deepseek-ai/deepseek-harness · error

landlock-run: partial enforcement (older Landlock ABI)

Error message

landlock-run: partial enforcement (older Landlock ABI)

What it means

Error "landlock-run: partial enforcement (older Landlock ABI)" thrown in deepseek-ai/deepseek-harness.

Source

Thrown at native/landlock-run/packages/entry/src/main.c:292

     * report line is part of the launcher CLI contract — the executor reads
     * enforcement completeness from it. */
    static const char *probe_root = "/";
    struct cli probe = { .ro = &probe_root, .ro_count = 1 };
    int partial = 0;
    code = restrict_self(&probe, &partial);
    if (code != 0) return code;
    printf("landlock: %s\n", partial ? "partially enforced (older ABI)" : "fully enforced");
    return 0;
  }

  int partial = 0;
  code = restrict_self(&cli, &partial);
  if (code != 0) return code;
  if (partial) {
    /* Older ABI: some handled accesses are not governed (e.g. truncate
     * before ABI 3). Still confined for everything the kernel supports —
     * report, do not refuse. */
    fprintf(stderr, "landlock-run: partial enforcement (older Landlock ABI)\n");
  }

  execvp(cli.command[0], cli.command);
  /* exec only returns on failure. */
  return fail("exec failed", strerror(errno));
}

View on GitHub (pinned to b150a551b8)

Solutions

1. Upgrade the kernel for full Landlock enforcement or accept the reduced sandbox coverage.

When it happens

Trigger: Thrown at native/landlock-run/packages/entry/src/main.c:292 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of deepseek-ai/deepseek-harness@b150a551b8 (2026-08-24). Data as JSON: /api/errors/745cd1d7a5b7a12c. Report an issue: GitHub.