Module landlock 

Landlock LSM for unprivileged filesystem and network access control.

Landlock is a Linux Security Module (LSM) that allows unprivileged processes to restrict their own access to the filesystem and network. Unlike traditional DAC/MAC, Landlock can be used without root privileges.

ABI Versions

ABI	Kernel	Features
1	5.13	Basic filesystem access
2	5.19	REFER (cross-directory rename/link)
3	6.2	TRUNCATE (file truncation)
4	6.7	IOCTL_DEV, TCP network access
5	6.12	SCOPE_SIGNAL, SCOPE_ABSTRACT_UNIX_SOCKET

Usage

let attr = LandlockRulesetAttr {
    handled_access_fs: fs_access_for_abi(abi),
    handled_access_net: net_access_for_abi(abi),
};
let ruleset_fd = landlock_create_ruleset(&attr)?;

// Add rules for allowed paths
let rule = LandlockPathBeneathAttr { allowed_access, parent_fd };
landlock_add_rule_path(&ruleset_fd, &rule)?;

// Restrict self - no going back after this!
landlock_restrict_self(&ruleset_fd)?;

Important

• Once landlock_restrict_self is called, it cannot be undone
• Access not explicitly allowed is denied
• Network blocking requires ABI 4+ (kernel 6.7+)

Structs

LandlockPathBeneathAttr

LandlockRulesetAttr

Constants

LANDLOCK_ACCESS_FS_EXECUTE

LANDLOCK_ACCESS_FS_IOCTL_DEV

LANDLOCK_ACCESS_FS_MAKE_BLOCK

LANDLOCK_ACCESS_FS_MAKE_CHAR

LANDLOCK_ACCESS_FS_MAKE_DIR

LANDLOCK_ACCESS_FS_MAKE_FIFO

LANDLOCK_ACCESS_FS_MAKE_REG

LANDLOCK_ACCESS_FS_MAKE_SOCK

LANDLOCK_ACCESS_FS_MAKE_SYM

LANDLOCK_ACCESS_FS_READ_DIR

LANDLOCK_ACCESS_FS_READ_FILE

LANDLOCK_ACCESS_FS_REFER

LANDLOCK_ACCESS_FS_REMOVE_DIR

LANDLOCK_ACCESS_FS_REMOVE_FILE

LANDLOCK_ACCESS_FS_TRUNCATE

LANDLOCK_ACCESS_FS_WRITE_FILE

LANDLOCK_ACCESS_NET_BIND_TCP

LANDLOCK_ACCESS_NET_CONNECT_TCP

LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET

Block abstract unix socket connections outside the sandbox.

LANDLOCK_SCOPE_SIGNAL

Block signals to processes outside the sandbox.

Functions

fs_access_for_abi

Returns the filesystem access flags for the given ABI version.

landlock_abi_version

Returns the Landlock ABI version supported by the kernel.

landlock_add_rule_path

Adds a path-based rule to a Landlock ruleset.

landlock_create_ruleset

Creates a new Landlock ruleset.

landlock_restrict_self

Restricts the calling thread to the given Landlock ruleset.

net_access_for_abi

Returns the network access flags for the given ABI version.

scope_for_abi

Returns the scoped restriction flags for the given ABI version.