trace_landlock_deny_ptrace(9)
π trace_landlock_deny_ptrace(9) β the Kernel API Manual moment
okay so bestie, welcome to trace_landlock_deny_ptrace(9), from the Kernel API Manual, and no cap this one's a whole vibe check on a Landlock domain catching somebody trying to ptrace when they absolutely should not. π¦
β¨ NAME β¨
trace_landlock_deny_ptrace β ptrace access denied by a Landlock domain. it's giving "you shall not pass" but make it kernel tracepoint energy π
πΈ SYNOPSIS πΈ
void trace_landlock_deny_ptrace (const struct landlock_hierarchy
*hierarchy , bool same_exec , bool logged , u64 tracee_domain_id ,
const struct task_struct *tracee , const struct task_struct
*tracer );
literally the whole signature, character for character, because we do not play about prototypes here π«Ά
π ARGUMENTS π
hierarchyβ the denying domain's hierarchy node, and it is neverNULL(iconic, honestly); itsidis thedomainfield. πsame_execβ whether the tracer entered the denying domain itself. yes/no, that's the tea βloggedβ the domain's audit-logging decision for this denial. so like, did we write it down or did we just silently judge you πtracee_domain_idβ the tracee's Landlock domain ID, or0if the tracee is unsandboxed. zero means free-range tracee, bestie πtraceeβ the target task ptrace acted on, neverNULL. also:tracee_pidis the init-namespace TGID (like audit'sopid). very specific, very demure β¨tracerβ the tracer or proposed tracer, neverNULL. and forPTRACE_TRACEMEthis is the parent, not the syscall caller. read that twice, it matters fr fr π
π₯ DESCRIPTION π₯
emitted when a Landlock domain denies a ptrace operation. that's it, that's the whole plot β a ptrace got told no by a domain that said absolutely not today π
β SEE ALSO β
- Kernel file
./include/trace/events/landlock.hLandlock trace events(9) trace_landlock_create_ruleset(9)trace_landlock_free_ruleset(9)trace_landlock_add_rule_path_beneath(9)trace_landlock_add_rule_net_port(9)trace_landlock_create_domain(9)trace_landlock_enforce_domain(9)trace_landlock_free_domain(9)trace_landlock_check_rule_inode(9)trace_landlock_check_rule_net_port(9)trace_landlock_deny_access_fs(9)trace_landlock_deny_access_net(9)trace_landlock_deny_scope_signal(9)trace_landlock_deny_scope_abstract_unix_socket(9)
like, the whole friend group showed up. love that for them π«Άπ
ngl this is tracepoint documentation, so if you're here hoping for a fun runtime function to call, this is a vibe check, not a syscall. also: it's emitted when a denial happens β the denial is the main character, not you π
and that's the page! π§ sourced from ./include/trace/events, dated October 2026, page trace_landlock_deny_ptrace(9) β slay, go read the other trace events, ily, bye ππ
π¦ where this page comes from
- nixpkgs unstable: linux-manual 7.3.1
- π girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on : a language model's rewrite of the original, under its terms