[PATCH v4] landlock.7, landlock_*.2: Document LANDLOCK_ADD_RULE_QUIET

[PATCH v4] landlock.7, landlock_*.2: Document LANDLOCK_ADD_RULE_QUIET

[Tingmao Wang]

LANDLOCK_ADD_RULE_QUIET is a new feature introduced in Landlock ABI
version 10, merged in kernel v7.2 [1].  This patch copies relevant
kernel documentation into man-pages.

Link: <https://patch.msgid.link/cover.1781228815.git.m@maowtm.org/> [1]
Signed-off-by: Tingmao Wang <m@maowtm.org>
---

Changes in v4:
Applied review suggestions:
- \em to parentheses
- can either be 0 or contain -> is a bit mask of the following optional flags
- .IR quiet_ *
- .IR \%struct\~landlock_ruleset_attr .
- Fix more semantic line breaks
- EINVAL flags "is not 0 or one of the allowed values" -> "is not valid"
- bitmask -> bit mask

Changes in v3:
- Fix out of bound array access in example caused by incrementing abi
  maximum but forgetting to also append the array.
- Semantic line breaks
- Add accidentally dropped lines:
    @quiet_access_fs, @quiet_access_net and @quiet_scoped must be a
    subset of @handled_access_fs, @handled_access_net and @scoped
    respectively.
  Thanks Günther!

Changes in v2:
- Fix missing .RE, and fix EINVAL label being incorrectly formatted
- Fix missed API bump in the example program (abi = MIN(abi, 10);)

For context, I'm the author of the quiet flag feature.

All text in this patch is copied from the kernel source except updates
requested in review of this patch.

 man/man2/landlock_add_rule.2       | 53 ++++++++++++++++++++++++--
 man/man2/landlock_create_ruleset.2 | 60 ++++++++++++++++++++++++++++++
 man/man7/landlock.7                | 34 ++++++++++++++++-
 3 files changed, 143 insertions(+), 4 deletions(-)

