Landlock Trace Events

Author:

Mickaël Salaün

Date:

August 2026

Landlock emits trace events for sandbox lifecycle operations and access denials. These events can be consumed by ftrace (for human-readable trace output and filtering) and by eBPF programs (for programmatic introspection via BTF).

User space documentation can be found here: Landlock: unprivileged access control

Warning

Landlock trace events, like audit records, expose sensitive information about all sandboxed processes on the system. See Observability security considerations for security considerations and privilege requirements.

Event overview

Landlock trace events are organized in four categories:

Syscall events are emitted during Landlock system calls:

  • landlock_create_ruleset: a new ruleset is created

  • landlock_add_rule_fs: a filesystem rule is added to a ruleset

  • landlock_add_rule_net: a network port rule is added to a ruleset

  • landlock_create_domain: a new domain is created from a ruleset

  • landlock_enforce_domain: a domain is enforced on a thread

Denial events are emitted when an access is denied:

  • landlock_deny_access_fs: filesystem access denied

  • landlock_deny_access_net: network access denied

  • landlock_deny_ptrace: ptrace access denied

  • landlock_deny_scope_signal: signal delivery denied

  • landlock_deny_scope_abstract_unix_socket: abstract unix socket access denied

Rule evaluation events are emitted during rule matching:

  • landlock_check_rule_fs: a filesystem rule is evaluated

  • landlock_check_rule_net: a network port rule is evaluated

Lifecycle events:

  • landlock_free_domain: a domain is freed

  • landlock_free_ruleset: a ruleset is freed

Enabling events

Enable all Landlock events:

echo 1 > /sys/kernel/tracing/events/landlock/enable

Enable a specific event:

echo 1 > /sys/kernel/tracing/events/landlock/landlock_deny_access_fs/enable

Read the trace output:

cat /sys/kernel/tracing/trace_pipe

Event samples

A fully unprivileged program is sandboxed so that it can still run (its binary and shared libraries stay readable) and write only /tmp, then it is denied reading /etc/passwd, which lies outside its read-only set. /etc/passwd is world-readable, so the denial comes solely from Landlock, not from regular file permissions:

$ cd /sys/kernel/tracing/events/landlock/
$ echo 1 | tee landlock_{create_ruleset,create_domain,enforce_domain,deny_access_fs,free_domain}/enable >/dev/null
$ LC_ALL=C LL_FS_RO=/usr:/lib:/lib64:/bin:/etc/ld.so.cache LL_FS_RW=/tmp \
    ./sandboxer cat /etc/passwd
$ cat /sys/kernel/tracing/trace_pipe
cat-127 [...] landlock_create_ruleset: ruleset=195cc6b76.0 handled_fs=execute|write_file|read_file|read_dir|remove_dir|remove_file|make_char|make_dir|make_reg|make_sock|make_fifo|make_block|make_sym|refer|truncate|ioctl_dev|resolve_unix handled_net= scoped=
cat-127 [...] landlock_create_domain: domain=195cc6b7c parent=0 ruleset=195cc6b76.6
cat-127 [...] landlock_enforce_domain: domain=195cc6b7c complete=1 process_wide=1 no_new_privs=1
cat-127 [...] landlock_deny_access_fs: domain=195cc6b7c same_exec=0 logged=0 blockers=read_file dev=0:17 ino=5901179 path=/etc/passwd
kworker/0:1-11 [...] landlock_free_domain: domain=195cc6b7c denials=1

The [...] replaces the ftrace CPU, flags, and timestamp columns. The first four events share the cat command name and PID because the sandboxer replaces itself with cat via execve() before the denial, and ftrace resolves a recorded PID to its latest command name. landlock_free_domain fires later from a kworker thread, so it carries that thread’s name instead.

Here logged=0 shows that audit would not record this cross-execution denial under the default flags, yet the deny_access_fs event still appears.

Differences from audit records

Tracepoints and audit records both log Landlock denials, but differ in some field formats:

  • Paths: Most filesystem tracepoints resolve the path with d_absolute_path() (namespace-independent absolute paths), while mount-topology denials that carry only a dentry use dentry_path_raw(). Audit uses d_path() (relative to the process’s chroot). A resolution failure is reported as <no_mem>, <too_long>, or <unreachable>. Path-based tracepoint output is deterministic regardless of the tracer’s mount namespace.

  • Device names: Tracepoints use numeric dev=<major>:<minor>. Audit uses string dev="<s_id>". Numeric format is more precise for machine parsing.

