### Apply filesystem restrictions

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/types.md

Example demonstrating the creation of filesystem rules and applying them via RestrictPaths.

```go
rule1 := landlock.RODirs("/usr", "/bin")
rule2 := landlock.RWDirs("/tmp").IgnoreIfMissing()
rule3 := landlock.PathAccess(landlock.AccessFSSet(0x7), "/opt")

err := landlock.V9.RestrictPaths(rule1, rule2, rule3)
```

--------------------------------

### Handle cgo Multithreading

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/abi-versions.md

Example demonstrating cgo thread usage with Landlock V8+.

```go
// This now works correctly with V8+
import "C"

// C code that spawns threads
// They will all be sandboxed correctly
```

--------------------------------

### Configure network access

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/types.md

Example usage of AccessNetSet for creating a configuration.

```go
cfg, err := landlock.NewConfig(landlock.AccessNetSet(0x3))
```

--------------------------------

### Configure IPC scope

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/types.md

Example usage of ScopedSet for creating a configuration.

```go
cfg, err := landlock.NewConfig(landlock.ScopedSet(0x3))
```

--------------------------------

### Configure filesystem access

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/types.md

Example usage of AccessFSSet for creating configurations and path rules.

```go
cfg, err := landlock.NewConfig(landlock.AccessFSSet(0xF))
rule := landlock.PathAccess(landlock.AccessFSSet(0x7), "/etc")
```

--------------------------------

### Upgrade Configuration from V4 to V5

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/abi-versions.md

Example of updating rules when upgrading, specifically adding WithIoctlDev for device access.

```go
// V4 config
err := landlock.V4.RestrictPaths(
    landlock.RWDirs("/tmp"),
)

// V5 may restrict device IOCTLs
// If your app uses /dev files, you need:
err = landlock.V5.RestrictPaths(
    landlock.RWDirs("/tmp"),
    landlock.RWDirs("/dev").WithIoctlDev(),  // NEW
)
```

--------------------------------

### Configure Filesystem Access Sets

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/access-rights.md

Examples of defining custom access sets using bitmasks and applying them to paths.

```go
// Restrict only file execution (V1+)
exec := landlock.AccessFSSet(0x1) // bit 0

// Restrict reading (V1+)
read := landlock.AccessFSSet(0x7) // bits 0, 1, 2

// Create custom access set
custom := landlock.AccessFSSet(0x3) // execute + write_file

// Using PathAccess for custom rights
rule := landlock.PathAccess(custom, "/opt/app")
```

--------------------------------

### Apply network restrictions

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/types.md

Example demonstrating the creation of network rules and applying them via RestrictNet.

```go
rule1 := landlock.ConnectTCP(53)    // DNS
rule2 := landlock.BindTCP(8080)

err := landlock.V4.RestrictNet(rule1, rule2)
```

--------------------------------

### Usage of ConnectTCP

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/rules.md

Example of allowing DNS queries via TCP connect.

```go
rule := landlock.ConnectTCP(53)   // Allow DNS queries
```

--------------------------------

### Usage of BindTCP

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/rules.md

Example of allowing a process to listen on a specific TCP port.

```go
rule := landlock.BindTCP(8080)    // Allow listening on port 8080
```

--------------------------------

### Implement Landlock test with lltest

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/types.md

Example usage of lltest utilities to restrict paths within a subprocess test.

```go
import "github.com/landlock-lsm/go-landlock/landlock/lltest"

func TestLandlockRestriction(t *testing.T) {
    lltest.RequireABI(t, 9)
    
    lltest.RunInSubprocess(t, func() {
        err := landlock.V9.BestEffort().RestrictPaths(
            landlock.RODirs("/usr"),
        )
        if err != nil {
            t.Fatal(err)
        }
        // Test restricted behavior
    })
}
```

--------------------------------

### Chain Configuration Options

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/quick-reference.md

Demonstrates chaining configuration methods before applying restrictions.

```go
err := landlock.V9.
    BestEffort().
    DisableLoggingForOriginatingProcess().
    RestrictPaths(
        landlock.RODirs("/usr", "/bin"),
        landlock.RWDirs("/tmp"),
    )
```

--------------------------------

### Create Custom Configuration

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/quick-reference.md

Initializes a configuration with custom bitmask sets for filesystem and network access.

```go
cfg, err := landlock.NewConfig(
    landlock.AccessFSSet(0xF),     // Custom filesystem rights
    landlock.AccessNetSet(0x3),    // Custom network rights
)

cfg = cfg.BestEffort()
err = cfg.RestrictPaths(...)
```

--------------------------------

### Configure Landlock V5

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/abi-versions.md

Initialize the Landlock V5 configuration.

```go
cfg := landlock.V5
```

--------------------------------

### Initialize Landlock with V9

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/abi-versions.md

Use the BestEffort mode to automatically downgrade to the highest available kernel support.

```go
err := landlock.V9.BestEffort().RestrictPaths(...)
```

--------------------------------

### Configure Landlock V4

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/abi-versions.md

Initialize the Landlock V4 configuration.

```go
cfg := landlock.V4
```

--------------------------------

### Configure Network Access Restrictions

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/access-rights.md

Demonstrates manual bitmask configuration and the use of helper constructors for TCP bind and connect operations.

```go
// Restrict TCP bind operations
bindRestrict := landlock.AccessNetSet(0x1)

// Restrict TCP connect operations
connectRestrict := landlock.AccessNetSet(0x2)

// Restrict both
both := landlock.AccessNetSet(0x3)

// Using helper constructors (preferred)
bindRule := landlock.BindTCP(8080)
connectRule := landlock.ConnectTCP(53)
```

--------------------------------

### Create a Landlock Configuration

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/config.md

Use NewConfig to initialize a configuration with specific access sets, returning an error if inputs are invalid.

```go
// Create a config restricting only filesystem execute operations
cfg, err := landlock.NewConfig(landlock.AccessFSSet(0x1))
if err != nil {
    log.Fatal(err)
}
```

