not be denied before the third Landlock ABI, so it is always allowed when using a kernel that only supports the first or second ABI.h]hFile truncation could not be denied before the third Landlock ABI, so it is always allowed when using a kernel that only supports the first or second ABI.}(hj9hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMhj9hhubj()}(hStarting with the Landlock ABI version 3, it is now possible to securely control truncation thanks to the new ``LANDLOCK_ACCESS_FS_TRUNCATE`` access right.h](hnStarting with the Landlock ABI version 3, it is now possible to securely control truncation thanks to the new }(hj9hhhNhNubj)}(h``LANDLOCK_ACCESS_FS_TRUNCATE``h]hLANDLOCK_ACCESS_FS_TRUNCATE}(hj9hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj9ubh access right.}(hj9hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhj9hhubeh}(h]file-truncation-abi-3ah ]h"]file truncation (abi < 3)ah$]h&]uh1hhjF9hhhhhMubh)}(hhh](h)}(hTCP bind and connect (ABI < 4)h]hTCP bind and connect (ABI < 4)}(hj9hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj9hhhhhMubj()}(hStarting with the Landlock ABI version 4, it is now possible to restrict TCP bind and connect actions to only a set of allowed ports thanks to the new ``LANDLOCK_ACCESS_NET_BIND_TCP`` and ``LANDLOCK_ACCESS_NET_CONNECT_TCP`` access rights.h](hStarting with the Landlock ABI version 4, it is now possible to restrict TCP bind and connect actions to only a set of allowed ports thanks to the new }(hj9hhhNhNubj)}(h ``LANDLOCK_ACCESS_NET_BIND_TCP``h]hLANDLOCK_ACCESS_NET_BIND_TCP}(hj9hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj9ubh and }(hj9hhhNhNubj)}(h#``LANDLOCK_ACCESS_NET_CONNECT_TCP``h]hLANDLOCK_ACCESS_NET_CONNECT_TCP}(hj:hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj9ubh access rights.}(hj9hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhj9hhubeh}(h]tcp-bind-and-connect-abi-4ah ]h"]tcp bind and connect (abi < 4)ah$]h&]uh1hhjF9hhhhhMubh)}(hhh](h)}(hDevice IOCTL (ABI < 5)h]hDevice IOCTL (ABI < 5)}(hj%:hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj":hhhhhMubj()}(hIOCTL operations could not be denied before the fifth Landlock ABI, so :manpage:`ioctl(2)` is always allowed when using a kernel that only supports an earlier ABI.h](hGIOCTL operations could not be denied before the fifth Landlock ABI, so }(hj3:hhhNhNubj/)}(h:manpage:`ioctl(2)`h]hioctl(2)}(hj;:hhhNhNubah}(h]h ]j.ah"]h$]h&]hhj>ioctl(2)j@ioctljBjCuh1j.hj3:ubhI is always allowed when using a kernel that only supports an earlier ABI.}(hj3:hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhj":hhubj()}(hStarting with the Landlock ABI version 5, it is possible to restrict the use of :manpage:`ioctl(2)` on character and block devices using the new ``LANDLOCK_ACCESS_FS_IOCTL_DEV`` right.h](hPStarting with the Landlock ABI version 5, it is possible to restrict the use of }(hjU:hhhNhNubj/)}(h:manpage:`ioctl(2)`h]hioctl(2)}(hj]:hhhNhNubah}(h]h ]j.ah"]h$]h&]hhj>ioctl(2)j@ioctljBjCuh1j.hjU:ubh. on character and block devices using the new }(hjU:hhhNhNubj)}(h ``LANDLOCK_ACCESS_FS_IOCTL_DEV``h]hLANDLOCK_ACCESS_FS_IOCTL_DEV}(hjq:hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjU:ubh right.