diff --git a/man/man2/landlock_add_rule.2 b/man/man2/landlock_add_rule.2
index fe01a98d9..94bc63068 100644
--- a/man/man2/landlock_add_rule.2
+++ b/man/man2/landlock_add_rule.2
@@ -120,7 +120,47 @@ .SH DESCRIPTION
 and it will automatically translate to binding on the related port range.
 .P
 .I flags
-must be 0.
+is a bit mask of the following optional flags:
+.TP
+.BR LANDLOCK_ADD_RULE_QUIET "  (since Landlock ABI version 10)"
+Together with the
+.IR quiet_ *
+fields in
+.IR \%struct\~landlock_ruleset_attr ,
+this flag controls whether Landlock will log audit messages when
+access to the objects covered by this rule is denied by this layer.
+.IP
+If logging is enabled,
+when Landlock denies an access,
+it will suppress the log if all of the following are true:
+.RS
+.IP \[bu] 3
+this layer is the innermost layer that denied the access;
+.IP \[bu]
+all accesses denied by this layer are part of the
+.IR quiet_ *
+fields in the related
+.IR \%struct\~landlock_ruleset_attr ;
+.IP \[bu]
+the object
+(or one of its parents, for filesystem rules)
+is marked as "quiet" via
+.BR LANDLOCK_ADD_RULE_QUIET .
+.RE
+.IP
+Because logging is only suppressed by a layer
+if the layer denies access,
+a sandboxed program cannot use this flag
+to "hide" access denials,
+without denying itself the access in the first place.
+.IP
+The effect of this flag does not depend on the value of
+.I allowed_access
+in the passed in
+.IR rule_attr .
+When this flag is present,
+the caller is also allowed to pass in an empty
+.IR allowed_access .
 .SH RETURN VALUE
 On success,
 .BR landlock_add_rule ()
@@ -159,7 +199,7 @@ .SH ERRORS
 .TP
 .B EINVAL
 .I flags
-is not 0.
+is not valid.
 .TP
 .B EINVAL
 The rule accesses are inconsistent (i.e.,
@@ -181,10 +221,17 @@ .SH ERRORS
 .IR \%struct\~landlock_net_port_attr ,
 the port number is greater than 65535.
 .TP
+.B EINVAL
+.B LANDLOCK_ADD_RULE_QUIET
+is passed
+but the ruleset has no quiet access bits set
+for the corresponding rule type.
+.TP
 .B ENOMSG
 Empty accesses (i.e.,
 .I rule_attr\->allowed_access
-is 0).
+is 0)
+and no flags.
 .TP
 .B EOPNOTSUPP
 Landlock is supported by the kernel but disabled at boot time.
diff --git a/man/man2/landlock_create_ruleset.2 b/man/man2/landlock_create_ruleset.2
index 2a33fa4b5..85df03668 100644
--- a/man/man2/landlock_create_ruleset.2
+++ b/man/man2/landlock_create_ruleset.2
@@ -45,6 +45,9 @@ .SH DESCRIPTION
     __u64 handled_access_fs;
     __u64 handled_access_net;
     __u64 scoped;
+    __u64 quiet_access_fs;
+    __u64 quiet_access_net;
+    __u64 quiet_scoped;
 };
 .EE
 .in
@@ -70,6 +73,17 @@ .SH DESCRIPTION
 in
 .BR landlock (7)).
 .IP
+.I quiet_access_fs
+is a bit mask of filesystem actions which should not be logged
+if the per-object quiet flag is set.
+.IP
+.I quiet_access_net
+is a bit mask of network actions which should not be logged
+if the per-object quiet flag is set.
+.IP
+.I quiet_scoped
+is a bit mask of scoped actions which should not be logged.
+.IP
 This structure defines a set of
 .IR "handled access rights" ,
 a set of actions on different object types,
@@ -100,6 +114,41 @@ .SH DESCRIPTION
 a wide range or all access rights that they know about at build time
 (and that they have tested with a kernel that supported them all).
 .IP
+.I quiet_access_fs
