landlock_create_ruleset

Implemented in Antinomie 0.7.0 · Syscall list

Synopsis

long landlock_create_ruleset(const struct landlock_ruleset_attr *attr, size_t size, __u32 flags);

Number (x86-64)	444
ABI	common
Kernel entry point	sys_landlock_create_ruleset

This is the raw kernel prototype from the pinned Linux 6.12.94 schema, not the libc wrapper.

Description

Creates a Landlock ruleset describing which kinds of access it will restrict.

Arguments

Name	Type	Meaning
attr (arg0)	const struct landlock_ruleset_attr *	Pointer to an attribute structure.
size (arg1)	size_t	Size in bytes.
flags (arg2)	__u32	Option flags that change the behavior of the call.

Return value

On success: A new file descriptor (a non-negative number).

In an Antinomie trace the Return column and the ret filter field show the raw kernel return value. On failure that is the negative errno, for example -2 for ENOENT, not the -1 plus errno that the libc wrapper gives. syscall.errno holds the positive errno and syscall.success is false.

Common errors

Raw return	Name	Meaning
-22	EINVAL	An argument is invalid.
-38	ENOSYS	The system call is not implemented.

Man page

landlock_create_ruleset(2) on man7.org

Captured by Antinomie

Coverage mark: Implemented. Every pointer argument has a capture rule in the pinned kernel patch and none of them records a “no decoder”, “address only” or “not observed” gap on any code path. Individual values can still be incomplete on a particular call; see the capture statuses.

Every call is recorded as an Entry record (the six argument words and the pointees copied at entry) and an Exit record (the return value and the pointees copied at exit).

Arguments

Argument	When	How	Recorded field key	Condition
attr (arg0)	Entry	the pointer itself, as a raw word	args.0, args.raw[0]
↳ pointee	Entry	structure landlock_ruleset_attr, size from size (arg1), versioned	arg0.ruleset	flags (arg2) is 0
size (arg1)	Entry	raw scalar word	args.1, args.size
flags (arg2)	Entry	raw scalar word; Syscall Trace also decodes it into flag names (landlock_create group), listing unknown bits separately	args.2, args.flags

Filter fields

• Result: ret, syscall.errno, syscall.success, syscall.duration_ns.
• Argument words: args.attr (arg0), args.size (arg1), args.flags (arg2); args.0 to args.5 by position.
• Structure landlock_ruleset_attr behind attr (arg0): args.attr.<member> for handled_access_fs, handled_access_net, scoped.

See Syscall Trace filter for the full syntax.

For what the capture statuses mean, see Capture statuses. For what is never recorded, see Known gaps.