fs_access(9)

fs_access(9) — Kernel API Manual, but make it make sense 💅

okay so this is the fs_access(9) page from the Kernel API Manual, and it's giving “all the filesystem access flags Landlock uses to lock things down.” A set of actions on kernel objects may be defined by an attribute (e.g. struct landlock_path_beneath_attr) that includes a bitmask of access. That's the setup, bestie. ✨

📁 Filesystem flags ✨

These flags enable you to restrict a sandboxed process to a set of actions on files and directories. Files or directories opened before the sandboxing are not subject to these restrictions. periodt.

The following access rights apply only to files:

• LANDLOCK_ACCESS_FS_EXECUTE — Execute a file.
• LANDLOCK_ACCESS_FS_WRITE_FILE — Open a file with write access. When opening files for writing, you will often additionally need the LANDLOCK_ACCESS_FS_TRUNCATE right. In many cases, these system calls truncate existing files when overwriting them (e.g., creat(2)).
• LANDLOCK_ACCESS_FS_READ_FILE — Open a file with read access.
• LANDLOCK_ACCESS_FS_TRUNCATE — Truncate a file with truncate(2), ftruncate(2), creat(2), or open(2) with O_TRUNC. This access right is available since the third version of the Landlock ABI.
• LANDLOCK_ACCESS_FS_IOCTL_DEV — Invoke ioctl(2) commands on an opened character or block device.

This access right applies to all ioctl(2) commands implemented by device drivers. However, the following common IOCTL commands continue to be invokable independent of the LANDLOCK_ACCESS_FS_IOCTL_DEV right:

• IOCTL commands targeting file descriptors (FIOCLEX, FIONCLEX)
• IOCTL commands targeting file descriptions (FIONBIO, FIOASYNC)
• IOCTL commands targeting file systems (FIFREEZE, FITHAW, FIGETBSZ, FS_IOC_GETFSUUID, FS_IOC_GETFSSYSFSPATH)
• Some IOCTL commands which do not make sense when used with devices, but whose implementations are safe and return the right error codes (FS_IOC_FIEMAP, FICLONE, FICLONERANGE, FIDEDUPERANGE)

This access right is available since the fifth version of the Landlock ABI.

• LANDLOCK_ACCESS_FS_RESOLVE_UNIX — Look up pathname UNIX domain sockets (unix(7)). On UNIX domain sockets, this restricts both calls to connect(2) as well as calls to sendmsg(2) with an explicit recipient address.

This access right applies only to connections to UNIX server sockets which were created outside of the newly created Landlock domain (e.g. from within a parent domain or from an unrestricted process). Newly created UNIX servers within the same Landlock domain continue to be accessible. In this regard, LANDLOCK_ACCESS_FS_RESOLVE_UNIX has the same semantics as the LANDLOCK_SCOPE_* flags.

If a resolution attempt is denied, the operation returns an EACCES error, in line with other filesystem access rights (but different to denials for abstract UNIX domain sockets).

This access right is available since the ninth version of the Landlock ABI.

The rationale for this design is described in :ref:Documentation/security/landlock.rst <scoped-flags-interaction>.

Whether an opened file can be truncated with ftruncate(2) or used with ioctl(2) is determined during open(2), in the same way as read and write permissions are checked during open(2) using LANDLOCK_ACCESS_FS_READ_FILE and LANDLOCK_ACCESS_FS_WRITE_FILE.

A directory can receive access rights related to files or directories. The following access right is applied to the directory itself, and the directories beneath it:

• LANDLOCK_ACCESS_FS_READ_DIR — Open a directory or list its content.

However, the following access rights only apply to the content of a directory, not the directory itself:

• LANDLOCK_ACCESS_FS_REMOVE_DIR — Remove an empty directory or rename one.
• LANDLOCK_ACCESS_FS_REMOVE_FILE — Unlink (or rename) a file.
• LANDLOCK_ACCESS_FS_MAKE_CHAR — Create (or rename or link) a character device.
• LANDLOCK_ACCESS_FS_MAKE_DIR — Create (or rename) a directory.
• LANDLOCK_ACCESS_FS_MAKE_REG — Create (or rename or link) a regular file. This also guards the creation of whiteout objects as used in OverlayFS.
• LANDLOCK_ACCESS_FS_MAKE_SOCK — Create (or rename or link) a UNIX domain socket.
• LANDLOCK_ACCESS_FS_MAKE_FIFO — Create (or rename or link) a named pipe.
• LANDLOCK_ACCESS_FS_MAKE_BLOCK — Create (or rename or link) a block device.
• LANDLOCK_ACCESS_FS_MAKE_SYM — Create (or rename or link) a symbolic link.
• LANDLOCK_ACCESS_FS_REFER — Link or rename a file from or to a different directory (i.e. reparent a file hierarchy).

This access right is available since the second version of the Landlock ABI.

This is lowkey the only access right which is denied by default by any ruleset, even if the right is not specified as handled at ruleset creation time. The only way to make a ruleset grant this right is to explicitly allow it for a specific directory by adding a matching rule to the ruleset. No cap.

In particular, when using the first Landlock ABI version, Landlock will always deny attempts to reparent files between different directories.

In addition to the source and destination directories having the LANDLOCK_ACCESS_FS_REFER access right, the attempted link or rename operation must meet the following constraints:

• The reparented file may not gain more access rights in the destination directory than it previously had in the source directory. If this is attempted, the operation results in an EXDEV error.
• When linking or renaming, the LANDLOCK_ACCESS_FS_MAKE_* right for the respective file type must be granted for the destination directory. Otherwise, the operation results in an EACCES error.
• When renaming, the LANDLOCK_ACCESS_FS_REMOVE_* right for the respective file type must be granted for the source directory. Otherwise, the operation results in an EACCES error.

If multiple requirements are not met, the EACCES error code takes precedence over EXDEV.

WARNING ⚠️

⚠️ It is currently not possible to restrict some file-related actions accessible through these syscall families: chdir(2), stat(2), flock(2), chmod(2), chown(2), setxattr(2), utime(2), fcntl(2), access(2). Future Landlock evolutions will enable to restrict them.

SEE ALSO 👀

• Kernel file ./include/uapi/linux/landlock.h struct
• landlock_ruleset_attr(9), landlock_create_ruleset_flags(9), landlock_add_rule_flags(9), landlock_restrict_self_flags(9), enum landlock_rule_type(9), struct landlock_path_beneath_attr(9), struct landlock_net_port_attr(9), net_access(9), scope(9)

Source/version: ./include/uapi/linux — date: October 2026 — page: fs_access(9). Bye bestie, go protect those files! 💖✨