--------------------------------

### Configure Landlock V7

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/abi-versions.md

Initialize the V7 configuration object.

```go
cfg := landlock.V7
```

--------------------------------

### View version-specific upgrade notes

Source: https://github.com/landlock-lsm/go-landlock/blob/main/docs/upgrade.md

Consult the library documentation for a specific ABI version to understand new restrictions and safety considerations.

```bash
go doc github.com/landlock-lsm/go-landlock/landlock.V1
```

--------------------------------

### Basic Sandboxing Test

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/usage-patterns.md

Uses lltest.RequireABI to ensure kernel compatibility and lltest.RunInSubprocess to isolate the sandbox environment.

```go
package myapp

import (
    "testing"
    "github.com/landlock-lsm/go-landlock/landlock"
    "github.com/landlock-lsm/go-landlock/landlock/lltest"
)

func TestAppWithSandbox(t *testing.T) {
    lltest.RequireABI(t, 6)  // Need at least V6
    
    lltest.RunInSubprocess(t, func() {
        // Restrict in subprocess
        err := landlock.V6.RestrictPaths(
            landlock.RODirs("/usr", "/bin"),
            landlock.RWDirs(lltest.TempDir(t)),
        )
        if err != nil {
            t.Fatal(err)
        }

        // Now test app behavior
        // File operations outside allowed dirs will fail
    })
}
```

--------------------------------

### Verifying Restriction Behavior

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/usage-patterns.md

Demonstrates how to assert that file operations succeed within allowed directories and fail outside of them.

```go
package myapp

import (
    "os"
    "testing"
    "github.com/landlock-lsm/go-landlock/landlock"
    "github.com/landlock-lsm/go-landlock/landlock/lltest"
)

func TestRestrictionWorks(t *testing.T) {
    lltest.RunInSubprocess(t, func() {
        // Only allow /tmp
        err := landlock.V9.RestrictPaths(
            landlock.RWDirs("/tmp"),
        )
        if err != nil {
            t.Fatal(err)
        }

        // This should succeed (in /tmp)
        tmpfile, err := os.CreateTemp("/tmp", "test")
        if err != nil {
            t.Fatalf("Should be able to write to /tmp: %v", err)
        }
        tmpfile.Close()
        os.Remove(tmpfile.Name())

        // This should fail (outside allowed dirs)
        _, err = os.Create("/tmp_outside_allowed.txt")
        if err == nil {
            t.Error("Should not be able to write outside /tmp")
        }
    })
}
```

--------------------------------

### Check and Upgrade ABI Versions

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/abi-versions.md

Verify current version usage and test upgrades using BestEffort before committing to a higher ABI version.

```go
// Current version
err := landlock.V4.RestrictNet(...)

// Test V5 upgrade
err = landlock.V5.BestEffort().RestrictPaths(...)
// If no errors, can upgrade to V5
```

--------------------------------

### Configure Landlock V6

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/abi-versions.md

Initialize the V6 configuration object.

```go
cfg := landlock.V6
```

--------------------------------

### Chain FSRule methods

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/rules.md

Demonstrates chaining multiple FSRule configuration methods together.

```go
rule := landlock.RWDirs("/home").
    WithRefer().
    WithResolveUnix()
```

--------------------------------

### Configure Landlock V1

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/abi-versions.md

Initialize a V1-compatible configuration using either the pre-configured constant or a custom bitmask.

```go
// Pre-configured V1 instance
cfg := landlock.V1

// Or create custom V1-compatible config
cfg, _ := landlock.NewConfig(
    landlock.AccessFSSet(0x1FFF), // All V1 rights
)
```

--------------------------------

### Create a Landlock Configuration with Panic

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/config.md

Use MustConfig to initialize a configuration, which panics if the provided arguments are invalid.

```go
cfg := landlock.MustConfig(landlock.AccessFSSet(0x1))
```

--------------------------------

### Configure IPC Scope Restrictions

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/access-rights.md

Demonstrates manual bitmask configuration and the use of helper methods for IPC scope restrictions.

```go
// Restrict abstract UNIX socket connections
socketRestrict := landlock.ScopedSet(0x1)

// Restrict signals
signalRestrict := landlock.ScopedSet(0x2)

// Restrict both
both := landlock.ScopedSet(0x3)

// Using helper method (preferred)
err := landlock.V6.BestEffort().RestrictScoped()
```

--------------------------------

### Create read-write directory rules

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/rules.md

Constructs a rule permitting full read and write access for specified directories.

```go
func RWDirs(paths ...string) FSRule
```

```go
rule := landlock.RWDirs("/tmp", "/home/user/.config")
```

--------------------------------

### Custom Access Sets

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/access-rights.md

Demonstrates how to define fine-grained filesystem access rules using custom bitmasks with PathAccess.

```APIDOC
## Custom Access Sets

### Description
Use PathAccess with custom bitmasks to define specific filesystem access permissions.

### Usage
```go
readOnlyBits := landlock.AccessFSSet(1 << 2) // read_file only
rule := landlock.PathAccess(readOnlyBits, "/etc/config")
err := landlock.V9.RestrictPaths(rule)
```
```

--------------------------------

### Handle ABI version mismatches

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/errors-limitations.md

Demonstrates how BestEffort() prevents errors when the kernel supports an older ABI version than requested.

```go
// Fails on kernels below V9
err := landlock.V9.RestrictPaths(landlock.RODirs("/usr"))
// err will contain "missing kernel Landlock support" if V9 not available

// Always works by downgrading gracefully
err = landlock.V9.BestEffort().RestrictPaths(landlock.RODirs("/usr"))
// Succeeds using V1-V9 as available
```

