landlock

See crate's metadata and related documentation.

What's Changed

See summary in CHANGELOG.md

• uapi: Update to Linux 7.1 by @l0kod in #136
• Add ABI v9: ResolveUnix by @l0kod in #135
• lib: Bump to v0.4.7 by @l0kod in #137

Full Changelog: v0.4.6...v0.4.7

New API

• Added support for Landlock ABI 9: control connections to pathname UNIX domain sockets with the new AccessFs::ResolveUnix right (PR #135).

See crate's metadata and related documentation.

What's Changed

See summary in CHANGELOG.md

• uapi: Update to Linux 7.0 by @l0kod in #129
• Parenthesize the shift in the unknown-access test by @l0kod in #133
• Add ABI v8: TSYNC by @l0kod in #130
• Fix flaky CI by @l0kod in #132
• Bump to v0.4.6 by @l0kod in #134

Full Changelog: v0.4.5...v0.4.6

New API

• Added support for Landlock ABI 8: atomically apply the sandbox to all threads of the calling process with all_threads() (shared between RulesetCreated and RestrictSelf) (PR #130).

See crate's metadata and related documentation.

What's Changed

See summary in CHANGELOG.md

• Bump dependencies and add SoftRequirement test for scope() by @l0kod in #118
• Update to Linux 6.15 and add errata interface by @l0kod in #119
• Rename set_no_new_privs() to no_new_privs() by @l0kod in #122
• Fix bare matches!() assertions in ruleset tests by @l0kod in #123
• Improve errata test debuggability by @l0kod in #124
• Bump GitHub actions by @l0kod in #125
• Update dependencies by @l0kod in #126
• Add ABI v7: log flags by @l0kod in #120
• Bump to v0.4.5 by @l0kod in #127

Full Changelog: v0.4.4...v0.4.5

New API

• Added support for Landlock ABI 7: control audit logging behavior with log_same_exec(), log_new_exec() (domain-specific), and log_subdomains() (shared between RulesetCreated and RestrictSelf) (PR #120).
• Added RestrictSelf builder for calling landlock_restrict_self() without creating a Landlock domain (e.g., muting subdomain audit logs).
• Extended RestrictionStatus with three new public fields (log_same_exec, log_new_exec, log_subdomains) reporting the effective audit-logging flag state after restrict_self() and apply().
• Added Erratum bitflags enum and Erratum::current() for querying fixed kernel bugs before building a ruleset (PR #119).

Deprecated API

Deprecate the set_no_new_privs() method and replace it with no_new_privs() (PR #122).

Dependencies

• Bumped MSRV to Rust 1.71.

Testing

• Extended CI to test against Linux 6.15.
• Added errata tests verifying the From<ABI> mapping matches CI kernel errata.
• Added SoftRequirement test coverage for scope() and restrict_self flags.
• Added try_compat_binary() unit tests for the binary compat dispatch.

Example

• Synced the sandboxer example with the kernel's sandboxer.c: added LL_FORCE_LOG environment variable for audit logging (PR #120).

See crate's metadata and related documentation.

What's Changed

See summary in CHANGELOG.md

• Bump MSRV to 1.68 by @l0kod in #112
• Generate 64-bit and 32-bit bindings by @l0kod in #111
• Print hints about Landlock ABI version by @l0kod in #103
• Improve LandlockStatus by @l0kod in #113
• Bump to v0.4.4 by @l0kod in #114

Full Changelog: v0.4.3...v0.4.4

New API

• Added support for all architectures (PR #111).
• Added LandlockStatus type to query the running kernel and display information about available Landlock features (PR #103 and PR #113).

Dependencies

• Bumped MSRV to Rust 1.68 (PR #112).

Testing

• Extended CI to build and test on i686 architecture (PR #111).

Example

• Enhanced sandboxer example to print helpful hints about Landlock status (PR #103).

See crate's metadata and related documentation.

