Landlock Trace Events

Author:

Mickaël Salaün

Date:

September 2026

Landlock emits trace events for sandbox lifecycle operations and access denials. These events can be consumed by ftrace (for human-readable trace output and filtering) and by eBPF programs (for programmatic introspection via BTF).

User space documentation can be found here: Landlock: unprivileged access control

Warning

Landlock trace events, like audit records, expose sensitive information about all sandboxed processes on the system. See Observability security considerations for security considerations and privilege requirements.

Event overview

Landlock trace events are organized in four categories:

Syscall events are emitted during Landlock system calls:

  • landlock_create_ruleset: a new ruleset is created

  • landlock_add_rule_path_beneath: a filesystem rule is added to a ruleset

  • landlock_add_rule_net_port: a network port rule is added to a ruleset

  • landlock_create_domain: a new domain is created from a ruleset

  • landlock_enforce_domain: a domain is enforced on a thread

Denial events are emitted when an access is denied:

  • landlock_deny_access_fs: filesystem access denied

  • landlock_deny_access_net: network access denied

  • landlock_deny_ptrace: ptrace access denied

  • landlock_deny_scope_signal: signal delivery denied

  • landlock_deny_scope_abstract_unix_socket: abstract unix socket access denied

Rule evaluation events are emitted during rule matching:

  • landlock_check_rule_inode: an inode-keyed rule is evaluated

  • landlock_check_rule_net_port: a network-port-keyed rule is evaluated

Lifecycle events:

  • landlock_free_domain: a domain is freed

  • landlock_free_ruleset: a ruleset is freed

Enabling events

Enable all Landlock events:

echo 1 > /sys/kernel/tracing/events/landlock/enable

Enable a specific event:

echo 1 > /sys/kernel/tracing/events/landlock/landlock_deny_access_fs/enable

Read the trace output:

cat /sys/kernel/tracing/trace_pipe

Event samples

A fully unprivileged program is sandboxed so that it can still run (its binary and shared libraries stay readable) and write only /tmp, then it is denied reading /etc/passwd, which lies outside its read-only set. /etc/passwd is world-readable, so the denial comes solely from Landlock, not from regular file permissions:

$ cd /sys/kernel/tracing/events/landlock/
$ echo 1 | tee landlock_{create_ruleset,create_domain,enforce_domain,deny_access_fs,free_domain}/enable >/dev/null
$ LC_ALL=C LL_FS_RO=/usr:/lib:/lib64:/bin:/etc/ld.so.cache LL_FS_RW=/tmp \
    ./sandboxer cat /etc/passwd
$ cat /sys/kernel/tracing/trace_pipe
cat-127 [...] landlock_create_ruleset: ruleset=195cc6b76.0 handled_fs=execute|write_file|read_file|read_dir|remove_dir|remove_file|make_char|make_dir|make_reg|make_sock|make_fifo|make_block|make_sym|refer|truncate|ioctl_dev|resolve_unix handled_net= scoped=
cat-127 [...] landlock_create_domain: domain=195cc6b7c parent=0 ruleset=195cc6b76.6
cat-127 [...] landlock_enforce_domain: domain=195cc6b7c complete=1 process_wide=1 no_new_privs=1
cat-127 [...] landlock_deny_access_fs: domain=195cc6b7c same_exec=0 logged=0 blockers=read_file dev=0:17 ino=5901179 path=/etc/passwd
kworker/0:1-11 [...] landlock_free_domain: domain=195cc6b7c denials=1

The [...] replaces the ftrace CPU, flags, and timestamp columns. The first four events share the cat command name and PID because the sandboxer replaces itself with cat via execve() before the denial, and ftrace resolves a recorded PID to its latest command name. landlock_free_domain fires later from a kworker thread, so it carries that thread’s name instead.

Here logged=0 shows that audit would not record this cross-execution denial under the default flags, yet the deny_access_fs event still appears.