+and
+.I quiet_access_net
+are bit masks of actions for which a denial by this layer
+will not trigger a log
+if the corresponding object
+(or its children, for filesystem rules)
+is marked with the "quiet" bit via
+.BR LANDLOCK_ADD_RULE_QUIET ,
+even if logging would normally take place per
+.BR landlock_restrict_self (2)
+flags.
+.I quiet_scoped
+is similar,
+except that it does not require marking any objects as quiet
+(if the ruleset is created with any bits set in
+.IR quiet_scoped ,
+then denial of such scoped resources will not trigger any log).
+These 3 fields are available since Landlock ABI version 10
+(see
+.B Quiet rule flag
+in
+.BR landlock (7)).
+.IP
+.IR quiet_access_fs ,
+.I quiet_access_net
+and
+.I quiet_scoped
+must be a subset of
+.IR handled_access_fs ,
+.I handled_access_net
+and
+.I scoped
+respectively.
+.IP
 This structure can grow in future Landlock versions.
 .P
 .I size
@@ -204,6 +253,17 @@ .SH ERRORS
 or
 .BR LANDLOCK_CREATE_RULESET_ERRATA .
 .TP
+.B EINVAL
+.IR quiet_access_fs ,
+.IR quiet_access_net ,
+or
+.I quiet_scoped
+is not a subset of the corresponding
+.IR handled_access_fs ,
+.IR handled_access_net ,
+or
+.IR scoped .
+.TP
 .B ENOMSG
 Empty accesses (i.e.,
 .I attr
diff --git a/man/man7/landlock.7 b/man/man7/landlock.7
index 880dd5058..ad63826da 100644
--- a/man/man7/landlock.7
+++ b/man/man7/landlock.7
@@ -456,6 +456,35 @@ .SS Truncating files
 It is also possible to pass such file descriptors between processes,
 keeping their Landlock properties,
 even when these processes do not have an enforced Landlock ruleset.
+.SS Quiet rule flag
+Starting with the Landlock ABI version 10,
+it is possible to selectively suppress logs
+for specific denied accesses
+on a per-object basis with the
+.B LANDLOCK_ADD_RULE_QUIET
+flag of
+.BR landlock_add_rule (2),
+in combination with the
+.B quiet_access_fs
+and
+.B quiet_access_net
+fields
+of
+.IR \%struct\~landlock_ruleset_attr .
+It is also now possible to suppress logs
+for scope accesses via the
+.B quiet_scoped
+field of
+.IR \%struct\~landlock_ruleset_attr .
+The object is marked as quiet within a ruleset
+when at least one
+.BR landlock_add_rule (2)
+call is made for it with the
+.B LANDLOCK_ADD_RULE_QUIET
+flag,
+additional add-rule calls
+for the same object without this flag
+do not clear it.
 .SH VERSIONS
 Landlock was introduced in Linux 5.13.
 .P
@@ -500,6 +529,8 @@ .SH VERSIONS
 8	7.0	LANDLOCK_RESTRICT_SELF_TSYNC
 _	_	_
 9	7.1	LANDLOCK_ACCESS_FS_RESOLVE_UNIX
+_	_	_
+10	7.2	LANDLOCK_ADD_RULE_QUIET
 .TE
 .P
 Users should use the Landlock ABI version rather than the kernel version
@@ -610,6 +641,7 @@ .SH EXAMPLES
     (LANDLOCK_ACCESS_FS_IOCTL_DEV    << 1) \- 1,  // v7: same
     (LANDLOCK_ACCESS_FS_IOCTL_DEV    << 1) \- 1,  // v8: same
     (LANDLOCK_ACCESS_FS_RESOLVE_UNIX << 1) \- 1,  // v9: add "resolve_unix"
+    (LANDLOCK_ACCESS_FS_RESOLVE_UNIX << 1) \- 1,  // v10: same
 };
 \&
 int abi = landlock_create_ruleset(NULL, 0,
@@ -622,7 +654,7 @@ .SH EXAMPLES
     perror("Unable to use Landlock");
     return;  /* Graceful fallback: Do nothing.  */
 }
-abi = MIN(abi, 9);
+abi = MIN(abi, 10);
 \&
 /* Only use the available rights in the ruleset.  */
 attr.handled_access_fs &= landlock_fs_access_rights[abi \- 1];
-- 
2.55.0