What's Changed

See summary in CHANGELOG.md

• tests: add case for AccessFs::from_file by @n0toose in #92
• docs: add more background to PathBeneath example by @n0toose in #94
• docs: extend CONTRIBUTING.md file by @n0toose in #95
• Implement common traits for public types by @l0kod in #108
• Bump to v0.4.3 by @l0kod in #109

New Contributors

• @n0toose made their first contribution in #92

Full Changelog: v0.4.2...v0.4.3

New API

• Implemented common traits (e.g., Debug) for public types (PR #108).

Documentation

• Extended CONTRIBUTING.md documentation with additional testing and development guidelines (PR #95).
• Added more background information to path_beneath_rules() documentation (PR #94).

Testing

• Added test case for AccessFs::from_file() method (PR #92).

See crate's metadata and related documentation.

What's Changed

See summary in CHANGELOG.md

• Update to thiserror version 2. by @dburgener in #78
• docs: Add clarifying notes: AccessFs::WriteFile, path_beneath_rules by @mrcnski in #80
• Add CONTRIBUTING.md doc by @dburgener in #76
• Implement IntoRawFd for RulesetCreated by @l0kod in #85
• Bump Ubuntu by @l0kod in #87
• Add the Errno helper by @l0kod in #86
• Expose From for ABI by @l0kod in #88
• Use newer landlock-test-tools by @l0kod in #89
• Clean up get_errno_from_landlock_status() by @l0kod in #90
• Use GitHub Pages with Actions by @l0kod in #91
• Bump CI kernel for Ubuntu 24.04 by @l0kod in #97
• Prepare for ABI 6 by @l0kod in #96
• Add support for ABI 6 (scope) by @l0kod in #98
• Document HandledAccess by @l0kod in #99
• Make HandledAccess implementations explicit by @l0kod in #100
• Synchronize example by @l0kod in #101
• Implement Deref instead of AsRef for Errno by @l0kod in #102
• Use OwnedFd instead of RawFd by @l0kod in #104
• Bump to v0.4.2 by @l0kod in #105
• Update readme for v0.4.2 by @l0kod in #106

New Contributors

• @dburgener made their first contribution in #78
• @mrcnski made their first contribution in #80

Full Changelog: v0.4.1...v0.4.2

New API

• Added support for Landlock ABI 6: control abstract UNIX sockets and signal scoping with the new Ruleset::scope() method taking a Scope enum (PR #96 and PR #98).
• Added From<RulesetCreated> implementation for Option<OwnedFd> (PR #104)
• Introduced a new HandledAccess trait specific to AccessFs and AccessNet (commit 554217dda0b7).
• Added a new Errno type to improve FFI support (PR #86 and PR #102).
• Exposed From<i32> implementation for ABI (PR #88).

Documentation

• Added clarifying notes about AccessFs::WriteFile behavior and path_beneath_rules usage (PR #80).
• Introduced CONTRIBUTING.md with testing workflow explanations (PR #76).

Testing

• Enhanced test coverage for new API and added testing against Linux 6.12 (PR #96).
• Updated CI configuration to use the latest Ubuntu versions (PR #87 and PR #97).
• Modified default LANDLOCK_CRATE_TEST_ABI to match the current kernel for more convenient local testing (PR #76).

Example

• Synchronized the sandboxer example with the C version (PR #101): improved error handling for inaccessible file paths and enhanced help documentation.

See crate's metadata and related documentation.

What's Changed

See summary in CHANGELOG.md

• Cache kernel builds by @l0kod in #72
• A couple of small cleanups by @bjorn3 in #71
• Fix typo in doc-comment by @rusty-snake in #70
• Prepare tests for ABI 5 by @l0kod in #73
• Add support for ABI 5 by @l0kod in #74
• Bump to v0.4.1 by @l0kod in #75

New Contributors

• @rusty-snake made their first contribution in #70

Full Changelog: v0.4.0...v0.4.1

New API

Add support for Landlock ABI 5: control IOCTL commands on character and block devices with the new AccessFs::IoctlDev right (PR #74).

Testing

Improved the CI to better test against different kernel versions (PR #72).

See crate's metadata and related documentation.