  • Denied access field: The deny_access_fs and deny_access_net tracepoints use the blockers= field name (same as audit). Both render the blocked access rights as names: audit prefixes the category and separates with commas (e.g., blockers=fs.read_file), while the tracepoints omit the category (carried by the event name) and separate with | (e.g., blockers=read_file). Scope and ptrace tracepoints omit blockers because the event name identifies the denial type.

  • Scope and ptrace target names: Tracepoints use role-specific field names (tracee_pid, target_pid, peer_pid) that reflect the semantic of each event. Audit uses generic names (opid, ocomm) because the audit log format is not event-type-specific.

  • Process name: The ptrace and signal denial tracepoints include the role-prefixed tracee_comm= and target_comm= labels in the printk output for stateless consumers (each matches its sibling tracee_pid=/target_pid= field). eBPF consumers can read comm directly from the task_struct via BTF. The comm value is treated as untrusted input and escaped in the trace text output so it cannot inject field separators or control characters.

  • Other party’s domain: A scope or ptrace denial compares the subject’s denying domain (domain=, always the enforcing domain and never the current task) with the other party’s domain, so these tracepoints also report the other party’s domain as a scalar ID: tracee_domain= (ptrace), target_domain= (signal), and peer_domain= (abstract unix socket). It is 0 when the other party is unsandboxed, and otherwise a domain ID that a consumer resolves against the landlock_create_ruleset and landlock_create_domain events it recorded. Because a scope or ptrace verdict is decided by comparing the two domains, resolving both the subject domain= and this other-party ID against those lifecycle events lets a consumer verify or reproduce the verdict by redoing the same two-domain comparison, rather than only noting which boundary was crossed. Audit records do not carry the other party’s domain.

Ruleset versioning

Syscall events include a ruleset version (ruleset=<hex_id>.<version>) that tracks the number of rules added to the ruleset. The version is incremented on each landlock_add_rule() call and frozen at landlock_restrict_self() time. This enables trace consumers to correlate a domain with the exact set of rules it was created from.

Domain enforcement

The whole-process-enforced guarantee (complete=1 && process_wide=1) is the observable outcome of a successful landlock_restrict_self(..., LANDLOCK_RESTRICT_SELF_TSYNC); see the thread synchronization section of Landlock: unprivileged access control.

The Landlock events and the generic syscall tracepoints are complementary: the Landlock events expose the semantic effect of an operation (the domain, its scope, the resulting no_new_privs state), while raw_syscalls:sys_enter/sys_exit (or the per-syscall syscalls:sys_{enter,exit}_landlock_* under CONFIG_FTRACE_SYSCALLS) expose the raw API -- the exact landlock_restrict_self() flags, arguments, and return value. Correlate them by thread; a LANDLOCK_RESTRICT_SELF_TSYNC operation also enforces the domain on the sibling threads, whose landlock_enforce_domain events fire in each sibling’s own context rather than the caller’s, so correlate those to the syscall by domain ID.

Interpreting check_rule events

The check_rule_fs and check_rule_net events expose the per-layer rule evaluation, which is useful for understanding why a specific access is allowed or denied.

Warning

These events fire on the access-check hot path, once per matching rule per check. On a busy sandboxed workload this can be very high frequency. Enable them only for targeted debugging, ideally combined with an ftrace filter (for example on ino or domain_id), and expect tracing overhead while they are enabled.

Two output fields carry the evaluation:

  • access_request= is the set of access rights being evaluated against the rule, rendered as |-separated names. For most checks this is the access the operation requested. For filesystem rename and link double-checks it is the domain’s full handled mask, because those operations re-evaluate every handled right.

  • grants= is a per-layer breakdown of the requested rights that this rule grants, in the form {<layer>,<layer>,...}:

    • The braces wrap one comma-separated group per domain layer, ordered from the outermost (least nested) sandbox layer to the innermost.

    • Each group lists the requested rights the rule grants at that layer, joined by |.

    • An empty group (for example the middle layer in {read_file,,read_file}) means the rule grants none of the requested rights at that layer.

A Landlock domain allows an access only when, for every requested right, every layer that handles that right has at least one matching rule granting it. A single check_rule event therefore shows one rule’s contribution, not the final decision:

  • If a right appears in every layer’s group, this rule alone is sufficient to allow that right.

  • If a right is missing from some layer’s group, that layer must grant it through another matching rule, or the right is denied and appears in the blockers= field of the corresponding deny_access event.