Re: [PATCH v4] landlock.7, landlock_*.2: Document LANDLOCK_ADD_RULE_QUIET

[Günther Noack]

On Wed, Sep 02, 2026 at 12:42:02AM +0100, Tingmao Wang wrote:
> LANDLOCK_ADD_RULE_QUIET is a new feature introduced in Landlock ABI
> version 10, merged in kernel v7.2 [1].  This patch copies relevant
> kernel documentation into man-pages.
> 
> Link: <https://patch.msgid.link/cover.1781228815.git.m@maowtm.org/> [1]
> Signed-off-by: Tingmao Wang <m@maowtm.org>
> ---
> 
> Changes in v4:
> Applied review suggestions:
> - \em to parentheses
> - can either be 0 or contain -> is a bit mask of the following optional flags
> - .IR quiet_ *
> - .IR \%struct\~landlock_ruleset_attr .
> - Fix more semantic line breaks
> - EINVAL flags "is not 0 or one of the allowed values" -> "is not valid"
> - bitmask -> bit mask
> 
> Changes in v3:
> - Fix out of bound array access in example caused by incrementing abi
>   maximum but forgetting to also append the array.
> - Semantic line breaks
> - Add accidentally dropped lines:
>     @quiet_access_fs, @quiet_access_net and @quiet_scoped must be a
>     subset of @handled_access_fs, @handled_access_net and @scoped
>     respectively.
>   Thanks Günther!
> 
> Changes in v2:
> - Fix missing .RE, and fix EINVAL label being incorrectly formatted
> - Fix missed API bump in the example program (abi = MIN(abi, 10);)
> 
> For context, I'm the author of the quiet flag feature.
> 
> All text in this patch is copied from the kernel source except updates
> requested in review of this patch.
> 
>  man/man2/landlock_add_rule.2       | 53 ++++++++++++++++++++++++--
>  man/man2/landlock_create_ruleset.2 | 60 ++++++++++++++++++++++++++++++
>  man/man7/landlock.7                | 34 ++++++++++++++++-
>  3 files changed, 143 insertions(+), 4 deletions(-)
> 
> diff --git a/man/man2/landlock_add_rule.2 b/man/man2/landlock_add_rule.2
> index fe01a98d9..94bc63068 100644
> --- a/man/man2/landlock_add_rule.2
> +++ b/man/man2/landlock_add_rule.2
> @@ -120,7 +120,47 @@ .SH DESCRIPTION
>  and it will automatically translate to binding on the related port range.
>  .P
>  .I flags
> -must be 0.
> +is a bit mask of the following optional flags:
> +.TP
> +.BR LANDLOCK_ADD_RULE_QUIET "  (since Landlock ABI version 10)"
> +Together with the
> +.IR quiet_ *
> +fields in
> +.IR \%struct\~landlock_ruleset_attr ,
> +this flag controls whether Landlock will log audit messages when
> +access to the objects covered by this rule is denied by this layer.
> +.IP
> +If logging is enabled,
> +when Landlock denies an access,
> +it will suppress the log if all of the following are true:
> +.RS
> +.IP \[bu] 3
> +this layer is the innermost layer that denied the access;
> +.IP \[bu]
> +all accesses denied by this layer are part of the
> +.IR quiet_ *
> +fields in the related
> +.IR \%struct\~landlock_ruleset_attr ;
> +.IP \[bu]
> +the object
> +(or one of its parents, for filesystem rules)
> +is marked as "quiet" via
> +.BR LANDLOCK_ADD_RULE_QUIET .
> +.RE
> +.IP
> +Because logging is only suppressed by a layer
> +if the layer denies access,
> +a sandboxed program cannot use this flag
> +to "hide" access denials,
> +without denying itself the access in the first place.
> +.IP
> +The effect of this flag does not depend on the value of
> +.I allowed_access
> +in the passed in
> +.IR rule_attr .
> +When this flag is present,
> +the caller is also allowed to pass in an empty
> +.IR allowed_access .
>  .SH RETURN VALUE
>  On success,
>  .BR landlock_add_rule ()
> @@ -159,7 +199,7 @@ .SH ERRORS
>  .TP
>  .B EINVAL
>  .I flags
> -is not 0.
> +is not valid.
>  .TP
>  .B EINVAL
>  The rule accesses are inconsistent (i.e.,
> @@ -181,10 +221,17 @@ .SH ERRORS
>  .IR \%struct\~landlock_net_port_attr ,
>  the port number is greater than 65535.
>  .TP
> +.B EINVAL
> +.B LANDLOCK_ADD_RULE_QUIET
> +is passed
> +but the ruleset has no quiet access bits set
> +for the corresponding rule type.
> +.TP
>  .B ENOMSG
>  Empty accesses (i.e.,
>  .I rule_attr\->allowed_access
> -is 0).
> +is 0)
> +and no flags.
>  .TP
>  .B EOPNOTSUPP
>  Landlock is supported by the kernel but disabled at boot time.
> diff --git a/man/man2/landlock_create_ruleset.2 b/man/man2/landlock_create_ruleset.2
> index 2a33fa4b5..85df03668 100644
> --- a/man/man2/landlock_create_ruleset.2
> +++ b/man/man2/landlock_create_ruleset.2
> @@ -45,6 +45,9 @@ .SH DESCRIPTION
>      __u64 handled_access_fs;
>      __u64 handled_access_net;
>      __u64 scoped;
> +    __u64 quiet_access_fs;
> +    __u64 quiet_access_net;
> +    __u64 quiet_scoped;
>  };
>  .EE
>  .in
> @@ -70,6 +73,17 @@ .SH DESCRIPTION
>  in
>  .BR landlock (7)).
>  .IP
> +.I quiet_access_fs
> +is a bit mask of filesystem actions which should not be logged
> +if the per-object quiet flag is set.
> +.IP
> +.I quiet_access_net
> +is a bit mask of network actions which should not be logged
> +if the per-object quiet flag is set.
