landlock_add_rule
Partial in Antinomie 0.7.0 · Syscall list
Synopsis
Section titled “Synopsis”long landlock_add_rule(int ruleset_fd, enum landlock_rule_type rule_type, const void *rule_attr, __u32 flags);| Number (x86-64) | 445 |
| ABI | common |
| Kernel entry point | sys_landlock_add_rule |
This is the raw kernel prototype from the pinned Linux 6.12.94 schema, not the libc wrapper.
Description
Section titled “Description”Adds a rule, such as access to a directory or a port, to a Landlock ruleset.
Arguments
Section titled “Arguments”| Name | Type | Meaning |
|---|---|---|
ruleset_fd (arg0) |
int |
File descriptor of a Landlock ruleset. |
rule_type (arg1) |
enum landlock_rule_type |
Type of rule to add. |
rule_attr (arg2) |
const void * |
Pointer to the rule structure. |
flags (arg3) |
__u32 |
Option flags that change the behavior of the call. |
Return value
Section titled “Return value”On success: 0.
In an Antinomie trace the Return column and the ret filter field show the raw kernel return value. On failure that is the negative errno, for example -2 for ENOENT, not the -1 plus errno that the libc wrapper gives. syscall.errno holds the positive errno and syscall.success is false.
Common errors
Section titled “Common errors”| Raw return | Name | Meaning |
|---|---|---|
-22 |
EINVAL |
An argument is invalid. |
-42 |
ENOMSG |
No message of the requested type. |
Man page
Section titled “Man page”landlock_add_rule(2) on man7.org
Captured by Antinomie
Section titled “Captured by Antinomie”Coverage mark: Partial. Rule types LANDLOCK_RULE_PATH_BENEATH and LANDLOCK_RULE_NET_PORT are decoded. An unknown type records a landlock.unknown_rule “no decoder” gap.
Every call is recorded as an Entry record (the six argument words and the pointees copied at entry) and an Exit record (the return value and the pointees copied at exit).
Arguments
Section titled “Arguments”| Argument | When | How | Recorded field key | Condition |
|---|---|---|---|---|
ruleset_fd (arg0) |
Entry | raw scalar word | args.0, args.ruleset_fd |
|
rule_type (arg1) |
Entry | raw scalar word | args.1, args.rule_type |
|
rule_attr (arg2) |
Entry | the pointer itself, as a raw word | args.2, args.raw[2] |
|
| ↳ pointee | Entry | structure landlock_path_beneath_attr or landlock_net_port_attr by rule_type (arg1) |
arg2.rule |
the rule type is known |
flags (arg3) |
Entry | raw scalar word; Syscall Trace also decodes it into flag names (unknown group), listing unknown bits separately |
args.3, args.flags |
Filter fields
Section titled “Filter fields”- Result:
ret,syscall.errno,syscall.success,syscall.duration_ns. - Argument words:
args.ruleset_fd(arg0),args.rule_type(arg1),args.rule_attr(arg2),args.flags(arg3);args.0toargs.5by position. - Structure
landlock_path_beneath_attrbehindrule_attr(arg2):args.rule_attr.<member>forallowed_access,parent_fd.
See Syscall Trace filter for the full syntax.
Known gaps
Section titled “Known gaps”- An unknown rule type records
landlock.unknown_rulewith the “no decoder” status. - See the coverage mark above for the code paths that record a gap.
For what the capture statuses mean, see Capture statuses. For what is never recorded, see Known gaps.