trace_landlo...reate_domain(9)

🌸 NAME 🌸

okay bestie, this is the trace_landlock_create_domain page from the Kernel API Manual. The official name vibe is New domain created — that's the whole mood. 💅

✨ SYNOPSIS ✨

Here's the signature, exactly as it stands:

void trace_landlock_create_domain (const struct landlock_domain *domain
       , const struct landlock_ruleset *ruleset );

🎀 ARGUMENTS 🎀

Two args, both absolutely not nullable, and they're both kind of the main character:

• domain — the newly created domain (never NULL, immutable after creation). Its domain->hierarchy->id is its unique ID, shared with the landlock_enforce_domain and landlock_free_domain events; domain->hierarchy->details holds the requesting process. 🫶
• ruleset — the source ruleset frozen into the domain (never NULL). The ruleset lock is held across the emission, so a BPF program reading it via BTF sees the exact merged ruleset; ruleset->id / ruleset->version identify it. 🔥

🦋 DESCRIPTION 🦋

So this event is emitted by sys_landlock_restrict_self once, in the requesting thread's context, right after the merge and before thread-sync. It's giving very specific timing, and we respect it.

The flags-only path (ruleset_fd == -1) creates no domain and does not emit this event. Important! No domain, no event, no drama.

It's paired with the per-thread landlock_enforce_domain (join on domain->hierarchy->id) and balanced by a matching landlock_free_domain event. 🌈

💅 SEE ALSO 💅

go read these next, bestie — the whole landlock trace-event friend group is here:

• Kernel file ./include/trace/events/landlock.h Landlock trace events(9)
• trace_landlock_create_ruleset(9)
• trace_landlock_free_ruleset(9)
• trace_landlock_add_rule_path_beneath(9)
• trace_landlock_add_rule_net_port(9)
• trace_landlock_enforce_domain(9)
• trace_landlock_free_domain(9)
• trace_landlock_check_rule_inode(9)
• trace_landlock_check_rule_net_port(9)
• trace_landlock_deny_access_fs(9)
• trace_landlock_deny_access_net(9)
• trace_landlock_deny_ptrace(9)
• trace_landlock_deny_scope_signal(9)
• trace_landlock_deny_scope_abstract_unix_socket(9)

xoxo bestie 💖 source/version: ./include/trace/events, date: October 2026 — catch you in the Kernel API Manual, periodt. 🧚