{"record":{"id":"f25cf926a05b9246","repo":"tinyhumansai/openhuman","slug":"landlock-not-available","errorCode":null,"errorMessage":"Landlock not available","messagePattern":"Landlock not available","errorType":"exception","errorClass":"io::Error","httpStatus":null,"severity":"error","filePath":"src/openhuman/security/landlock.rs","lineNumber":38,"sourceCode":"#[cfg(all(feature = \"sandbox-landlock\", target_os = \"linux\"))]\nimpl LandlockSandbox {\n    /// Create a new Landlock sandbox with the given workspace directory\n    pub fn new() -> std::io::Result<Self> {\n        Self::with_workspace(None)\n    }\n\n    /// Create a Landlock sandbox with a specific workspace directory\n    pub fn with_workspace(workspace_dir: Option<std::path::PathBuf>) -> std::io::Result<Self> {\n        // Test if Landlock is available by trying to create a minimal ruleset\n        let test_ruleset = Ruleset::default()\n            .handle_access(AccessFs::ReadFile | AccessFs::WriteFile)\n            .and_then(|ruleset| ruleset.create());\n\n        match test_ruleset {\n            Ok(_) => Ok(Self { workspace_dir }),\n            Err(e) => {\n                log::debug!(\"Landlock not available: {}\", e);\n                Err(std::io::Error::new(\n                    std::io::ErrorKind::Unsupported,\n                    \"Landlock not available\",\n                ))\n            }\n        }\n    }\n\n    /// Probe if Landlock is available (for auto-detection)\n    pub fn probe() -> std::io::Result<Self> {\n        Self::new()\n    }\n\n    /// Apply Landlock restrictions to the current process\n    fn apply_restrictions(&self) -> std::io::Result<()> {\n        let mut ruleset = Ruleset::default()\n            .handle_access(\n                AccessFs::ReadFile\n                    | AccessFs::WriteFile","sourceCodeStart":20,"sourceCodeEnd":56,"githubUrl":"https://github.com/tinyhumansai/openhuman/blob/749120085864ce16e0f273c7b86fac7740b39c5b/src/openhuman/security/landlock.rs#L20-L56","documentation":"Availability probe inside LandlockSandbox::with_workspace: constructing a minimal Ruleset with handle_access(ReadFile|WriteFile) tests whether the kernel exposes the Landlock LSM. If that ruleset cannot be created (kernel < 5.13, Landlock compiled out of the kernel, or seccomp restrictions in the container), the constructor returns this error rather than a half-functional sandbox.","triggerScenarios":"Thrown at src/openhuman/security/landlock.rs:38 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Run on a Linux kernel >= 5.13 with CONFIG_SECURITY_LANDLOCK enabled","Avoid running the core inside containers/namespaces that filter the landlock_create_ruleset syscall","Fall back to another sandbox backend (bubblewrap, docker) or run unsandboxed per policy"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"749120085864ce16e0f273c7b86fac7740b39c5b","analyzedAt":"2026-08-17T21:21:45.363Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}