landlock_create_ruleset(2)

1landlock_create_ruleset(2)    System Calls Manual   landlock_create_ruleset(2)
2
3
4

NAME

6       landlock_create_ruleset - create a new Landlock ruleset
7

LIBRARY

9       Standard C library (libc, -lc)
10

SYNOPSIS

12       #include <linux/landlock.h>  /* Definition of LANDLOCK_* constants */
13       #include <sys/syscall.h>     /* Definition of SYS_* constants */
14
15       int syscall(SYS_landlock_create_ruleset,
16                   const struct landlock_ruleset_attr *attr,
17                   size_t size , uint32_t flags);
18

DESCRIPTION

20       A  Landlock  ruleset  identifies  a  set of rules (i.e., actions on ob‐
21       jects).  This landlock_create_ruleset() system call enables creating  a
22       new  file  descriptor  identifying a ruleset.  This file descriptor can
23       then be used  by  landlock_add_rule(2)  and  landlock_restrict_self(2).
24       See landlock(7) for a global overview.
25
26       attr  specifies  the  properties  of the new ruleset.  It points to the
27       following structure:
28
29                  struct landlock_ruleset_attr {
30                      __u64 handled_access_fs;
31                  };
32
33              handled_access_fs is a bitmask of actions  that  is  handled  by
34              this  ruleset and should then be forbidden if no rule explicitly
35              allows them (see Filesystem actions in landlock(7)).   This  en‐
36              ables simply restricting ambient rights (e.g., global filesystem
37              access) and is needed for compatibility reasons.
38
39       size must be specified as sizeof(struct landlock_ruleset_attr) for com‐
40       patibility reasons.
41
42       flags must be 0 if attr is used.  Otherwise, flags can be set to:
43
44       LANDLOCK_CREATE_RULESET_VERSION
45              If  attr  is  NULL and size is 0, then the returned value is the
46              highest supported Landlock ABI version (starting  at  1).   This
47              version  can  be used for a best-effort security approach, which
48              is encouraged when user space is not pinned to a specific kernel
49              version.   All features documented in these man pages are avail‐
50              able with the version 1.
51

RETURN VALUE

53       On success, landlock_create_ruleset() returns a  new  Landlock  ruleset
54       file descriptor, or a Landlock ABI version, according to flags.
55

ERRORS

57       landlock_create_ruleset() can fail for the following reasons:
58
59       EOPNOTSUPP
60              Landlock is supported by the kernel but disabled at boot time.
61
62       EINVAL Unknown flags, or unknown access, or too small size.
63
64       E2BIG  size is too big.
65
66       EFAULT attr was not a valid address.
67
68       ENOMSG Empty accesses (i.e., attr->handled_access_fs is 0).
69

STANDARDS

71       Linux.
72

HISTORY

74       Linux 5.13.
75

EXAMPLES

77       See landlock(7).
78