--------------------------------

### NewConfig Argument Validation

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/errors-limitations.md

Demonstrates the correct way to provide AccessFSSet arguments to NewConfig to avoid configuration errors.

```go
// Wrong: multiple AccessFSSet arguments
cfg, err := landlock.NewConfig(
    landlock.AccessFSSet(0x1),
    landlock.AccessFSSet(0x2),
)
// err: "only one AccessFSSet may be provided"

// Correct: single AccessFSSet or other supported type
cfg, err := landlock.NewConfig(landlock.AccessFSSet(0x3))
```

--------------------------------

### Apply Basic Path Restrictions

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/quick-reference.md

Restrict access to specific read-only and read-write directories using BestEffort mode.

```go
err := landlock.V9.BestEffort().RestrictPaths(
    landlock.RODirs("/usr", "/bin", "/lib"),
    landlock.RWDirs("/tmp"),
)
```

--------------------------------

### Create DNS Lookup Rule Library

Source: https://github.com/landlock-lsm/go-landlock/blob/main/docs/rule_libraries.md

Bundles Landlock rules necessary for basic DNS lookup operations. Use this to encapsulate common DNS access requirements.

```go
// DNSLookup bundles the Landlock rules required for basic DNS lookup.
func DNSLookup() landlock.Rule {
  return landlock.CompositeRule(
    landlock.RODirs("/etc"),
    landlock.ConnectTCP(53),
  )
}
```

--------------------------------

### Main Configuration Entry Points

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/INDEX.md

Structure of the Config struct and its associated methods for managing Landlock configurations.

```text
Config (struct)
├── V1, V2, V3, V4, V5, V6, V7, V8, V9 (pre-configured instances)
├── NewConfig() (custom configuration)
├── MustConfig() (panics on error)
│
└── Methods:
    ├── BestEffort() → Config
    ├── RestrictPaths(...Rule) → error
    ├── RestrictNet(...Rule) → error
    ├── RestrictScoped() → error
    ├── Restrict(...Rule) → error
    ├── DisableLoggingForOriginatingProcess() → Config
    ├── EnableLoggingForSubprocesses() → Config
    ├── DisableLoggingForSubdomains() → Config
    └── String() → string
```

--------------------------------

### Create custom path access rules

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/rules.md

Constructs a rule with specific bit-set access rights for advanced filesystem control.

```go
func PathAccess(accessFS AccessFSSet, paths ...string) FSRule
```

```go
// Only allow reading files, not executing or listing directories
accessRights := landlock.AccessFSSet(0x4) // AccessFSReadFile
rule := landlock.PathAccess(accessRights, "/etc/config")
```

--------------------------------

### Define Filesystem Access Rules

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/quick-reference.md

Configure read-only or read-write access for directories and files.

```go
landlock.RODirs(paths...)      // Directories (read, execute, list)
landlock.ROFiles(paths...)     // Files only (read, execute)
```

```go
landlock.RWDirs(paths...)      // Directories (full access)
landlock.RWFiles(paths...)     // Files only (full access)
```

--------------------------------

### Configure Logging (V7+)

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/quick-reference.md

Adjusts logging behavior for the originating process, subprocesses, and subdomains.

```go
cfg := landlock.V7.BestEffort()
cfg = cfg.DisableLoggingForOriginatingProcess()  // Hide own denials
cfg = cfg.EnableLoggingForSubprocesses()         // Log execve'd processes
cfg = cfg.DisableLoggingForSubdomains()          // Hide child domains
```

--------------------------------

### Apply minimal filesystem restrictions

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/INDEX.md

Restrict access to specific directories using read-only and read-write modes.

```go
landlock.V9.BestEffort().RestrictPaths(
    landlock.RODirs("/usr", "/bin"),
    landlock.RWDirs("/tmp"),
)
```

--------------------------------

### Define Reusable Rule Libraries in Go

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/usage-patterns.md

Create modular sandboxing profiles using landlock.CompositeRule to standardize security policies across different application components.

```go
package myapp

import "github.com/landlock-lsm/go-landlock/landlock"

// ProfileBasic: Minimal sandbox for read-only apps
var ProfileBasic = landlock.CompositeRule(
    landlock.RODirs("/usr", "/bin", "/lib", "/lib64"),
    landlock.RWDirs("/tmp"),
)

// ProfileDatabase: For database applications
var ProfileDatabase = landlock.CompositeRule(
    landlock.RODirs("/usr", "/bin", "/lib", "/lib64"),
    landlock.RWDirs("/var/lib/mydb"),
    landlock.RWDirs("/var/log/mydb"),
    landlock.RWDirs("/tmp"),
    landlock.ConnectTCP(5432),  // PostgreSQL
)

// ProfileWebServer: For web services
var ProfileWebServer = landlock.CompositeRule(
    landlock.RODirs("/usr", "/bin", "/lib", "/lib64"),
    landlock.RODirs("/app/static"),
    landlock.RWDirs("/var/log/app"),
    landlock.RWDirs("/tmp"),
    landlock.BindTCP(8080),
    landlock.ConnectTCP(53),
    landlock.ConnectTCP(443),
)

// Usage
func ApplyBasicSandbox() error {
    return landlock.V9.BestEffort().Restrict(ProfileBasic)
}

func ApplyDatabaseSandbox() error {
    return landlock.V9.BestEffort().Restrict(ProfileDatabase)
}
```

--------------------------------

### Chain V7 Logging Methods

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/abi-versions.md

Combine multiple logging configuration methods in a single chain.

```go
cfg := landlock.V7.
    DisableLoggingForOriginatingProcess().
    EnableLoggingForSubprocesses().
    DisableLoggingForSubdomains()
```

--------------------------------

### MustConfig

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/config.md

Creates a new Landlock configuration, panicking on error.

```APIDOC
## func MustConfig(args ...any) Config

### Description
Like NewConfig but panics on error instead of returning an error.

### Parameters
- **args** (...any) - Optional - Same as NewConfig

### Return Type
- Config - The created configuration.
```

