landlock_restrict_self

Implemented in Antinomie 0.7.0 · Syscall list

Synopsis

long landlock_restrict_self(int ruleset_fd, __u32 flags);

Number (x86-64)	446
ABI	common
Kernel entry point	sys_landlock_restrict_self

This is the raw kernel prototype from the pinned Linux 6.12.94 schema, not the libc wrapper.

Description

Enforces a Landlock ruleset on the calling thread and its future children.

Arguments

Name	Type	Meaning
ruleset_fd (arg0)	int	File descriptor of a Landlock ruleset.
flags (arg1)	__u32	Option flags that change the behavior of the call.

Return value

On success: 0.

In an Antinomie trace the Return column and the ret filter field show the raw kernel return value. On failure that is the negative errno, for example -2 for ENOENT, not the -1 plus errno that the libc wrapper gives. syscall.errno holds the positive errno and syscall.success is false.

Common errors

Raw return	Name	Meaning
-22	EINVAL	An argument is invalid.
-1	EPERM	The operation is not permitted for this process.

Man page

landlock_restrict_self(2) on man7.org

Captured by Antinomie

Coverage mark: Implemented. All arguments are plain values, recorded as the raw argument words at entry. There is no pointee to copy and no known gap.

Every call is recorded as an Entry record (the six argument words and the pointees copied at entry) and an Exit record (the return value and the pointees copied at exit).

Arguments

Argument	When	How	Recorded field key	Condition
ruleset_fd (arg0)	Entry	raw scalar word	args.0, args.ruleset_fd
flags (arg1)	Entry	raw scalar word; Syscall Trace also decodes it into flag names (unknown group), listing unknown bits separately	args.1, args.flags

Filter fields

• Result: ret, syscall.errno, syscall.success, syscall.duration_ns.
• Argument words: args.ruleset_fd (arg0), args.flags (arg1); args.0 to args.5 by position.

See Syscall Trace filter for the full syntax.

For what the capture statuses mean, see Capture statuses. For what is never recorded, see Known gaps.