Trait RestrictSelfAttr

Source

pub trait RestrictSelfAttr: Sized + RestrictSelfFlagsState {
    // Provided methods
    fn log_subdomains(self, set: bool) -> Result<Self, RulesetError> { ... }
    fn all_threads(self, set: bool) -> Result<Self, RulesetError> { ... }
}

Expand description

Trait for types that accept restrict_self flag configuration.

Provides log_subdomains() and all_threads() which work both with and without a Landlock domain.

Implemented by RulesetCreated (via RulesetCreatedAttr supertrait) and RestrictSelf.

Domain-specific setters (log_same_exec, log_new_exec) are on RulesetCreatedAttr.

Provided Methods§

Source

fn log_subdomains(self, set: bool) -> Result<Self, RulesetError>

Controls logging of denied accesses from nested Landlock domains. Logging is enabled by default. See the kernel documentation.

Calling with false sets the LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF flag. Setters are last-call-wins: calling again with a different boolean re-configures the flag (e.g., log_subdomains(false).log_subdomains(true) leaves logging enabled).

Setting to the default value never triggers a compatibility check, so it cannot error even under CompatLevel::HardRequirement on an unsupported kernel.

Available since Landlock ABI v7.

On error, returns a wrapped SyscallFlagError<RestrictSelfFlag>.

Source

fn all_threads(self, set: bool) -> Result<Self, RulesetError>

Applies the Landlock configuration to all threads of the calling process, rather than only the calling thread. Disabled by default.

Calling with true sets the LANDLOCK_RESTRICT_SELF_TSYNC flag, which atomically enforces the domain and logging configuration on every thread of the process. If the calling thread runs with no_new_privs, the kernel also enables it on the sibling threads. Calling with false is a no-op (the default behavior).

When enforcing with a Landlock domain (via RulesetCreated), this works on its own. On the domain-less RestrictSelf builder the kernel only accepts this flag together with log_subdomains(false); calling apply() with all_threads(true) alone returns a wrapped RestrictSelfError. The crate does not pre-check this so as not to restrict what the kernel allows.

Setting to the default value never triggers a compatibility check, so it cannot error even under CompatLevel::HardRequirement on an unsupported kernel.

Available since Landlock ABI v8.

§Warning

On a kernel older than ABI v8, this flag is not supported. With the default CompatLevel::BestEffort it is silently dropped. When enforcing a domain (via RulesetCreated) this leaves only the calling thread and its future children restricted, not the sibling and parent threads, a weaker guarantee than requested for a multithreaded process. On the domain-less RestrictSelf builder the remaining configuration (e.g. log_subdomains()) then applies only to the calling thread, and if this flag was the only request the enforcement syscall is skipped entirely. Applications that require process-wide enforcement should use CompatLevel::HardRequirement (which errors on an unsupported kernel) or inspect the all_threads field of the returned status.

On error, returns a wrapped SyscallFlagError<RestrictSelfFlag>.