sys_landlock_add_rule(9)

📦 version 7.3.1, in nixpkgs unstable

💅 sys_landlock_add_rule(9) — the Kernel API Manual bestie edition ✨

okay so before we even start: this is a page from the Kernel API Manual, section 9, and it's all about sys_landlock_add_rule. sit down, grab a strawberry drink 🍓, and let's get into it because this syscall is genuinely iconic.

🌸 NAME 🌸

sys_landlock_add_rule — bestie, it adds a new rule to a ruleset. that's the whole vibe. 🎀

✨ SYNOPSIS ✨

long sys_landlock_add_rule (const int ruleset_fd , const enum
landlock_rule_type rule_type , const void __user *const rule_attr ,
const __u32 flags );

look at that signature. she's long, she's got const everywhere, she's that girl. 😌

🫶 ARGUMENTS 🫶

  • ruleset_fd — the file descriptor tied to the ruleset that should be extended with the new rule. it's literally the ruleset you're adding to, no cap.
  • rule_type — identifies the structure type that rule_attr is pointing at. the options are LANDLOCK_RULE_PATH_BENEATH or LANDLOCK_RULE_NET_PORT. choose wisely, queen 👑.
  • rule_attr — pointer to a rule (and it has to match the rule_type, obviously). the actual content ✨.
  • flags — must be 0 or LANDLOCK_ADD_RULE_QUIET. that's it. that's the whole list. don't get creative 💀.

🔥 DESCRIPTION 🔥

so this system call enables you to define a new rule and add it to an existing ruleset. that's the main character energy of the whole page. 💖

and then we get into the error lore, which is honestly a lot, so buckle up:

  • EOPNOTSUPP — Landlock is supported by the kernel but disabled at boot time. so the vibes are there, the feature just isn't turned on 🙈.
  • EAFNOSUPPORT — rule_type is LANDLOCK_RULE_NET_PORT but TCP/IP is not supported by the running kernel. wrong kernel for that net port fantasy, sorry.
  • EINVAL — flags is not valid. you tried it. it didn't work.
  • EINVAL — the rule accesses are inconsistent (i.e. landlock_path_beneath_attr.allowed_access or landlock_net_port_attr.allowed_access is not a subset of the ruleset handled accesses). math is not mathing.
  • EINVAL — landlock_net_port_attr.port is greater than 65535. that port is out of range, bestie 😭.
  • EINVAL — LANDLOCK_ADD_RULE_QUIET is passed but the ruleset has no quiet access bits set for the corresponding rule type. you asked for quiet mode on a ruleset that isn't serving quiet mode.
  • ENOMSG — empty accesses (e.g. landlock_path_beneath_attr.allowed_access is 0 and no flags). nothing inside. empty. void. 💀
  • EBADF — ruleset_fd is not a file descriptor for the current thread, or a member of rule_attr is not a file descriptor as expected.
  • EBADFD — ruleset_fd is not a ruleset file descriptor, or a member of rule_attr is not the expected file descriptor type. yes, EBADF and EBADFD are two different things, and yes, they will both humble you.
  • EPERM — ruleset_fd has no write access to the underlying ruleset. no write access, no entry 🚫.
  • EFAULT — rule_attr was not a valid address. the pointer said "trust me" and lied.

also, there's this kernel-doc bit that's just sitting here being all mysterious:

.. kernel-doc:: include/uapi/linux/landlock.h :identifiers:
landlock_add_rule_flags

that's for landlock_add_rule_flags. iconic of it to just appear with no further comment. 🦋

⭐ RETURN ⭐

0 on success, or -errno on failure. possible returned errors are: (yes, they're the ones listed up above in DESCRIPTION, go scroll back, i'll wait 🧚)

🌈 SEE ALSO 🌈

the whole landlock friend group honestly. go read them too, they're all linked. 💜

okay that's the page!! and before you go — the source is from ./security/landlock, dated October 2026, and the whole thing is filed under sys_landlock_add_rule(9). so there you have it: sourced, dated, and absolutely slaying. mwah 💋✨🎀

📦 where this page comes from