sys_landlock_restrict_self(9)

sys_landlock_restrict_self(9) 💅

okay so bestie, this is the glow-up of a page from the Kernel API Manual — sys_landlock_restrict_self(9) — and it's all about enforcing a Landlock ruleset on the calling thread. security gatekeeping, but make it syscall. 👑

---

💖 NAME 💖

sys_landlock_restrict_self — enforce a ruleset on the calling thread. literally the “lock it in” move for Landlock, no cap. 🫶

✨ SYNOPSIS ✨

       long sys_landlock_restrict_self (const int ruleset_fd , const __u32
       flags );

🎀 ARGUMENTS 🎀

• ruleset_fd — file descriptor tied to the ruleset to merge with the target. like, the little VIP handle for the ruleset you're bringing to the function. 🎟️
• flags — supported values: the five LANDLOCK_RESTRICT_SELF_* flag girlies listed in DESCRIPTION below. yes, the whole menu, bestie. 👇

🌸 DESCRIPTION 🌸

okay so these are the supported values for flags, and this page gives us the names, periodt:

• LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF — a supported flags value. ✨
• LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON — a supported flags value. ✨
• LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF — a supported flags value. ✨
• LANDLOCK_RESTRICT_SELF_TSYNC — a supported flags value. ✨
• LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS — a supported flags value. ✨

This system call enforces a Landlock ruleset on the current thread. Enforcing a ruleset requires that the task has CAP_SYS_ADMIN in its namespace or is running with no_new_privs. This avoids scenarios where unprivileged tasks can affect the behavior of privileged children. 💀

With LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS, the no_new_privs attribute of the calling thread is set only once the enforcement of the ruleset succeeded, which fulfills the above requirement: no_new_privs is set if and only if the call succeeds. highkey iconic behavior. 👑

and here's the possible-error guest list, in original order:

• EOPNOTSUPP: Landlock is supported by the kernel but disabled at boot time;
• EINVAL: flags contains an unknown bit.
• EBADF: ruleset_fd is not a file descriptor for the current thread;
• EBADFD: ruleset_fd is not a ruleset file descriptor;
• EPERM: ruleset_fd has no read access to the underlying ruleset, or LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS is not set while the current thread is not running with no_new_privs and doesn't have CAP_SYS_ADMIN in its namespace.
• E2BIG: The maximum number of stacked rulesets is reached for the current thread.

also this page pulls in the uapi header identifiers, so keep this exact kernel-doc directive energy:

       .. kernel-doc:: include/uapi/linux/landlock.h :identifiers:
       landlock_restrict_self_flags

👑 RETURN 👑

0 on success, or -errno on failure. Possible returned errors are: the whole list we just did above, bestie — EOPNOTSUPP, EINVAL, EBADF, EBADFD, EPERM, and E2BIG. that's the error buffet. 🍓

🦋 SEE ALSO 🦋

• Kernel file ./security/landlock/syscalls.c
• copy_min_struct_from_user(9)
• sys_landlock_create_ruleset(9)
• sys_landlock_add_rule(9)

---

mwah 💋 — this cutie comes from source/version ./security/landlock, dated October 2026. stay slay, bestie. 🫶