diff options
author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-15 19:41:07 +0000 |
---|---|---|
committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-15 19:41:07 +0000 |
commit | 3af6d22bb3850ab2bac67287e3a3d3b0e32868e5 (patch) | |
tree | 3ee7a3ec64525911fa865bb984c86d997d855527 /man2/landlock_restrict_self.2 | |
parent | Adding debian version 6.05.01-1. (diff) | |
download | manpages-3af6d22bb3850ab2bac67287e3a3d3b0e32868e5.tar.xz manpages-3af6d22bb3850ab2bac67287e3a3d3b0e32868e5.zip |
Merging upstream version 6.7.
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'man2/landlock_restrict_self.2')
-rw-r--r-- | man2/landlock_restrict_self.2 | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/man2/landlock_restrict_self.2 b/man2/landlock_restrict_self.2 index f02c3a1..c82181b 100644 --- a/man2/landlock_restrict_self.2 +++ b/man2/landlock_restrict_self.2 @@ -4,7 +4,7 @@ .\" .\" SPDX-License-Identifier: Linux-man-pages-copyleft .\" -.TH landlock_restrict_self 2 2023-03-30 "Linux man-pages 6.05.01" +.TH landlock_restrict_self 2 2023-10-31 "Linux man-pages 6.7" .SH NAME landlock_restrict_self \- enforce a Landlock ruleset .SH LIBRARY @@ -14,7 +14,7 @@ Standard C library .nf .BR "#include <linux/landlock.h>" " /* Definition of " LANDLOCK_* " constants */" .BR "#include <sys/syscall.h>" " /* Definition of " SYS_* " constants */" -.PP +.P .BI "int syscall(SYS_landlock_restrict_self, int " ruleset_fd , .BI " uint32_t " flags ); .SH DESCRIPTION @@ -24,7 +24,7 @@ system call enables enforcing this ruleset on the calling thread. See .BR landlock (7) for a global overview. -.PP +.P A thread can be restricted with multiple rulesets that are then composed together to form the thread's Landlock domain. This can be seen as a stack of rulesets but @@ -43,7 +43,7 @@ composed rulesets limit. Instead, developers are encouraged to build a tailored ruleset thanks to multiple calls to .BR landlock_add_rule (2). -.PP +.P In order to enforce a ruleset, either the caller must have the .B CAP_SYS_ADMIN capability in its user namespace, or the thread must already have the @@ -59,13 +59,13 @@ the thread must make the following call: .EX prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); .EE -.PP +.P .I ruleset_fd is a Landlock ruleset file descriptor obtained with .BR landlock_create_ruleset (2) and fully populated with a set of calls to .BR landlock_add_rule (2). -.PP +.P .I flags must be 0. .SH RETURN VALUE |