trace_landl...force_domain(9)

🌸 trace_landlock_enforce_domain(9) — from the Kernel API Manual

okay so bestie, this page lives in the Kernel API Manual and it's literally about the moment a Landlock domain gets enforced on a thread — like the actual clamping-down moment, not the setup. it's a tracepoint, it's iconic, let's go 💅

---

✨ NAME ✨

trace_landlock_enforce_domain — the domain that's now enforced on a thread 🫶

---

✨ SYNOPSIS ✨

void trace_landlock_enforce_domain (const struct landlock_domain *domain
, bool complete , bool process_wide , bool no_new_privs );

that's the whole signature, no notes 💖

---

✨ ARGUMENTS ✨

• domain — the domain that's now enforced on the current thread. it's never NULL, it's immutable, and you read it locklessly, so no locking drama 🎀. to correlate it to landlock_create_domain, go through domain->hierarchy->id for the source ruleset and the requesting thread, or read domain->hierarchy->details if you want the requesting process.
• complete — this one's set on the single event that concludes the operation, right after all of the operation's other enforcements. like, filter on this if you want exactly one event per operation, periodt ✨
• process_wide — the enforcement covers every eligible (non-exiting) thread of the process. it's set when the caller used LANDLOCK_RESTRICT_SELF_TSYNC, or when the process is single-threaded.

🚨 careful bestie: a lone thread whose group still holds a zombie leader is not counted as single-threaded. so process_wide == 0 never proves the opposite. do not read that as a green light, fr fr 😭

• no_new_privs — the enforcing thread's no_new_privs state at enforcement time. it's 1 if it was set (either by a prior :manpage:prctl(2)`` PR_SET_NO_NEW_PRIVS or by LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS), and 0 if the domain was enforced with CAP_SYS_ADMIN instead. two paths, two vibes 👑

---

✨ DESCRIPTION ✨

so this event is emitted for each thread that sys_landlock_restrict_self enforces the domain on — in that thread's own context, right after its commit_creds. which means it only fires once the thread is irreversibly enforcing the domain. aborted operations emit none. no half-sends, no "oops nvm", none of that 🙈

this tracepoint is not balanced — know that going in. every enforcement falls between the domain's landlock_create_domain and landlock_free_domain events, so it's bracketed, it's accounted for, it's fine 🌸

and the big one: complete == 1 && process_wide == 1 means the whole process is sandboxed by domain, durably 🔥. Landlock domains are monotonic and inherited on :manpage:clone(2)``, so that lock-in? it stays. main character energy honestly 💀

---

✨ SEE ALSO ✨

Kernel file ./include/trace/events/landlock.h Landlock trace events(9), trace_landlock_create_ruleset(9), trace_landlock_free_ruleset(9), trace_landlock_add_rule_path_beneath(9), trace_landlock_add_rule_net_port(9), trace_landlock_create_domain(9), trace_landlock_free_domain(9), trace_landlock_check_rule_inode(9), trace_landlock_check_rule_net_port(9), trace_landlock_deny_access_fs(9), trace_landlock_deny_access_net(9), trace_landlock_deny_ptrace(9), trace_landlock_deny_scope_signal(9), trace_landlock_deny_scope_abstract_unix_socket(9)

---

and that's the whole page, bestie 🦋 it comes from the ./include/trace/events source, dated October 2026 — so go forth, filter your tracepoints, and slay 💖✨🎀