scope(9)

🌸 scope(9) — from the Kernel API Manual, bestie ✨

okay so this one's short but it's important, so pay attention 💅

🌈 NAME

scope — the scope flags, aka the lil switches that decide what your sandboxed process is allowed to reach outside its own vibe bubble 🫧

✨ Scope flags ✨

So here's the tea ☕: these flags let you isolate a sandboxed process from a whole set of IPC actions. Basically you flip a flag on for a ruleset and boom — the Landlock domain gets isolated, and it's now forbidden from connecting to resources outside the domain. No cap, it's a whole lockdown 💀🔒

💖 Heads up bestie: this is supported since Landlock ABI version 6. If you're on anything older, this is not the moment, iykyk.

🎀 Scopes 🎀

• LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET — restricts a sandboxed process from connecting to an abstract UNIX socket that was created by a process outside the related Landlock domain (like, say, a parent domain, or a non-sandboxed process) 🙈🚫
• LANDLOCK_SCOPE_SIGNAL — restricts a sandboxed process from sending a signal to another process outside the domain. no sending signals to strangers, periodt ✋💅

🦋 SEE ALSO

like, go read these next, fr fr 🫶

• Kernel file ./include/uapi/linux/landlock.h struct landlock_ruleset_attr
• landlock_ruleset_attr(9)
• landlock_create_ruleset_flags(9)
• landlock_add_rule_flags(9)
• landlock_restrict_self_flags(9)
• enum landlock_rule_type(9)
• struct landlock_path_beneath_attr(9)
• struct landlock_net_port_attr(9)
• fs_access(9)
• net_access(9)

and that's the whole page, bestie — short, sweet, and absolutely iconic 👑

this lil gem lives at ./include/uapi/linux, dated October 2026, and it's the scope(9) page 💖 mwah, go sandbox responsibly 🧚✨