--- name: "landlock_restrict_self" section: "2" platform: "linux" package: "man-pages" version: "6.19-1" release: "Arch Linux 2026-11-01" platforms: ["linux"] url: "https://new.carta.tech/landlock_restrict_self" --- # landlock\_restrict\_self(2) enforce a Landlock ruleset ## NAME landlock\_restrict\_self - enforce a Landlock ruleset ## LIBRARY Standard C library (*libc*, *-lc*) ## SYNOPSIS ``` #include /* Definition of LANDLOCK_* constants */ #include /* Definition of SYS_* constants */ ``` **int syscall(SYS\_landlock\_restrict\_self, int** *ruleset\_fd***,** **uint32\_t** *flags***);** ## DESCRIPTION Once a Landlock ruleset is populated with the desired rules, the **landlock\_restrict\_self**() system call enforces this ruleset on the calling thread. See [**landlock**(7)](/landlock/7.md) for a global overview. A thread can be restricted with multiple rulesets that are then composed together to form the thread's Landlock domain. This can be seen as a stack of rulesets but it is implemented in a more efficient way. A domain can only be updated in such a way that the constraints of each past and future composed rulesets will restrict the thread and its future children for their entire life. It is then possible to gradually enforce tailored access control policies with multiple independent rulesets coming from different sources (e.g., init system configuration, user session policy, built-in application policy). However, most applications should only need one call to **landlock\_restrict\_self**() and they should avoid arbitrary numbers of such calls because of the composed rulesets limit. Instead, developers are encouraged to build a single tailored ruleset with multiple calls to [**landlock\_add\_rule**(2)](/landlock_add_rule/2.md). In order to enforce a ruleset, either the caller must have the **CAP\_SYS\_ADMIN** capability in its user namespace, or the thread must already have the *no\_new\_privs* bit set. As for [**seccomp**(2)](/seccomp/2.md), this avoids scenarios where unprivileged processes can affect the behavior of privileged children (e.g., because of set-user-ID binaries). If that bit was not already set by an ancestor of this thread, the thread must make the following call: - ``` prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); ``` *ruleset\_fd* is a Landlock ruleset file descriptor obtained with [**landlock\_create\_ruleset**(2)](/landlock_create_ruleset/2.md) and fully populated with a set of calls to [**landlock\_add\_rule**(2)](/landlock_add_rule/2.md). By default, denied accesses originating from programs that sandbox themselves are logged via the audit subsystem. Such events typically indicate unexpected behavior, such as bugs or exploitation attempts. However, to avoid excessive logging, access requests denied by a domain not created by the originating program are not logged by default. The rationale is that programs should know their own behavior, but not necessarily the behavior of other programs. This default configuration is suitable for most programs that sandbox themselves. For specific use cases, the following flags allow programs to modify this default logging behavior. The **LANDLOCK\_RESTRICT\_SELF\_LOG\_SAME\_EXEC\_OFF** and **LANDLOCK\_RESTRICT\_SELF\_LOG\_NEW\_EXEC\_ON** flags apply to the newly created Landlock domain. - **LANDLOCK\_RESTRICT\_SELF\_LOG\_SAME\_EXEC\_OFF** (since Landlock ABI version 7) Disables logging of denied accesses originating from the thread creating the Landlock domain, as well as its children, as long as they continue running the same executable code (i.e., without an intervening [**execve**(2)](/execve/2.md) call). This is intended for programs that execute unknown code without invoking [**execve**(2)](/execve/2.md), such as script interpreters. Programs that only sandbox themselves should not set this flag, so users can be notified of unauthorized access attempts via system logs. - **LANDLOCK\_RESTRICT\_SELF\_LOG\_NEW\_EXEC\_ON** (since Landlock ABI version 7) Enables logging of denied accesses after an [**execve**(2)](/execve/2.md) call, providing visibility into unauthorized access attempts by newly executed programs within the created Landlock domain. This flag is recommended only when all potential executables in the domain are expected to comply with the access restrictions, as excessive audit log entries could make it more difficult to identify critical events. - **LANDLOCK\_RESTRICT\_SELF\_LOG\_SUBDOMAINS\_OFF** (since Landlock ABI version 7) Disables logging of denied accesses originating from nested Landlock domains created by the caller or its descendants. This flag should be set according to runtime configuration, not hardcoded, to avoid suppressing important security events. It is useful for container runtimes or sandboxing tools that may launch programs which themselves create Landlock domains and could otherwise generate excessive logs. Unlike **LANDLOCK\_RESTRICT\_SELF\_LOG\_SAME\_EXEC\_OFF**, this flag only affects future nested domains, not the one being created. It can also be used with a *ruleset\_fd* value of -1 to mute subdomain logs without creating a domain. The following flag supports policy enforcement in multithreaded processes: - **LANDLOCK\_RESTRICT\_SELF\_TSYNC** (since Landlock ABI version 8) Applies the new Landlock configuration atomically to all threads of the current process, including the Landlock domain and logging configuration. This overrides the Landlock configuration of sibling threads, irrespective of previously established Landlock domains and logging configurations on those threads. - If the calling thread is running with *no\_new\_privs*, this operation enables *no\_new\_privs* on the sibling threads as well. ## RETURN VALUE On success, **landlock\_restrict\_self**() returns 0. On error, -1 is returned and *errno* is set to indicate the error. ## ERRORS **landlock\_restrict\_self**() can fail for the following reasons: - **E2BIG** The maximum number of composed rulesets is reached for the calling thread. This limit is currently 64. - **EBADF** *ruleset\_fd* is not a file descriptor for the current thread. - **EBADFD** *ruleset\_fd* is not a ruleset file descriptor. - **EINVAL** Invalid value in *flags*. - **EOPNOTSUPP** Landlock is supported by the kernel but disabled at boot time. - **EPERM** *ruleset\_fd* has no read access to the underlying ruleset, or the calling thread is not running with *no\_new\_privs*, or it doesn't have the **CAP\_SYS\_ADMIN** in its user namespace. ## STANDARDS Linux. ## HISTORY Linux 5.13. ## EXAMPLES See [**landlock**(7)](/landlock/7.md). ## SEE ALSO [**landlock\_create\_ruleset**(2)](/landlock_create_ruleset/2.md), [**landlock\_add\_rule**(2)](/landlock_add_rule/2.md), [**landlock**(7)](/landlock/7.md)