trace_landlo..._unix_socket(9)

🦋 trace_landlo..._unix_socket(9) — the kernel API manual, bestie edition 🦋

okay so this is a page from the Kernel API Manual, and the star of the show is trace_landlo..._unix_socket(9) — yes that name is long enough to need a snack break, and no we're not shortening it, it's iconic 💅

---

✨ NAME ✨

trace_landlock_deny_scope_abstract_unix_socket — literally the trace event you get when an abstract unix socket gets its access denied by LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET. no cap, that's the whole vibe 🎀

---

🌸 SYNOPSIS 🌸

void trace_landlock_deny_scope_abstract_unix_socket (const struct
landlock_hierarchy *hierarchy , bool same_exec , bool logged , u64
peer_domain_id , const struct sock *peer );

that's the signature, copy it exactly bestie, don't freestyle it 🙈

---

🫶 ARGUMENTS 🫶

• hierarchy — the denying domain's hierarchy node. this one is never NULL, periodt. its id is the domain field 🔥
• same_exec — a bool, and it's answering "did the current task enter the denying domain itself?" yes/no energy ⭐
• logged — the domain's audit-logging decision for this denial. like, the domain already decided whether this gets logged, and this is that answer 💜
• peer_domain_id — the peer's Landlock domain ID, or 0 if the peer is unsandboxed. zero means "no sandbox, living free" 🦋
• peer — the peer socket, and again never NULL. now listen: peer_pid is best-effort — it's 0 for a datagram peer because there's no SO_PEERCRED, so sun_path is the reliable peer identifier. that's the important bit, don't sleep on it 😭

---

💖 DESCRIPTION 💖

emitted when a Landlock domain denies access to a scoped-out abstract unix socket. that's it, that's the moment, that's the whole event 👑

---

🌈 SEE ALSO 🌈

the whole friend group, all of them, no one left out:

• Kernel file ./include/trace/events/landlock.h Landlock trace events(9)
• trace_landlock_create_ruleset(9)
• trace_landlock_free_ruleset(9)
• trace_landlock_add_rule_path_beneath(9)
• trace_landlock_add_rule_net_port(9)
• trace_landlock_create_domain(9)
• trace_landlock_enforce_domain(9)
• trace_landlock_free_domain(9)
• trace_landlock_check_rule_inode(9)
• trace_landlock_check_rule_net_port(9)
• trace_landlock_deny_access_fs(9)
• trace_landlock_deny_access_net(9)
• trace_landlock_deny_ptrace(9)
• trace_landlock_deny_scope_signal(9)

---

real talk: the peer_pid thing is the trap. datagram peer → no SO_PEERCRED → peer_pid is 0. use sun_path if you actually want to know who you're talking to. iykyk 🧚

---

and that's the page!! sign-off time: this one lives at ./include/trace/events, dated October 2026, filed under trace_landlo..._unix_socket(9) — the truncated title is just how it's indexed, not me being lazy, i promise 😭💖 slay, go read your trace events 🎀✨