landlock_res...t_self_flags(9)

🎀 landlock_restrict_self_flags 🎀

okay so this is the Kernel API Manual entry for landlock_restrict_self_flags, and honestly? it's giving "tiny flag, huge security energy" ✨ buckle up bestie, we're reading the flags 💅

---

✨ Flags ✨

So by default, when a program sandboxes itself and gets denied on something, that denial gets logged through the audit subsystem. and like… that's on purpose 🫶 because those events typically mean something unexpected is happening — a bug, or someone trying to exploit stuff 😭

But — and this is the key part — to avoid excessive logging, access requests that get denied by a domain not created by the originating program are not logged by default. the rationale is lowkey iconic: programs should know their own behavior, but not necessarily the behavior of other programs. periodt 💅 this default setup is suitable for most programs that sandbox themselves.

For specific use cases tho, the following flags let programs modify that default logging behavior 👑

Quick note before the list: the LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF and LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON flags apply to the newly created Landlock domain 🦋

• LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF — Disables logging of denied accesses originating from the thread creating the Landlock domain, as well as its children, as long as they continue running the same executable code (i.e., without an intervening execve(2) call). This is intended for programs that execute unknown code without invoking execve(2), such as script interpreters. Programs that only sandbox themselves should not set this flag, so users can be notified of unauthorized access attempts via system logs 🌸
• LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON — Enables logging of denied accesses after an execve(2) call, providing visibility into unauthorized access attempts by newly executed programs within the created Landlock domain. This flag is recommended only when all potential executables in the domain are expected to comply with the access restrictions, as excessive audit log entries could make it more difficult to identify critical events 🙈
• LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF — Disables logging of denied accesses originating from nested Landlock domains created by the caller or its descendants. This flag should be set according to runtime configuration, not hardcoded, to avoid suppressing important security events ⚠️ It is useful for container runtimes or sandboxing tools that may launch programs which themselves create Landlock domains and could otherwise generate excessive logs. Unlike LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF, this flag only affects future nested domains, not the one being created. It can also be used with a ruleset_fd value of -1 to mute subdomain logs without creating a domain. When combined with LANDLOCK_RESTRICT_SELF_TSYNC and a ruleset_fd value of -1, this configuration is propagated to all threads of the current process 🧚

---

okay next up — the following flag supports policy enforcement in multithreaded processes 👯‍♀️

• LANDLOCK_RESTRICT_SELF_TSYNC — Applies the new Landlock configuration atomically to all threads of the current process, including the Landlock domain and logging configuration. This overrides the Landlock configuration of sibling threads, irrespective of previously established Landlock domains and logging configurations on these threads. no cap, it just takes over 💀

If the calling thread is running with no_new_privs, this operation enables no_new_privs on the sibling threads as well 🫶

---

and the following flag ties the no_new_privs attribute to the ruleset enforcement 🔥

• LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS — Sets the no_new_privs attribute of the calling thread only once the enforcement of the ruleset succeeded: no_new_privs is set if and only if sys_landlock_restrict_self succeeds. This removes the need for a prior prctl(2) PR_SET_NO_NEW_PRIVS call (or CAP_SYS_ADMIN use). This flag requires a ruleset ⚠️ When combined with LANDLOCK_RESTRICT_SELF_TSYNC, no_new_privs is set on the sibling threads as well 💜

---

💖 SEE ALSO 💖

• Kernel file ./include/uapi/linux/landlock.h struct landlock_ruleset_attr(9)
• landlock_create_ruleset_flags(9)
• landlock_add_rule_flags(9)
• enum landlock_rule_type(9)
• struct landlock_path_beneath_attr(9)
• struct landlock_net_port_attr(9)
• fs_access(9)
• net_access(9)
• scope(9)

---

bestie reminder: go read the whole crew, they all connect 🦋✨

and that's the page!! shipped straight out of ./include/uapi/linux, stamped October 2026, filed under landlock_res...t_self_flags(9) — go be iconic with your sandboxes, ily 💅👑🌈