}(hjU:hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhj":hhubeh}(h]device-ioctl-abi-5ah ]h"]device ioctl (abi < 5)ah$]h&]uh1hhjF9hhhhhMubh)}(hhh](h)}(hAbstract UNIX socket (ABI < 6)h]hAbstract UNIX socket (ABI < 6)}(hj:hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj:hhhhhMubj()}(hStarting with the Landlock ABI version 6, it is possible to restrict connections to an abstract :manpage:`unix(7)` socket by setting ``LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET`` to the ``scoped`` ruleset attribute.h](h`Starting with the Landlock ABI version 6, it is possible to restrict connections to an abstract }(hj:hhhNhNubj/)}(h:manpage:`unix(7)`h]hunix(7)}(hj:hhhNhNubah}(h]h ]j.ah"]h$]h&]hhj>unix(7)j@unixjBjuh1j.hj:ubh socket by setting }(hj:hhhNhNubj)}(h'``LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET``h]h#LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET}(hj:hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj:ubh to the }(hj:hhhNhNubj)}(h ``scoped``h]hscoped}(hj:hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj:ubh ruleset attribute.}(hj:hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhj:hhubeh}(h]abstract-unix-socket-abi-6ah ]h"]abstract unix socket (abi < 6)ah$]h&]uh1hhjF9hhhhhMubh)}(hhh](h)}(hSignal (ABI < 6)h]hSignal (ABI < 6)}(hj:hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj:hhhhhMubj()}(hStarting with the Landlock ABI version 6, it is possible to restrict :manpage:`signal(7)` sending by setting ``LANDLOCK_SCOPE_SIGNAL`` to the ``scoped`` ruleset attribute.h](hEStarting with the Landlock ABI version 6, it is possible to restrict }(hj;hhhNhNubj/)}(h:manpage:`signal(7)`h]h signal(7)}(hj ;hhhNhNubah}(h]h ]j.ah"]h$]h&]hhj> signal(7)j@signaljBjuh1j.hj;ubh sending by setting }(hj;hhhNhNubj)}(h``LANDLOCK_SCOPE_SIGNAL``h]hLANDLOCK_SCOPE_SIGNAL}(hj;hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj;ubh to the }(hj;hhhNhNubj)}(h ``scoped``h]hscoped}(hj/;hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj;ubh ruleset attribute.}(hj;hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhj:hhubeh}(h] signal-abi-6ah ]h"]signal (abi < 6)ah$]h&]uh1hhjF9hhhhhMubh)}(hhh](h)}(hLogging (ABI < 7)h]hLogging (ABI < 7)}(hjR;hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjO;hhhhhMubj()}(hXrStarting with the Landlock ABI version 7, it is possible to control logging of Landlock audit events with the ``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF``, ``LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON``, and ``LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF`` flags passed to sys_landlock_restrict_self(). See Documentation/admin-guide/LSM/landlock.rst for more details on audit.h](hnStarting with the Landlock ABI version 7, it is possible to control logging of Landlock audit events with the }(hj`;hhhNhNubj)}(h,``LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF``h]h(LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF}(hjh;hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj`;ubh, }(hj`;hhhNhNubj)}(h*``LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON``h]h&LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON}(hjz;hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj`;ubh, and }(hj`;hhhNhNubj)}(h-``LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF``h]h)LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF}(hj;hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj`;ubhy flags passed to sys_landlock_restrict_self(). See Documentation/admin-guide/LSM/landlock.rst for more details on audit.