landlock_unmask_layers(9)

🦋 landlock_unmask_layers(9) 🦋

okay so bestie, welcome to the Kernel API Manual page for landlock_unmask_layers(9) — yes that's the whole title, and yes it's lowkey a mouthful, but we're gonna get through it together 💖

✨ NAME ✨

landlock_unmask_layers — literally removes the access rights in masks that are granted by a matching rule 🎀

✨ SYNOPSIS ✨

bool landlock_unmask_layers (const struct landlock_domain *const domain
, const struct landlock_id id , struct layer_masks *masks , const struct
landlock_rule **matched_rule );

✨ ARGUMENTS ✨

• domain — the Landlock domain you're searching for a matching rule in 👑 this is the main character of the search tbh
• id — the identifier for the rule target, like an inode or a port 🎯 iykyk
• masks — a whole matrix of unfulfilled access rights, one set per layer 🌈 yes, a matrix, she's fancy
• matched_rule — optional output for the matched rule, for tracing purposes ✨ when it's non-NULL it gets set to the matching rule; otherwise it stays unchanged, no cap 🫶

✨ DESCRIPTION ✨

So the way this works: it looks up the rule matching id in domain, then it updates the set of (per-layer) unfulfilled access rights masks so that all the access rights granted by that rule get removed — because babes, they're fulfilled now 💅 periodt.

✨ RETURN ✨

Returns true if the request is allowed — meaning the access rights that got granted covered all the remaining unfulfilled access rights and masks has no leftover set bits left over 🌸 no stragglers, no crumbs, immaculate.

✨ SEE ALSO ✨

• Kernel file ./security/landlock/domain.c 📁
• landlock_init_layer_masks(9)
• landlock_merge_ruleset(9)
• get_current_exe(9)
• landlock_init_hierarchy_log(9)
• landlock_get_quiet_optional_accesses(9)

go read those next bestie, they're giving required reading energy 📚✨

that's the whole page!! this iconic lil number lives in ./security/landlock and the version vibes are October 2026 🗓️💜 slay, go unmask some layers, ily, bye 🧚‍♀️🎀