Struct Ruleset 

pub struct Ruleset { /* private fields */ }

A Landlock policy under construction.

Rules are added with the allow_* methods and the policy is applied with Ruleset::restrict_self, which consumes the builder. Building never fails: errors (invalid paths, unsupported rights, …) are remembered and reported by restrict_self, and nothing is enforced when it returns them.

The builder is Send and Sync, and every method takes self by value, so a policy is never shared or mutated by two threads at once.

Implementations

impl Ruleset

pub fn allow_filesystem( self, access: Access, paths: impl IntoIterator<Item = impl AsRef<Path>>, ) -> Self

Grants access on each path of paths.

The same access rights are granted on every path. Paths are opened with O_PATH, which requires no permission on the target, and rules are attached to the objects the paths resolve to (symlinks are followed).

Rights that do not apply to the object are dropped (for example Access::RemoveFile on a regular file). Requesting access that grants nothing on the object (for example Access::ReadDir on a regular file) is an invalid rule and is reported by Ruleset::restrict_self.

Failure modes are deferred to Ruleset::restrict_self; this method never returns an error.

pub fn allow_file_descriptor( self, access: Access, fds: impl IntoIterator<Item = impl AsFd>, ) -> Self

Grants access on each of fds, which must identify file hierarchies.

This is the equivalent of Ruleset::allow_filesystem for callers that want to control how the path is resolved (for example with openat2 and RESOLVE_NO_SYMLINKS). The descriptors may be closed once Ruleset::restrict_self returned: the kernel keeps a reference to the underlying objects.

Failure modes are deferred to Ruleset::restrict_self; this method never returns an error.

pub fn allow_network( self, access: NetworkAccess, ports: impl IntoIterator<Item = u16>, ) -> Self

Grants access on each of ports.

Port 0 covers the ephemeral port range for binding. Landlock has no wildcard port, so every port has to be listed. Only TCP and UDP are restricted.

Failure modes are deferred to Ruleset::restrict_self; this method never returns an error.

pub fn allow_scope(self, scope: Scope) -> Self

Lifts the IPC restriction described by scope.

Scopes are active by default. Unlike filesystem and network access, Landlock cannot grant exceptions to a scope: it can only be lifted as a whole.

Failure modes are deferred to Ruleset::restrict_self; this method never returns an error.

pub fn restrict_self(self) -> Result<u32, Error>

Applies the policy to the calling thread (and, on Landlock ABI 8 and newer, to every thread of the process).

This consumes the ruleset, which is final: restrictions can never be relaxed afterwards, only added to. On success, the returned ABI version is the version reported by the running kernel, and the restrictions stay in place when the builder is dropped.

PR_SET_NO_NEW_PRIVS is set on the calling thread first (on Landlock ABI 11 and newer the kernel does it as part of the enforcement). It is never unset, and it prevents the process from gaining privileges through set-user-ID programs.

Errors

Returns the first error encountered while building the policy (see Error) without applying it, or an error reported by the kernel.

Trait Implementations

impl Debug for Ruleset

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.