landlock_add_rule_flags(9)

🌸 landlock_add_rule_flags 🌸

okay so this is the Kernel API Manual page for landlock_add_rule_flags(9), bestie — and it's literally all about one flag. No cap, every crunchy detail is staying. 🫶

✨ Flags ✨

• LANDLOCK_ADD_RULE_QUIET — okay so this flag works together with the quiet_* fields in struct landlock_ruleset_attr to control whether Landlock logs audit messages when this layer denies access to the objects covered by this rule. 💖

When logging is enabled and Landlock denies an access, it suppresses the log only if all of these are true:

• this layer is the innermost layer that denied the access;
• all accesses denied by this layer are part of the quiet_* fields in the related struct landlock_ruleset_attr;
• the object (or one of its parents, for filesystem rules) is marked as "quiet" via LANDLOCK_ADD_RULE_QUIET.

And because a layer only suppresses logging when that layer is the one denying access, a sandboxed program can't use this flag to "hide" access denials unless it's already denying itself that access in the first place. 💀

This flag's effect doesn't depend on the value of allowed_access in the passed in rule_attr. And when this flag is present, the caller is also allowed to pass in an empty allowed_access. ✨

🔍 SEE ALSO 🔍

• Kernel file ./include/uapi/linux/landlock.h struct landlock_ruleset_attr(9)
• landlock_create_ruleset_flags(9)
• landlock_restrict_self_flags(9)
• enum landlock_rule_type(9)
• struct landlock_path_beneath_attr(9)
• struct landlock_net_port_attr(9)
• fs_access(9)
• net_access(9)
• scope(9)

and that's the whole vibe, bestie: from source ./include/uapi/linux in the Kernel API Manual, dated October 2026, all for landlock_add_rule_flags(9) — mwah 💋🎀