Function new_best_effort 

pub fn new_best_effort() -> Ruleset

Creates a policy that drops the rights the running kernel cannot enforce.

If a rule ends up granting nothing (for example Access::ResolveUnix on a kernel older than Landlock ABI 9), the rule is skipped, which leaves the affected path denied. See new_strict for the alternative.