landlock_create_ruleset(2)

✨ landlock_create_ruleset(2) ✨

okay bestie, this is from the System Calls Manual and it's literally the ✨origin story✨ of every Landlock sandbox you've ever loved. no cap. sit down, hydrate, let's go 💖

---

🦋 LIBRARY 🦋

Standard C library (libc, -lc). the free real estate, babe 🫶

---

💅 SYNOPSIS 💅

#include <linux/landlock.h>  /* Definition of LANDLOCK_* constants */
#include <sys/syscall.h>     /* Definition of SYS_* constants */
#include <unistd.h>

int syscall(SYS_landlock_create_ruleset,
            const struct landlock_ruleset_attr *attr,
            size_t size , uint32_t flags);

(she's a raw syscall() girlie, there's no wrapper, we're doing it manual, and yes that spacing is exactly as given, don't @ me 😭)

---

🌸 DESCRIPTION 🌸

A Landlock ruleset is basically a receipt of rules — a set of rules, i.e. actions on objects. landlock_create_ruleset() creates a brand new file descriptor that identifies one such ruleset. that fd is then the main character, handed off to landlock_add_rule(2) and landlock_restrict_self(2). pls read landlock(7) for the global overview, she's the vibe map ✨

attr specifies the properties of the new ruleset. it points to this structure and this structure ate:

struct landlock_ruleset_attr {
    __u64 handled_access_fs;
    __u64 handled_access_net;
    __u64 scoped;
    __u64 quiet_access_fs;
    __u64 quiet_access_net;
    __u64 quiet_scoped;
};

• handled_access_fs — a bitmask of handled filesystem actions (peep Filesystem actions in landlock(7)) 🌈
• handled_access_net — a bitmask of handled network actions (peep Network actions in landlock(7)) 🌐
• scoped — a bitmask of scope flags (peep Scope flags in landlock(7)) 🎀
• quiet_access_fs — a bit mask of filesystem actions which should not be logged if the per-object quiet flag is set 🤫
• quiet_access_net — a bit mask of network actions which should not be logged if the per-object quiet flag is set 🤫
• quiet_scoped — a bit mask of scoped actions which should not be logged 🤫

so basically this struct is a set of handled access rights, a set of actions on different object types, and all of those get denied by default the moment the ruleset is enacted. and vice versa: access rights you did NOT specifically list here are simply not going to be denied by this ruleset when it's enacted. the audacity, honestly. we love a clearly-scoped queen 💅

history time, fr fr: for historical reasons, the LANDLOCK_ACCESS_FS_REFER right is always denied by default, even when its bit is not set in handled_access_fs. but to add new rules with that access right, the bit must still be set explicitly (see Filesystem actions in landlock(7)). so like, she's denied whether you asked or not, but you still have to ask. iconic behaviour.

the explicit listing of handled access rights is required for backwards compatibility reasons. in most use cases, processes that use Landlock will handle a wide range or all access rights that they know about at build time (and that they have tested with a kernel that supported them all). so like, throw the whole known-at-build-time list in there, bestie, that's the move 🫶

quiet_access_fs and quiet_access_net are bit masks of actions for which a denial by this layer will not trigger a log if the corresponding object (or its children, for filesystem rules) is marked with the "quiet" bit via LANDLOCK_ADD_RULE_QUIET — even if logging would normally take place per landlock_restrict_self(2) flags. quiet_scoped is similar, except that it does not require marking any objects as quiet (if the ruleset is created with any bits set in quiet_scoped, then denial of such scoped resources will not trigger any log). these 3 fields are available since Landlock ABI version 10 (see Quiet rule flag in landlock(7)). 💖

also, quiet_access_fs, quiet_access_net and quiet_scoped must be a subset of handled_access_fs, handled_access_net and scoped respectively. no freeloading 🚫

and this structure can grow in future Landlock versions. glow-up pending ✨

---

<h3>the other two args</h3>

size must be specified as sizeof(struct landlock_ruleset_attr) for compatibility reasons. not vibes. not a guess. that number. 📏

flags must be 0 if attr is used. otherwise, flags can be set to:

• LANDLOCK_CREATE_RULESET_VERSION — return the highest supported Landlock ABI version (starting at 1). this version can be used for a best-effort security approach, which is encouraged when user space is not pinned to a specific kernel version 🌈
  • unless noted otherwise, all features documented in these manual pages are available with the version 1. nice.
• LANDLOCK_CREATE_RULESET_ERRATA — return a bitmask of fixed issues for the current Landlock ABI version. if bit N is set (i.e., errata & (1 << (N - 1))), then erratum N has been fixed in the running kernel 🔧
  • in addition to ABI versions, Landlock's errata mechanism tracks fixes for issues that may affect backwards compatibility or require userspace awareness.
  • only check errata if your application specifically relies on behavior that changed due to the fix. don't go looking for drama you don't need, bestie 🙈
  • the full list of Landlock errata is available at https://docs.kernel.org/userspace-api/landlock.html#landlock-errata.
  • this flag is available on all Linux versions where Landlock errata were fixed. this specifically includes all newest bugfix releases of stable kernels where Landlock is supported 🎀

okay so heads up: if LANDLOCK_CREATE_RULESET_VERSION or LANDLOCK_CREATE_RULESET_ERRATA is set, then attr must be NULL and size must be 0. those two flags are like "just tell me the number", so there's no struct, no size, nada 💀

---

🎀 RETURN VALUE 🎀

on success, landlock_create_ruleset() returns a new Landlock ruleset file descriptor, a Landlock ABI version, or a Landlock errata bitmask, according to flags. she shapeshifts, and every form is slay ✨

on error, -1 is returned and errno is set to indicate the error. sad girl era, but informative 😭

---

💀 ERRORS 💀

landlock_create_ruleset() can fail for the following reasons:

• E2BIG — size is too big. girl. calm down 📏
• EFAULT — attr was not a valid address. that pointer is giving nothing 🚫
• EINVAL — unknown flags, or unknown access, or unknown scope, or too small size.
• EINVAL — non-NULL attr or non-zero size in combination with LANDLOCK_CREATE_RULESET_VERSION or LANDLOCK_CREATE_RULESET_ERRATA.
• EINVAL — quiet_access_fs, quiet_access_net, or quiet_scoped is not a subset of the corresponding handled_access_fs, handled_access_net, or scoped. (told you, no freeloading.)
• ENOMSG — empty accesses (i.e., attr did not specify any access rights to restrict). you built a whole ruleset and restricted… nothing? bestie what 💀
• EOPNOTSUPP — Landlock is supported by the kernel but disabled at boot time. the kernel has the talent, the bootloader said no 🙈

---

🌈 STANDARDS 🌈

Linux. that's it. that's the standard 🐧

---

👑 HISTORY 👑

Linux 5.13. vintage, but still eating 👑

---

🍓 EXAMPLES 🍓

See landlock(7). (she did the examples, go look, they're cute ✨)

---

🫶 SEE ALSO 🫶

landlock_add_rule(2), landlock_restrict_self(2), landlock(7) — read them all, it's a trilogy, no cap 📚

---

and that's the whole page, bestie!! 🎀 this was Linux man-pages 6.20, dated 2026-09-11, for landlock_create_ruleset(2) 💖 now go forth and sandbox responsibly, mwah 🫶✨