landlock_trace_denial(9)

💅 landlock_trace_denial(9) 💅

okay so this is a page from the Kernel API Manual and honestly? it's giving "tiny function, big feelings." bestie, let's get into it 🫶

✨ NAME ✨

landlock_trace_denial — the little guy that emits a tracepoint whenever an access request gets denied 🙈✨

🦋 SYNOPSIS 🦋

void landlock_trace_denial (const struct landlock_request *const request
, const struct landlock_hierarchy *const youngest_denied , const
access_mask_t missing , const bool same_exec , const bool logged );

like, yes, that's the whole signature. she's compact. she's iconic. no cap 💅

🎀 ARGUMENTS 🎀

• request — all the deets about the user space request 👑
• youngest_denied — the youngest hierarchy node that denied the access. literally the baby of the family doing the rejecting 😭 (const struct landlock_hierarchy *const)
• missing — the final missing access subset, when applicable (access_mask_t)
• same_exec — records whether the policy subject is the same executable that called landlock_restrict_self for the denying domain, as computed by landlock_log_denial. fr fr, that's the whole vibe check 🧚
• logged — whether the domain's policy selects this denial for logging, as computed by landlock_log_denial 🌸

🔥 DESCRIPTION 🔥

So what does she actually do? She emits the tracepoint matching request->type when its event is enabled. periodt ✨

and here's the part that matters: unlike audit, it fires regardless of logged. the value gets recorded in the event so consumers can filter on it themselves. no gatekeeping 💀

She gets called from landlock_log_denial — that's her main character origin story 🌈

👑 SEE ALSO 👑

• the Kernel file ./security/landlock/trace.c
• landlock_trace_free_domain(9)

okay that's the whole page, bestie, you ate that 🍓💖 and for the cute sign-off: this one lives in ./security/landlock, dated October 2026, and it's landlock_trace_denial(9) all day every day ⭐🦋💜