Function landlock_available 

pub fn landlock_available() -> bool

Whether real Landlock filesystem confinement is available on THIS process’s kernel — a genuine, side-effect-free (beyond dropping one ruleset file descriptor) PARENT-PROCESS probe: it builds a CompatLevel::HardRequirement ruleset requiring exactly the write-access rights apply_linux_confinement would later request and checks whether Ruleset::create() succeeds — it deliberately never calls restrict_self() (that confines the CALLING process/thread permanently and every future child of it — calling it here would confine supercode ITSELF, exactly the “confinement targets the child, not supercode” invariant this module must never violate). Cached for the process lifetime (the kernel’s Landlock support can’t change at runtime).