STRUCT LANDLOCK_CRED_SECURITY(9)

✨ struct landlock_cred_security(9) ✨

okay so this is a page from the Kernel API Manual bestie, and we're talking about struct landlock_cred_security — literally the credential security blob 👑

---

💖 NAME 💖

struct landlock_cred_security — the Credential security blob, no cap 🫶

---

🌸 SYNOPSIS 🌸

struct landlock_cred_security {
    struct landlock_domain *domain;
  #ifdef CONFIG_SECURITY_LANDLOCK_LOG;
    u16 domain_exec;
    u8 log_subdomains_off : 1;
  #endif ;
 };

---

🎀 Members 🎀

• domain — the immutable domain that's enforced on a task. like, it's set and it stays set, that's the whole vibe 🔥
• domain_exec — a bitmask that identifies which domain layers were enforced by the current task's executed file 🦋 (meaning: there's been no new execve(2) since landlock_restrict_self(2) — track that, it matters)
• log_subdomains_off — set if the domain descendants's log_status should be set to LANDLOCK_LOG_DISABLED 💀 this is not a landlock_hierarchy configuration, and the reason is lowkey iconic: it applies to future descendant domains and it does not require a current domain. periodt.

---

🌈 Description 🌈

okay so the whole point of this structure being packed is to minimize the size of struct landlock_file_security — it's giving space-saving main character energy ✨

but!! it's always aligned in the LSM cred blob, k? see lsm_set_blob_size for the receipts 👀

⚠️ heads up bestie: when you update this, also update landlock_cred_copy if needed. don't forget, i'm literally begging 🙈

---

⭐ SEE ALSO ⭐

• Kernel file ./security/landlock/cred.h
• landlock_get_applicable_subject(9)

---

and that's the whole page, bestie 💅 mwah 💖

— with love from ./security/landlock, dated October 2026 🎀🦋🌷