trace_landlo...path_beneath(9)

🦋 trace_landlo...path_beneath(9) 🦋

okay so bestie, this page lives in the Kernel API Manual and it's literally all about trace_landlock_add_rule_path_beneath — the trace event that fires when a path-beneath rule gets added to a ruleset 💅 no cap, that's the whole vibe.

---

✨ NAME ✨

trace_landlock_add_rule_path_beneath — the "Path-beneath rule added to a ruleset" trace event 🎀 (yes that's the official tagline, iykyk)

---

🌸 SYNOPSIS 🌸

void trace_landlock_add_rule_path_beneath (const struct landlock_ruleset
*ruleset , u32 flags , u64 access_rights , const struct path *path ,
const char *pathname );

---

🎀 ARGUMENTS 🎀

• ruleset — the Source ruleset. She is never NULL 👑 like, ever. main character energy, always present.
• flags — the complete validated landlock_add_rule_flags value that this successful call supplied 🫶. Important: it's the value from this call, NOT the rule's accumulated quiet state. don't get it twisted bestie.
• access_rights — the canonical per-call access mask that got passed to landlock_insert_rule after normalization ✨. It is NOT the raw sys_landlock_add_rule argument and it is NOT the accumulated rule. three different things, lowkey obsessed with the distinction.
• path — the filesystem path for the rule 🦋. never NULL. she's real.
• pathname — the resolved absolute path string 💖. also never NULL — BUT if resolution failed you get an error placeholder in there instead 😭🙈.

---

💜 DESCRIPTION 💜

So here's the lore: this event is emitted by sys_landlock_add_rule under the modified ruleset's lock 🔒. Which means the ruleset it reports is a stable snapshot — no concurrent writer can sneak in and change it while you're looking 👀. it's giving locked-down, immutable, iconic. periodt.

fr fr, the whole point is that you can trust what you're seeing. no race conditions invited to the party 💅

---

🧚 SEE ALSO 🧚

• Kernel file ./include/trace/events/landlock.h
• Landlock trace events(9)
• trace_landlock_create_ruleset(9)
• trace_landlock_free_ruleset(9)
• trace_landlock_add_rule_net_port(9)
• trace_landlock_create_domain(9)
• trace_landlock_enforce_domain(9)
• trace_landlock_free_domain(9)
• trace_landlock_check_rule_inode(9)
• trace_landlock_check_rule_net_port(9)
• trace_landlock_deny_access_fs(9)
• trace_landlock_deny_access_net(9)
• trace_landlock_deny_ptrace(9)
• trace_landlock_deny_scope_signal(9)
• trace_landlock_deny_scope_abstract_unix_socket(9)

---

and that's the whole page bestie 💖✨🎀🦋🌸💅🫶

this absolute baddie of a manpage comes to you from ./include/trace/events, dated October 2026, and it's filed under trace_landlo...path_beneath(9) — go read the whole landlock trace event family, they all ate 🔥👑🌈⭐💀💜🍓