}(hj`;hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhjO;hhubeh}(h] logging-abi-7ah ]h"]logging (abi < 7)ah$]h&]uh1hhjF9hhhhhMubh)}(hhh](h)}(h Thread synchronization (ABI < 8)h]h Thread synchronization (ABI < 8)}(hj;hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj;hhhhhMubj()}(hStarting with the Landlock ABI version 8, it is now possible to enforce Landlock rulesets across all threads of the calling process using the ``LANDLOCK_RESTRICT_SELF_TSYNC`` flag passed to sys_landlock_restrict_self().h](hStarting with the Landlock ABI version 8, it is now possible to enforce Landlock rulesets across all threads of the calling process using the }(hj;hhhNhNubj)}(h ``LANDLOCK_RESTRICT_SELF_TSYNC``h]hLANDLOCK_RESTRICT_SELF_TSYNC}(hj;hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj;ubh- flag passed to sys_landlock_restrict_self().}(hj;hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhj;hhubeh}(h]thread-synchronization-abi-8ah ]h"] thread synchronization (abi < 8)ah$]h&]uh1hhjF9hhhhhMubh)}(hhh](h)}(hPathname UNIX sockets (ABI < 9)h]hPathname UNIX sockets (ABI < 9)}(hj;hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj;hhhhhMubj()}(hStarting with the Landlock ABI version 9, it is possible to restrict connections to pathname UNIX domain sockets (:manpage:`unix(7)`) using the new ``LANDLOCK_ACCESS_FS_RESOLVE_UNIX`` right.h](hrStarting with the Landlock ABI version 9, it is possible to restrict connections to pathname UNIX domain sockets (}(hj;hhhNhNubj/)}(h:manpage:`unix(7)`h]hunix(7)}(hj;hhhNhNubah}(h]h ]j.ah"]h$]h&]hhj>unix(7)j@unixjBjuh1j.hj;ubh) using the new }(hj;hhhNhNubj)}(h#``LANDLOCK_ACCESS_FS_RESOLVE_UNIX``h]hLANDLOCK_ACCESS_FS_RESOLVE_UNIX}(hj<hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj;ubh right.}(hj;hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhj;hhubeh}(h]pathname-unix-sockets-abi-9ah ]h"]pathname unix sockets (abi < 9)ah$]h&]uh1hhjF9hhhhhMubh)}(hhh](h)}(h&UDP bind, connect and send* (ABI < 10)h]h&UDP bind, connect and send* (ABI < 10)}(hj5<hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj2<hhhhhMubj()}(hXAStarting with the Landlock ABI version 10, it is possible to restrict setting the local port of UDP sockets with the ``LANDLOCK_ACCESS_NET_BIND_UDP`` right. This includes restricting the ability to trigger autobind of an ephemeral port by the kernel by e.g. sending a first datagram or setting the remote peer of a socket. The ``LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP`` right controls setting the remote port of UDP sockets (via :manpage:`connect(2)`), and sending datagrams to an explicit remote port (ignoring any destination set on UDP sockets, via e.g. :manpage:`sendto(2)`).h](huStarting with the Landlock ABI version 10, it is possible to restrict setting the local port of UDP sockets with the }(hjC<hhhNhNubj)}(h ``LANDLOCK_ACCESS_NET_BIND_UDP``h]hLANDLOCK_ACCESS_NET_BIND_UDP}(hjK<hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjC<ubh right. This includes restricting the ability to trigger autobind of an ephemeral port by the kernel by e.g. sending a first datagram or setting the remote peer of a socket. The }(hjC<hhhNhNubj)}(h(``LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP``h]h$LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP}(hj]<hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjC<ubh< right controls setting the remote port of UDP sockets (via }(hjC<hhhNhNubj/)}(h:manpage:`connect(2)`h]h connect(2)}(hjo<hhhNhNubah}(h]h ]j.ah"]h$]h&]hhj> connect(2)j@connectjBjCuh1j.hjC<ubhk), and sending datagrams to an explicit remote port (ignoring any destination set on UDP sockets, via e.g. }(hjC<hhhNhNubj/)}(h:manpage:`sendto(2)`h]h sendto(2)}(hj<hhhNhNubah}(h]h ]j.ah"]h$]h&]hhj> sendto(2)j@sendtojBjCuh1j.hjC<ubh).