Differences from audit records

Tracepoints and audit records both log Landlock denials, but differ in some field formats:

  • Paths: Most filesystem tracepoints resolve the path with d_absolute_path() (namespace-independent absolute paths), while mount-topology denials that carry only a dentry use dentry_path_raw(). Audit uses d_path() (relative to the process’s chroot). A resolution failure is reported as <no_mem>, <too_long>, or <unreachable>. Path-based tracepoint output is deterministic regardless of the tracer’s mount namespace.

  • Device names: Tracepoints use numeric dev=<major>:<minor>. Audit uses string dev="<s_id>". Numeric format is more precise for machine parsing.

  • Denied access field: The deny_access_fs and deny_access_net tracepoints use the blockers= field name (same as audit). Both render the blocked access rights as names: audit prefixes the category and separates with commas (e.g., blockers=fs.read_file), while the tracepoints omit the category (carried by the event name) and separate with | (e.g., blockers=read_file). Scope and ptrace tracepoints omit blockers because the event name identifies the denial type.

  • Scope and ptrace target names: Tracepoints use role-specific field names (tracee_pid, target_pid, peer_pid) that reflect the semantic of each event. Audit uses generic names (opid, ocomm) because the audit log format is not event-type-specific.

  • Process name: The ptrace and signal denial tracepoints include the role-prefixed tracee_comm= and target_comm= labels in the printk output for stateless consumers (each matches its sibling tracee_pid=/target_pid= field). eBPF consumers can read comm directly from the task_struct via BTF. The comm value is treated as untrusted input and escaped in the trace text output so it cannot inject field separators or control characters.

  • Other party’s domain: A scope or ptrace denial compares the subject’s denying domain (domain=), which is the enforcing domain and not necessarily the current task’s domain, with the other party’s domain. These tracepoints also report the other party’s domain as a scalar ID: tracee_domain= (ptrace), target_domain= (signal), and peer_domain= (abstract unix socket). It is 0 when the other party is unsandboxed, and otherwise a domain ID that a consumer resolves against the landlock_create_ruleset and landlock_create_domain events it recorded. Because a scope or ptrace verdict is decided by comparing the two domains, resolving both the subject domain= and this other-party ID against those lifecycle events lets a consumer verify or reproduce the verdict by redoing the same two-domain comparison, rather than only noting which boundary was crossed. Audit records do not carry the other party’s domain.

Ruleset versioning

Syscall events include a ruleset version (ruleset=<hex_id>.<version>) that tracks the number of rules added to the ruleset. The version is incremented on each landlock_add_rule() call and frozen at landlock_restrict_self() time. This enables trace consumers to correlate a domain with the exact set of rules it was created from.

Domain enforcement

The whole-process-enforced guarantee (complete=1 && process_wide=1) is the observable outcome of a successful landlock_restrict_self(..., LANDLOCK_RESTRICT_SELF_TSYNC); see the thread synchronization section of Landlock: unprivileged access control.

The Landlock events and the generic syscall tracepoints are complementary: the Landlock events expose the semantic effect of an operation (the domain, its scope, the resulting no_new_privs state), while raw_syscalls:sys_enter/sys_exit (or the per-syscall syscalls:sys_{enter,exit}_landlock_* under CONFIG_FTRACE_SYSCALLS) expose the raw API -- the exact landlock_restrict_self() flags, arguments, and return value. Correlate them by thread; a LANDLOCK_RESTRICT_SELF_TSYNC operation also enforces the domain on the sibling threads, whose landlock_enforce_domain events fire in each sibling’s own context rather than the caller’s, so correlate those to the syscall by domain ID.

Interpreting check_rule events

The check_rule_inode and check_rule_net_port events expose the per-layer rule evaluation, which is useful for understanding why a specific access is allowed or denied.

Warning

These events fire on the access-check hot path, once per matching rule per check. On a busy sandboxed workload this can be very high frequency. Enable them only for targeted debugging, ideally combined with an ftrace filter (for example on ino or domain_id), and expect tracing overhead while they are enabled.