To reconstruct the decision for an object, aggregate the grants= groups of all check_rule events emitted for that object during the check.

Note

Because a verdict requires aggregating grants= across all matching rules of one access check, a stateless ftrace filter on a single check_rule event cannot distinguish an allowed access from a denied one.

For example, a program sandboxed with read and execute access to the whole filesystem reads /etc/passwd; both the execve() and the read match the rule covering / (inode 2), so check_rule_fs fires with the requested rights intersected against what that rule grants. The access_request= mask includes truncate because the file-open hook evaluates that optional right alongside the required access, but the rule does not grant it, so truncate never appears in grants=:

cat-127 [...] landlock_check_rule_fs: domain=1e40cb56f access_request=execute|read_file|truncate dev=0:17 ino=2 grants={execute|read_file}
cat-127 [...] landlock_check_rule_fs: domain=1e40cb56f access_request=read_file|truncate dev=0:17 ino=2 grants={read_file}

The [...] replaces the ftrace CPU, flags, and timestamp columns. A single grants= group means the enforcing domain has one layer. With two nested sandboxes that each grant the same rights, the rule spans both layers, so grants= has one group per layer:

cat-128 [...] landlock_check_rule_fs: domain=184788b52 access_request=execute|read_file|truncate dev=0:17 ino=2 grants={execute|read_file,execute|read_file}
cat-128 [...] landlock_check_rule_fs: domain=184788b52 access_request=read_file|truncate dev=0:17 ino=2 grants={read_file,read_file}

eBPF access

eBPF programs attached via BPF_RAW_TRACEPOINT can access the tracepoint arguments directly through BTF. The arguments include both standard kernel objects and Landlock-internal objects:

  • Standard kernel objects (struct task_struct, struct sock, struct path, struct dentry) can be used with existing BPF helpers.

  • Landlock-internal objects (struct landlock_domain, struct landlock_ruleset, struct landlock_rule, struct landlock_hierarchy) can be read via BPF_CORE_READ. Internal struct layouts may change between kernel versions; use CO-RE for field relocation.

A stateful eBPF program observes the full event stream and maintains per-domain state in BPF maps:

  1. On landlock_create_domain: record the domain ID and parent (the per-domain Landlock log flags are not event fields; read them from struct landlock_hierarchy via BTF if needed).

  2. On landlock_enforce_domain: record the sandboxed thread under the domain= key (join to the create_domain recorded in step 1), building the per-domain thread set; filter complete==1 for a one-event-per-operation summary.

  3. On landlock_deny_access_*: look up the domain, decide whether to count, alert, or ignore the denial based on custom policy.

  4. On landlock_free_domain: clean up the per-domain state, log final statistics.

This approach requires no kernel modification and no Landlock-specific BPF helpers. The Landlock IDs serve as correlation keys across events.

Audit filtering equivalence

The logged field reflects the domain’s log policy but not the global audit_enabled toggle, so it does not change when audit is turned on or off. When audit is enabled, logged==1 selects the denials the domain submits to audit (audit-side rate-limiting and exclude rules may still drop some), so a stateless ftrace filter can select them:

# Show only denials that audit would also log:
echo 'logged==1' > \
    /sys/kernel/tracing/events/landlock/landlock_deny_access_fs/filter

Event reference

These guarantees and constraints hold for every Landlock tracepoint. A new tracepoint must uphold them, and an eBPF consumer can rely on them.

Decision context

A denial event, together with the lifecycle events, exposes the full set of inputs the verdict consumed, so a consumer that tracked domain creation (landlock_create_ruleset, landlock_create_domain) can verify or reproduce the Landlock decision rather than merely observe it happened. In who/what/why terms: who is the denying domain (the domain field, always the subject that enforced the policy, never the current task), what is the operation and its object, and why is every other input the verdict weighed.

Lifecycle consistency

Lifecycle events are balanced: a creation event always has a matching deallocation event and vice versa, so an eBPF program can model object lifetimes from the trace stream without reconciliation logic. A creation event fires while the object is still private to the calling thread (landlock_create_ruleset fires before the ruleset’s file descriptor is installed, so it cannot race a concurrent close(2)); if fd installation later fails and the ruleset is freed, free_ruleset still fires, keeping the pair balanced. The domain pair (create_domain and free_domain) is balanced the same way: create_domain fires when the domain is created (under the ruleset lock, before thread-sync), and free_domain fires when it is freed. A rare thread-sync failure aborts the just-created domain, which then emits both events (its creation, then an immediate free). Denial events fire only for denials that actually happen.

