{"record":{"id":"2fd92c146f03df33","repo":"zeroclaw-labs/zeroclaw","slug":"landlock-is-only-supported-on-linux-with-the-sandb","errorCode":null,"errorMessage":"Landlock is only supported on Linux with the sandbox-landlock feature","messagePattern":"Landlock is only supported on Linux with the sandbox-landlock feature","errorType":"exception","errorClass":"std::io::Error","httpStatus":null,"severity":"error","filePath":"crates/zeroclaw-runtime/src/security/landlock.rs","lineNumber":314,"sourceCode":"\n    fn name(&self) -> &str {\n        \"landlock\"\n    }\n\n    fn description(&self) -> &str {\n        \"Linux kernel LSM sandboxing (filesystem access control)\"\n    }\n}\n\n// Stub implementations for non-Linux or when feature is disabled\n#[cfg(not(all(feature = \"sandbox-landlock\", target_os = \"linux\")))]\n#[derive(Debug)]\npub struct LandlockSandbox;\n\n#[cfg(not(all(feature = \"sandbox-landlock\", target_os = \"linux\")))]\nimpl LandlockSandbox {\n    pub fn new() -> std::io::Result<Self> {\n        Err(std::io::Error::new(\n            std::io::ErrorKind::Unsupported,\n            \"Landlock is only supported on Linux with the sandbox-landlock feature\",\n        ))\n    }\n\n    pub fn with_workspace(_workspace_dir: Option<std::path::PathBuf>) -> std::io::Result<Self> {\n        Err(std::io::Error::new(\n            std::io::ErrorKind::Unsupported,\n            \"Landlock is only supported on Linux\",\n        ))\n    }\n\n    pub fn probe() -> std::io::Result<Self> {\n        Err(std::io::Error::new(\n            std::io::ErrorKind::Unsupported,\n            \"Landlock is only supported on Linux\",\n        ))\n    }","sourceCodeStart":296,"sourceCodeEnd":332,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/crates/zeroclaw-runtime/src/security/landlock.rs#L296-L332","documentation":"This error comes from the compile-time stub of LandlockSandbox, which exists whenever the crate is built without the `sandbox-landlock` cargo feature or for a non-Linux target (the `#[cfg(not(all(feature = \"sandbox-landlock\", target_os = \"linux\")))]` block at landlock.rs:307). The stub keeps the type nameable on every platform so downstream code compiles, but every constructor returns io::ErrorKind::Unsupported. Hitting it means the binary was never built with Landlock support at all — not that the host kernel lacks Landlock (that case produces the real implementation's distinct \"Landlock not available\" error).","triggerScenarios":"Calling LandlockSandbox::new() directly, or through an unconditional backend = \"landlock\" config mapping, in a build compiled without `--features sandbox-landlock` or on macOS/Windows. Also reached via LandlockSandbox::probe() in auto-detection code that does not first check cfg!.","commonSituations":"A plain `cargo build` of zeroclaw-runtime with default features (which omit sandbox-landlock); deploying a Linux binary that was built without the feature; running the test suite on a macOS dev machine; CI matrices that build every target uniformly.","solutions":["Rebuild on Linux with the feature enabled: `cargo build --features zeroclaw-runtime/sandbox-landlock` (or add `sandbox-landlock` to the features list in your Cargo.toml dependency on zeroclaw-runtime)","On macOS, use the Seatbelt backend (SeatbeltSandbox) instead — Landlock is Linux-only by design","Gate the call site with `#[cfg(all(feature = \"sandbox-landlock\", target_os = \"linux\"))]` and provide an alternate branch for other platforms","In backend auto-detection, treat ErrorKind::Unsupported from new()/probe() as \"backend not compiled in\" and continue to the next candidate instead of propagating the error"],"exampleFix":"// before\nlet sandbox = LandlockSandbox::new()?; // Err(Unsupported) on non-Linux or feature-off builds\n\n// after — only construct Landlock when it was actually compiled in\nfn pick_sandbox() -> std::io::Result<Box<dyn zeroclaw_runtime::security::traits::Sandbox>> {\n    #[cfg(all(feature = \"sandbox-landlock\", target_os = \"linux\"))]\n    { return Ok(Box::new(LandlockSandbox::new()?)); }\n    #[cfg(not(all(feature = \"sandbox-landlock\", target_os = \"linux\")))]\n    { return Ok(Box::new(fallback_backend()?)); } // e.g. SeatbeltSandbox::new()? on macOS\n}","handlingStrategy":"validation","validationCode":"// run before LandlockSandbox::new()\nfn landlock_compiled_in() -> bool {\n    cfg!(all(feature = \"sandbox-landlock\", target_os = \"linux\"))\n}","typeGuard":"fn is_unsupported(e: &std::io::Error) -> bool {\n    e.kind() == std::io::ErrorKind::Unsupported\n}","tryCatchPattern":"match LandlockSandbox::new() {\n    Ok(sandbox) => { /* use it */ }\n    Err(e) if e.kind() == std::io::ErrorKind::Unsupported => { /* skip to next backend */ }\n    Err(e) => return Err(e.into()),\n}","preventionTips":["Enable sandbox-landlock explicitly in the Linux production build profile instead of relying on defaults","Route backend selection through probe()/is_available() and treat Unsupported as a skip, not a failure","Log which sandbox backend was actually selected at startup so silent stubs are visible"],"tags":["rust","sandbox","landlock","linux","cargo-features","cross-platform"],"backgroundTag":"platform-not-supported","analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}