Changes in landlock.h

67f8bc848ee31831336bd478e57d2f993551902e - Merge drm/drm-fixes into drm-misc-fixes

Tue, 01 Sep 2026 09:38:51 +0200

Merge drm/drm-fixes into drm-misc-fixesLet's start the 7.3 drm-misc-fixes cycle.Signed-off-by: Maxime Ripard List of files: /linux/include/trace/events/landlock.h

7199989f3f3194d653b024ce8e79cea6b15e38b9 - Merge tag 'landlock-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux

Fri, 21 Aug 2026 21:28:35 +0200

Merge tag 'landlock-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linuxPull Landlock update from Mickaël Salaün: "This improves observability with Landlock tracepoints support, which required some refactoring for dedicated domain types and common helpers shared with audit code. A LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS flag is also added to improve process-wide domain enforcement consistency. Whiteout files are now correctly handled and tested, and a few other fixes"* tag 'landlock-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux: (34 commits) landlock: Document tracepoints selftests/landlock: Add landlock_enforce_domain trace tests selftests/landlock: Add scope and ptrace tracepoint tests selftests/landlock: Add network tracepoint tests selftests/landlock: Add filesystem tracepoint tests selftests/landlock: Add trace event test infrastructure and tests landlock: Add tracepoints for ptrace and scope denials landlock: Add landlock_deny_access_fs and landlock_deny_access_net landlock: Add tracepoints for rule checking landlock: Add landlock_enforce_domain tracepoint landlock: Add create_domain and free_domain tracepoints landlock: Add landlock_add_rule_fs and landlock_add_rule_net tracepoints landlock: Add create_ruleset and free_ruleset tracepoints landlock: Consolidate access-right and scope names in a shared header landlock: Decouple the per-denial logging decision from CONFIG_AUDIT landlock: Split denial logging from audit into common framework landlock: Split struct landlock_domain from struct landlock_ruleset landlock: Move domain query functions to domain.c landlock: Prepare ruleset and domain type split samples/landlock: Add LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS to sampler ... List of files: /linux/include/trace/events/landlock.h

bb91730f16c064f4eb0dc15ed27814c8f9aef670 - landlock: Add tracepoints for ptrace and scope denials

Tue, 11 Aug 2026 11:43:27 +0200

landlock: Add tracepoints for ptrace and scope denialsScope and ptrace denials follow a different code path (a domainhierarchy check) than access-right denials, so they need dedicatedtracepoints with type-specific TP_PROTO arguments. Complete the denialcoverage with:- landlock_deny_ptrace: ptrace access denied by a domain hierarchy mismatch.- landlock_deny_scope_signal: signal delivery denied by LANDLOCK_SCOPE_SIGNAL.- landlock_deny_scope_abstract_unix_socket: abstract unix socket access denied by LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET.TP_PROTO passes the raw kernel object (struct task_struct or structsock) for eBPF BTF access; the comm and sun_path string fields use__print_untrusted_str() because they hold untrusted input. Unlike thedeny_access events, these omit the blockers field: each maps to exactlyone denial type named by the event, so the bitmask would always be zero.Like the deny_access events they carry same_exec and logged.Audit logs the task-targeted denials with generic field names (opid,ocomm), but a strongly typed trace event can use role-prefixed names(tracee_pid/tracee_comm, target_pid/target_comm) that match the mainlinetask-name convention (sched_process_fork's parent_comm/child_comm) andsay whose name each field holds; a bare comm= would collide acrossevents. The abstract-unix-socket event reports peer_pid instead, atracepoint-only field with no audit counterpart.A scope or ptrace verdict compares the subject domain against the otherparty's domain, so each event also reports that other party's Landlockdomain (tracee_domain=, target_domain=, or peer_domain=); the subjectdomain= alone does not let a consumer redo domain_is_scoped() ordomain_ptrace(). It is reported as a scalar ID rather than a domainpointer: a domain object is immutable, but the other task can replaceits credential and free the domain that credential referenced, so astored foreign pointer could dangle before the event is consumed. Thescalar ID also honors the tracepoint no-nullable-pointer rule, since theother party is frequently unsandboxed. Passing the foreign domainhierarchy object so an eBPF consumer could walk the other party'sancestry live would lengthen the RCU section on the shared denial pathand needs a deferred refcount put, so it is left as a futureenhancement. The relational domain-ID field (tracee_domain,target_domain, or peer_domain) is trace-only and is not added to auditrecords, so audit's denial format is unchanged by this series.Cc: Günther Noack Cc: Justin Suess Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Steven Rostedt Cc: Tingmao Wang Link: https://patch.msgid.link/20260811094338.288094-14-mic@digikod.netSigned-off-by: Mickaël Salaün List of files: /linux/include/trace/events/landlock.h

