net_access(9)

🌐 net_access 💅

okay bestie so this is net_access(9), straight out of the Kernel API Manual, and it's literally all about the network flags 🎀 — the ones that let you lock a sandboxed process down to a specific little set of network actions. No random internet shenanigans, we're on a strict vibe check here ✨

🌸 Network flags 🌸

These flags exist so you can restrict a sandboxed process to a set of network actions — like, only these ports, nothing else, periodt 🫶

So for TCP port numbers, the following access rights apply:

• LANDLOCK_ACCESS_NET_BIND_TCP — bind TCP sockets to the given local port 🔒 Support added in Landlock ABI version 4.
• LANDLOCK_ACCESS_NET_CONNECT_TCP — connect TCP sockets to the given remote port 🌈 Support added in Landlock ABI version 4.

And similarly for UDP port numbers, we got:

• LANDLOCK_ACCESS_NET_BIND_UDP — bind UDP sockets to the given local port ✨ Support added in Landlock ABI version 10.
• LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP — set the remote port of UDP sockets to the given port, or send datagrams to the given remote port ignoring any destination pre-set on a socket 🔥 Support added in Landlock ABI version 10.

💀 note note note — setting a remote address or sending a first datagram auto-binds UDP sockets to an ephemeral local source port if they're not already bound. To allow this when both LANDLOCK_ACCESS_NET_BIND_UDP and LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP are handled, you need to either: - use a socket already bound to a port before the ruleset started being enforced; - or grant LANDLOCK_ACCESS_NET_BIND_UDP on port 0, meaning "any port in the ephemeral port range"; - or grant LANDLOCK_ACCESS_NET_BIND_UDP on a specific port, and call bind(2) on that port before trying to connect(2) or send datagrams.

🫠 also a note — sending datagrams to an AF_UNSPEC destination address family is not supported for IPv6 UDP sockets: you will need to use a NULL address instead.

👑 SEE ALSO 👑

Kernel file ./include/uapi/linux/landlock.h, struct landlock_ruleset_attr(9), landlock_create_ruleset_flags(9), landlock_add_rule_flags(9), landlock_restrict_self_flags(9), enum landlock_rule_type(9), struct landlock_path_beneath_attr(9), struct landlock_net_port_attr(9), fs_access(9), scope(9) 🦋

k that's the whole thing bestie, go forth and sandbox responsibly 💅✨ this came from ./include/uapi/linux, dated October 2026 — mwah, ily, bye 🎀💖