Enum Error 

#[non_exhaustive]
pub enum Error {
    NotSupported {
        source: Error,
    },
    Unsupported {
        feature: Feature,
        kernel_abi: u32,
        required_abi: u32,
    },
    InvalidPath {
        path: PathBuf,
        reason: PathError,
    },
    Open {
        path: PathBuf,
        source: Error,
    },
    InapplicableAccess {
        access: Access,
        path: Option<PathBuf>,
    },
    InvalidFileDescriptor {
        source: Error,
    },
    LayerLimitReached,
    Syscall {
        operation: Operation,
        source: Error,
    },
}

Everything that can prevent a policy from being enforced.

Ruleset::restrict_self returns the first error encountered while the policy was built. When it returns an error, no restriction has been applied (with one caveat: a failure while enforcing the second or third ruleset layer can leave the process partially restricted, see Error::Syscall).

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

NotSupported

Landlock is not available: the kernel does not implement it (ENOSYS), it is disabled at boot time (EOPNOTSUPP, lsm= kernel command line), or the system calls are blocked (for example by a seccomp filter).

Fields

source: Error

The error reported by the kernel.

Unsupported

In strict mode, the running kernel cannot enforce a requested feature.

Fields

feature: Feature

The feature that cannot be enforced.

kernel_abi: u32

The ABI version supported by the running kernel.

required_abi: u32

The oldest ABI version that supports feature.

InvalidPath

The path is not usable for a rule.

Fields

path: PathBuf

The offending path.

reason: PathError

What is wrong with it.

Open

The path could not be opened.

Fields

path: PathBuf

The offending path.

source: Error

The error reported by the kernel (ENOENT, EACCES, ELOOP, …).

InapplicableAccess

The requested access has no meaning for the object (for example Access::ReadDir on a regular file).

Fields

access: Access

The requested access.

path: Option<PathBuf>

The path, when the rule was created from a path.

InvalidFileDescriptor

The file descriptor does not identify a file hierarchy that Landlock can restrict: it refers to a pipe, a socket, an anonymous inode, a ruleset, or an internal filesystem such as /proc/<pid>/ns/*.

Fields

source: Error

The error reported by the kernel.

LayerLimitReached

The kernel’s limit of 16 stacked rulesets is reached for this thread.

A single Ruleset applies at most three layers (filesystem, network and scope). This error means the thread already inherited or applied many rulesets; build a single policy per thread where possible.

Syscall

An unexpected error from a Landlock system call.

Fields

operation: Operation

The operation that failed.

source: Error

The error reported by the kernel.

Trait Implementations

impl Debug for Error

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for Error

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Error for Error

fn source(&self) -> Option<&(dyn StdError + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.