01ce260f5ccf0fe7e38d2fd548e776f594409cf6 - landlock: Add landlock_deny_access_fs and landlock_deny_access_net

Tue, 11 Aug 2026 11:43:26 +0200

landlock: Add landlock_deny_access_fs and landlock_deny_access_netAdd per-type tracepoints emitted from landlock_log_denial() when anaccess is denied: landlock_deny_access_fs for filesystem denials andlandlock_deny_access_net for network denials. They use the "deny_"prefix (rather than "check_") to mark that they fire only on a denial,and they complement the check_rule events by making thedenial-by-absence case explicit (when no rule matches, no check_ruleevent fires).Unlike the audit records, these events fire regardless of the auditconfiguration and the domain's log flags: the user's "disable logging"intent applies to audit records, not to kernel tracing. The loggedfield records whether the domain's log policy would submit the denial toaudit; it is the decision computed once by landlock_log_denial() andpassed to both the audit and the tracing emitter, so a stateless ftracefilter can select the audit-visible denials with logged==1.TP_PROTO passes the denying hierarchy node, not the task's currentdomain, so domain_id reports the specific node that blocked the access,matching audit record semantics. (check_rule instead passes the currentdomain, which it needs to size its per-layer array.) same_exec is alsopassed explicitly because it is computed from the credential bitmask andis not derivable from the hierarchy pointer alone. The denial field isnamed blockers to match the audit record field.The filesystem path comes from the request's audit data. Its typeselects which union member holds the object, exactly asdump_common_audit_data() selects it (a path, a file's path, an ioctlop's path, or a bare dentry); reading the wrong member would dereferencegarbage, so every reachable type has an explicit case and an unexpectedone is flagged with WARN_ONCE() instead of misread. Path-backed typesresolve via d_absolute_path() (as landlock_add_rule_fs does) and thebare-dentry case via dentry_path_raw().The inode number is read defensively. A filesystem denial can carry anegative dentry (no backing inode), for example a denied creation, sothe event mirrors the guard in dump_common_audit_data() and reportsinode 0 rather than dereferencing a NULL inode. The sibling fstracepoints do not need the guard: a dentry that matches a rule duringan access check, or one opened to add a rule, always has a backinginode. Landlock tracepoints are reachable by unprivileged sandboxees,so a denial on a negative dentry with the event enabled must not faultthe kernel.Cc: Günther Noack Cc: Justin Suess Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Steven Rostedt Cc: Tingmao Wang Link: https://patch.msgid.link/20260811094338.288094-13-mic@digikod.netSigned-off-by: Mickaël Salaün List of files: /linux/include/trace/events/landlock.h

3f1f106e4c14071ad8cb8ae6775d2d11780a7d01 - landlock: Add tracepoints for rule checking

Tue, 11 Aug 2026 11:43:25 +0200

landlock: Add tracepoints for rule checkingMerge landlock_find_rule() into landlock_unmask_layers() so rulepointers stay inside the domain implementation while unmask checkinggets the matched rule it needs for the check_rule tracepoint.landlock_unmask_layers() now takes a landlock_id and the domain insteadof a rule pointer. A rename or link evaluates the same dentry againstboth renamed parents, so this path now looks the rule up once perparent; collapsing that back to a single lookup is left to a follow-up.Emit, via the per-type wrappers unmask_layers_fs() andunmask_layers_net(), the rights each matching rule grants at everydomain layer. The events carry this as a dynamic per-layer array (up toLANDLOCK_MAX_NUM_LAYERS entries) reserved from the trace ring buffer,not the caller's stack, and rendered symbolically per layer. AWARN_ON_ONCE() in __trace_landlock_fill_layers() flags a rule whoselayer levels fall outside the domain range or are unsorted, acannot-happen case; the zero-filled slots keep the rendered output andthe array bounds safe regardless.Setting allowed_parent2 to true for non-dom-check requests whenget_inode_id() returns false preserves the pre-refactoring behavior: anegative dentry (no backing inode) has no matching rule, so the accessis allowed at this path component. Before the refactoring,landlock_unmask_layers() with a NULL rule produced this result as a sideeffect; now the caller must set it explicitly.Name the trace-only check_rule fields so each printk label equals itsring-buffer field name and works directly as an ftrace filter: therequest field is labelled access_request= and the per-layer array isnamed grants. Values audit also logs keep audit's label (domain=,ruleset=) so a single filter works across trace and audit.Cc: Günther Noack Cc: Justin Suess Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Steven Rostedt Cc: Tingmao Wang Link: https://patch.msgid.link/20260811094338.288094-12-mic@digikod.netSigned-off-by: Mickaël Salaün List of files: /linux/include/trace/events/landlock.h