}(hjC<hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMhj2<hhubeh}(h] udp-bind-connect-and-send-abi-10ah ]h"]&udp bind, connect and send* (abi < 10)ah$]h&]uh1hhjF9hhhhhMubh)}(hhh](h)}(hQuiet rule flag (ABI < 10)h]hQuiet rule flag (ABI < 10)}(hj<hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj<hhhhhM ubj()}(hXStarting with the Landlock ABI version 10, it is possible to selectively suppress logs for specific denied accesses on a per-object basis with the ``LANDLOCK_ADD_RULE_QUIET`` flag of sys_landlock_add_rule(), in combination with the ``quiet_access_fs`` and ``quiet_access_net`` fields of struct landlock_ruleset_attr. It is also now possible to suppress logs for scope accesses via the ``quiet_scoped`` field of struct landlock_ruleset_attr. The object is marked as quiet within a ruleset when at least one sys_landlock_add_rule() call is made for it with the ``LANDLOCK_ADD_RULE_QUIET`` flag, additional add-rule calls for the same object without this flag do not clear it.h](hStarting with the Landlock ABI version 10, it is possible to selectively suppress logs for specific denied accesses on a per-object basis with the }(hj<hhhNhNubj)}(h``LANDLOCK_ADD_RULE_QUIET``h]hLANDLOCK_ADD_RULE_QUIET}(hj<hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj<ubh: flag of sys_landlock_add_rule(), in combination with the }(hj<hhhNhNubj)}(h``quiet_access_fs``h]hquiet_access_fs}(hj<hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj<ubh and }(hj<hhhNhNubj)}(h``quiet_access_net``h]hquiet_access_net}(hj<hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj<ubhn fields of struct landlock_ruleset_attr. It is also now possible to suppress logs for scope accesses via the }(hj<hhhNhNubj)}(h``quiet_scoped``h]h quiet_scoped}(hj<hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj<ubh field of struct landlock_ruleset_attr. The object is marked as quiet within a ruleset when at least one sys_landlock_add_rule() call is made for it with the }(hj<hhhNhNubj)}(h``LANDLOCK_ADD_RULE_QUIET``h]hLANDLOCK_ADD_RULE_QUIET}(hj=hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj<ubhW flag, additional add-rule calls for the same object without this flag do not clear it.}(hj<hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhM hj<hhubj )}(h.. _kernel_support:h]h}(h]h ]h"]h$]h&]jMkernel-supportuh1j hMhj<hhhhubeh}(h]quiet-rule-flag-abi-10ah ]h"]quiet rule flag (abi < 10)ah$]h&]uh1hhjF9hhhhhM ubeh}(h]previous-limitationsah ]h"]previous limitationsah$]h&]uh1hhhhhhhhMubh)}(hhh](h)}(hKernel supporth]hKernel support}(hj<=hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj9=hhhhhMubh)}(hhh](h)}(hBuild time configurationh]hBuild time configuration}(hjM=hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjJ=hhhhhMubj()}(hXLandlock was first introduced in Linux 5.13 but it must be configured at build time with ``CONFIG_SECURITY_LANDLOCK=y``. Landlock must also be enabled at boot time like other security modules. The list of security modules enabled by default is set with ``CONFIG_LSM``. The kernel configuration should then contain ``CONFIG_LSM=landlock,[...]`` with ``[...]