sys_landlock_create_ruleset(9)

📦 version 7.3.1, in nixpkgs unstable

💅 NAME 💅

sys_landlock_create_ruleset — Create a new ruleset

okay so welcome to the Kernel API Manual, bestie 🎀 this one's all about sys_landlock_create_ruleset(9), and yes she's a syscall, yes she's iconic, let's get into it.

✨ SYNOPSIS ✨

long sys_landlock_create_ruleset (const struct landlock_ruleset_attr
__user *const attr , const size_t size , const __u32 flags );

literally the whole signature, character for character, no notes 👑

🫶 ARGUMENTS 🫶

  • attr — a pointer to a struct landlock_ruleset_attr, and what she does is identify the scope of the new ruleset. that's her whole job 💖
  • size — the size of the struct landlock_ruleset_attr that attr points at. why do we need it? for backward and forward compatibility, periodt. she's thinking about the future 🦋
  • flags — the supported values are:
    • LANDLOCK_CREATE_RULESET_VERSION
    • LANDLOCK_CREATE_RULESET_ERRATA

(yes those two bullets are listed right here under ARGUMENTS, and also show up in DESCRIPTION — the manpage is just being extra, we love her for it 💅)

🌸 DESCRIPTION 🌸

So this system call enables you to create a new Landlock ruleset. that's the vibe. new ruleset, fresh start, main character energy 👑

The flag values, one more time for the people in the back:

  • LANDLOCK_CREATE_RULESET_VERSION
  • LANDLOCK_CREATE_RULESET_ERRATA
⚠️ important, no cap: if LANDLOCK_CREATE_RULESET_VERSION or LANDLOCK_CREATE_RULESET_ERRATA is set, then attr must be NULL and size must be 0. do not fight this. she is very clear about it 🫶

And here's the error list, which the page drops right here in DESCRIPTION (we'll talk about that in RETURN, don't worry 😭):

  • EOPNOTSUPP — Landlock is supported by the kernel but disabled at boot time. she's home but she's not answering the door 💀
  • EINVAL — unknown flags, or unknown access, or unknown scope, or too small size. something in there just doesn't add up 🙈
  • EINVAL — quiet_access_fs, quiet_access_net, or quiet_scoped is not a subset of the corresponding handled_access_fs, handled_access_net, or scoped. yeah. that relationship is not giving subset energy 🔥
  • E2BIG — attr or size inconsistencies
  • EFAULT — attr or size inconsistencies
  • ENOMSG — empty landlock_ruleset_attr.handled_access_fs. nothing in the bag, nothing to work with 🍓

aaaand the page also carries this lil directive, copied exactly because it's literally part of the page:

.. kernel-doc:: include/uapi/linux/landlock.h :identifiers:
landlock_create_ruleset_flags

⭐ RETURN ⭐

Here's what you get back, bestie:

  • the ruleset file descriptor on success 🎀
  • the Landlock ABI version if LANDLOCK_CREATE_RULESET_VERSION is set
  • the errata value if LANDLOCK_CREATE_RULESET_ERRATA is set
  • or -errno on failure 😭

And the page ends this section with the line Possible returned errors are: — which is a little silly because the actual error bullets are chilling up in DESCRIPTION (scroll up, iykyk 👀). we're keeping it exactly as written because that's the page's business, not ours 💅

🦋 SEE ALSO 🦋

go read those next, they're the friend group 🌈

that's the whole page, mwah 💖 source/version vibes come courtesy of ./security/landlock, dated October 2026 — and sys_landlock_create_ruleset(9) is the name, see you in the group chat 🧚‍♀️✨

📦 where this page comes from