landlock

New API

• Added support for Landlock ABI 8: atomically apply the sandbox to all threads of the calling process with all_threads() (shared between RulesetCreated and RestrictSelf) (PR #130).

New API

• Added support for Landlock ABI 7: control audit logging behavior with log_same_exec(), log_new_exec() (domain-specific), and log_subdomains() (shared between RulesetCreated and RestrictSelf) (PR #120).
• Added RestrictSelf builder for calling landlock_restrict_self() without creating a Landlock domain (e.g., muting subdomain audit logs).
• Extended RestrictionStatus with three new public fields (log_same_exec, log_new_exec, log_subdomains) reporting the effective audit-logging flag state after restrict_self() and apply().
• Added Erratum bitflags enum and Erratum::current() for querying fixed kernel bugs before building a ruleset (PR #119).

Deprecated API

Deprecate the set_no_new_privs() method and replace it with no_new_privs() (PR #122).

Dependencies

• Bumped MSRV to Rust 1.71.

Testing

• Extended CI to test against Linux 6.15.
• Added errata tests verifying the From<ABI> mapping matches CI kernel errata.
• Added SoftRequirement test coverage for scope() and restrict_self flags.
• Added try_compat_binary() unit tests for the binary compat dispatch.

Example

• Synced the sandboxer example with the kernel's sandboxer.c: added LL_FORCE_LOG environment variable for audit logging (PR #120).

New API

• Added support for all architectures (PR #111).
• Added LandlockStatus type to query the running kernel and display information about available Landlock features (PR #103 and PR #113).

Dependencies

• Bumped MSRV to Rust 1.68 (PR #112).

Testing

• Extended CI to build and test on i686 architecture (PR #111).

Example

• Enhanced sandboxer example to print helpful hints about Landlock status (PR #103).

New API

• Implemented common traits (e.g., Debug) for public types (PR #108).

Documentation

• Extended CONTRIBUTING.md documentation with additional testing and development guidelines (PR #95).
• Added more background information to path_beneath_rules() documentation (PR #94).

Testing

• Added test case for AccessFs::from_file() method (PR #92).

New API

• Added support for Landlock ABI 6: control abstract UNIX sockets and signal scoping with the new Ruleset::scope() method taking a Scope enum (PR #96 and PR #98).
• Added From<RulesetCreated> implementation for Option<OwnedFd> (PR #104)
• Introduced a new HandledAccess trait specific to AccessFs and AccessNet (commit 554217dda0b7).
• Added a new Errno type to improve FFI support (PR #86 and PR #102).
• Exposed From<i32> implementation for ABI (PR #88).

Documentation

• Added clarifying notes about AccessFs::WriteFile behavior and path_beneath_rules usage (PR #80).
• Introduced CONTRIBUTING.md with testing workflow explanations (PR #76).

Testing

• Enhanced test coverage for new API and added testing against Linux 6.12 (PR #96).
• Updated CI configuration to use the latest Ubuntu versions (PR #87 and PR #97).
• Modified default LANDLOCK_CRATE_TEST_ABI to match the current kernel for more convenient local testing (PR #76).

Example

• Synchronized the sandboxer example with the C version (PR #101): improved error handling for inaccessible file paths and enhanced help documentation.

New API

Add support for Landlock ABI 5: control IOCTL commands on character and block devices with the new AccessFs::IoctlDev right (PR #74).

Testing

Improved the CI to better test against different kernel versions (PR #72).

New API

Add support for Landlock ABI 4: control TCP binding and connection according to specified network ports. This is now possible with the AccessNet rights and the NetPort rule (PR #55).

Breaking change

The from_read() and from_write() methods moved from the Access trait to the AccessFs struct (commit 68f066eba571).

Compatibility management

Improve compatibility consistency and prioritize runtime errors against compatibility errors (PR #67).

Fixed a corner case where a ruleset was created on a kernel not supporting Landlock, while requesting to add a rule with an access right handled by the ruleset (BestEffort). When trying to enforce this ruleset, this led to a runtime error (i.e. wrong file descriptor) instead of a compatibility error.

To simplify compatibility management, always call prctl(PR_SET_NO_NEW_PRIVS, 1) by default (see set_no_new_privs()). This was required to get a consistent compatibility management and it should not be an issue given that this feature is supported by all LTS kernels (commit d99f75155bec).

New API

Add RulesetCreated::try_clone() (PR #38).

New API

Add support for Landlock ABI 3: control truncate operations with the new AccessFs::Truncate right (PR #40).

Revamp the compatibility handling and add a new set_compatibility() method for Ruleset, RulesetCreated, and PathBeneath. We can now fine-tune the compatibility behavior according to the running kernel and then the supported features thanks to three compatible levels: best effort, soft requirement and hard requirement (PR #12).

Add a new AccessFs::from_file() helper (commit 0b3238c6dd70).

Deprecated API

Deprecate the set_best_effort() method and replace it with set_compatibility() (PR #12).

Deprecate Ruleset::new() and replace it with Ruleset::default() (PR #44).

Breaking changes

We now check that a ruleset really handles at least one access right, which can now cause Ruleset::create() to return an error if the ruleset compatibility level is HardRequirement or set_best_effort(false) (commit 95addc13b4a8).

We now check that access rights passed to add_rule() make sense according to the file type. To handle most use cases, path_beneath_rules() now automatically check and downgrade access rights for files (i.e. remove superfluous directory-only access rights, commit 8e47940b3722).

Testing

Test coverage in the CI is greatly improved by running all tests on all relevant kernel versions: Linux 5.10, 5.15, 6.1, and 6.4 (PR #41).

Run each test in a dedicated thread to avoid inconsistent behavior (PR #46).