`` as the list of other potentially useful security modules for the running system (see the ``CONFIG_LSM`` help).h](hYLandlock was first introduced in Linux 5.13 but it must be configured at build time with }(hj[=hhhNhNubj)}(h``CONFIG_SECURITY_LANDLOCK=y``h]hCONFIG_SECURITY_LANDLOCK=y}(hjc=hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj[=ubh. Landlock must also be enabled at boot time like other security modules. The list of security modules enabled by default is set with }(hj[=hhhNhNubj)}(h``CONFIG_LSM``h]h CONFIG_LSM}(hju=hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj[=ubh0. The kernel configuration should then contain }(hj[=hhhNhNubj)}(h``CONFIG_LSM=landlock,[...]``h]hCONFIG_LSM=landlock,[...]}(hj=hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj[=ubh with }(hj[=hhhNhNubj)}(h ``[...]``h]h[...]}(hj=hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj[=ubh[ as the list of other potentially useful security modules for the running system (see the }(hj[=hhhNhNubj)}(h``CONFIG_LSM``h]h CONFIG_LSM}(hj=hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj[=ubh help).}(hj[=hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhM hjJ=hhubeh}(h]build-time-configurationah ]h"]build time configurationah$]h&]uh1hhj9=hhhhhMubh)}(hhh](h)}(hBoot time configurationh]hBoot time configuration}(hj=hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj=hhhhhM)ubj()}(hIf the running kernel does not have ``landlock`` in ``CONFIG_LSM``, then we can enable Landlock by adding ``lsm=landlock,[...]`` to Documentation/admin-guide/kernel-parameters.rst in the boot loader configuration.h](h$If the running kernel does not have }(hj=hhhNhNubj)}(h ``landlock``h]hlandlock}(hj=hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj=ubh in }(hj=hhhNhNubj)}(h``CONFIG_LSM``h]h CONFIG_LSM}(hj=hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj=ubh(, then we can enable Landlock by adding }(hj=hhhNhNubj)}(h``lsm=landlock,[...]``h]hlsm=landlock,[...]}(hj>hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj=ubhU to Documentation/admin-guide/kernel-parameters.rst in the boot loader configuration.}(hj=hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhM+hj=hhubj()}(h6For example, if the current built-in configuration is:h]h6For example, if the current built-in configuration is:}(hj >hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhM0hj=hhubj)}(h~$ zgrep -h "^CONFIG_LSM=" "/boot/config-$(uname -r)" /proc/config.gz 2>/dev/null CONFIG_LSM="lockdown,yama,integrity,apparmor"h]h~$ zgrep -h "^CONFIG_LSM=" "/boot/config-$(uname -r)" /proc/config.gz 2>/dev/null CONFIG_LSM="lockdown,yama,integrity,apparmor"}hj.>sbah}(h]h ]h"]h$]h&]hhjjconsolej}uh1jhhhM2hj=hhubj()}(h:...and if the cmdline doesn't contain ``landlock`` either:h](h(...and if the cmdline doesn’t contain }(hj>>hhhNhNubj)}(h ``landlock``h]hlandlock}(hjF>hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj>>ubh either:}(hj>>hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhM7hj=hhubj)}(hW$ sed -n 's/.*\(\sbah}(h]h ]h"]h$]h&]hhjjconsolej}uh1jhhhM9hj=hhubj()}(hr...we should configure the boot loader to set a cmdline extending the ``lsm`` list with the ``landlock,`` prefix::h](hF...we should configure the boot loader to set a cmdline extending the }(hjn>hhhNhNubj)}(h``lsm``h]hlsm}(hjv>hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjn>ubh list with the }(hjn>hhhNhNubj)}(h ``landlock,``h]h landlock,}(hj>hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjn>ubh prefix:}(hjn>hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhM>hj=hhubj)}(h-lsm=landlock,lockdown,yama,integrity,apparmorh]h-lsm=landlock,lockdown,yama,integrity,apparmor}hj>sbah}(h]h ]h"]h$]h&]hhuh1jhhhMAhj=hhubj()}(hWAfter a reboot, we can check that Landlock is up and running by looking at kernel logs:h]hWAfter a reboot, we can