132d84b16b5fe729fd228b169fa9e55f3e56b7af - landlock: Add landlock_enforce_domain tracepoint

Tue, 11 Aug 2026 11:43:24 +0200

landlock: Add landlock_enforce_domain tracepointThe landlock_create_domain event records that a domain was created,once, before thread-sync. It cannot tell which threads end up enforcingit: a successful landlock_restrict_self(2) withLANDLOCK_RESTRICT_SELF_TSYNC applies the domain to the caller and everyeligible sibling. Creation (the operation) and enforcement (theper-thread outcome) are distinct.Add landlock_enforce_domain(domain, complete, process_wide), emittedonce per thread the domain is applied to, strictly after that thread'scommit_creds(), so it fires only for a thread that is enforcing thedomain, never speculatively; an aborted operation emits none. Thelifecycle now reads create -> enforce* -> free.The two booleans name properties, not the implementation:- complete: marks the single event that concludes the operation. It names the outcome, the set is now enforced, not which thread finishes, which the contract leaves unspecified.- process_wide: means every eligible thread of the process is covered. It is set race-free by either establishing path, thread-sync or a single-threaded process, so complete && process_wide is the whole-process-enforced guarantee.The requesting thread and source ruleset are not repeated here: they areon create_domain (joined via domain->hierarchy->id) and on the immutabledomain->hierarchy->details. Source ruleset means the ruleset_id andruleset_version recorded on create_domain, not the ruleset object, whichthe caller may close before enforcement.Cc: Günther Noack Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Steven Rostedt Cc: Tingmao Wang Link: https://patch.msgid.link/20260811094338.288094-11-mic@digikod.netSigned-off-by: Mickaël Salaün List of files: /linux/include/trace/events/landlock.h

67567f03a4bf75905684b333f518da8c21f58514 - landlock: Add create_domain and free_domain tracepoints

Tue, 11 Aug 2026 11:43:23 +0200

landlock: Add create_domain and free_domain tracepointsAdd a landlock_create_domain tracepoint emitted fromlandlock_restrict_self() after the new domain is created, so a consumercan correlate the source ruleset with the resulting domain. Theflags-only path (ruleset_fd == -1) creates no domain and emits no event.Move the ruleset lock acquisition from landlock_merge_ruleset() to thecaller so the lock is held across both the merge and the tracepointemission, giving an eBPF program a consistent ruleset snapshot. Releaseit before the thread-sync: holding ruleset->lock acrosslandlock_restrict_sibling_threads() would deadlock a sibling blocked onthe same lock. The event therefore fires before the (rare) thread-syncfailure path; when that path aborts the just-created domain, thematching free_domain event fires so the create/free pair stays balanced.Add a landlock_free_domain tracepoint that fires when a domain'shierarchy node is freed. The hierarchy node is the lifecycle boundarybecause it represents the domain's identity and outlives the domain'saccess masks, which may still be active in descendant domains.A domain freed without ever being committed to a credential was nevervisible to user space, so free_domain is suppressed for it. This istracked by a new landlock_log_status value, LANDLOCK_LOG_UNCOMMITTED,which is also the zero value so a hierarchy whose initialization faileddefaults to not observable. A hierarchy is born UNCOMMITTED and ispromoted to LANDLOCK_LOG_PENDING (or LANDLOCK_LOG_DISABLED when loggingis off) right after its create_domain event fires; a thread-sync failuredoes not reset it, so an aborted domain that already emittedcreate_domain still emits the matching free_domain. Promoting rightafter the event, rather than at commit_creds() time, avoids a race: on asuccessful thread-sync the sibling threads commit the new domain inlockstep before landlock_restrict_self() returns, so the shared domainmay already have moved to LANDLOCK_LOG_RECORDED through a plain store,and a late promotion would race that store and could unbalance thedomain allocation and deallocation audit records.Cc: Günther Noack Cc: Justin Suess Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Steven Rostedt Cc: Tingmao Wang Link: https://patch.msgid.link/20260811094338.288094-10-mic@digikod.netSigned-off-by: Mickaël Salaün List of files: /linux/include/trace/events/landlock.h

