trace_landlock_deny_ptrace(9)

πŸ“¦ version 7.3.1, in nixpkgs unstable

πŸ’œ trace_landlock_deny_ptrace(9) β€” the Kernel API Manual moment

okay so bestie, welcome to trace_landlock_deny_ptrace(9), from the Kernel API Manual, and no cap this one's a whole vibe check on a Landlock domain catching somebody trying to ptrace when they absolutely should not. πŸ¦‹


✨ NAME ✨

trace_landlock_deny_ptrace β€” ptrace access denied by a Landlock domain. it's giving "you shall not pass" but make it kernel tracepoint energy πŸ’…


🌸 SYNOPSIS 🌸

void trace_landlock_deny_ptrace (const struct landlock_hierarchy
*hierarchy , bool same_exec , bool logged , u64 tracee_domain_id ,
const struct task_struct *tracee , const struct task_struct
*tracer );

literally the whole signature, character for character, because we do not play about prototypes here 🫢


πŸŽ€ ARGUMENTS πŸŽ€

  • hierarchy β€” the denying domain's hierarchy node, and it is never NULL (iconic, honestly); its id is the domain field. πŸ‘‘
  • same_exec β€” whether the tracer entered the denying domain itself. yes/no, that's the tea β˜•
  • logged β€” the domain's audit-logging decision for this denial. so like, did we write it down or did we just silently judge you πŸ’€
  • tracee_domain_id β€” the tracee's Landlock domain ID, or 0 if the tracee is unsandboxed. zero means free-range tracee, bestie πŸ“
  • tracee β€” the target task ptrace acted on, never NULL. also: tracee_pid is the init-namespace TGID (like audit's opid). very specific, very demure ✨
  • tracer β€” the tracer or proposed tracer, never NULL. and for PTRACE_TRACEME this is the parent, not the syscall caller. read that twice, it matters fr fr 😭

πŸ”₯ DESCRIPTION πŸ”₯

emitted when a Landlock domain denies a ptrace operation. that's it, that's the whole plot β€” a ptrace got told no by a domain that said absolutely not today 🌈


⭐ SEE ALSO ⭐

like, the whole friend group showed up. love that for them πŸ«ΆπŸ’–


ngl this is tracepoint documentation, so if you're here hoping for a fun runtime function to call, this is a vibe check, not a syscall. also: it's emitted when a denial happens β€” the denial is the main character, not you 😌

and that's the page! 🧚 sourced from ./include/trace/events, dated October 2026, page trace_landlock_deny_ptrace(9) β€” slay, go read the other trace events, ily, bye πŸ’œπŸŽ€

πŸ“¦ where this page comes from