Struct LandlockManager 

pub struct LandlockManager { /* private fields */ }

Landlock filesystem access-control manager

Implements fine-grained, path-based filesystem restrictions as an additional defense layer on top of namespaces, capabilities, and seccomp.

Properties (matching Nucleus security invariants):

• Irreversible: once restrict_self() is called, restrictions cannot be lifted
• Stackable: layered with seccomp and capability dropping
• Unprivileged: works in rootless mode

Implementations

impl LandlockManager

pub fn new() -> Self

pub fn apply_container_policy(&mut self) -> Result<bool>

Apply the container Landlock policy.

Rules:

• / (root): read-only traversal (ReadDir) so path resolution works
• /bin, /usr: read + execute (for running agent binaries)
• /lib, /lib64: read (shared libraries)
• /etc: read (config / resolv.conf / nsswitch)
• /dev: read (already minimal device nodes)
• /proc: read (already mounted read-only)
• /tmp: read + write + create + remove (agent scratch space)
• /context: read-only (pre-populated agent data)

Everything else is denied by the ruleset.

pub fn assert_minimum_abi(&self, production_mode: bool) -> Result<()>

Assert that the kernel supports at least the minimum Landlock ABI version required for production workloads.

Returns Ok(()) if the ABI is sufficient, or Err if the kernel is too old. In best-effort mode, a too-old kernel is logged but not fatal.

pub fn apply_container_policy_with_mode( &mut self, best_effort: bool, ) -> Result<bool>

Apply with configurable failure behavior.

When best_effort is true, failures (e.g. kernel without Landlock) are logged and execution continues.

pub fn is_applied(&self) -> bool

Check if Landlock policy has been applied

Trait Implementations

impl Default for LandlockManager

fn default() -> Self

Returns the “default value” for a type.