mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2026-08-27 21:03:31 -04:00
172b6a6d84
Until now, Landlock observability documentation covered only audit records. The tracepoints added by the previous commits introduce a second channel with different semantics (firing regardless of audit configuration and domain log flags, exposing the full ruleset and domain state to eBPF via BTF), which kernel developers, administrators, and userspace tool authors need to discover and compare against audit. Add a dedicated "Landlock Trace Events" reference covering the event categories, enabling events via tracefs, ruleset versioning, eBPF access through BPF_RAW_TRACEPOINT, and the same_exec and logged denial fields (logged being the kernel's audit-logging decision, so a stateless ftrace filter can select the denials audit would record with logged==1). Cross-reference it from the administrator, kernel-internals, and userspace API documents, contrasting tracepoints with audit: when each channel is preferred, what each guarantees, and how NOAUDIT hooks and audit rate limiting affect them. Also document the relational other-party domain fields the scope and ptrace denial tracepoints expose (tracee_domain, target_domain, peer_domain; 0 when the other party is unsandboxed), so a consumer can resolve them against the lifecycle events and reproduce the two-domain verdict. Cc: Günther Noack <gnoack@google.com> Cc: Tingmao Wang <m@maowtm.org> Link: https://patch.msgid.link/20260811094338.288094-20-mic@digikod.net [mic: Update dates] Signed-off-by: Mickaël Salaün <mic@digikod.net>