uapi/linux/landlock.h

1 /* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
3  * Landlock - User space API
5  * Copyright © 2017-2020 Mickaël Salaün <mic@digikod.net>
6  * Copyright © 2018-2020 ANSSI
7  * Copyright © 2021-2025 Microsoft Corporation
16  * struct landlock_ruleset_attr - Ruleset definition.
25  * For historical reasons, the %LANDLOCK_ACCESS_FS_REFER right is always denied
27  * add new rules with this access right, the bit must still be set explicitly
31  * compatibility reasons.  In most use cases, processes that use Landlock will
67 /* clang-format off */
70 /* clang-format on */
83  * default configuration is suitable for most programs that sandbox themselves.
118  *     with a @ruleset_fd value of -1 to mute subdomain logs without creating a
121 /* clang-format off */
125 /* clang-format on */
128  * enum landlock_rule_type - Landlock rule type
146  * struct landlock_path_beneath_attr - Path hierarchy definition
169  * struct landlock_net_port_attr - Network port definition
188 	 * right means that requesting to bind on port 0 is allowed and it will
209  * - %LANDLOCK_ACCESS_FS_EXECUTE: Execute a file.
210  * - %LANDLOCK_ACCESS_FS_WRITE_FILE: Open a file with write access.  When
212  *   %LANDLOCK_ACCESS_FS_TRUNCATE right.  In many cases, these system calls
214  * - %LANDLOCK_ACCESS_FS_READ_FILE: Open a file with read access.
215  * - %LANDLOCK_ACCESS_FS_TRUNCATE: Truncate a file with :manpage:`truncate(2)`,
217  *   ``O_TRUNC``.  This access right is available since the third version of the
226  * following access right is applied to the directory itself, and the
229  * - %LANDLOCK_ACCESS_FS_READ_DIR: Open a directory or list its content.
234  * - %LANDLOCK_ACCESS_FS_REMOVE_DIR: Remove an empty directory or rename one.
235  * - %LANDLOCK_ACCESS_FS_REMOVE_FILE: Unlink (or rename) a file.
236  * - %LANDLOCK_ACCESS_FS_MAKE_CHAR: Create (or rename or link) a character
238  * - %LANDLOCK_ACCESS_FS_MAKE_DIR: Create (or rename) a directory.
239  * - %LANDLOCK_ACCESS_FS_MAKE_REG: Create (or rename or link) a regular file.
240  * - %LANDLOCK_ACCESS_FS_MAKE_SOCK: Create (or rename or link) a UNIX domain
242  * - %LANDLOCK_ACCESS_FS_MAKE_FIFO: Create (or rename or link) a named pipe.
243  * - %LANDLOCK_ACCESS_FS_MAKE_BLOCK: Create (or rename or link) a block device.
244  * - %LANDLOCK_ACCESS_FS_MAKE_SYM: Create (or rename or link) a symbolic link.
245  * - %LANDLOCK_ACCESS_FS_REFER: Link or rename a file from or to a different
248  *   This access right is available since the second version of the Landlock
251  *   This is the only access right which is denied by default by any ruleset,
252  *   even if the right is not specified as handled at ruleset creation time.
253  *   The only way to make a ruleset grant this right is to explicitly allow it
260  *   %LANDLOCK_ACCESS_FS_REFER access right, the attempted link or rename
267  *   * When linking or renaming, the ``LANDLOCK_ACCESS_FS_MAKE_*`` right for the
271  *   * When renaming, the ``LANDLOCK_ACCESS_FS_REMOVE_*`` right for the
278  * The following access right applies both to files and directories:
280  * - %LANDLOCK_ACCESS_FS_IOCTL_DEV: Invoke :manpage:`ioctl(2)` commands on an opened
283  *   This access right applies to all `ioctl(2)` commands implemented by device
285  *   invokable independent of the %LANDLOCK_ACCESS_FS_IOCTL_DEV right:
292  *     whose implementations are safe and return the right error codes
295  *   This access right is available since the fifth version of the Landlock
300  *   It is currently not possible to restrict some file-related actions
307 /* clang-format off */
324 /* clang-format on */
339  * - %LANDLOCK_ACCESS_NET_BIND_TCP: Bind a TCP socket to a local port.
340  * - %LANDLOCK_ACCESS_NET_CONNECT_TCP: Connect an active TCP socket to
343 /* clang-format off */
346 /* clang-format on */
362  * - %LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET: Restrict a sandboxed process from
364  *   related Landlock domain (e.g., a parent domain or a non-sandboxed process).
365  * - %LANDLOCK_SCOPE_SIGNAL: Restrict a sandboxed process from sending a signal
368 /* clang-format off */
371 /* clang-format on*/