check that Landlock is up and running by looking at kernel logs:}(hj>hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMChj=hhubj)}(hXa# dmesg | grep landlock || journalctl -kb -g landlock [ 0.000000] Command line: [...] lsm=landlock,lockdown,yama,integrity,apparmor [ 0.000000] Kernel command line: [...] lsm=landlock,lockdown,yama,integrity,apparmor [ 0.000000] LSM: initializing lsm=lockdown,capability,landlock,yama,integrity,apparmor [ 0.000000] landlock: Up and running.h]hXa# dmesg | grep landlock || journalctl -kb -g landlock [ 0.000000] Command line: [...] lsm=landlock,lockdown,yama,integrity,apparmor [ 0.000000] Kernel command line: [...] lsm=landlock,lockdown,yama,integrity,apparmor [ 0.000000] LSM: initializing lsm=lockdown,capability,landlock,yama,integrity,apparmor [ 0.000000] landlock: Up and running.}hj>sbah}(h]h ]h"]h$]h&]hhjjconsolej}uh1jhhhMFhj=hhubj()}(hThe kernel may be configured at build time to always load the ``lockdown`` and ``capability`` LSMs. In that case, these LSMs will appear at the beginning of the ``LSM: initializing`` log line as well, even if they are not configured in the boot loader.h](h>The kernel may be configured at build time to always load the }(hj>hhhNhNubj)}(h ``lockdown``h]hlockdown}(hj>hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj>ubh and }(hj>hhhNhNubj)}(h``capability``h]h capability}(hj>hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj>ubhE LSMs. In that case, these LSMs will appear at the beginning of the }(hj>hhhNhNubj)}(h``LSM: initializing``h]hLSM: initializing}(hj>hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj>ubhF log line as well, even if they are not configured in the boot loader.}(hj>hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMNhj=hhubeh}(h]boot-time-configurationah ]h"]boot time configurationah$]h&]uh1hhj9=hhhhhM)ubh)}(hhh](h)}(hNetwork supporth]hNetwork support}(hj?hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj?hhhhhMTubj()}(hXfTo be able to explicitly allow TCP or UDP operations (e.g., adding a network rule with ``LANDLOCK_ACCESS_NET_BIND_TCP``), the kernel must support the TCP/IP protocol suite (``CONFIG_INET=y``). Otherwise, sys_landlock_add_rule() returns an ``EAFNOSUPPORT`` error, which can safely be ignored because this kind of TCP or UDP operation is already not possible.h](hWTo be able to explicitly allow TCP or UDP operations (e.g., adding a network rule with }(hj)?hhhNhNubj)}(h ``LANDLOCK_ACCESS_NET_BIND_TCP``h]hLANDLOCK_ACCESS_NET_BIND_TCP}(hj1?hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj)?ubh6), the kernel must support the TCP/IP protocol suite (}(hj)?hhhNhNubj)}(h``CONFIG_INET=y``h]h CONFIG_INET=y}(hjC?hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj)?ubh2). Otherwise, sys_landlock_add_rule() returns an }(hj)?hhhNhNubj)}(h``EAFNOSUPPORT``h]h EAFNOSUPPORT}(hjU?hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj)?ubhf error, which can safely be ignored because this kind of TCP or UDP operation is already not possible.}(hj)?hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMVhj?hhubeh}(h]network-supportah ]h"]network supportah$]h&]uh1hhj9=hhhhhMTubeh}(h](j(=id2eh ]h"](kernel supportkernel_supporteh$]h&]uh1hhhhhhhhMj5 }j{?j=sj7 }j(=j=subh)}(hhh](h)}(hQuestions and answersh]hQuestions and answers}(hj?hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj?hhhhhM]ubh)}(hhh](h)}(h'What about user space sandbox managers?h]h'What about user space sandbox managers?