Two output fields carry the evaluation:

  • access_request= is the set of access rights being evaluated against the rule, rendered as |-separated names. For most checks this is the access the operation requested. For filesystem rename and link double-checks it is the domain’s full handled mask, because those operations re-evaluate every handled right.

  • grants= is a per-layer breakdown of the requested rights that this rule grants, in the form {<layer>,<layer>,...}:

    • The braces wrap one comma-separated group per domain layer, ordered from the outermost (least nested) sandbox layer to the innermost.

    • Each group lists the requested rights the rule grants at that layer, joined by |.

    • An empty group (for example the middle layer in {read_file,,read_file}) means the rule grants none of the requested rights at that layer.

A Landlock domain allows an access only when, for every requested right, every layer that handles that right has at least one matching rule granting it. A single check_rule event therefore shows one rule’s contribution, not the final decision:

  • If a right appears in every layer’s group, this rule alone is sufficient to allow that right.

  • If a right is missing from some layer’s group, that layer must grant it through another matching rule, or the right is denied and appears in the blockers= field of the corresponding deny_access event.

For an access check that a consumer can delimit, aggregate the grants= groups of all matching check_rule events. These events do not carry a request ID; use their execution context and generic tracepoints to separate concurrent or successive checks of the same object.

Note

Because a verdict requires aggregating grants= across all matching rules of one access check, a stateless ftrace filter on a single check_rule event cannot distinguish an allowed access from a denied one.

For example, a program sandboxed with read and execute access to the whole filesystem reads /etc/passwd; both the execve() and the read match the rule covering / (inode 2), so check_rule_inode fires with the requested rights intersected against what that rule grants. The access_request= mask includes truncate because the file-open hook evaluates that optional right alongside the required access, but the rule does not grant it, so truncate never appears in grants=:

cat-127 [...] landlock_check_rule_inode: domain=1e40cb56f access_request=execute|read_file|truncate dev=0:17 ino=2 grants={execute|read_file}
cat-127 [...] landlock_check_rule_inode: domain=1e40cb56f access_request=read_file|truncate dev=0:17 ino=2 grants={read_file}

The [...] replaces the ftrace CPU, flags, and timestamp columns. A single grants= group means the enforcing domain has one layer. With two nested sandboxes that each grant the same rights, the rule spans both layers, so grants= has one group per layer:

cat-128 [...] landlock_check_rule_inode: domain=184788b52 access_request=execute|read_file|truncate dev=0:17 ino=2 grants={execute|read_file,execute|read_file}
cat-128 [...] landlock_check_rule_inode: domain=184788b52 access_request=read_file|truncate dev=0:17 ino=2 grants={read_file,read_file}

eBPF access

BTF-enabled raw tracepoint programs attached through libbpf SEC("tp_btf/...") sections receive typed callback arguments. The event prototypes in Event reference document their argument layouts. The arguments include both standard kernel objects and Landlock-internal objects:

  • Standard kernel objects (struct task_struct, struct sock, struct path, struct dentry) can be used with existing BPF helpers.

  • Landlock-internal objects (struct landlock_domain, struct landlock_ruleset, struct landlock_rule, struct landlock_hierarchy) can be read via BPF_CORE_READ. Internal struct layouts may change between kernel versions; use CO-RE for field relocation.

A stateful eBPF program attached before sandbox construction can maintain per-domain state in BPF maps:

  1. On landlock_create_domain: record the domain ID and parent (the per-domain Landlock log flags are not event fields; read them from struct landlock_hierarchy via BTF if needed).

  2. On landlock_enforce_domain: record the sandboxed thread under the domain= key (join to the create_domain recorded in step 1), building the per-domain thread set; filter complete==1 for a one-event-per-operation summary.

  3. On landlock_deny_access_*: look up the domain, decide whether to count, alert, or ignore the denial based on custom policy.

  4. On landlock_free_domain: clean up the per-domain state, log final statistics.

This approach requires no kernel modification and no Landlock-specific BPF helpers. Landlock IDs serve as correlation keys within one boot. Records exported through tracing or BPF buffers can be lost, and records from different CPUs are not globally ordered, so consumers must detect and reconcile incomplete state.

