landlock_init_layer_masks(9)
π landlock_init_layer_masks β like, the whole vibe check for layer masks
okay so bestie, welcome to the landlock_init_layer_masks(9) page π this is a Kernel API Manual moment, and it's genuinely iconic. We're talking about the function that sets up your layer masks from an access request β the little setup era before the real work happens β¨
β¨ SYNOPSIS β¨
access_mask_t landlock_init_layer_masks (const struct landlock_domain
*const domain , const access_mask_t access_request , struct layer_masks
*const masks , const enum landlock_key_type key_type );
that's the whole signature, no cap π copy it exactly, don't be weird about it.
πΈ ARGUMENTS πΈ
domainβ the domain defining the current restrictions, i.e. the main character of this whole operation πaccess_requestβ the requested access rights to check. this is the "what do u actually want" list fr frmasksβ the layer access masks to populate. like, the empty lil containers we're filling up πkey_typeβ the key type to switch between access masks of different types. yes, there are different types, and yes, this is how u pick π¦
π DESCRIPTION π
okay so here's what it actually does, and it ate:
It populates masks such that, for each access right in access_request, the bits for all the layers are set where this access right is handled. Rule flags are also zeroed. π«Ά
that's it, that's the whole thing. bits get set where the access right is handled across the layers, and the rule flags get zeroed out β clean slate energy β¨
β RETURN β
It hands u back an access mask where each access right bit is set which is handled in any of the active layers in domain. like, any layer at all β if it's handled somewhere, that bit is showing up π
π₯ SEE ALSO π₯
go check out the Kernel file ./security/landlock/domain.c and also these besties:
landlock_unmask_layers(9)landlock_merge_ruleset(9)get_current_exe(9)landlock_init_hierarchy_log(9)landlock_get_quiet_optional_accesses(9)
they're all part of the same little friend group, iykyk π§
and that's the page!! π this absolute banger lives over in ./security/landlock, and the version vibes are dated October 2026 β so like, mark ur calendar bestie ποΈβ¨ periodt.
π¦ where this page comes from
- nixpkgs unstable: linux-manual 7.3.1
- π girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on : a language model's rewrite of the original, under its terms