}(hj?hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj?hhhhhM`ubj()}(hX6Using user space processes to enforce restrictions on kernel resources can lead to race conditions or inconsistent evaluations (i.e. `Incorrect mirroring of the OS code and state `_).h](hUsing user space processes to enforce restrictions on kernel resources can lead to race conditions or inconsistent evaluations (i.e. }(hj?hhhNhNubj)}(h`Incorrect mirroring of the OS code and state `_h]h,Incorrect mirroring of the OS code and state}(hj?hhhNhNubah}(h]h ]h"]h$]h&]name,Incorrect mirroring of the OS code and statej$}https://www.ndss-symposium.org/ndss2003/traps-and-pitfalls-practical-problems-system-call-interposition-based-security-tools/uh1jhj?ubj )}(h h]h}(h],incorrect-mirroring-of-the-os-code-and-stateah ]h"],incorrect mirroring of the os code and stateah$]h&]refurij?uh1j j#Khj?ubh).}(hj?hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMbhj?hhubeh}(h]&what-about-user-space-sandbox-managersah ]h"]'what about user space sandbox managers?ah$]h&]uh1hhj?hhhhhM`ubh)}(hhh](h)}(h%What about namespaces and containers?h]h%What about namespaces and containers?}(hj?hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj?hhhhhMhubj()}(hXjNamespaces can help create sandboxes but they are not designed for access-control and then miss useful features for such use case (e.g. no fine-grained restrictions). Moreover, their complexity can lead to security issues, especially when untrusted processes can manipulate them (cf. `Controlling access to user namespaces `_).h](hXNamespaces can help create sandboxes but they are not designed for access-control and then miss useful features for such use case (e.g. no fine-grained restrictions). Moreover, their complexity can lead to security issues, especially when untrusted processes can manipulate them (cf. }(hj?hhhNhNubj)}(hK`Controlling access to user namespaces `_h]h%Controlling access to user namespaces}(hj?hhhNhNubah}(h]h ]h"]h$]h&]name%Controlling access to user namespacesj$ https://lwn.net/Articles/673597/uh1jhj?ubj )}(h# h]h}(h]%controlling-access-to-user-namespacesah ]h"]%controlling access to user namespacesah$]h&]refurij@uh1j j#Khj?ubh).}(hj?hhhNhNubeh}(h]h ]h"]h$]h&]uh1j'hhhMjhj?hhubeh}(h]$what-about-namespaces-and-containersah ]h"]%what about namespaces and containers?ah$]h&]uh1hhj?hhhhhMhubh)}(hhh](h)}(h&How to disable Landlock audit records?h]h&How to disable Landlock audit records?}(hj&@hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj#@hhhhhMqubj()}(hdYou might want to put in place filters as explained here: Documentation/admin-guide/LSM/landlock.rsth]hdYou might want to put in place filters as explained here: Documentation/admin-guide/LSM/landlock.rst}(hj4@hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMshj#@hhubeh}(h]%how-to-disable-landlock-audit-recordsah ]h"]&how to disable landlock audit records?ah$]h&]uh1hhj?hhhhhMqubeh}(h]questions-and-answersah ]h"]questions and answersah$]h&]uh1hhhhhhhhM]ubh)}(hhh](h)}(hAdditional documentationh]hAdditional documentation}(hjU@hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjR@hhhhhMwubj)}(hhh](j)}(h*Documentation/admin-guide/LSM/landlock.rsth]j()}(hjh@h]h*Documentation/admin-guide/LSM/landlock.rst}(hjj@hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMyhjf@ubah}(h]h ]h"]h$]h&]uh1jhjc@hhhhhNubj)}(h#Documentation/security/landlock.rsth]j()}(hj@h]h#Documentation/security/landlock.rst}(hj@hhhNhNubah}(h]h ]h"]h$]h&]uh1j'hhhMzhj}@ubah}(h]h ]h"]h$]h&]uh1jhjc@hhhhhNubj)}(hhttps://landlock.io