--------------------------------

### Restrict a web server process

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/INDEX.md

Apply filesystem and network restrictions suitable for a web server environment.

```go
landlock.V9.BestEffort().Restrict(
    landlock.RODirs("/usr", "/bin", "/lib"),
    landlock.RWDirs("/var/log/app"),
    landlock.BindTCP(8080),
    landlock.ConnectTCP(53),
)
```

--------------------------------

### Constructing Path Access Rules

Source: https://github.com/landlock-lsm/go-landlock/blob/main/docs/custom_fs_rules.md

Use `landlock.PathAccess` to build Landlock filesystem rules with specific access rights for given paths. Note the interdependency between WRITE_FILE and TRUNCATE access rights.

```go
accesses := landlock.PathAccess(
	landlock.AccessFS(landlock.LANDLOCK_ACCESS_FS_READ_FILE|landlock.LANDLOCK_ACCESS_FS_WRITE_FILE|landlock.LANDLOCK_ACCESS_FS_TRUNCATE),
	"/etc/passwd",
	"/etc/shadow",
)

```

--------------------------------

### Implement Configuration-Driven Restrictions

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/usage-patterns.md

Load security policies from external JSON files to allow dynamic updates without recompiling the application.

```go
package main

import (
    "encoding/json"
    "log"
    "os"
    "github.com/landlock-lsm/go-landlock/landlock"
)

type RestrictConfig struct {
    ReadOnlyDirs []string `json:"readonly_dirs"`
    ReadWriteDirs []string `json:"readwrite_dirs"`
    BindPorts []uint16 `json:"bind_ports"`
    ConnectPorts []uint16 `json:"connect_ports"`
}

func ApplyConfig(cfg RestrictConfig) error {
    var rules []landlock.Rule

    // Add read-only rules
    if len(cfg.ReadOnlyDirs) > 0 {
        rules = append(rules, landlock.RODirs(cfg.ReadOnlyDirs...))
    }

    // Add read-write rules
    if len(cfg.ReadWriteDirs) > 0 {
        rules = append(rules, landlock.RWDirs(cfg.ReadWriteDirs...))
    }

    // Add network bind rules
    for _, port := range cfg.BindPorts {
        rules = append(rules, landlock.BindTCP(port))
    }

    // Add network connect rules
    for _, port := range cfg.ConnectPorts {
        rules = append(rules, landlock.ConnectTCP(port))
    }

    return landlock.V9.BestEffort().Restrict(rules...)
}

func main() {
    // Load config
    data, _ := os.ReadFile("landlock.json")
    var cfg RestrictConfig
    json.Unmarshal(data, &cfg)

    // Apply restrictions
    if err := ApplyConfig(cfg); err != nil {
        log.Fatal(err)
    }
}
```

```json
{
    "readonly_dirs": ["/usr", "/bin", "/lib"],
    "readwrite_dirs": ["/tmp", "/var/log"],
    "bind_ports": [8080, 8443],
    "connect_ports": [53, 443]
}
```

--------------------------------

### Chain configuration methods in Go

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/config.md

Use method chaining to configure and apply Landlock restrictions in a single statement.

```go
err := landlock.V9.
    BestEffort().
    DisableLoggingForOriginatingProcess().
    Restrict(
        landlock.RODirs("/usr", "/bin"),
        landlock.RWDirs("/tmp"),
    )
```

--------------------------------

### Handle Optional Paths

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/errors-limitations.md

Use IgnoreIfMissing to prevent errors when restricting paths that may not exist on all systems.

```go
// For optional paths, mark them as such
rule := landlock.RODirs("/opt/app/plugins").IgnoreIfMissing()
err := landlock.V9.RestrictPaths(rule)
```

--------------------------------

### Create reusable rule libraries

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/usage-patterns.md

Use CompositeRule to define rules once and reuse them across multiple restriction calls.

```go
// Reusable rule library - computed once
var commonRules = landlock.CompositeRule(
    landlock.RODirs("/usr", "/bin", "/lib"),
    landlock.RWDirs("/tmp"),
)

// Use multiple times
landlock.V9.Restrict(commonRules)  // First time
landlock.V9.Restrict(commonRules)  // Subsequent times
```

--------------------------------

### Enable UNIX Domain Socket Connections

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/errors-limitations.md

Use WithResolveUnix to allow connections to pathname UNIX domain sockets outside the Landlock domain.

```go
rule := landlock.RWDirs("/var/run").WithResolveUnix()
```

--------------------------------

### Select Landlock ABI Version

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/quick-reference.md

Choose the appropriate ABI version based on the target Linux kernel requirements.

```go
landlock.V1   // Linux 5.13+  - Basic file operations
landlock.V2   // Linux 5.15+  - + File reparenting
landlock.V3   // Linux 5.19+  - + File truncation
landlock.V4   // Linux 6.2+   - + TCP networking
landlock.V5   // Linux 6.6+   - + Device IOCTL
landlock.V6   // Linux 6.7+   - + IPC scoping
landlock.V7   // Linux 6.8+   - + Audit logging
landlock.V8   // Linux 6.9+   - + Thread sync
landlock.V9   // Linux 6.10+  - + UNIX sockets
```

--------------------------------

### Configure Landlock V2

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/abi-versions.md

Sets the Landlock configuration to version 2.

```go
cfg := landlock.V2
```

--------------------------------

### Create read-write file rules

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/rules.md

Constructs a rule permitting read and write access for specific files, excluding directory operations.

```go
func RWFiles(paths ...string) FSRule
```

```go
rule := landlock.RWFiles("/var/log/myapp.log", "/tmp/cache.db")
```