63747c94774d4a5a0a9d9e739da0df29937aebea - landlock: Add landlock_add_rule_fs and landlock_add_rule_net tracepoints

Tue, 11 Aug 2026 11:43:22 +0200

landlock: Add landlock_add_rule_fs and landlock_add_rule_net tracepointsAdd tracepoints for Landlock rule addition, landlock_add_rule_fs forfilesystem rules and landlock_add_rule_net for network rules, so traceconsumers can correlate filesystem objects and network ports with theirrulesets. Both are emitted under the ruleset lock (asserted inTP_fast_assign) so an eBPF program reads the ruleset, including the rulejust inserted, in a consistent snapshot.Add a version field to struct landlock_ruleset, gated onCONFIG_TRACEPOINTS like the id field and incremented under the rulesetlock on each successful landlock_add_rule(2), including when it onlyextends an existing rule's access rights. It fills the existing 4-bytehole after usage, so the struct does not grow. Pairing the ruleset IDwith the version lets a later restrict_self event record the exactruleset revision merged into a domain.Resolve the filesystem rule's absolute path with d_absolute_path()rather than the d_path() audit uses: d_absolute_path() producesnamespace-independent paths that do not depend on the tracer's chrootstate, making trace output deterministic regardless of mount namespaceconfiguration. Distinguish the error cases as ""(-ENAMETOOLONG) and "" (anonymous files or detachedmounts).Also add __trace_print_untrusted_str(), a static inline helper in theheader guarded by CREATE_TRACE_POINTS: it escapes separators, quotes,backslashes, and non-printable bytes via string_escape_mem() so anuntrusted string (the path here, process names in later denial events)cannot inject field separators or control characters into the ftracetext output.Cc: Christian Brauner Cc: Günther Noack Cc: Justin Suess Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Steven Rostedt Cc: Tingmao Wang Link: https://patch.msgid.link/20260811094338.288094-9-mic@digikod.netSigned-off-by: Mickaël Salaün List of files: /linux/include/trace/events/landlock.h

b4540a72be4138a97c7cb74f803e57a7350a55ec - landlock: Add create_ruleset and free_ruleset tracepoints

Tue, 11 Aug 2026 11:43:21 +0200

landlock: Add create_ruleset and free_ruleset tracepointsAdd the first Landlock tracepoints, for ruleset lifecycle:landlock_create_ruleset fires from the landlock_create_ruleset() syscallhandler, and landlock_free_ruleset fires in free_ruleset() before theruleset is freed.These tracepoints, and the ones added by the following commits, share acommon design. Rather than one polymorphic event distinguished by astatus field (as audit uses a shared record type with a "status="field), each lifecycle transition and denial type gets its own eventwith a type-safe TP_PROTO, giving precise ftrace filtering by event nameand type-safe eBPF access. TP_PROTO passes the object pointer and thefields are read from it in TP_fast_assign, so an eBPF program reads thefull object state (rules, access masks, hierarchy) via BTF from a singlepointer rather than from the flattened TP_STRUCT__entry fields. Thewhole cost is paid only when a tracer is attached; the static branch isnot taken otherwise. Trace fields carry the bare access-right and scopenames (read_file), reusing the audit name tables; audit prepends thecategory (fs.read_file), which the trace event name already conveys.The trace header's DOC comment documents the consistency and lockingguarantees these events share.create_ruleset needs no lock because the ruleset is not yet shared (itsfile descriptor is not yet installed). The deallocation events use the"free_" prefix, not "drop_", because they fire when the object isactually freed.Add trace.c, built for CONFIG_TRACEPOINTS, which definesCREATE_TRACE_POINTS, and extend CONFIG_SECURITY_LANDLOCK_LOG to also beselected by CONFIG_TRACEPOINTS so the common log framework is availableto a tracepoints-only build.Add an id field to struct landlock_ruleset, gated on CONFIG_TRACEPOINTSand assigned from landlock_get_id_range() at creation. Only thetracepoints consume it (audit identifies domains, not rulesets), so itdoes not exist in an audit-only build. The Landlock ID is a stable u64that names the ruleset across the trace stream and uses the same schemeas audit, so a ruleset can be correlated between trace and auditrecords.Cc: Günther Noack Cc: Justin Suess Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Steven Rostedt Cc: Tingmao Wang Link: https://patch.msgid.link/20260811094338.288094-8-mic@digikod.netSigned-off-by: Mickaël Salaün List of files: /linux/include/trace/events/landlock.h