h]j()}(hhttps://landlock.ioh]j)}(hj@h]hhttps://landlock.io}(hj@hhhNhNubah}(h]h ]h"]h$]h&]refurij@uh1jhj@ubah}(h]h ]h"]h$]h&]uh1j'hhhM{hj@ubah}(h]h ]h"]h$]h&]uh1jhjc@hhhhhNubeh}(h]h ]h"]h$]h&]jjuh1jhhhMyhjR@hhubh)}(hLinksh]hLinks}hj@sbah}(h]h ]h"]h$]h&]hhuh1hhjR@hhhhhM}ubj )}(h.. _samples/landlock/sandboxer.c: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/samples/landlock/sandboxer.ch]h}(h]samples-landlock-sandboxer-cah ]h"]samples/landlock/sandboxer.cah$]h&]j$j%uh1j hM~hjR@hhhhj#Kubeh}(h]additional-documentationah ]h"]additional documentationah$]h&]uh1hhhhhhhhMwubeh}(h]$landlock-unprivileged-access-controlah ]h"]%landlock: unprivileged access controlah$]h&]uh1hhhhhhhhKubeh}(h]h ]h"]h$]h&]sourcehuh1hcurrent_sourceN current_lineNsettingsdocutils.frontendValues)}(hN generatorN datestampN source_linkN source_urlN toc_backlinksentryfootnote_backlinksK sectnum_xformKstrip_commentsNstrip_elements_with_classesN strip_classesN report_levelK halt_levelKexit_status_levelKdebugNwarning_streamN tracebackinput_encoding utf-8-siginput_encoding_error_handlerstrictoutput_encodingutf-8output_encoding_error_handlerj Aerror_encodingutf-8error_encoding_error_handlerbackslashreplace language_codeenrecord_dependenciesNconfigN id_prefixhauto_id_prefixid dump_settingsNdump_internalsNdump_transformsNdump_pseudo_xmlNexpose_internalsNstrict_visitorN_disable_configN_sourcehnj _destinationN _config_files]7/var/lib/git/docbuild/linux/Documentation/docutils.confafile_insertion_enabled raw_enabledKline_length_limitM'pep_referencesN pep_base_urlhttps://peps.python.org/pep_file_url_templatepep-%04drfc_referencesN rfc_base_url&https://datatracker.ietf.org/doc/html/ tab_widthKtrim_footnote_reference_spacesyntax_highlightlong smart_quotessmartquotes_locales]character_level_inline_markupdoctitle_xform docinfo_xformKsectsubtitle_xform image_loadinglinkembed_stylesheetcloak_email_addressessection_self_linkenvNubreporterNindirect_targets]substitution_defs}substitution_names}refnames}(samples/landlock/sandboxer.c]japtrace restrictions](j=j7efilesystem flags](j j"j/.e network flags](j!j/e scope flags]jP!aurefids}(j ]j aj(=]j=aunameids}(j@j@jf jc j6j3jjj0j-jsjpjjj jjjj j j^ j[ j j j j j j j2 j j1 j. j j j@ j= j j j/ j, j j~ j7j6j!jjljij|jyjjj#j#j0j0j6j6jC9j@9ju7jr7j7j7j 8j 8j48j18j;9j89j6=j3=j9j9j9j9j:j:j:j:j:j:jL;jI;j;j;j;j;j/<j,<j<j<j.=j+=j{?j(=jz?jw?j=j=j?j?jr?jo?jO@jL@j?j?j?j?j @j@j @j @jG@jD@j@j@j@j@u nametypes}(j@jf j6jj0jsjj jj j^ j j j j2 j1 j j@ j j/ j j7j!jlj|jj#j0j6jC9ju7j7j 8j48j;9j6=j9j9j:j:j:jL;j;j;j/<j<j.=j{?jz?j=j?jr?jO@j?j?j @j @jG@j@j@uh}(j@hjc jj3jjj9j-jjpj3jjvjjjj$j jj[ j j ji j jz j j j j j. j j j9 j= j j jC j, j j~ j2 j6j jj jij jyjojjj#j$jDjMjjj0j#j$j $j+j+jR-jW-j.j.j6j0j0j0j@9j7jr7j7j7jx7j 8j7j18j8j89j78j3=jF9j9jW9j9j9j:j9j:j":j:j:jI;j:j;jO;j;j;j,<j;j<j2<j+=j<j(=j9=jw?j9=j=jJ=j?j=jo?j?jL@j?j?j?j?j?j@j?j @j@jD@j#@j@jR@j@j@u footnote_refs} citation_refs} autofootnotes]autofootnote_refs]symbol_footnotes]symbol_footnote_refs] footnotes] citations]autofootnote_startKsymbol_footnote_startK id_counter collectionsCounter}jAKsRparse_messages]transform_messages](hsystem_message)}(hhh]j()}(hhh]h;Hyperlink target "landlock-abi-versions" is not referenced.}hj~Asbah}(h]h ]h"]h$]h&]uh1j'hj{Aubah}(h]h ]h"]h$]h&]levelKtypeINFOsourcehnjlineMuh1jyAubjzA)}(hhh]j()}(hhh]h4Hyperlink target "kernel-support" is not referenced.}hjAsbah}(h]h ]h"]h$]h&]uh1j'hjAubah}(h]h ]h"]h$]h&]levelKtypejAsourcehnjlineMuh1jyAube transformerN include_log] decorationNhhub.