Changes in log.h

67f8bc848ee31831336bd478e57d2f993551902e - Merge drm/drm-fixes into drm-misc-fixes

Tue, 01 Sep 2026 09:38:51 +0200

Merge drm/drm-fixes into drm-misc-fixesLet's start the 7.3 drm-misc-fixes cycle.Signed-off-by: Maxime Ripard List of files: /linux/security/landlock/log.h

7199989f3f3194d653b024ce8e79cea6b15e38b9 - Merge tag 'landlock-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux

Fri, 21 Aug 2026 21:28:35 +0200

Merge tag 'landlock-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linuxPull Landlock update from Mickaël Salaün: "This improves observability with Landlock tracepoints support, which required some refactoring for dedicated domain types and common helpers shared with audit code. A LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS flag is also added to improve process-wide domain enforcement consistency. Whiteout files are now correctly handled and tested, and a few other fixes"* tag 'landlock-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux: (34 commits) landlock: Document tracepoints selftests/landlock: Add landlock_enforce_domain trace tests selftests/landlock: Add scope and ptrace tracepoint tests selftests/landlock: Add network tracepoint tests selftests/landlock: Add filesystem tracepoint tests selftests/landlock: Add trace event test infrastructure and tests landlock: Add tracepoints for ptrace and scope denials landlock: Add landlock_deny_access_fs and landlock_deny_access_net landlock: Add tracepoints for rule checking landlock: Add landlock_enforce_domain tracepoint landlock: Add create_domain and free_domain tracepoints landlock: Add landlock_add_rule_fs and landlock_add_rule_net tracepoints landlock: Add create_ruleset and free_ruleset tracepoints landlock: Consolidate access-right and scope names in a shared header landlock: Decouple the per-denial logging decision from CONFIG_AUDIT landlock: Split denial logging from audit into common framework landlock: Split struct landlock_domain from struct landlock_ruleset landlock: Move domain query functions to domain.c landlock: Prepare ruleset and domain type split samples/landlock: Add LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS to sampler ... List of files: /linux/security/landlock/log.h

bb91730f16c064f4eb0dc15ed27814c8f9aef670 - landlock: Add tracepoints for ptrace and scope denials

Tue, 11 Aug 2026 11:43:27 +0200

landlock: Add tracepoints for ptrace and scope denialsScope and ptrace denials follow a different code path (a domainhierarchy check) than access-right denials, so they need dedicatedtracepoints with type-specific TP_PROTO arguments. Complete the denialcoverage with:- landlock_deny_ptrace: ptrace access denied by a domain hierarchy mismatch.- landlock_deny_scope_signal: signal delivery denied by LANDLOCK_SCOPE_SIGNAL.- landlock_deny_scope_abstract_unix_socket: abstract unix socket access denied by LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET.TP_PROTO passes the raw kernel object (struct task_struct or structsock) for eBPF BTF access; the comm and sun_path string fields use__print_untrusted_str() because they hold untrusted input. Unlike thedeny_access events, these omit the blockers field: each maps to exactlyone denial type named by the event, so the bitmask would always be zero.Like the deny_access events they carry same_exec and logged.Audit logs the task-targeted denials with generic field names (opid,ocomm), but a strongly typed trace event can use role-prefixed names(tracee_pid/tracee_comm, target_pid/target_comm) that match the mainlinetask-name convention (sched_process_fork's parent_comm/child_comm) andsay whose name each field holds; a bare comm= would collide acrossevents. The abstract-unix-socket event reports peer_pid instead, atracepoint-only field with no audit counterpart.A scope or ptrace verdict compares the subject domain against the otherparty's domain, so each event also reports that other party's Landlockdomain (tracee_domain=, target_domain=, or peer_domain=); the subjectdomain= alone does not let a consumer redo domain_is_scoped() ordomain_ptrace(). It is reported as a scalar ID rather than a domainpointer: a domain object is immutable, but the other task can replaceits credential and free the domain that credential referenced, so astored foreign pointer could dangle before the event is consumed. Thescalar ID also honors the tracepoint no-nullable-pointer rule, since theother party is frequently unsandboxed. Passing the foreign domainhierarchy object so an eBPF consumer could walk the other party'sancestry live would lengthen the RCU section on the shared denial pathand needs a deferred refcount put, so it is left as a futureenhancement. The relational domain-ID field (tracee_domain,target_domain, or peer_domain) is trace-only and is not added to auditrecords, so audit's denial format is unchanged by this series.Cc: Günther Noack Cc: Justin Suess Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Steven Rostedt Cc: Tingmao Wang Link: https://patch.msgid.link/20260811094338.288094-14-mic@digikod.netSigned-off-by: Mickaël Salaün List of files: /linux/security/landlock/log.h

e761a88cedeb46de17b6d9e8c7c41c7671e83a6b - landlock: Split denial logging from audit into common framework

Tue, 11 Aug 2026 11:43:18 +0200

landlock: Split denial logging from audit into common frameworkTracepoint emission requires the denial framework (layer identification,request validation) without depending on CONFIG_AUDIT. Separate thedenial logging infrastructure from the audit-specific code byintroducing a common log framework.Create CONFIG_SECURITY_LANDLOCK_LOG, enabled by default whenCONFIG_AUDIT is set; a following commit extends it to CONFIG_TRACEPOINTSwhen the first tracepoint consumer is added. Move the common framework(the request types, the layer identification and request validation, andthe landlock_log_denial() and landlock_log_free_domain() entry points)into log.c and log.h, and keep the audit-specific record formatting inaudit.c. log.o is built for CONFIG_SECURITY_LANDLOCK_LOG and audit.o forCONFIG_AUDIT, so the common framework is available to a tracepoints-onlybuild. The entry points dispatch to no-op static inline audit stubswithout CONFIG_AUDIT, so the call sites stay unconditional. Rename theformer landlock_log_drop_domain() to landlock_log_free_domain() to matchthe landlock_free_domain tracepoint added in a following commit.landlock_log_denial() counts denials even without audit, so itsdeclaration and no-op stub are guarded by CONFIG_SECURITY_LANDLOCK_LOG,not CONFIG_AUDIT; a CONFIG_AUDIT guard would expose the stub and clashwith log.c's definition in a tracepoints-only build.Widen the ID allocation (id.o and the landlock_init_id() /landlock_get_id_range() declarations) and the log-state representation(the domain_exec and log_subdomains_off credential fields, thelandlock_hierarchy log fields, and the code that maintains them) fromCONFIG_AUDIT to CONFIG_SECURITY_LANDLOCK_LOG, so each field and itswriter share one guard and are available to tracing without auditsupport.Widen the denial-path state that feeds the per-denial logging decisionthe same way, so the "logged" verdict is computed identically whether ornot CONFIG_AUDIT is set. Widening fown_layer is what keeps thefile-owner-signal path valid without audit: otherwisehook_file_send_sigiotask() would leave layer_plus_one at zero, trippingthe is_valid_request() canary and dropping the LANDLOCK_SCOPE_SIGNALdenial from tracing.The ruleset-level quiet_masks stays on no CONFIG guard: it is builderstate validated and stored from user input, kept available soLANDLOCK_ADD_RULE_QUIET flags are accepted and ignored, not rejected,when CONFIG_SECURITY_LANDLOCK_LOG is disabled.Cc: Günther Noack Link: https://patch.msgid.link/20260811094338.288094-5-mic@digikod.netSigned-off-by: Mickaël Salaün List of files: /linux/security/landlock/log.h