> +.IP
> +.I quiet_scoped
> +is a bit mask of scoped actions which should not be logged.
> +.IP
>  This structure defines a set of
>  .IR "handled access rights" ,
>  a set of actions on different object types,
> @@ -100,6 +114,41 @@ .SH DESCRIPTION
>  a wide range or all access rights that they know about at build time
>  (and that they have tested with a kernel that supported them all).
>  .IP
> +.I quiet_access_fs
> +and
> +.I quiet_access_net
> +are bit masks of actions for which a denial by this layer
> +will not trigger a log
> +if the corresponding object
> +(or its children, for filesystem rules)
> +is marked with the "quiet" bit via
> +.BR LANDLOCK_ADD_RULE_QUIET ,
> +even if logging would normally take place per
> +.BR landlock_restrict_self (2)
> +flags.
> +.I quiet_scoped
> +is similar,
> +except that it does not require marking any objects as quiet
> +(if the ruleset is created with any bits set in
> +.IR quiet_scoped ,
> +then denial of such scoped resources will not trigger any log).
> +These 3 fields are available since Landlock ABI version 10
> +(see
> +.B Quiet rule flag
> +in
> +.BR landlock (7)).
> +.IP
> +.IR quiet_access_fs ,
> +.I quiet_access_net
> +and
> +.I quiet_scoped
> +must be a subset of
> +.IR handled_access_fs ,
> +.I handled_access_net
> +and
> +.I scoped
> +respectively.
> +.IP
>  This structure can grow in future Landlock versions.
>  .P
>  .I size
> @@ -204,6 +253,17 @@ .SH ERRORS
>  or
>  .BR LANDLOCK_CREATE_RULESET_ERRATA .
>  .TP
> +.B EINVAL
> +.IR quiet_access_fs ,
> +.IR quiet_access_net ,
> +or
> +.I quiet_scoped
> +is not a subset of the corresponding
> +.IR handled_access_fs ,
> +.IR handled_access_net ,
> +or
> +.IR scoped .
> +.TP
>  .B ENOMSG
>  Empty accesses (i.e.,
>  .I attr
> diff --git a/man/man7/landlock.7 b/man/man7/landlock.7
> index 880dd5058..ad63826da 100644
> --- a/man/man7/landlock.7
> +++ b/man/man7/landlock.7
> @@ -456,6 +456,35 @@ .SS Truncating files
>  It is also possible to pass such file descriptors between processes,
>  keeping their Landlock properties,
>  even when these processes do not have an enforced Landlock ruleset.
> +.SS Quiet rule flag
> +Starting with the Landlock ABI version 10,
> +it is possible to selectively suppress logs
> +for specific denied accesses
> +on a per-object basis with the
> +.B LANDLOCK_ADD_RULE_QUIET
> +flag of
> +.BR landlock_add_rule (2),
> +in combination with the
> +.B quiet_access_fs
> +and
> +.B quiet_access_net
> +fields
> +of
> +.IR \%struct\~landlock_ruleset_attr .
> +It is also now possible to suppress logs
> +for scope accesses via the
> +.B quiet_scoped
> +field of
> +.IR \%struct\~landlock_ruleset_attr .
> +The object is marked as quiet within a ruleset
> +when at least one
> +.BR landlock_add_rule (2)
> +call is made for it with the
> +.B LANDLOCK_ADD_RULE_QUIET
> +flag,
> +additional add-rule calls
> +for the same object without this flag
> +do not clear it.
>  .SH VERSIONS
>  Landlock was introduced in Linux 5.13.
>  .P
> @@ -500,6 +529,8 @@ .SH VERSIONS
>  8	7.0	LANDLOCK_RESTRICT_SELF_TSYNC
>  _	_	_
>  9	7.1	LANDLOCK_ACCESS_FS_RESOLVE_UNIX
> +_	_	_
> +10	7.2	LANDLOCK_ADD_RULE_QUIET
>  .TE
>  .P
>  Users should use the Landlock ABI version rather than the kernel version
> @@ -610,6 +641,7 @@ .SH EXAMPLES
>      (LANDLOCK_ACCESS_FS_IOCTL_DEV    << 1) \- 1,  // v7: same
>      (LANDLOCK_ACCESS_FS_IOCTL_DEV    << 1) \- 1,  // v8: same
>      (LANDLOCK_ACCESS_FS_RESOLVE_UNIX << 1) \- 1,  // v9: add "resolve_unix"
> +    (LANDLOCK_ACCESS_FS_RESOLVE_UNIX << 1) \- 1,  // v10: same
>  };
>  \&
>  int abi = landlock_create_ruleset(NULL, 0,
> @@ -622,7 +654,7 @@ .SH EXAMPLES
>      perror("Unable to use Landlock");
>      return;  /* Graceful fallback: Do nothing.  */
>  }
> -abi = MIN(abi, 9);
> +abi = MIN(abi, 10);
>  \&
>  /* Only use the available rights in the ruleset.  */
>  attr.handled_access_fs &= landlock_fs_access_rights[abi \- 1];
> -- 
> 2.55.0

Reviewed-by: Günther Noack <gnoack@google.com>

Re: [PATCH v4] landlock.7, landlock_*.2: Document LANDLOCK_ADD_RULE_QUIET

[Alejandro Colomar]

[-- Attachment #1: Type: text/plain, Size: 690 bytes --]

Hi Tingmao, Günther,

> Date: 2026-09-02 17:09:10+0200
> From: Günther Noack <gnoack@google.com>
>
> On Wed, Sep 02, 2026 at 12:42:02AM +0100, Tingmao Wang wrote:
> > LANDLOCK_ADD_RULE_QUIET is a new feature introduced in Landlock ABI
> > version 10, merged in kernel v7.2 [1].  This patch copies relevant
> > kernel documentation into man-pages.
> > 
> > Link: <https://patch.msgid.link/cover.1781228815.git.m@maowtm.org/> [1]
> > Signed-off-by: Tingmao Wang <m@maowtm.org>
> > ---
[...]
> 
> Reviewed-by: Günther Noack <gnoack@google.com>

Thanks!  I've applied the patch and appended the tag.


Have a lovely day!
Alex

-- 
<https://www.alejandro-colomar.es>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]