LKML Archive on
help / color / mirror / Atom feed
From: "Mickaël Salaün" <>
To: Alejandro Colomar <>,
	Michael Kerrisk <>
Cc: "Mickaël Salaün" <>,
	"Jann Horn" <>,
	"Jonathan Corbet" <>,
	"Kees Cook" <>,
	"Randy Dunlap" <>,
	"Vincent Dagonneau" <>,,,,,
	"Mickaël Salaün" <>
Subject: [PATCH v3 2/4] landlock_create_ruleset.2: Document new syscall
Date: Fri, 30 Jul 2021 16:41:14 +0200	[thread overview]
Message-ID: <> (raw)
In-Reply-To: <>

From: Mickaël Salaün <>

This is an adaptation of

Signed-off-by: Mickaël Salaün <>

Changes since v2:
* Fix syscall signature (attr pointer).
* Add an EXAMPLES section referring to landlock(7).
* Change list order in the SEE ALSO section.
* Fix .IR and .BR use as explained by Alejandro Colomar.

Changes since v1:
* Replace all ".I" with ".IR", except when used for titles.
* Append punctuation to ".IR" and ".BR" when it makes sense (requested
  by Alejandro Colomar).
* Cut lines according to the semantic newline rules (requested by
  Alejandro Colomar).
* Remove roman style from ".TP" section titles (requested by Alejandro
* Add comma after "i.e." and "e.g.".
* Add a "CONFORMING TO" section.
* Replace "(2)" with "()" for the described syscall name.
 man2/landlock_create_ruleset.2 | 139 +++++++++++++++++++++++++++++++++
 1 file changed, 139 insertions(+)
 create mode 100644 man2/landlock_create_ruleset.2

diff --git a/man2/landlock_create_ruleset.2 b/man2/landlock_create_ruleset.2
new file mode 100644
index 000000000000..e1ca4bcf8c86
--- /dev/null
+++ b/man2/landlock_create_ruleset.2
@@ -0,0 +1,139 @@
+.\" Copyright © 2017-2020 Mickaël Salaün <>
+.\" Copyright © 2019-2020 ANSSI
+.\" Copyright © 2021 Microsoft Corporation
+.\" Permission is granted to make and distribute verbatim copies of this
+.\" manual provided the copyright notice and this permission notice are
+.\" preserved on all copies.
+.\" Permission is granted to copy and distribute modified versions of this
+.\" manual under the conditions for verbatim copying, provided that the
+.\" entire resulting derived work is distributed under the terms of a
+.\" permission notice identical to this one.
+.\" Since the Linux kernel and libraries are constantly changing, this
+.\" manual page may be incorrect or out-of-date.  The author(s) assume no
+.\" responsibility for errors or omissions, or for damages resulting from
+.\" the use of the information contained herein.  The author(s) may not
+.\" have taken the same level of care in the production of this manual,
+.\" which is licensed free of charge, as they might when working
+.\" professionally.
+.\" Formatted or processed versions of this manual, if unaccompanied by
+.\" the source, must acknowledge the copyright and authors of this work.
+.TH LANDLOCK_CREATE_RULESET 2 2021-06-27 Linux "Linux Programmer's Manual"
+landlock_create_ruleset \- create a new Landlock ruleset
+.BR "#include <linux/landlock.h>" "  /* Definition of " LANDLOCK_* " constants */"
+.BR "#include <sys/syscall.h>" "     /* Definition of " SYS_* " constants */"
+.BI "int syscall(SYS_landlock_create_ruleset,
+.BI "            const struct landlock_ruleset_attr *" attr ,
+.BI "            size_t " size " , __u32 " flags );
+A Landlock ruleset identifies a set of rules (i.e., actions on objects).
+.BR landlock_create_ruleset ()
+system call enables creating a new file descriptor identifying a ruleset.
+This file descriptor can then be used by
+.BR landlock_add_rule (2)
+.BR landlock_restrict_self (2).
+.BR landlock (7)
+for a global overview.
+.I attr
+specifies the properties of the new ruleset.
+It points to the following structure:
+.IP +4n
+struct landlock_ruleset_attr {
+	__u64 handled_access_fs;
+.I handled_access_fs
+is a bitmask of actions that is handled by this ruleset and should then be
+forbidden if no rule explicitly allow them
+.B Filesystem actions
+.BR landlock (7)).
+This enables simply restricting ambient rights
+(e.g., global filesystem access) and is needed for compatibility reasons.
+.I size
+must be specified as
+.I sizeof(struct landlock_ruleset_attr)
+for compatibility reasons.
+.I flags
+must be 0 if
+.I attr
+is used.
+.I flags
+can be set to:
+.I attr
+is NULL and
+.I size
+is 0, then the returned value is the highest supported Landlock ABI version
+(starting at 1).
+This version can be used for a best-effort security approach,
+which is encouraged when user space is not pinned to a specific kernel
+All features documented in these man pages are available with the version
+On success,
+.BR landlock_create_ruleset ()
+returns a new Landlock ruleset file descriptor, or a Landlock ABI version
+according to
+.IR flags .
+.BR landlock_create_ruleset ()
+can failed for the following reasons:
+Landlock is supported by the kernel but disabled at boot time.
+.IR flags ,
+or unknown access, or too small
+.IR size .
+.I size
+is too big.
+.I attr
+was not a valid address.
+Empty accesses (i.e.,
+.I attr->handled_access_fs
+is 0).
+Landlock was added in Linux 5.13.
+This system call is Linux-specific.
+.BR landlock (7).
+.BR landlock_add_rule (2),
+.BR landlock_restrict_self (2),
+.BR landlock (7)

  parent reply	other threads:[~2021-07-30 14:39 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-07-30 14:41 [PATCH v3 0/4] Add Landlock man pages Mickaël Salaün
2021-07-30 14:41 ` [PATCH v3 1/4] landlock.7: Add a new page to introduce Landlock Mickaël Salaün
2021-07-30 14:41 ` Mickaël Salaün [this message]
2021-07-30 14:41 ` [PATCH v3 3/4] landlock_add_rule.2: Document new syscall Mickaël Salaün
2021-07-30 14:41 ` [PATCH v3 4/4] landlock_restrict_self.2: " Mickaël Salaün

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \ \ \ \ \ \ \ \ \
    --subject='Re: [PATCH v3 2/4] landlock_create_ruleset.2: Document new syscall' \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).