Audit filtering equivalence

The logged field reflects the domain’s log policy but not the global audit_enabled toggle, so it does not change when audit is turned on or off. When audit is enabled, logged==1 selects the denials the domain submits to audit (audit-side rate-limiting and exclude rules may still drop some), so a stateless ftrace filter can select them:

# Show only denials that audit would also log:
echo 'logged==1' > \
    /sys/kernel/tracing/events/landlock/landlock_deny_access_fs/filter

Event reference

These guarantees and constraints hold for every Landlock tracepoint. A new tracepoint must uphold them, and an eBPF consumer can rely on them.

Decision context

A denial event identifies the domain whose policy denied the request, the Landlock operation and policy object that were checked, and the blocker or domain relationship responsible for the denial. When tracing starts with sandbox construction, ruleset and domain events provide the policy history needed to interpret these identifiers. The denying domain is the subject that enforced the policy, not necessarily current. Generic tracepoints can provide additional operational context.

Lifecycle consistency

Lifecycle emission is balanced: a creation event always has a matching deallocation event and vice versa. A consumer that observes an object’s complete lifetime can model it from this pair; one that attaches late or loses exported records must reconcile incomplete state. A creation event fires while the object is still private to the calling thread (landlock_create_ruleset fires before the ruleset’s file descriptor is installed, so it cannot race a concurrent close(2)); if fd installation later fails and the ruleset is freed, free_ruleset still fires, keeping the pair balanced. The domain pair (create_domain and free_domain) is balanced the same way: create_domain fires when the domain is created (under the ruleset lock, before thread-sync), and free_domain fires when it is freed. A rare thread-sync failure aborts the just-created domain, which then emits both events (its creation, then an immediate free). Denial events fire only for denials that actually happen.

Pointer access

All pointer arguments in TP_PROTO are guaranteed non-NULL by the caller, but pointers reached through them may still be NULL (e.g., hierarchy->parent at a root domain) and must be checked. eBPF programs read these pointers via BTF for richer introspection than the TP_STRUCT__entry fields, which serve TP_printk display only.

Mutable object pointers are passed while the caller holds the object’s lock, so TP_fast_assign and a BTF reader see the exact object the event reports, a snapshot no concurrent writer can change: add_rule holds the modified ruleset’s lock, and create_domain holds the ruleset lock across the emission (before the thread-sync wait) so the inspected ruleset is the one merged into the domain. Objects immutable at the emission site (a domain after creation, a hierarchy at its last reference) need no lock. A few values that no held lock protects are a best-effort lockless snapshot instead: a task’s comm, and the deny_access_net struct sock (whose network hook holds no socket lock), matching how the sched and signal trace events sample comm.

Field encoding

Fields that mirror the Landlock UAPI preserve their widths and endianness (e.g. network ports are u64 in host endianness, like landlock_net_port_attr.port). Per-event details, such as where a value is byte-swapped, live in the field’s own kdoc.

Rule-check fields

The check_rule events fire during an access check, once per matching rule, before the final allow-or-deny verdict. They share domain (the enforcing domain being evaluated), access_request (the access mask being checked), and rule (the matching rule, with per-layer access masks).

Denial fields

Every denial event shares three fields. domain is the ID of the innermost domain that blocked the access. same_exec tells whether the current task is the same executable that entered that domain. logged is the domain’s audit-logging decision for this denial (its log_status is enabled and the per-execution flag selected by same_exec is set); a stateless ftrace filter can select the denials the domain submits to audit with logged==1, without reconstructing it from the per-execution log flags. Denial events order their fields as domain, same_exec, logged, then blockers (deny_access events only), then the type-specific object fields, then any variable-length field.

