[lkml]   [2021]   [Jul]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subject[PATCH v1 3/4] landlock_add_rule.2: Document new syscall
    From: Mickaël Salaün <>

    This is an adaptation of

    Signed-off-by: Mickaël Salaün <>
    man2/landlock_add_rule.2 | 139 +++++++++++++++++++++++++++++++++++++++
    1 file changed, 139 insertions(+)
    create mode 100644 man2/landlock_add_rule.2

    diff --git a/man2/landlock_add_rule.2 b/man2/landlock_add_rule.2
    new file mode 100644
    index 000000000000..66da2c142a03
    --- /dev/null
    +++ b/man2/landlock_add_rule.2
    @@ -0,0 +1,139 @@
    +.\" Copyright © 2017-2020 Mickaël Salaün <>
    +.\" Copyright © 2019-2020 ANSSI
    +.\" Copyright © 2021 Microsoft Corporation
    +.\" Permission is granted to make and distribute verbatim copies of this
    +.\" manual provided the copyright notice and this permission notice are
    +.\" preserved on all copies.
    +.\" Permission is granted to copy and distribute modified versions of this
    +.\" manual under the conditions for verbatim copying, provided that the
    +.\" entire resulting derived work is distributed under the terms of a
    +.\" permission notice identical to this one.
    +.\" Since the Linux kernel and libraries are constantly changing, this
    +.\" manual page may be incorrect or out-of-date. The author(s) assume no
    +.\" responsibility for errors or omissions, or for damages resulting from
    +.\" the use of the information contained herein. The author(s) may not
    +.\" have taken the same level of care in the production of this manual,
    +.\" which is licensed free of charge, as they might when working
    +.\" professionally.
    +.\" Formatted or processed versions of this manual, if unaccompanied by
    +.\" the source, must acknowledge the copyright and authors of this work.
    +.\" %%%LICENSE_END
    +.TH LANDLOCK_ADD_RULE 2 2021-06-27 Linux "Linux Programmer's Manual"
    +.SH NAME
    +landlock_add_rule \- add a new Landlock rule to a ruleset
    +.BR "#include <linux/landlock.h>" " /* Definition of " LANDLOCK_* " constants */"
    +.BR "#include <sys/syscall.h>" " /* Definition of " SYS_* " constants */"
    +.BI "int syscall(SYS_landlock_add_rule, int " ruleset_fd ,
    +.BI " enum landlock_rule_type " rule_type ,
    +.BI " const void * " rule_attr ", __u32 " flags );
    +A Landlock rule describes an action on an object. An object is currently a
    +file hierarchy, and the related filesystem actions are defined with a set
    +of access rights. This
    +.BR landlock_add_rule (2)
    +system call enables adding a new Landlock rule to an existing ruleset
    +created with
    +.BR landlock_create_ruleset (2)
    +\&. See
    +.BR landlock (7)
    +for a global overview.
    +.I ruleset_fd
    +is a Landlock ruleset file descriptor obtained with
    +.BR landlock_create_ruleset (2)
    +.I rule_type
    +identifies the structure type pointed to by
    +.I rule_attr
    +\&. Currently, Linux supports the following
    +.I rule_type
    +This defines the object type as a file hierarchy.
    +In this case,
    +.I rule_attr
    +points to the following structure:
    +.IP +4n
    +struct landlock_path_beneath_attr {
    + __u64 allowed_access;
    + __s32 parent_fd;
    +} __attribute__((packed));
    +.I allowed_access
    +contains a bitmask of allowed filesystem actions for this file hierarchy
    +.BR "Filesystem actions"
    +.BR landlock (7)
    +.I parent_fd
    +is an opened file descriptor, preferably with the
    +.I O_PATH
    +flag, which identifies the parent directory of the file hierarchy or a just
    +.I flags
    +must be 0.
    +On success,
    +.BR landlock_add_rule (2)
    +returns 0.
    +.BR landlock_add_rule (2)
    +can failed for the following reasons:
    +Landlock is supported by the kernel but disabled at boot time.
    +.I flags
    +is not 0, or the rule accesses are inconsistent (i.e.
    +.I rule_attr->allowed_access
    +is not a subset of the ruleset handled accesses).
    +Empty accesses (i.e.
    +.I rule_attr->allowed_access
    +is 0).
    +.BR EBADF
    +.I ruleset_fd
    +is not a file descriptor for the current thread, or a member of
    +.I rule_attr
    +is not a file descriptor as expected.
    +.I ruleset_fd
    +is not a ruleset file descriptor, or a member of
    +.I rule_attr
    +is not the expected file descriptor type.
    +.BR EPERM
    +.I ruleset_fd
    +has no write access to the underlying ruleset.
    +.I rule_attr
    +was not a valid address.
    +Landlock was added in Linux 5.13.
    +.BR landlock (7),
    +.BR landlock_create_ruleset (2),
    +.BR landlock_restrict_self (2)
     \ /
      Last update: 2021-07-06 20:23    [W:3.123 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site