STRUCT LANDLOCK_FILE_SECURITY(9)

🦋 struct landlock_file_security(9) — the Kernel API Manual, bestie edition 🦋

Okay so this is a page from the Kernel API Manual about struct landlock_file_security, aka the vibes-holder for a file's security blob. Think of it as the little diary Landlock keeps about a file the moment it gets opened. 💅

---

✨ NAME ✨

struct landlock_file_security — the File security blob. That's it, that's the whole name. Iconic, lowkey.

---

🌸 SYNOPSIS 🌸

struct landlock_file_security {
    access_mask_t allowed_access;
  #ifdef CONFIG_SECURITY_LANDLOCK_LOG;
    deny_masks_t deny_masks;
    optional_access_t quiet_optional_accesses;
    u8 fown_layer;
  #endif ;
    struct landlock_cred_security fown_subject;
    struct pid *fown_tg;
 };

Not me showing you the whole struct like it's a fit pic 😭 — it's literally copied character for character, #ifdef, stray #endif ; semicolon and all. Do not come for me about that semicolon, it's in the source, periodt.

---

🎀 Members 🎀

• allowed_access — the access rights that were actually available at the time the file was opened. 🫶 Quick heads up though: this is not necessarily the full set of access rights that existed at that moment — it's the necessary subset you need in order to authorize later operations on the already-open file. So it's the "enough to get by" mask, not the whole closet.
• deny_masks — domain layer levels that deny an optional access. See _LANDLOCK_ACCESS_FS_OPTIONAL. It's giving "the bouncer with the list." 🚫
• quiet_optional_accesses — stores which optional accesses are covered by quiet rules within the layer referred to in deny_masks, one access per bit. ⭐ But bestie, be aware: it does not take into account whether the quiet access bits are actually set in the layer's corresponding landlock_hierarchy. So it's the intention, not the receipt. 🙈
• fown_layer — the layer level of fown_subject->domain with LANDLOCK_SCOPE_SIGNAL. 💫
• fown_subject — the Landlock credential of the task that set the PID that may receive a signal, e.g. SIGURG when writing MSG_OOB to the related socket. This pointer is protected by the related file->f_owner->lock, same as for fown_struct's members: pid, uid, and euid. 🔒 Lock-taken care of, no cap.
• fown_tg — the thread group of the task that set the file owner, pinned while fown_subject holds a domain. It lets hook_file_send_sigiotask always allow a SIGIO delivered to the owner's own process — e.g. the thread-group leader reached through a process-group owner — matching the same-process exemption of hook_task_kill. It's NULL when no domain is recorded. 💀 Protected by file->f_owner->lock, like fown_subject. Same lock, same energy, they're a package deal.

---

🌈 Description 🌈

So this information gets populated when you open a file in hook_file_open, and it tracks the relevant Landlock access rights that were available at the time of opening the file. ✨ Then other LSM hooks use these rights in order to authorize operations on files that are already opened. It's giving "receipts from the moment of purchase so later you can prove what you were allowed to do." 🧾👑

---

💜 SEE ALSO 💜

Kernel file ./security/landlock/fs.h, plus these absolute icons:

• struct landlock_inode_security(9)
• struct landlock_superblock_security(9)
• resolve_path_for_trace(9)

Go read them, iykyk. 📚

---

💖 Friendly reminder bestie: this page lives at ./security/landlock and it's dated October 2026. That's the source/version and the date, all folded into this cute little sign-off. Mwah, slay, bye! 🎀🦋🔥