Skip to main content

[create]

Simple Story

Adding a sheet of paper to the pile.

Not a socket, not a pipe, not a link, and never a device. Each of those is a separate permission, because each carries a different risk.

Position in the example policy file​

The section documented on this page is marked in red. Every page in this section shows the same example file, so reading them in order walks it from top to bottom.

exercise.cfg
# Every section this reference documents, gathered in one file so that each page can
# point at its own. A real policy names only what its command needs.

[read]
/srv/reference-data
/opt/toolchain

[execute]
/opt/toolchain

[write]
/var/tmp/workspace

[create]
/var/tmp/workspace

[delete]
/var/tmp/workspace

[create-ipc]
/var/tmp/workspace/run

[create-symlink]
/var/tmp/workspace/build

[restructure]
/var/tmp/workspace

# Devices that may receive ioctl calls, here the pseudo-terminals of the container.
[ioctl]
/dev/pts

[connect]
allow 192.0.2.10:443
allow repo.example.org:443
allow 203.0.113.53:53 udp

[bind]
allow 8080
allow 5353 udp

[accept]
expose 18080 to 8080 from 198.51.100.0/24

[limits]
timeout=120
mem_mb=2048
nproc=256
nofile=1024
fsize_mb=512
cpu=100

That file is a catalogue rather than a working configuration. Three of its entries change what a run needs, and the Policy Reference index says which.

Syntax​

One path per line.

[create]
/var/tmp/workspace

What it grants​

Landlock rightWhat it permits
LANDLOCK_ACCESS_FILESYSTEM_MAKE_REGULAR_FILEcreating a regular file
LANDLOCK_ACCESS_FILESYSTEM_MAKE_DIRECTORYcreating a directory

The rule carries the letter m.

What enforces it​

Phobos materialises the path like a [write] path. A path that does not exist is therefore created as an empty regular file. A regular file cannot hold a directory-only right, so a missing path named only in this section ends the run with exit status 125 (add_rule failed). Create the directory before the run. Where the path appears in no other section the rule is --rights=m <path>. A path named in several sections gets one rule per section, each carrying the union of the letters.

Notes​

Creating a device node is never granted. A character or block device reaches hardware the policy never named, and no build tool needs one, so the right stays in the handled set and is denied rather than left unregulated. There is no section that grants it.

Sockets, named pipes and symbolic links have their own sections. They were once part of one blanket create right; they are now [create-ipc] and [create-symlink], so a policy that needs one of them does not gain the others.

Creating is not moving. Creating a file in one directory and deleting it in another is not a rename. Landlock requires the REFER right for a rename or a hard link across directories, and that right is granted only by [restructure].

Further reading​