landlock_store_rule(9)

✨ landlock_store_rule(9) ✨

okay bestie, so this is a page from the Kernel API Manual (kernel land, we love her) and it's all about landlock_store_rule — the little function that creates a rule and inserts it into the rule storage. 💅 Two jobs, one function, main character energy fr fr.

---

🎀 SYNOPSIS 🎀

int landlock_store_rule (struct landlock_rules *const rules , const
       struct landlock_id id , const struct landlock_layer (*layers)[] , const
       size_t num_layers );

like, yes, it's a whole mouthful. we'll go through every single piece, no cap. 🫶

---

🌸 ARGUMENTS 🌸

• rules — the rule storage that's getting updated. bestie this one comes with a whole responsibility speech 😭 the caller is on the hook for any locking that's required. for rulesets, that literally means holding landlock_ruleset.lock. for domains that are still under construction? no lock needed, because the domain isn't visible to other tasks yet — it's giving "not yet perceived, not yet a problem" ✨
• id — the ID you're building the shiny new rule with. and if there's an underlying kernel object involved, the caller must already be holding it. 🫶
• layers — one or multiple layers, and they get copied into the new rule. 🎀
• num_layers — the number of layers entries. simple as that. ⭐

---

🦋 DESCRIPTION 🦋

so here's the tea. ☕ when user space asks to add a new rule to a ruleset, layers only contains one entry, and that entry is not assigned to any level. in that case, the new rule will extend rules — think of it like a boolean OR between access rights. slay, very additive, very "yes and". 💖

but when you're merging a ruleset into a domain, or copying a domain? layers gets added to rules as new constraints — like a boolean AND between access rights. 🔥 very "hold up, you need both". iconic behavior honestly.

---

👑 RETURN 👑

• 0 on success 🎉
• -errno on failure 💀

---

🧚 SEE ALSO 🧚

• Kernel file ./security/landlock/ruleset.c

---

ngl bestie, if you're locking stuff by hand here, please actually lock it. i'm not mad, i'm just saying. 🙈

---

and that's the page!! shipped to you from ./security/landlock, dated October 2026 — mwah, love u, go read ruleset.c 💜🎀🦋