is_masked_device_ioctl(9)

💅 is_masked_device_ioctl — a Kernel API Manual moment ✨

okay so bestie, we're in the Kernel API Manual today and this one is genuinely so niche and so cute. It's is_masked_device_ioctl(9) and it's basically the bouncer checking the guest list for ioctls on device files 🎀

---

✨ NAME ✨

is_masked_device_ioctl — figure out whether an IOCTL command is always permitted with Landlock for device files. Like, these commands literally can not be restricted on device files by enforcing a Landlock policy. They're grandfathered in, periodt 💅

---

🌸 SYNOPSIS 🌸

bool is_masked_device_ioctl (const unsigned int cmd );

---

🦋 ARGUMENTS 🦋

• cmd — the IOCTL command that's supposed to be run. that's the whole vibe check right there 👑

---

💖 DESCRIPTION 💖

so by default, any IOCTL on a device file requires the LANDLOCK_ACCESS_FS_IOCTL_DEV right. yes, any. strict queen behavior 🔥

but!! we blanket-permit some commands, and here's the criteria — if:

1. The command is implemented in fs/ioctl.c's do_vfs_ioctl, not in f_ops->unlocked_ioctl or f_ops->compat_ioctl.
2. The command is harmless when invoked on devices. no chaos, no drama, we love that for us 🫶

we also permit commands that don't really make sense for devices, but where the do_vfs_ioctl implementation returns a more conventional error code. like okay, it's giving "why are you here" but the error message is polite so we let it slide 😭

heads up bestie: any new IOCTL commands that get implemented in fs/ioctl.c's do_vfs_ioctl should be considered for inclusion here. don't forget, or the list gets stale and nobody wants that 💀

---

👑 RETURN 👑

True if the IOCTL cmd can not be restricted with Landlock for device files, false otherwise. simple as that, slay ⭐

---

🌈 SEE ALSO 🌈

• Kernel file ./security/landlock/fs.c
• get_inode_id(9)
• is_access_to_paths_allowed(9)
• collect_domain_accesses(9)
• current_check_refer_path(9)
• unmask_scoped_access(9)
• get_required_file_open_access(9)

---

okay that's the whole page, hope it ate 💖 and for the receipt-keepers: this one's stamped from ./security/landlock, dated October 2026 — no cap, that's the source and the date, mwah 🎀✨