--------------------------------

### Configure Landlock V3

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/abi-versions.md

Sets the Landlock configuration to version 3.

```go
cfg := landlock.V3
```

--------------------------------

### Update the go-landlock library

Source: https://github.com/landlock-lsm/go-landlock/blob/main/docs/upgrade.md

Use this command to fetch the latest version of the go-landlock library.

```bash
go get -u github.com/landlock-lsm/go-landlock
```

--------------------------------

### String

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/config.md

Returns a human-readable representation of the Config.

```APIDOC
## func (c Config) String() string

### Description
Returns a human-readable representation of the Config showing ABI version, access sets, and flags.
```

--------------------------------

### Configure Landlock V9

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/abi-versions.md

Sets the configuration to use Landlock ABI version 9.

```go
cfg := landlock.V9
```

--------------------------------

### Detect Kernel ABI Support

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/abi-versions.md

Use the lltest package to require a minimum ABI version for tests, skipping them if the kernel support is insufficient.

```go
import "github.com/landlock-lsm/go-landlock/landlock/lltest"

func TestLandlock(t *testing.T) {
    lltest.RequireABI(t, 6)  // Skip if kernel < V6
    // Test code here
}
```

--------------------------------

### Enable IOCTL Operations on Device Files

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/errors-limitations.md

Use WithIoctlDev to permit IOCTL operations on device files, which are restricted by default in V5+.

```go
rule := landlock.RWDirs("/dev").WithIoctlDev()
```

--------------------------------

### Sandbox a Web Server

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/quick-reference.md

Restrict file system access and network capabilities for a web server application.

```go
err := landlock.V9.BestEffort().Restrict(
    landlock.RODirs("/usr", "/bin", "/lib"),
    landlock.RODirs("/app/static"),
    landlock.RWDirs("/var/log/app", "/tmp"),
    landlock.BindTCP(8080),
    landlock.ConnectTCP(53),
    landlock.ConnectTCP(443),
)
```

--------------------------------

### Create read-only directory rules

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/rules.md

Constructs a rule permitting read and execute access for specified directories.

```go
func RODirs(paths ...string) FSRule
```

```go
rule := landlock.RODirs("/usr", "/bin", "/lib")
```

--------------------------------

### NewConfig

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/config.md

Creates a new Landlock configuration with custom access sets.

```APIDOC
## func NewConfig(args ...any) (*Config, error)

### Description
Creates a new Landlock configuration with custom access sets.

### Parameters
- **args** (...any) - Optional - Variable number of access set arguments (AccessFSSet, AccessNetSet, ScopedSet)

### Return Type
- (*Config, error) - A pointer to a Config or an error if arguments are invalid.
```

--------------------------------

### WithIoctlDev

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/rules.md

Adds the 'ioctl dev' access right to the FSRule, permitting IOCTL operations on device files.

```APIDOC
## WithIoctlDev

### Description
Adds the "ioctl dev" access right, permitting IOCTL operations on device files.

### Signature
`func (r FSRule) WithIoctlDev() FSRule`

### Requirements
Landlock V5 or later.

### Example
```go
rule := landlock.RWFiles("/dev/tty").WithIoctlDev()
```
```

--------------------------------

### Enable Refer Permission for File Operations

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/errors-limitations.md

Use WithRefer to allow renaming or linking files across different directories.

```go
rule := landlock.RWDirs("/home").WithRefer()
```

--------------------------------

### Define Custom Path Access with Bitmasks

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/access-rights.md

Use PathAccess with custom bitmasks for fine-grained control over filesystem operations.

```go
// Only allow reading specific files, no execution
readOnlyBits := landlock.AccessFSSet(1 << 2) // read_file only
rule := landlock.PathAccess(readOnlyBits, "/etc/config")
err := landlock.V9.RestrictPaths(rule)
```

--------------------------------

### Handle Multipath TCP Limitations

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/abi-versions.md

Demonstrates the limitation of Landlock with Multipath TCP in Go 1.24+ and the recommended Unix socket workaround.

```go
// This will NOT be restricted by Landlock (Go 1.24+)
listener, _ := net.Listen("tcp", ":8080") 

// Workaround: Use Unix domain sockets
listener, _ := net.Listen("unix", "/tmp/app.sock")
```

--------------------------------

### Apply Custom Path Access

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/quick-reference.md

Use fine-grained control for specific path access requirements.

```go
landlock.PathAccess(accessSet, paths...)  // Fine-grained control
```

--------------------------------

### Add IoctlDev access right to FSRule

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/rules.md

Permits IOCTL operations on device files. Requires Landlock V5 or later.

```go
rule := landlock.RWFiles("/dev/tty").WithIoctlDev()
```

--------------------------------

### Configure Landlock V8

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/abi-versions.md

Sets the configuration to use Landlock ABI version 8.

```go
cfg := landlock.V8
```

--------------------------------

### Restrict Paths with V1

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/abi-versions.md

Apply V1 filesystem restrictions to specific directories using read-only and read-write access modes.

```go
err := landlock.V1.RestrictPaths(
    landlock.RODirs("/usr", "/bin"),
    landlock.RWDirs("/tmp"),
)
```

--------------------------------

### Filesystem Rules

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/quick-reference.md

Methods for defining filesystem access permissions.

```APIDOC
## Filesystem Rules

### Read-Only Access
- **landlock.RODirs(paths...)** - Grants read, execute, and list access to directories.
- **landlock.ROFiles(paths...)** - Grants read and execute access to files.

### Read-Write Access
- **landlock.RWDirs(paths...)** - Grants full access to directories.
- **landlock.RWFiles(paths...)** - Grants full access to files.

### Custom Access
- **landlock.PathAccess(accessSet, paths...)** - Provides fine-grained control over path access.

### Modifiers
- **rule.WithRefer()** - Allow file reparenting (V2+)
- **rule.WithIoctlDev()** - Allow device IOCTL (V5+)
- **rule.WithResolveUnix()** - Allow UNIX socket connect (V9+)
- **rule.IgnoreIfMissing()** - Skip paths that do not exist.
```