What's Changed

See summary in CHANGELOG.md

• Improve PrivateRule trait by @l0kod in #65
• Move from_read() and from_write() into AccessFs by @l0kod in #66
• Update error priority and no_new_privs behavior by @l0kod in #67
• Fix and test unsupported rule by @l0kod in #68
• Add initial networking support by @l0kod in #55
• Bump to 0.4.0 by @l0kod in #69

Full Changelog: v0.3.1...v0.4.0

New API

Add support for Landlock ABI 4: control TCP binding and connection according to specified network ports. This is now possible with the AccessNet rights and the NetPort rule (PR #55).

Breaking change

The from_read() and from_write() methods moved from the Access trait to the AccessFs struct (commit 68f066eba571).

Compatibility management

Improve compatibility consistency and prioritize runtime errors against compatibility errors (PR #67).

Fixed a corner case where a ruleset was created on a kernel not supporting Landlock, while requesting to add a rule with an access right handled by the ruleset (BestEffort). When trying to enforce this ruleset, this led to a runtime error (i.e. wrong file descriptor) instead of a compatibility error.

To simplify compatibility management, always call prctl(PR_SET_NO_NEW_PRIVS, 1) by default (see set_no_new_privs()). This was required to get a consistent compatibility management and it should not be an issue given that this feature is supported by all LTS kernels (commit d99f75155bec).

See crate's metadata and related documentation.

What's Changed

See summary in CHANGELOG.md

• Update UAPI to Linux 6.7 by @l0kod in #56
• Initial duplicate RulesetCreated implementation by @int5-grey in #38
• Bump to v0.3.1 by @l0kod in #63

Full Changelog: v0.3.0...v0.3.1

New Contributors

• @int5-grey made their first contribution in #38

New API

Add RulesetCreated::try_clone() (PR #38).

See crate's metadata and related documentation.

What's Changed

See summary in CHANGELOG.md

• Run tests on all commits by @l0kod in #34
• Test the merge commit when required by @l0kod in #35
• Remove Ubuntu 18.04 from the CI by @l0kod in #39
• Improve CI to test all meaningful kernels by @l0kod in #41
• API compatibility improvements by @l0kod in #12
• Add support for ABI 3 by @l0kod in #40
• Make sure the same Cargo version is used for all tests by @l0kod in #45
• Execute each restrict_self() test in a dedicated thread by @l0kod in #46
• Run tests built with Rust MSRV by @l0kod in #47
• Use Ruleset::default() instead of Ruleset::new() by @l0kod in #44
• Test with Landlock ABI 3 by @l0kod in #49
• ci: Update Ubunty 22.04.3 kernel by @l0kod in #51
• Make AsMut unambiguous by @l0kod in #52
• Improve the ABI documentation by @l0kod in #50
• Bump to v0.3.0 by @l0kod in #54

Full Changelog: v0.2.0...v0.3.0

Reviews and tests

• @cd-work
• @bjorn3
• @gnoack
• @mrcnski
• @dburgener

New API

Add support for Landlock ABI 3: control truncate operations with the new AccessFs::Truncate right (PR #40).

Revamp the compatibility handling and add a new set_compatibility() method for Ruleset, RulesetCreated, and PathBeneath. We can now fine-tune the compatibility behavior according to the running kernel and then the supported features thanks to three compatible levels: best effort, soft requirement and hard requirement (PR #12).

Add a new AccessFs::from_file() helper (commit 0b3238c6dd70).

Deprecated API

Deprecate the set_best_effort() method and replace it with set_compatibility() (PR #12).

Deprecate Ruleset::new() and replace it with Ruleset::default() (PR #44).

Breaking changes

We now check that a ruleset really handles at least one access right, which can now cause Ruleset::create() to return an error if the ruleset compatibility level is HardRequirement or set_best_effort(false) (commit 95addc13b4a8).

We now check that access rights passed to add_rule() make sense according to the file type. To handle most use cases, path_beneath_rules() now automatically check and downgrade access rights for files (i.e. remove superfluous directory-only access rights, commit 8e47940b3722).

Testing

Test coverage in the CI is greatly improved by running all tests on all relevant kernel versions: Linux 5.10, 5.15, 6.1, and 6.4 (PR #41).

Run each test in a dedicated thread to avoid inconsistent behavior (PR #46).

This is the first major release of this crate. It brings a high-level interface to the Landlock kernel interface.