[create-ipc]
Some tools talk to themselves through a pipe in the corner of the desk.
That is harmless and it is still a permission, so it is asked for by name rather than arriving with the right to create ordinary files.
Position in the example policy file
The section documented on this page is marked in red. Every page in this section shows the same example file, so reading them in order walks it from top to bottom.
# Every section this reference documents, gathered in one file so that each page can
# point at its own. A real policy names only what its command needs.
[read]
/srv/reference-data
/opt/toolchain
[execute]
/opt/toolchain
[write]
/var/tmp/workspace
[create]
/var/tmp/workspace
[delete]
/var/tmp/workspace
[create-ipc]
/var/tmp/workspace/run
[create-symlink]
/var/tmp/workspace/build
[restructure]
/var/tmp/workspace
# Devices that may receive ioctl calls, here the pseudo-terminals of the container.
[ioctl]
/dev/pts
[connect]
allow 192.0.2.10:443
allow repo.example.org:443
allow 203.0.113.53:53 udp
[bind]
allow 8080
allow 5353 udp
[accept]
expose 18080 to 8080 from 198.51.100.0/24
[limits]
timeout=120
mem_mb=2048
nproc=256
nofile=1024
fsize_mb=512
cpu=100
That file is a catalogue rather than a working configuration. Three of its entries change what a run needs, and the Policy Reference index says which.
Syntax
One path per line.
[create-ipc]
/var/tmp/workspace/run
What it grants
| Landlock right | What it permits |
|---|---|
LANDLOCK_ACCESS_FILESYSTEM_MAKE_SOCKET | creating a UNIX-domain socket file |
LANDLOCK_ACCESS_FILESYSTEM_MAKE_NAMED_PIPE | creating a named pipe, or FIFO |
The rule carries the letter p.
What enforces it
Phobos materialises the path like a [write] path. A path that does not exist is therefore created as
an empty regular file. A regular file cannot hold a directory-only right, so a missing path named
only in this section ends the run with exit status 125 (add_rule failed). Create the directory
before the run. Where the path appears in no other section the rule is --rights=p <path>. A
path named in several sections gets one rule per section, each carrying the union of the letters.
Notes
This is for local inter-process communication (IPC) objects alone. A tool that needs to
bind and listen on a control socket in its run directory gets this section and nothing more, so
it does not gain the right to create ordinary files there. A connect() to a UNIX socket, even
its own, is refused by the connect guard unless the network restriction is off.
A nested entry adds to its ancestor, it never narrows it. In the example above,
/var/tmp/workspace/run lies beneath /var/tmp/workspace, which already holds write, create,
delete and the REFER right. Landlock unions the rights of every rule along a path, so the nested entry holds
those rights too, plus the socket and pipe rights it names. Writing a nested entry with a
strict subset of an ancestor's rights is refused outright, because such a restriction could not
hold.
Reaching a socket is a different question from creating one. Connecting to a pathname UNIX
socket whose server lives outside the Landlock domain is gated by RESOLVE_UNIX, which rides
with [read], but only where the connect guard is off: with the network layer on, the
guard refuses every UNIX-domain connect first. An abstract UNIX socket outside the sandbox is refused by scoping
from Landlock version 6.