Pointer access

All pointer arguments in TP_PROTO are guaranteed non-NULL by the caller, but pointers reached through them may still be NULL (e.g., hierarchy->parent at a root domain) and must be checked. eBPF programs read these pointers via BTF for richer introspection than the TP_STRUCT__entry fields, which serve TP_printk display only.

Mutable object pointers are passed while the caller holds the object’s lock, so TP_fast_assign and a BTF reader see the exact object the event reports, a snapshot no concurrent writer can change: add_rule holds the modified ruleset’s lock, and create_domain holds the ruleset lock across the emission (before the thread-sync wait) so the inspected ruleset is the one merged into the domain. Objects immutable at the emission site (a domain after creation, a hierarchy at its last reference) need no lock. A few values that no held lock protects are a best-effort lockless snapshot instead: a task’s comm, and the deny_access_net struct sock (whose network hook holds no socket lock), matching how the sched and signal trace events sample comm.

Field encoding

Fields that mirror the Landlock UAPI use the same C types and endianness (e.g. network ports are __u64 in host endianness, like landlock_net_port_attr.port). Per-event details, such as where a value is byte-swapped, live in the field’s own kdoc.

Rule-check fields

The check_rule events fire during an access check, once per matching rule, before the final allow-or-deny verdict. They share domain (the enforcing domain being evaluated), access_request (the access mask being checked), and rule (the matching rule, with per-layer access masks).

Denial fields

Every denial event shares three fields. domain is the ID of the innermost domain that blocked the access. same_exec tells whether the current task is the same executable that entered that domain. logged is the domain’s audit-logging decision for this denial (its log_status is enabled and the per-execution flag selected by same_exec is set); a stateless ftrace filter can select the denials the domain submits to audit with logged==1, without reconstructing it from the per-execution log flags. Denial events order their fields as domain, same_exec, logged, then blockers (deny_access events only), then the type-specific object fields, then any variable-length field.

Relational referents

A scope or ptrace verdict compares two domains, so the other party’s domain is part of the decision context. It is exposed as a scalar domain ID (0 when that party is unsandboxed): target_domain (signal), peer_domain (abstract unix socket), tracee_domain (ptrace). With both IDs in the stream, a consumer that tracked domain creation can relate the two parties without kernel-internal state. The ID is a scalar snapshot, not a live domain pointer that could dangle: an optional relational referent is a scalar (0 sentinel), not a nullable pointer.

void trace_landlock_create_ruleset(const struct landlock_ruleset *ruleset)

New ruleset created

Parameters

const struct landlock_ruleset *ruleset

Newly created ruleset (never NULL); not yet shared via an fd, so no lock is needed.

Description

Emitted by sys_landlock_create_ruleset() while the new ruleset is still private to the calling thread, before its file descriptor is installed, so it cannot race a concurrent close(2). Balanced by a matching landlock_free_ruleset event.

void trace_landlock_free_ruleset(const struct landlock_ruleset *ruleset)

Ruleset freed

Parameters

const struct landlock_ruleset *ruleset

Ruleset being freed (never NULL); at its last reference, so no lock is needed.

Description

Emitted when a ruleset’s last reference is dropped (typically when the creating process closes the ruleset file descriptor). Fires even when file-descriptor installation failed after creation, keeping the create/free pair balanced.

void trace_landlock_add_rule_fs(const struct landlock_ruleset *ruleset, access_mask_t access_rights, const struct path *path, const char *pathname)

Filesystem rule added to a ruleset

Parameters

const struct landlock_ruleset *ruleset

Source ruleset (never NULL).

access_mask_t access_rights

Effective access mask stored in the rule, not the raw sys_landlock_add_rule() argument (unhandled rights added).

const struct path *path

Filesystem path for the rule (never NULL).

const char *pathname

Resolved absolute path string (never NULL; error placeholder on resolution failure).

Description

Emitted by sys_landlock_add_rule() under the modified ruleset’s lock, so the reported ruleset is a stable snapshot that no concurrent writer can change.

void trace_landlock_add_rule_net(const struct landlock_ruleset *ruleset, access_mask_t access_rights, __u64 port)

Network port rule added to a ruleset

Parameters

const struct landlock_ruleset *ruleset

Source ruleset (never NULL).

access_mask_t access_rights

Effective access mask stored in the rule, not the raw sys_landlock_add_rule() argument (unhandled rights added).

__u64 port

Network port, the landlock_net_port_attr.port UAPI value forwarded directly.