Relational referents

A scope or ptrace verdict compares two domains, so the other party’s domain is part of the decision context. It is exposed as a scalar domain ID (0 when that party is unsandboxed): target_domain (signal), peer_domain (abstract unix socket), tracee_domain (ptrace). With both IDs in the stream, a consumer that tracked domain creation can relate the two parties without kernel-internal state. The ID is a scalar snapshot, not a live domain pointer that could dangle: an optional relational referent is a scalar (0 sentinel), not a nullable pointer. Nonzero IDs are unique within one boot. For ptrace, same_exec instead describes the tracer, even for PTRACE_TRACEME, and may differ from the current task.

Blocker fields

The filesystem and network blocker arguments identify the request type and carry its final missing access subset when applicable. The type determines how to interpret the access value.

void trace_landlock_create_ruleset(const struct landlock_ruleset *ruleset)

New ruleset created

Parameters

const struct landlock_ruleset *ruleset

Newly created ruleset (never NULL); not yet shared via an fd, so no lock is needed.

Description

Emitted by sys_landlock_create_ruleset() while the new ruleset is still private to the calling thread, before its file descriptor is installed, so it cannot race a concurrent close(2). Balanced by a matching landlock_free_ruleset event.

void trace_landlock_free_ruleset(const struct landlock_ruleset *ruleset)

Ruleset freed

Parameters

const struct landlock_ruleset *ruleset

Ruleset being freed (never NULL); at its last reference, so no lock is needed.

Description

Emitted when a ruleset’s last reference is dropped (typically when the creating process closes the ruleset file descriptor). Fires even when file-descriptor installation failed after creation, keeping the create/free pair balanced.

void trace_landlock_add_rule_path_beneath(const struct landlock_ruleset *ruleset, u32 flags, u64 access_rights, const struct path *path, const char *pathname)

Path-beneath rule added to a ruleset

Parameters

const struct landlock_ruleset *ruleset

Source ruleset (never NULL).

u32 flags

Complete validated landlock_add_rule_flags value supplied by this successful call, not the rule’s accumulated quiet state.

u64 access_rights

Canonical per-call access mask passed to landlock_insert_rule() after normalization, not the raw sys_landlock_add_rule() argument or accumulated rule.

const struct path *path

Filesystem path for the rule (never NULL).

const char *pathname

Resolved absolute path string (never NULL; error placeholder on resolution failure).

Description

Emitted by sys_landlock_add_rule() under the modified ruleset’s lock, so the reported ruleset is a stable snapshot that no concurrent writer can change.

void trace_landlock_add_rule_net_port(const struct landlock_ruleset *ruleset, u32 flags, u64 access_rights, u64 port)

Network-port rule added to a ruleset

Parameters

const struct landlock_ruleset *ruleset

Source ruleset (never NULL).

u32 flags

Complete validated landlock_add_rule_flags value supplied by this successful call, not the rule’s accumulated quiet state.

u64 access_rights

Canonical per-call access mask passed to landlock_insert_rule() after normalization, not the raw sys_landlock_add_rule() argument or accumulated rule.

u64 port

Network port in host endianness, forwarded directly from landlock_net_port_attr.port.

Description

Emitted by sys_landlock_add_rule() under the modified ruleset’s lock, so the reported ruleset is a stable snapshot that no concurrent writer can change.

void trace_landlock_create_domain(const struct landlock_domain *domain, const struct landlock_ruleset *ruleset)

New domain created

Parameters

const struct landlock_domain *domain

Newly created domain (never NULL, immutable after creation). domain->hierarchy->id is its unique ID, shared with the landlock_enforce_domain and landlock_free_domain events; domain->hierarchy->details holds the requesting process.

const struct landlock_ruleset *ruleset

Source ruleset frozen into the domain (never NULL). The ruleset lock is held across the emission, so a BPF program reading it via BTF sees the exact merged ruleset; ruleset->id / ruleset->version identify it.

