# landlock_add_rule

## NAME



           landlock_add_rule - add a new Landlock rule to a ruleset
    


## LIBRARY



           Standard C library (_libc_ , _-lc_)
    


## SYNOPSIS



           **#include <linux/landlock.h>  **/* Definition of **LANDLOCK_*** constants */
           **#include <sys/syscall.h>     **/* Definition of **SYS_*** constants */
    
           **int syscall(SYS_landlock_add_rule, int** _ruleset_fd_**,**
                       **enum landlock_rule_type** _rule_type_**,**
                       **const void ***_rule_attr_**, uint32_t** _flags_**);**
    


## DESCRIPTION



           A Landlock rule describes an action on an object which the process
           intends to perform.  A set of rules is aggregated in a ruleset,
           which can then restrict the thread enforcing it, and its future
           children.
    
           The **landlock_add_rule**() system call adds a new Landlock rule to an
           existing ruleset.  See landlock(7) for a global overview.
    
           _ruleset_fd_ is a Landlock ruleset file descriptor obtained with
           landlock_create_ruleset(2).
    
           _rule_type_ identifies the structure type pointed to by _rule_attr_.
           Currently, Linux supports the following _rule_type_ values:
    
           **LANDLOCK_RULE_PATH_BENEATH**
                  For these rules, the object is a file hierarchy, and the
                  related filesystem actions are defined with _filesystem_
                  _access rights_.
    
                  In this case, _rule_attr_ points to the following structure:
    
                      struct landlock_path_beneath_attr {
                          __u64 allowed_access;
                          __s32 parent_fd;
                      } __attribute__((packed));
    
                  _allowed_access_ contains a bitmask of allowed filesystem
                  actions, which can be applied on the given _parent_fd_ (see
                  **Filesystem actions** in landlock(7)).
    
                  _parent_fd_ is an opened file descriptor, preferably with the
                  _O_PATH_ flag, which identifies the parent directory of the
                  file hierarchy or just a file.
    
           **LANDLOCK_RULE_NET_PORT**
                  For these rules, the object is a TCP port, and the related
                  actions are defined with _network access rights_.
    
                  In this case, _rule_attr_ points to the following structure:
    
                      struct landlock_net_port_attr {
                          __u64 allowed_access;
                          __u64 port;
                      };
    
                  _allowed_access_ contains a bitmask of allowed network
                  actions, which can be applied on the given port.
    
                  _port_ is the network port in host endianness.
    
                  It should be noted that port 0 passed to bind(2) will bind
                  to an available port from the ephemeral port range.  This
                  can be configured in the
                  _/proc/sys/net/ipv4/ip_local_port_range_ sysctl (also used
                  for IPv6).
    
                  A Landlock rule with port 0 and the
                  **LANDLOCK_ACCESS_NET_BIND_TCP** right means that requesting to
                  bind on port 0 is allowed and it will automatically
                  translate to binding on the related port range.
    
           _flags_ must be 0.
    


## RETURN VALUE



           On success, **landlock_add_rule**() returns 0.  On error, -1 is
           returned and _errno_ is set to indicate the error.
    


## ERRORS



           **landlock_add_rule**() can fail for the following reasons:
    
           **EAFNOSUPPORT**
                  _rule_type_ is **LANDLOCK_RULE_NET_PORT** , but TCP is not
                  supported by the running kernel.
    
           **EOPNOTSUPP**
                  Landlock is supported by the kernel but disabled at boot
                  time.
    
           **EINVAL** _flags_ is not 0.
    
           **EINVAL** The rule accesses are inconsistent (i.e.,
                  _rule_attr- >allowed_access_ is not a subset of the ruleset
                  handled accesses).
    
           **EINVAL** In _struct landlock_path_beneath_attr_ , the rule accesses are
                  not applicable to the file (i.e., some access rights in
                  _rule_attr- >allowed_access_ are only applicable to
                  directories, but _rule_attr- >parent_fd_ does not refer to a
                  directory).
    
           **EINVAL** In _struct landlock_net_port_attr_ , the port number is
                  greater than 65535.
    
           **ENOMSG** Empty accesses (i.e., _rule_attr- >allowed_access_ is 0).
    
           **EBADF** _ruleset_fd_ is not a file descriptor for the current thread,
                  or a member of _rule_attr_ is not a file descriptor as
                  expected.
    
           **EBADFD** _ruleset_fd_ is not a ruleset file descriptor, or a member of
                  _rule_attr_ is not the expected file descriptor type.
    
           **EPERM** _ruleset_fd_ has no write access to the underlying ruleset.
    
           **EFAULT** _rule_attr_ was not a valid address.
    


## STANDARDS



           Linux.
    


## EXAMPLES



           See landlock(7).
    


* * *