---
name: "landlock_add_rule"
section: "2"
platform: "linux"
package: "man-pages"
version: "6.19-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/landlock_add_rule"
---

# landlock\_add\_rule(2)

add a new Landlock rule to a ruleset

## NAME

landlock\_add\_rule - add a new Landlock rule to a ruleset

## LIBRARY

Standard C library (*libc*, *-lc*)

## SYNOPSIS

```
#include <linux/landlock.h>  /* Definition of LANDLOCK_* constants */
#include <sys/syscall.h>     /* Definition of SYS_* constants */
```

**int syscall(SYS\_landlock\_add\_rule, int** *ruleset\_fd***,**             **enum landlock\_rule\_type** *rule\_type***,**             **const void \****rule\_attr***, uint32\_t** *flags***);**

## DESCRIPTION

A Landlock rule describes an action on an object which the process intends to perform. A set of rules is aggregated in a ruleset, which can then restrict the thread enforcing it, and its future children.

The **landlock\_add\_rule**() system call adds a new Landlock rule to an existing ruleset. See [**landlock**(7)](/landlock/7.md) for a global overview.

*ruleset\_fd* is a Landlock ruleset file descriptor obtained with [**landlock\_create\_ruleset**(2)](/landlock_create_ruleset/2.md).

*rule\_type* identifies the structure type pointed to by *rule\_attr*. Currently, Linux supports the following *rule\_type* values:

- **LANDLOCK\_RULE\_PATH\_BENEATH**

  For these rules, the object is a file hierarchy, and the related filesystem actions are defined with *filesystem access rights*.

-

  In this case, *rule\_attr* points to the following structure:

-

  ```
  struct landlock_path_beneath_attr {
      __u64 allowed_access;
      __s32 parent_fd;
  } __attribute__((packed));
  ```

-

  *allowed\_access* contains a bitmask of allowed filesystem actions, which can be applied on the given *parent\_fd* (see **Filesystem actions** in [**landlock**(7)](/landlock/7.md)).

-

  *parent\_fd* is an opened file descriptor, preferably with the *O\_PATH* flag, which identifies the parent directory of the file hierarchy or just a file.

- **LANDLOCK\_RULE\_NET\_PORT** (since Landlock ABI version 4)

  For these rules, the object is a TCP port, and the related actions are defined with *network access rights*.

-

  In this case, *rule\_attr* points to the following structure:

-

  ```
  struct landlock_net_port_attr {
      __u64 allowed_access;
      __u64 port;
  };
  ```

-

  *allowed\_access* contains a bitmask of allowed network actions, which can be applied on the given port.

-

  *port* is the network port in host endianness.

-

  It should be noted that port 0 passed to [**bind**(2)](/bind/2.md) will bind to an available port from the ephemeral port range. This can be configured in the */proc/sys/net/ipv4/ip\_local\_port\_range* sysctl (also used for IPv6).

-

  A Landlock rule with port 0 and the **LANDLOCK\_ACCESS\_NET\_BIND\_TCP** right means that requesting to bind on port 0 is allowed and it will automatically translate to binding on the related port range.

*flags* must be 0.

## RETURN VALUE

On success, **landlock\_add\_rule**() returns 0. On error, -1 is returned and *errno* is set to indicate the error.

## ERRORS

**landlock\_add\_rule**() can fail for the following reasons:

- **EAFNOSUPPORT**

  *rule\_type* is **LANDLOCK\_RULE\_NET\_PORT**, but TCP is not supported by the running kernel.

- **EBADF**

  *ruleset\_fd* is not a file descriptor for the current thread, or a member of *rule\_attr* is not a file descriptor as expected.

- **EBADFD**

  *ruleset\_fd* is not a ruleset file descriptor, or a member of *rule\_attr* is not the expected file descriptor type.

- **EFAULT**

  *rule\_attr* was not a valid address.

- **EINVAL**

  *flags* is not 0.

- **EINVAL**

  The rule accesses are inconsistent (i.e., *rule\_attr-\>allowed\_access* is not a subset of the ruleset handled accesses).

- **EINVAL**

  In *struct landlock\_path\_beneath\_attr*, the rule accesses are not applicable to the file (i.e., some access rights in *rule\_attr-\>allowed\_access* are only applicable to directories, but *rule\_attr-\>parent\_fd* does not refer to a directory).

- **EINVAL**

  In *struct landlock\_net\_port\_attr*, the port number is greater than 65535.

- **ENOMSG**

  Empty accesses (i.e., *rule\_attr-\>allowed\_access* is 0).

- **EOPNOTSUPP**

  Landlock is supported by the kernel but disabled at boot time.

- **EPERM**

  *ruleset\_fd* has no write access to the underlying ruleset.

## STANDARDS

Linux.

## HISTORY

Linux 5.13.

## EXAMPLES

See [**landlock**(7)](/landlock/7.md).

## SEE ALSO

[**landlock\_create\_ruleset**(2)](/landlock_create_ruleset/2.md), [**landlock\_restrict\_self**(2)](/landlock_restrict_self/2.md), [**landlock**(7)](/landlock/7.md)