--------------------------------

### Import go-landlock

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/quick-reference.md

Required import statement for accessing the landlock package.

```go
import "github.com/landlock-lsm/go-landlock/landlock"
```

--------------------------------

### Enable Best Effort Mode

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/quick-reference.md

Use this mode for portable applications to automatically downgrade to the highest version supported by the host kernel.

```go
landlock.V9.BestEffort()  // Downgrades to available version
```

--------------------------------

### Stacked Ruleset Limit Management

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/errors-limitations.md

Illustrates how to avoid hitting the maximum number of stacked rulesets by consolidating restriction calls.

```go
// This could hit the limit with many threads
for i := 0; i < 1000; i++ {
    landlock.V9.BestEffort().RestrictPaths(landlock.RODirs("/tmp"))
}

// Better: restrict once
err := landlock.V9.BestEffort().RestrictPaths(landlock.RODirs("/tmp"))
```

--------------------------------

### Verify Critical Paths

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/errors-limitations.md

Validate the existence of required filesystem paths before applying restrictions to prevent runtime failures.

```go
// For critical paths, verify before restricting
for _, path := range []string{"/usr", "/bin", "/lib"} {
    if _, err := os.Stat(path); err != nil {
        log.Fatalf("Required path %s missing: %v", path, err)
    }
}

err := landlock.V9.RestrictPaths(landlock.RODirs("/usr", "/bin", "/lib"))
```

--------------------------------

### Restrict Application Early in Go

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/usage-patterns.md

Applies security restrictions immediately upon application startup to minimize the attack surface before executing user-defined logic.

```go
package main

import (
    "log"
    "os"
    "github.com/landlock-lsm/go-landlock/landlock"
)

func main() {
    // Restrict BEFORE doing anything else
    if err := landlock.V9.BestEffort().RestrictPaths(
        landlock.RODirs("/usr"),
    ); err != nil {
        log.Fatal(err)
    }

    // Now safe to run user code
    runApplication()
}
```

--------------------------------

### Sandbox a Subprocess

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/quick-reference.md

Apply restrictions to the current process before executing an untrusted program.

```go
landlock.V9.BestEffort().RestrictPaths(
    landlock.RODirs("/usr", "/bin"),
    landlock.RWDirs("/tmp"),
)
cmd := exec.Command("./untrusted-program")
cmd.Run()
```

--------------------------------

### Handle kernel support errors with BestEffort

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/errors-limitations.md

Use BestEffort() to gracefully handle cases where the kernel does not support the requested Landlock version.

```go
err := landlock.V9.RestrictPaths(landlock.RODirs("/usr"))
if err != nil {
    // May be ENOSYS
}

// Better approach with BestEffort
err = landlock.V9.BestEffort().RestrictPaths(landlock.RODirs("/usr"))
// Always succeeds
```

--------------------------------

### Incompatible Rule Handling

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/errors-limitations.md

Shows how rules requiring access rights not defined in the configuration trigger errors.

```go
// Config only restricts execute right
cfg, err := landlock.NewConfig(landlock.AccessFSSet(0x1))

// Rule asks for write_file (bit 1) which isn't in config
rule := landlock.PathAccess(landlock.AccessFSSet(0x2), "/tmp")

// This will error because rule accesses not in config.handledAccessFS
err = cfg.RestrictPaths(rule)
// err: incompatible rule
```

--------------------------------

### Enforce strict mode

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/usage-patterns.md

Use standard RestrictPaths without BestEffort to ensure the application fails if the exact ABI version is not supported by the kernel.

```go
package main

import (
    "log"
    "github.com/landlock-lsm/go-landlock/landlock"
)

func main() {
    // Fails if kernel doesn't have exact ABI version
    err := landlock.V9.RestrictPaths(
        landlock.RODirs("/usr"),
    )
    if err != nil {
        log.Fatalf("V9 not available: %v", err)
    }
}
```

--------------------------------

### EnableLoggingForSubprocesses

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/config.md

Enables audit logging of denied accesses after execve(2) calls.

```APIDOC
## func (c Config) EnableLoggingForSubprocesses() Config

### Description
Enables audit logging of denied accesses after execve(2) calls, providing visibility into behavior of newly executed programs.

### Return Type
Config - A new config with this logging flag set.
```

--------------------------------

### Restrict Device IOCTLs with V5

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/abi-versions.md

Grant IOCTL permissions on specific device paths using V5 path restrictions.

```go
// Grant IOCTL permission on device files
rule := landlock.RWDirs("/dev").WithIoctlDev()
err := landlock.V5.RestrictPaths(rule)
```

--------------------------------

### Network Rules (NetRule)

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/INDEX.md

Constructors for defining network access rules.

```text
NetRule
├── ConnectTCP(port) → NetRule
└── BindTCP(port) → NetRule
```

--------------------------------

### Define ConnectTCP Constructor

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/rules.md

Constructor signature for creating a TCP connect rule.

```go
func ConnectTCP(port uint16) NetRule
```

--------------------------------

### Define BindTCP Constructor

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/rules.md

Constructor signature for creating a TCP bind rule.

```go
func BindTCP(port uint16) NetRule
```

--------------------------------

### Apply Conditional Restrictions Based on Environment

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/usage-patterns.md

Adjust security strictness dynamically by checking environment variables, useful for differentiating between development and production deployments.

```go
package main

import (
    "log"
    "os"
    "github.com/landlock-lsm/go-landlock/landlock"
)

func ApplyRestrictions() error {
    env := os.Getenv("ENVIRONMENT")
    
    // Development: more permissive
    if env == "dev" {
        return landlock.V9.BestEffort().RestrictPaths(
            landlock.RODirs("/usr", "/bin", "/lib"),
            landlock.RWDirs("/tmp", "/home"),  // Allow home directory
        )
    }

    // Production: strict
    return landlock.V9.RestrictPaths(
        landlock.RODirs("/usr", "/bin", "/lib"),
        landlock.RWDirs("/tmp"),
    )
}

func main() {
    if err := ApplyRestrictions(); err != nil {
        log.Fatal(err)
    }
}
```