Description

Emitted by sys_landlock_restrict_self() once, in the requesting thread’s context, right after the merge and before thread-sync. The flags-only path (ruleset_fd == -1) creates no domain and does not emit this event. Paired with the per-thread landlock_enforce_domain (join on domain->hierarchy->id) and balanced by a matching landlock_free_domain event.

void trace_landlock_enforce_domain(const struct landlock_domain *domain, bool complete, bool process_wide, bool no_new_privs)

Domain enforced on a thread

Parameters

const struct landlock_domain *domain

Domain now enforced on the current thread (never NULL, immutable; read locklessly). Correlate to landlock_create_domain via domain->hierarchy->id for the source ruleset and requesting thread, or read domain->hierarchy->details for the requesting process.

bool complete

Set on the single event that concludes the operation, after all its other enforcements; filter on it for one event per operation.

bool process_wide

The enforcement covers every eligible (non-exiting) thread of the process: set when the caller used LANDLOCK_RESTRICT_SELF_TSYNC or the process is single-threaded. A lone thread whose group still holds a zombie leader is not counted single-threaded, so process_wide == 0 never proves the opposite.

bool no_new_privs

The enforcing thread’s no_new_privs state at enforcement time: 1 if set (by a prior prctl(2) PR_SET_NO_NEW_PRIVS or by LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS), 0 if the domain was enforced with CAP_SYS_ADMIN instead.

Description

Emitted for each thread sys_landlock_restrict_self() enforces the domain on, in that thread’s own context, right after its commit_creds(), so it fires only once the thread is irreversibly enforcing the domain (aborted operations emit none). Not balanced; every enforcement falls between the domain’s landlock_create_domain and landlock_free_domain events.

complete == 1 && process_wide == 1 means the whole process is sandboxed by domain, durably (Landlock domains are monotonic and inherited on clone(2)).

void trace_landlock_free_domain(const struct landlock_hierarchy *hierarchy)

Domain freed

Parameters

const struct landlock_hierarchy *hierarchy

Hierarchy node being freed (never NULL).

Description

Emitted when the hierarchy node’s last reference is dropped: its refcount reaches zero after all child domains have released their parent reference. A committed domain is freed from a kworker via landlock_put_domain_deferred() (the credential free path runs in RCU context, where sleeping is forbidden), so the current task is not the sandboxed task that triggered the free. Balanced by a matching landlock_create_domain event.

void trace_landlock_check_rule_inode(const struct landlock_domain *domain, const struct landlock_rule *rule, u64 access_request, const struct dentry *dentry)

Inode rule evaluated during access check

Parameters

const struct landlock_domain *domain

Enforcing domain (never NULL).

const struct landlock_rule *rule

Matching rule with per-layer access masks (never NULL).

u64 access_request

Access mask evaluated against the rule (the domain’s handled mask during rename/link double-checks).

const struct dentry *dentry

Filesystem dentry being checked (never NULL).

Description

Emitted for each rule that matches during a filesystem access check. The grants array shows the requested rights the rule grants at each domain layer. See Landlock Trace Events for how to interpret it.

void trace_landlock_check_rule_net_port(const struct landlock_domain *domain, const struct landlock_rule *rule, u64 access_request, u64 port)

Network port rule evaluated

Parameters

const struct landlock_domain *domain

Enforcing domain (never NULL).

const struct landlock_rule *rule

Matching rule with per-layer access masks (never NULL).

u64 access_request

Access mask being requested.

u64 port

Network port being checked (host endianness).

Description

Emitted for each rule that matches during a network access check. The grants array shows the requested rights the rule grants at each domain layer. See Landlock Trace Events for how to interpret it.

void trace_landlock_deny_access_fs(const struct landlock_hierarchy *hierarchy, bool same_exec, bool logged, const struct landlock_blockers *blockers, const struct path *path, const char *pathname)

Filesystem access denied

Parameters

const struct landlock_hierarchy *hierarchy

Denying domain’s hierarchy node (never NULL); its id is the domain field.

bool same_exec

Whether the current task entered the denying domain itself.

bool logged

The domain’s audit-logging decision for this denial.

const struct landlock_blockers *blockers

Request type and final missing access subset (never NULL).

const struct path *path

Filesystem path that was denied (never NULL).

const char *pathname

Resolved path string (never NULL; an error placeholder on resolution failure).

