STRUCT LANDLOCK_RULESET_ATTR(9)

💅 NAME

struct landlock_ruleset_attr — the literal ruleset definition, bestie. This is the blueprint, the vibe board, the whole personality of a Landlock ruleset ✨

Oh and hii, you're reading the Kernel API Manual — welcome to the group chat 🫶

---

✨ SYNOPSIS

struct landlock_ruleset_attr {
    __u64 handled_access_fs;
    __u64 handled_access_net;
    __u64 scoped;
    __u64 quiet_access_fs;
    __u64 quiet_access_net;
    __u64 quiet_scoped;
 };

---

🎀 Members

• handled_access_fs — a bitmask of the filesystem actions you're handling (cf. Filesystem flags_). Think of it as your "yes I'm dealing with this, actually" list 💅
• handled_access_net — a bitmask of the network actions you're handling (cf. Network flags_). Same energy, network edition 🌐
• scoped — a bitmask of scopes (cf. Scope flags_) that stop a Landlock domain from reaching outside resources, like IPCs. It's giving "you can't sit with us" 🔒
• quiet_access_fs — a bitmask of filesystem actions that should not be logged if the per-object quiet flag is set. Lowkey shy logging 🙈
• quiet_access_net — a bitmask of network actions that should not be logged if the per-object quiet flag is set. Same deal, but for net 🌸
• quiet_scoped — a bitmask of scoped actions that should not be logged. No per-object flag needed, it's just quiet 🤫

---

🦋 Description

This struct is the argument of sys_landlock_create_ruleset. Periodt.

So here's the tea, bestie: this structure defines a set of handled access rights — a set of actions on different object types — which should be denied by default when the ruleset is enacted. Vice versa (love that for us), access rights that are not specifically listed here are not going to be denied by this ruleset when it's enacted. Not listed = not blocked, simple as that 💀

⚠️ For historical reasons, the LANDLOCK_ACCESS_FS_REFER right is always denied by default, even when its bit is not set in handled_access_fs. And to add new rules with this access right, the bit must still be set explicitly (cf. Filesystem flags_). Yeah, it's extra like that, but that's the rule 👑

The explicit listing of handled access rights is required for backwards compatibility reasons. In most use cases, processes that use Landlock will handle a wide range or all access rights that they know about at build time (and that they have tested with a kernel that supported them all). Basically: list it out loud, don't be mysterious about it 🎀

Okay now the quiet fields, because they're iconic ✨ quiet_access_fs and quiet_access_net are bitmasks of actions for which a denial by this layer will not trigger a log if the corresponding object (or its children, for filesystem rules) is marked with the "quiet" bit via LANDLOCK_ADD_RULE_QUIET — even if logging would normally take place per landlock_restrict_self flags. quiet_scoped is similar, except that it does not require marking any objects as quiet: if the ruleset is created with any bits set in quiet_scoped, then denial of such scoped resources will not trigger any log. These 3 fields are available since Landlock ABI version 10 🎉

And the compatibility check, do not skip this part fr fr: quiet_access_fs, quiet_access_net and quiet_scoped must be a subset of handled_access_fs, handled_access_net and scoped respectively 🫶

This structure can grow in future Landlock versions. She's evolving, we love a growth arc 🦋

---

🌈 SEE ALSO

• Kernel file ./include/uapi/linux/landlock.h
• landlock_create_ruleset_flags(9)
• landlock_add_rule_flags(9)
• landlock_restrict_self_flags(9)
• enum landlock_rule_type(9)
• struct landlock_path_beneath_attr(9)
• struct landlock_net_port_attr(9)
• fs_access(9)
• net_access(9)
• scope(9)

---

That's the whole page, no crumbs left 💖 this came from ./include/uapi/linux and it's dated October 2026 — slay, go forth and handle your access rights responsibly 😭💅