--------------------------------

### Configure Audit Logging

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/config.md

Methods to control audit logging behavior for processes and subdomains.

```go
cfg := landlock.V7.DisableLoggingForOriginatingProcess()
```

```go
cfg := landlock.V7.EnableLoggingForSubprocesses()
```

```go
cfg := landlock.V7.DisableLoggingForSubdomains()
```

--------------------------------

### Define and apply a reusable profile

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/INDEX.md

Group multiple rules into a CompositeRule for modular and reusable security profiles.

```go
var webProfile = landlock.CompositeRule(
    landlock.RODirs("/usr", "/bin"),
    landlock.RWDirs("/tmp"),
    landlock.BindTCP(8080),
)

landlock.V9.BestEffort().Restrict(webProfile)
```

--------------------------------

### Verify path existence before restriction

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/errors-limitations.md

Manually check if a path exists using os.Stat before applying a rule.

```go
if _, err := os.Stat("/usr"); err == nil {
    rule := landlock.RODirs("/usr")
    err = landlock.V9.RestrictPaths(rule)
}
```

--------------------------------

### Create read-only file rules

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/rules.md

Constructs a rule permitting read access for specific files, excluding directory operations.

```go
func ROFiles(paths ...string) FSRule
```

```go
rule := landlock.ROFiles("/etc/passwd", "/etc/group")
```

--------------------------------

### Apply BestEffort Portability

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/errors-limitations.md

Use BestEffort to maintain compatibility across different kernel versions that may not support all features.

```go
// Recommended for applications that should work on multiple kernel versions
err := landlock.V9.BestEffort().RestrictPaths(...)
```

--------------------------------

### lltest.TempDir

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/types.md

Creates a temporary directory specifically for use within Landlock-enabled tests.

```APIDOC
## TempDir

### Description
Creates a temporary directory for use in tests.

### Signature
`func TempDir(t testing.TB) string`

### Parameters
- **t** (testing.TB) - Required - The testing interface.
```

--------------------------------

### Configure logging for restrictions

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/rules.md

Disable logging for the originating process while applying filesystem restrictions.

```go
err := landlock.V9.BestEffort().
    DisableLoggingForOriginatingProcess().
    RestrictPaths(
        landlock.RODirs("/usr", "/bin"),
    )
```

--------------------------------

### WithResolveUnix

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/rules.md

Adds the 'resolve unix' access right to the FSRule, permitting connect(2) and sendmsg(2) on pathname UNIX domain sockets.

```APIDOC
## WithResolveUnix

### Description
Adds the "resolve unix" access right, permitting connect(2) and sendmsg(2) on pathname UNIX domain sockets. Affects unix(7) sockets and glibc NSS lookups in cgo binaries.

### Signature
`func (r FSRule) WithResolveUnix() FSRule`

### Requirements
Landlock V9 or later.

### Example
```go
rule := landlock.RWDirs("/var/run").WithResolveUnix()
```
```

--------------------------------

### Test Sandboxed Code

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/quick-reference.md

Use lltest utilities to enforce ABI requirements and run tests in isolated subprocesses.

```go
import "github.com/landlock-lsm/go-landlock/landlock/lltest"

func TestSandboxed(t *testing.T) {
    lltest.RequireABI(t, 6)  // Skip if kernel < V6
    
    lltest.RunInSubprocess(t, func() {
        landlock.V6.RestrictPaths(...)
        // Test restricted behavior
    })
}

tempDir := lltest.TempDir(t)  // Use instead of t.TempDir()
```

--------------------------------

### Add Refer Right to Rules

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/abi-versions.md

Permits moving or linking files between directories by adding the WithRefer capability.

```go
// Allow moving files between allowed directories
rule := landlock.RWDirs("/home", "/backup").WithRefer()
err := landlock.V2.RestrictPaths(rule)
```

--------------------------------

### Restrict Paths with V9

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/abi-versions.md

Applies path restrictions using Landlock V9, including UNIX socket resolution.

```go
err := landlock.V9.RestrictPaths(
    landlock.RWDirs("/var/run").WithResolveUnix(),
)
```

--------------------------------

### Filesystem Rules (FSRule)

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/INDEX.md

Constructors and modifiers available for defining filesystem access rules.

```text
FSRule
├── Constructors:
│   ├── RODirs(paths...) → FSRule
│   ├── RWDirs(paths...) → FSRule
│   ├── ROFiles(paths...) → FSRule
│   ├── RWFiles(paths...) → FSRule
│   └── PathAccess(accessFS, paths...) → FSRule
│
└── Modifiers:
    ├── WithRefer() → FSRule
    ├── WithIoctlDev() → FSRule
    ├── WithResolveUnix() → FSRule
    ├── IgnoreIfMissing() → FSRule
    └── String() → string
```

--------------------------------

### Access Syscall Constants

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/access-rights.md

Low-level access rights available via the syscall subpackage for specific ABI versions.

```go
import llsys "github.com/landlock-lsm/go-landlock/landlock/syscall"

// Individual rights
llsys.AccessFSExecute     // Bit 0
llsys.AccessFSWriteFile   // Bit 1
llsys.AccessFSReadFile    // Bit 2
llsys.AccessFSReadDir     // Bit 3
llsys.AccessFSRemoveDir   // Bit 4
llsys.AccessFSRemoveFile  // Bit 5
llsys.AccessFSMakeChar    // Bit 6
llsys.AccessFSMakeDir     // Bit 7
llsys.AccessFSMakeReg     // Bit 8
llsys.AccessFSMakeSock    // Bit 9
llsys.AccessFSMakeFifo    // Bit 10
llsys.AccessFSMakeBlock   // Bit 11
llsys.AccessFSMakeSym     // Bit 12
llsys.AccessFSRefer       // Bit 13 (V2+)
llsys.AccessFSTruncate    // Bit 14 (V3+)
llsys.AccessFSIoctlDev    // Bit 15 (V5+)
llsys.AccessFSResolveUnix // Bit 16 (V9+)
```

