trace_landlo...y_access_net(9)

💅 trace_landlo...y_access_net(9) — network access denied, bestie

okay so this is a page from the Kernel API Manual and it's literally all about trace_landlock_deny_access_net — the trace event that fires the second a Landlock domain says "nope" to a network operation. it's giving security girlie with a clipboard. let's get into it 🎀

---

✨ NAME ✨

trace_landlock_deny_access_net — Network access denied

like, the whole personality is in the name. a network thing got denied. that's the tweet. 🦋

---

✨ SYNOPSIS ✨

void trace_landlock_deny_access_net (const struct landlock_hierarchy *hierarchy , bool same_exec , bool logged , const struct landlock_blockers *blockers , const struct sock *sk , u16 socket_family , const struct sockaddr_storage *address , int addrlen );

it returns void, so don't go looking for a return value, she doesn't do that 💅

---

✨ ARGUMENTS ✨

• hierarchy — the denying domain's hierarchy node, and it is never NULL (iconic, honestly). its id is the domain field.
• same_exec — a bool that tells you whether the current task entered the denying domain itself. main character behavior check 🫶
• logged — the domain's audit-logging decision for this denial. basically: did we write this down or not.
• blockers — request type plus the final missing access subset. never NULL, bestie, don't even try it.
• sk — the socket object (never NULL), but heads up: it's read without a socket lock, so its fields are a best-effort snapshot. it's giving blurry candid photo, not a professional headshot 📸
• socket_family — a u16 snapshot of the socket family, used by the verdict.
• address — the authoritative address that the verdict actually checked (never NULL). the producer copies addrlen bytes from the checked address and zeroes out the rest of the storage before emission. and the sockaddr_in.sin_port or sockaddr_in6.sin6_port member, when present, stays in network endianness — do not come for her byte order ⭐
• addrlen — the validated signed length of address. signed, yes, we know, it's fine.

---

✨ DESCRIPTION ✨

this event gets emitted when a Landlock domain denies a network operation. periodt. 🔥

the blocker tells you whether the address is a bind policy object or a connect/send policy object — iykyk.

and the flattened port field? it's converted from the checked address to host endianness. or it's -1 when no port was checked at all. and just so we're clear: 0 is a valid checked port, so don't go treating zero like it means nothing, that's so rude 😭

---

✨ SEE ALSO ✨

• Kernel file ./include/trace/events/landlock.h
• Landlock trace events(9)
• trace_landlock_create_ruleset(9)
• trace_landlock_free_ruleset(9)
• trace_landlock_add_rule_path_beneath(9)
• trace_landlock_add_rule_net_port(9)
• trace_landlock_create_domain(9)
• trace_landlock_enforce_domain(9)
• trace_landlock_free_domain(9)
• trace_landlock_check_rule_inode(9)
• trace_landlock_check_rule_net_port(9)
• trace_landlock_deny_access_fs(9)
• trace_landlock_deny_ptrace(9)
• trace_landlock_deny_scope_signal(9)
• trace_landlock_deny_scope_abstract_unix_socket(9)

---

ok that's the whole page, you ate that 💖 go forth and trace your denials responsibly 🌸

mwah 💋 this came from ./include/trace/events, dated October 2026, and it's the trace_landlo...y_access_net(9) page — yeah the header truncated it too, we don't know why, we don't ask 🧚