Description

Emitted when a Landlock domain denies a filesystem access.

void trace_landlock_deny_access_net(const struct landlock_hierarchy *hierarchy, bool same_exec, bool logged, const struct landlock_blockers *blockers, const struct sock *sk, u16 socket_family, const struct sockaddr_storage *address, int addrlen)

Network access denied

Parameters

const struct landlock_hierarchy *hierarchy

Denying domain’s hierarchy node (never NULL); its id is the domain field.

bool same_exec

Whether the current task entered the denying domain itself.

bool logged

The domain’s audit-logging decision for this denial.

const struct landlock_blockers *blockers

Request type and final missing access subset (never NULL).

const struct sock *sk

Socket object (never NULL), read without a socket lock, so its fields are a best-effort snapshot.

u16 socket_family

Socket-family snapshot used by the verdict.

const struct sockaddr_storage *address

Authoritative address checked by the verdict (never NULL). The producer copies addrlen bytes from the checked address and zeroes the remaining storage before emission. The sockaddr_in.sin_port or sockaddr_in6.sin6_port member, when present, remains in network endianness.

int addrlen

Validated signed length of address.

Description

Emitted when a Landlock domain denies a network operation. The blocker identifies whether the address is a bind or connect/send policy object. The flattened port field is converted from the checked address to host endianness, or is -1 when no port was checked. Zero is a valid checked port.

void trace_landlock_deny_ptrace(const struct landlock_hierarchy *hierarchy, bool same_exec, bool logged, u64 tracee_domain_id, const struct task_struct *tracee, const struct task_struct *tracer)

Ptrace access denied by a Landlock domain

Parameters

const struct landlock_hierarchy *hierarchy

Denying domain’s hierarchy node (never NULL); its id is the domain field.

bool same_exec

Whether the tracer entered the denying domain itself.

bool logged

The domain’s audit-logging decision for this denial.

u64 tracee_domain_id

The tracee’s Landlock domain ID, or 0 if the tracee is unsandboxed.

const struct task_struct *tracee

The target task ptrace acted on (never NULL). tracee_pid is the init-namespace TGID (like audit’s opid).

const struct task_struct *tracer

The tracer or proposed tracer (never NULL); for PTRACE_TRACEME this is the parent, not the syscall caller.

Description

Emitted when a Landlock domain denies a ptrace operation.

void trace_landlock_deny_scope_signal(const struct landlock_hierarchy *hierarchy, bool same_exec, bool logged, u64 target_domain_id, const struct task_struct *target, int signal)

Signal delivery denied by LANDLOCK_SCOPE_SIGNAL

Parameters

const struct landlock_hierarchy *hierarchy

Denying domain’s hierarchy node (never NULL); its id is the domain field.

bool same_exec

Whether the policy subject entered the denying domain itself.

bool logged

The domain’s audit-logging decision for this denial.

u64 target_domain_id

The target’s Landlock domain ID, or 0 if the target is unsandboxed.

const struct task_struct *target

The task the signal was aimed at (never NULL). target_pid is the init-namespace TGID (like audit’s opid).

int signal

The signal selected by the denied check. Zero is a permission probe, not an absent value.

Description

Emitted when a Landlock domain denies signal delivery to a scoped-out target.

void trace_landlock_deny_scope_abstract_unix_socket(const struct landlock_hierarchy *hierarchy, bool same_exec, bool logged, u64 peer_domain_id, const struct sock *peer)

Abstract unix socket access denied by LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET

Parameters

const struct landlock_hierarchy *hierarchy

Denying domain’s hierarchy node (never NULL); its id is the domain field.

bool same_exec

Whether the current task entered the denying domain itself.

bool logged

The domain’s audit-logging decision for this denial.

u64 peer_domain_id

The peer’s Landlock domain ID, or 0 if the peer is unsandboxed.

const struct sock *peer

Peer socket (never NULL). peer_pid is best-effort: it is 0 for a datagram peer (no SO_PEERCRED), so sun_path is the reliable peer identifier.

Description

Emitted when a Landlock domain denies access to a scoped-out abstract unix socket.

Additional documentation