All of
 help / color / mirror / Atom feed
From: "Mickaël Salaün" <>
To: Alejandro Colomar <>,
	Michael Kerrisk <>
Cc: "Mickaël Salaün" <>,
	"Jann Horn" <>,
	"Jonathan Corbet" <>,
	"Kees Cook" <>,
	"Randy Dunlap" <>,
	"Vincent Dagonneau" <>,,,,,
	"Mickaël Salaün" <>
Subject: [PATCH v1 3/4] landlock_add_rule.2: Document new syscall
Date: Tue,  6 Jul 2021 20:22:16 +0200	[thread overview]
Message-ID: <> (raw)
In-Reply-To: <>

From: Mickaël Salaün <>

This is an adaptation of

Signed-off-by: Mickaël Salaün <>
 man2/landlock_add_rule.2 | 139 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 139 insertions(+)
 create mode 100644 man2/landlock_add_rule.2

diff --git a/man2/landlock_add_rule.2 b/man2/landlock_add_rule.2
new file mode 100644
index 000000000000..66da2c142a03
--- /dev/null
+++ b/man2/landlock_add_rule.2
@@ -0,0 +1,139 @@
+.\" Copyright © 2017-2020 Mickaël Salaün <>
+.\" Copyright © 2019-2020 ANSSI
+.\" Copyright © 2021 Microsoft Corporation
+.\" Permission is granted to make and distribute verbatim copies of this
+.\" manual provided the copyright notice and this permission notice are
+.\" preserved on all copies.
+.\" Permission is granted to copy and distribute modified versions of this
+.\" manual under the conditions for verbatim copying, provided that the
+.\" entire resulting derived work is distributed under the terms of a
+.\" permission notice identical to this one.
+.\" Since the Linux kernel and libraries are constantly changing, this
+.\" manual page may be incorrect or out-of-date.  The author(s) assume no
+.\" responsibility for errors or omissions, or for damages resulting from
+.\" the use of the information contained herein.  The author(s) may not
+.\" have taken the same level of care in the production of this manual,
+.\" which is licensed free of charge, as they might when working
+.\" professionally.
+.\" Formatted or processed versions of this manual, if unaccompanied by
+.\" the source, must acknowledge the copyright and authors of this work.
+.TH LANDLOCK_ADD_RULE 2 2021-06-27 Linux "Linux Programmer's Manual"
+landlock_add_rule \- add a new Landlock rule to a ruleset
+.BR "#include <linux/landlock.h>" "  /* Definition of " LANDLOCK_* " constants */"
+.BR "#include <sys/syscall.h>" "     /* Definition of " SYS_* " constants */"
+.BI "int syscall(SYS_landlock_add_rule, int " ruleset_fd ,
+.BI "            enum landlock_rule_type " rule_type ,
+.BI "            const void * " rule_attr ", __u32 " flags );
+A Landlock rule describes an action on an object.  An object is currently a
+file hierarchy, and the related filesystem actions are defined with a set
+of access rights.  This
+.BR landlock_add_rule (2)
+system call enables adding a new Landlock rule to an existing ruleset
+created with
+.BR landlock_create_ruleset (2)
+\&.  See
+.BR landlock (7)
+for a global overview.
+.I ruleset_fd
+is a Landlock ruleset file descriptor obtained with
+.BR landlock_create_ruleset (2)
+.I rule_type
+identifies the structure type pointed to by
+.I rule_attr
+\&. Currently, Linux supports the following
+.I rule_type
+This defines the object type as a file hierarchy.
+In this case,
+.I rule_attr
+points to the following structure:
+.IP +4n
+struct landlock_path_beneath_attr {
+    __u64 allowed_access;
+    __s32 parent_fd;
+} __attribute__((packed));
+.I allowed_access
+contains a bitmask of allowed filesystem actions for this file hierarchy
+.BR "Filesystem actions"
+.BR landlock (7)
+.I parent_fd
+is an opened file descriptor, preferably with the
+flag, which identifies the parent directory of the file hierarchy or a just
+.I flags
+must be 0.
+On success,
+.BR landlock_add_rule (2)
+returns 0.
+.BR landlock_add_rule (2)
+can failed for the following reasons:
+Landlock is supported by the kernel but disabled at boot time.
+.I flags
+is not 0, or the rule accesses are inconsistent (i.e.
+.I rule_attr->allowed_access
+is not a subset of the ruleset handled accesses).
+Empty accesses (i.e.
+.I rule_attr->allowed_access
+is 0).
+.I ruleset_fd
+is not a file descriptor for the current thread, or a member of
+.I rule_attr
+is not a file descriptor as expected.
+.I ruleset_fd
+is not a ruleset file descriptor, or a member of
+.I rule_attr
+is not the expected file descriptor type.
+.I ruleset_fd
+has no write access to the underlying ruleset.
+.I rule_attr
+was not a valid address.
+Landlock was added in Linux 5.13.
+.BR landlock (7),
+.BR landlock_create_ruleset (2),
+.BR landlock_restrict_self (2)

  parent reply	other threads:[~2021-07-06 18:42 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-07-06 18:22 [PATCH v1 0/4] Add Landlock man pages Mickaël Salaün
2021-07-06 18:22 ` [PATCH v1 1/4] landlock.7: Add a new page to introduce Landlock Mickaël Salaün
2021-07-10 18:12   ` Alejandro Colomar (man-pages)
2021-07-06 18:22 ` [PATCH v1 2/4] landlock_create_ruleset.2: Document new syscall Mickaël Salaün
2021-07-06 18:22 ` Mickaël Salaün [this message]
2021-07-06 18:22 ` [PATCH v1 4/4] landlock_restrict_self.2: " Mickaël Salaün

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \ \ \ \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.