Description

Emitted by sys_landlock_add_rule() under the modified ruleset’s lock, so the reported ruleset is a stable snapshot that no concurrent writer can change.

void trace_landlock_create_domain(const struct landlock_domain *domain, const struct landlock_ruleset *ruleset)

New domain created

Parameters

const struct landlock_domain *domain

Newly created domain (never NULL, immutable after creation). domain->hierarchy->id is its unique ID, shared with the landlock_enforce_domain and landlock_free_domain events; domain->hierarchy->details holds the requesting process.

const struct landlock_ruleset *ruleset

Source ruleset frozen into the domain (never NULL). The ruleset lock is held across the emission, so a BPF program reading it via BTF sees the exact merged ruleset; ruleset->id / ruleset->version identify it.

Description

Emitted by sys_landlock_restrict_self() once, in the requesting thread’s context, right after the merge and before thread-sync. The flags-only path (ruleset_fd == -1) creates no domain and does not emit this event. Paired with the per-thread landlock_enforce_domain (join on domain->hierarchy->id) and balanced by a matching landlock_free_domain event.

void trace_landlock_enforce_domain(const struct landlock_domain *domain, bool complete, bool process_wide, bool no_new_privs)

Domain enforced on a thread

Parameters

const struct landlock_domain *domain

Domain now enforced on the current thread (never NULL, immutable; read locklessly). Correlate to landlock_create_domain via domain->hierarchy->id for the source ruleset and requesting thread, or read domain->hierarchy->details for the requesting process.

bool complete

Set on the single event that concludes the operation, after all its other enforcements; filter on it for one event per operation.

bool process_wide

The enforcement covers every eligible (non-exiting) thread of the process: set when the caller used LANDLOCK_RESTRICT_SELF_TSYNC or the process is single-threaded. A lone thread whose group still holds a zombie leader is not counted single-threaded, so process_wide == 0 never proves the opposite.

bool no_new_privs

The enforcing thread’s no_new_privs state at enforcement time: 1 if set (by a prior prctl(2) PR_SET_NO_NEW_PRIVS or by LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS), 0 if the domain was enforced with CAP_SYS_ADMIN instead.

Description

Emitted for each thread sys_landlock_restrict_self() enforces the domain on, in that thread’s own context, right after its commit_creds(), so it fires only once the thread is irreversibly enforcing the domain (aborted operations emit none). Not balanced; every enforcement falls between the domain’s landlock_create_domain and landlock_free_domain events.

complete == 1 && process_wide == 1 means the whole process is sandboxed by domain, durably (Landlock domains are monotonic and inherited on clone(2)).

void trace_landlock_free_domain(const struct landlock_hierarchy *hierarchy)

Domain freed

Parameters

const struct landlock_hierarchy *hierarchy

Hierarchy node being freed (never NULL).

Description

Emitted when the hierarchy node’s last reference is dropped: its refcount reaches zero after all child domains have released their parent reference. A committed domain is freed from a kworker via landlock_put_domain_deferred() (the credential free path runs in RCU context, where sleeping is forbidden), so the current task is not the sandboxed task that triggered the free. Balanced by a matching landlock_create_domain event.

void trace_landlock_check_rule_fs(const struct landlock_domain *domain, const struct landlock_rule *rule, access_mask_t access_request, const struct dentry *dentry)

Filesystem rule evaluated during access check

Parameters

const struct landlock_domain *domain

Enforcing domain (never NULL).

const struct landlock_rule *rule

Matching rule with per-layer access masks (never NULL).

access_mask_t access_request

Access mask evaluated against the rule (the domain’s handled mask during rename/link double-checks).

const struct dentry *dentry

Filesystem dentry being checked (never NULL).

Description

Emitted for each rule that matches during a filesystem access check. The grants array shows the requested rights the rule grants at each domain layer. See Landlock Trace Events for how to interpret it.

void trace_landlock_check_rule_net(const struct landlock_domain *domain, const struct landlock_rule *rule, access_mask_t access_request, __u64 port)

Network port rule evaluated during access check

Parameters

const struct landlock_domain *domain

Enforcing domain (never NULL).

const struct landlock_rule *rule

Matching rule with per-layer access masks (never NULL).

access_mask_t access_request

Access mask being requested.

__u64 port

Network port being checked (host endianness).

