{"record":{"id":"b791880183a8e68e","repo":"zeroclaw-labs/zeroclaw","slug":"landlock-is-only-supported-on-linux","errorCode":null,"errorMessage":"Landlock is only supported on Linux","messagePattern":"Landlock is only supported on Linux","errorType":"exception","errorClass":"std::io::Error","httpStatus":null,"severity":"error","filePath":"crates/zeroclaw-runtime/src/security/landlock.rs","lineNumber":321,"sourceCode":"    }\n}\n\n// Stub implementations for non-Linux or when feature is disabled\n#[cfg(not(all(feature = \"sandbox-landlock\", target_os = \"linux\")))]\n#[derive(Debug)]\npub struct LandlockSandbox;\n\n#[cfg(not(all(feature = \"sandbox-landlock\", target_os = \"linux\")))]\nimpl LandlockSandbox {\n    pub fn new() -> std::io::Result<Self> {\n        Err(std::io::Error::new(\n            std::io::ErrorKind::Unsupported,\n            \"Landlock is only supported on Linux with the sandbox-landlock feature\",\n        ))\n    }\n\n    pub fn with_workspace(_workspace_dir: Option<std::path::PathBuf>) -> std::io::Result<Self> {\n        Err(std::io::Error::new(\n            std::io::ErrorKind::Unsupported,\n            \"Landlock is only supported on Linux\",\n        ))\n    }\n\n    pub fn probe() -> std::io::Result<Self> {\n        Err(std::io::Error::new(\n            std::io::ErrorKind::Unsupported,\n            \"Landlock is only supported on Linux\",\n        ))\n    }\n}\n\n#[cfg(not(all(feature = \"sandbox-landlock\", target_os = \"linux\")))]\nimpl Sandbox for LandlockSandbox {\n    fn wrap_command(&self, _cmd: &mut std::process::Command) -> std::io::Result<()> {\n        Err(std::io::Error::new(\n            std::io::ErrorKind::Unsupported,","sourceCodeStart":303,"sourceCodeEnd":339,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/crates/zeroclaw-runtime/src/security/landlock.rs#L303-L339","documentation":"with_workspace is the workspace-scoped constructor, and on stub builds (non-Linux target, or Linux without the `sandbox-landlock` feature — the negative cfg block at landlock.rs:311) it returns io::ErrorKind::Unsupported before ever touching the workspace path, which the stub deliberately ignores (_workspace_dir). Note the message here says only \"Landlock is only supported on Linux\" even though a feature-less Linux build also lands in this stub, unlike new()'s message which names the feature. The real implementation, when compiled in, probes the kernel by creating a minimal ruleset and fails with a different message (\"Landlock not available\") if the kernel lacks Landlock.","triggerScenarios":"Calling LandlockSandbox::with_workspace(Some(dir)) or with_workspace(None) from sandbox-factory or config-driven code on macOS/Windows, or on a Linux build without the sandbox-landlock feature enabled.","commonSituations":"Default-features builds of zeroclaw-runtime (sandbox-landlock omitted); cross-compilation targets; a config file that pins backend = \"landlock\" being shipped to non-Linux hosts; developer machines on macOS.","solutions":["Enable the feature in the dependency declaration so Linux builds compile the real implementation (see exampleFix)","Switch the platform: Landlock cannot be used off Linux; select SeatbeltSandbox on macOS","Treat ErrorKind::Unsupported as a signal to fall back to another sandbox backend rather than a fatal error","Fix misleading operator messaging: this variant fires for feature-less Linux builds too, even though the text only mentions Linux"],"exampleFix":"# before (Cargo.toml)\n[dependencies]\nzeroclaw-runtime = { path = \"../zeroclaw-runtime\" } # default features: no sandbox-landlock\n\n# after\n[dependencies]\nzeroclaw-runtime = { path = \"../zeroclaw-runtime\", features = [\"sandbox-landlock\"] } # Linux builds get the real LandlockSandbox","handlingStrategy":"validation","validationCode":"if !cfg!(all(feature = \"sandbox-landlock\", target_os = \"linux\")) {\n    // do not call LandlockSandbox::with_workspace(..); pick another backend\n}","typeGuard":"fn is_unsupported(e: &std::io::Error) -> bool {\n    e.kind() == std::io::ErrorKind::Unsupported\n}","tryCatchPattern":"match LandlockSandbox::with_workspace(Some(ws)) {\n    Ok(s) => s,\n    Err(e) if e.kind() == std::io::ErrorKind::Unsupported => fallback_sandbox()?,\n    Err(e) => return Err(e.into()),\n}","preventionTips":["Declare sandbox-landlock in the features list of the dependency rather than on the command line only, so CI and local builds agree","Never hardcode backend = \"landlock\" in config shipped to mixed-OS fleets","Assert at startup that the requested backend type matches the compiled-in set"],"tags":["rust","sandbox","landlock","workspace","cargo-features","linux"],"backgroundTag":"platform-not-supported","analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}