--------------------------------

### ABI Versioning

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/quick-reference.md

Select the appropriate Landlock ABI version based on the target Linux kernel version.

```APIDOC
## ABI Versions

### Description
Select the Landlock ABI version that matches the target Linux kernel requirements.

### Constants
- **landlock.V1** (Linux 5.13+) - Basic file operations
- **landlock.V2** (Linux 5.15+) - Includes file reparenting
- **landlock.V3** (Linux 5.19+) - Includes file truncation
- **landlock.V4** (Linux 6.2+) - Includes TCP networking
- **landlock.V5** (Linux 6.6+) - Includes device IOCTL
- **landlock.V6** (Linux 6.7+) - Includes IPC scoping
- **landlock.V7** (Linux 6.8+) - Includes audit logging
- **landlock.V8** (Linux 6.9+) - Includes thread sync
- **landlock.V9** (Linux 6.10+) - Includes UNIX sockets

### Best Effort Mode
- **landlock.V9.BestEffort()** - Downgrades to the highest version supported by the current kernel.
```

--------------------------------

### Define Config struct

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/types.md

Represents the core Landlock security configuration structure.

```go
type Config struct {
    // Private fields
}
```

--------------------------------

### Search for existing ABI usage

Source: https://github.com/landlock-lsm/go-landlock/blob/main/docs/upgrade.md

Identify the currently used ABI version by searching for landlock version constants in the codebase.

```bash
grep -R 'landlock\.V'
```

--------------------------------

### Handle missing paths with IgnoreIfMissing

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/errors-limitations.md

Use IgnoreIfMissing() to prevent errors when a specified path does not exist.

```go
rule := landlock.RODirs("/optional/config").IgnoreIfMissing()
err := landlock.V9.RestrictPaths(rule)
// No error even if path doesn't exist
```

--------------------------------

### ABI Version-Specific Tests

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/usage-patterns.md

Uses lltest.RequireABI to conditionally execute tests based on the kernel's Landlock ABI version.

```go
package myapp

import (
    "testing"
    "github.com/landlock-lsm/go-landlock/landlock"
    "github.com/landlock-lsm/go-landlock/landlock/lltest"
)

func TestV4Features(t *testing.T) {
    lltest.RequireABI(t, 4)  // Skip if kernel < V4
    
    lltest.RunInSubprocess(t, func() {
        err := landlock.V4.RestrictNet(
            landlock.BindTCP(8080),
        )
        if err != nil {
            t.Fatal(err)
        }
        // Test network restrictions
    })
}

func TestV6Features(t *testing.T) {
    lltest.RequireABI(t, 6)  // Skip if kernel < V6
    
    lltest.RunInSubprocess(t, func() {
        err := landlock.V6.RestrictScoped()
        if err != nil {
            t.Fatal(err)
        }
        // Test IPC restrictions
    })
}
```

--------------------------------

### Implement Graceful Degradation

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/usage-patterns.md

Applies different restriction levels based on the available Landlock ABI version. BestEffort allows the application to continue if a specific feature is unsupported.

```go
package main

import (
    "log"
    "github.com/landlock-lsm/go-landlock/landlock"
)

func restrictFileSystem() error {
    return landlock.V9.BestEffort().RestrictPaths(
        landlock.RODirs("/usr", "/bin", "/lib"),
        landlock.RWDirs("/tmp"),
    )
}

func restrictNetwork() error {
    // Only works with V4+, returns success on older kernels
    return landlock.V4.BestEffort().RestrictNet(
        landlock.BindTCP(8080),
        landlock.ConnectTCP(53),
    )
}

func restrictIPC() error {
    // Only works with V6+, returns success on older kernels
    return landlock.V6.BestEffort().RestrictScoped()
}

func main() {
    if err := restrictFileSystem(); err != nil {
        log.Fatal(err)
    }
    if err := restrictNetwork(); err != nil {
        log.Fatal(err)
    }
    if err := restrictIPC(); err != nil {
        log.Fatal(err)
    }
}
```

--------------------------------

### Restrict filesystem access with Landlock

Source: https://github.com/landlock-lsm/go-landlock/blob/main/README.md

Apply filesystem restrictions to the current process by specifying read-only and read-write directories.

```go
err := landlock.V9.BestEffort().RestrictPaths(
    landlock.RODirs("/usr", "/bin"),
    landlock.RWDirs("/tmp"),
)
```

--------------------------------

### BestEffort

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/config.md

Enables best-effort mode for a configuration.

```APIDOC
## func (c Config) BestEffort() Config

### Description
Returns a new Config that will opportunistically enforce the strongest rules it can, up to the configured ABI version, working with whatever Landlock support is available in the running kernel.

### Return Type
- Config - A new config with best-effort mode enabled.
```

--------------------------------

### Combine network and filesystem restrictions

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/rules.md

Apply both directory access and TCP network rules in a single restriction call.

```go
err := landlock.V9.BestEffort().Restrict(
    landlock.RODirs("/usr", "/bin"),
    landlock.BindTCP(8080),
    landlock.ConnectTCP(53),
)
```

--------------------------------

### Document ABI Version Requirements

Source: https://github.com/landlock-lsm/go-landlock/blob/main/_autodocs/errors-limitations.md

Explicitly check for required ABI versions to ensure the application has the necessary security features.

```go
// Require V9 for full functionality
if err := landlock.V9.RestrictPaths(...); err != nil {
    log.Fatalf("V9 required but not available: %v", err)
}
```