Description

Emitted for each rule that matches during a network access check. The grants array shows the requested rights the rule grants at each domain layer. See Landlock Trace Events for how to interpret it.

void trace_landlock_deny_access_fs(const struct landlock_hierarchy *hierarchy, bool same_exec, bool logged, access_mask_t blockers, const struct path *path, const char *pathname)

Filesystem access denied

Parameters

const struct landlock_hierarchy *hierarchy

Denying domain’s hierarchy node (never NULL); its id is the domain field.

bool same_exec

Whether the current task entered the denying domain itself.

bool logged

The domain’s audit-logging decision for this denial.

access_mask_t blockers

Access mask that was blocked (zero for a mount-topology change, whose only blocker is the operation itself).

const struct path *path

Filesystem path that was denied (never NULL).

const char *pathname

Resolved path string (never NULL; an error placeholder on resolution failure).

Description

Emitted when a Landlock domain denies a filesystem access.

void trace_landlock_deny_access_net(const struct landlock_hierarchy *hierarchy, bool same_exec, bool logged, access_mask_t blockers, const struct sock *sk, __u64 sport, __u64 dport)

Network access denied

Parameters

const struct landlock_hierarchy *hierarchy

Denying domain’s hierarchy node (never NULL); its id is the domain field.

bool same_exec

Whether the current task entered the denying domain itself.

bool logged

The domain’s audit-logging decision for this denial.

access_mask_t blockers

Access mask that was blocked.

const struct sock *sk

Socket object (never NULL), read without a socket lock, so its fields are a best-effort snapshot. The denied endpoint is not available: the hook runs before bind(2) / connect(2) sets the socket addresses.

__u64 sport

Source port in host endianness, set for bind denials (zero for an autobind/ephemeral port); zero for connect and send denials.

__u64 dport

Destination port in host endianness, set for connect and send denials; zero for bind denials, and also zero for a UDP send to an AF_UNSPEC address on an IPv6 socket (indistinguishable from a real destination port 0). The bind-vs-connect direction is given by blockers, not by which port is set.

Description

Emitted when a Landlock domain denies a network operation.

The port fields are converted from the socket’s network byte order to host endianness before emitting.

void trace_landlock_deny_ptrace(const struct landlock_hierarchy *hierarchy, bool same_exec, bool logged, u64 tracee_domain_id, const struct task_struct *tracee)

Ptrace access denied by a Landlock domain

Parameters

const struct landlock_hierarchy *hierarchy

Denying domain’s hierarchy node (never NULL); its id is the domain field.

bool same_exec

Whether the current task entered the denying domain itself.

bool logged

The domain’s audit-logging decision for this denial.

u64 tracee_domain_id

The tracee’s Landlock domain ID, or 0 if the tracee is unsandboxed.

const struct task_struct *tracee

The target task ptrace acted on (never NULL). tracee_pid is the init-namespace TGID (like audit’s opid).

Description

Emitted when a Landlock domain denies a ptrace operation.

void trace_landlock_deny_scope_signal(const struct landlock_hierarchy *hierarchy, bool same_exec, bool logged, u64 target_domain_id, const struct task_struct *target)

Signal delivery denied by LANDLOCK_SCOPE_SIGNAL

Parameters

const struct landlock_hierarchy *hierarchy

Denying domain’s hierarchy node (never NULL); its id is the domain field.

bool same_exec

Whether the current task entered the denying domain itself.

bool logged

The domain’s audit-logging decision for this denial.

u64 target_domain_id

The target’s Landlock domain ID, or 0 if the target is unsandboxed.

const struct task_struct *target

The task the signal was aimed at (never NULL). target_pid is the init-namespace TGID (like audit’s opid).

Description

Emitted when a Landlock domain denies signal delivery to a scoped-out target.

void trace_landlock_deny_scope_abstract_unix_socket(const struct landlock_hierarchy *hierarchy, bool same_exec, bool logged, u64 peer_domain_id, const struct sock *peer)

Abstract unix socket access denied by LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET

Parameters

const struct landlock_hierarchy *hierarchy

Denying domain’s hierarchy node (never NULL); its id is the domain field.

bool same_exec

Whether the current task entered the denying domain itself.

bool logged

The domain’s audit-logging decision for this denial.

u64 peer_domain_id

The peer’s Landlock domain ID, or 0 if the peer is unsandboxed.

const struct sock *peer

Peer socket (never NULL). peer_pid is best-effort: it is 0 for a datagram peer (no SO_PEERCRED), so sun_path is the reliable peer identifier.

Description

Emitted when a Landlock domain denies access to a scoped-out abstract unix socket.

Additional documentation