landlock_restrict_self(2) System Calls Manual landlock_restrict_self(2) landlock_restrict_self - Landlock (libc -lc) #include /* LANDLOCK_* */ #include /* SYS_* */ int syscall(SYS_landlock_restrict_self, int ruleset_fd, uint32_t flags); Landlock landlock_restrict_self() . landlock(7) . Landlock . . . ( ). landlock_restrict_self() . landlock_add_rule(2). CAP_SYS_ADMIN no_new_privs . seccomp(2) ( set-user-ID). : prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); ruleset_fd Landlock landlock_create_ruleset(2) landlock_add_rule(2). . . . . . . LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON Landlock . LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF Landlock ( execve(2) ). execve(2) . . LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON execve(2) Landlock . . LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF Landlock . . Landlock . LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF . ruleset_fd -1 . : LANDLOCK_RESTRICT_SELF_TSYNC ( ABI Landlock 8) Landlock Landlock . Landlock Landlock . no_new_privs no_new_privs . landlock_restrict_self() 0. -1 errno . landlock_restrict_self() : E2BIG . 64 . EBADF ruleset_fd . EBADFD ruleset_fd . EINVAL flags. EOPNOTSUPP Landlock . EPERM ruleset_fd no_new_privs CAP_SYS_ADMIN . . 5.13. landlock(7). landlock_create_ruleset(2), landlock_add_rule(2), landlock(7) 3 . . : . 6.18 21 2026 landlock_restrict_self(2)