sphinx.addnodesdocument)}( rawsourcechildren]( translations LanguagesNode)}(hhh](h pending_xref)}(hhh]docutils.nodesTextChinese (Simplified)}parenthsba attributes}(ids]classes]names]dupnames]backrefs] refdomainstdreftypedoc reftarget,/translations/zh_CN/admin-guide/LSM/landlockmodnameN classnameN refexplicitutagnamehhh ubh)}(hhh]hChinese (Traditional)}hh2sbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget,/translations/zh_TW/admin-guide/LSM/landlockmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hItalian}hhFsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget,/translations/it_IT/admin-guide/LSM/landlockmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hJapanese}hhZsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget,/translations/ja_JP/admin-guide/LSM/landlockmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hKorean}hhnsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget,/translations/ko_KR/admin-guide/LSM/landlockmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hPortuguese (Brazilian)}hhsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget,/translations/pt_BR/admin-guide/LSM/landlockmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hSpanish}hhsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget,/translations/sp_SP/admin-guide/LSM/landlockmodnameN classnameN refexplicituh1hhh ubeh}(h]h ]h"]h$]h&]current_languageEnglishuh1h hh _documenthsourceNlineNubhcomment)}(h SPDX-License-Identifier: GPL-2.0h]h SPDX-License-Identifier: GPL-2.0}hhsbah}(h]h ]h"]h$]h&] xml:spacepreserveuh1hhhhhhF/var/lib/git/docbuild/linux/Documentation/admin-guide/LSM/landlock.rsthKubh)}(h'Copyright © 2025 Microsoft Corporationh]h'Copyright © 2025 Microsoft Corporation}hhsbah}(h]h ]h"]h$]h&]hhuh1hhhhhhhhKubh)}(h"Copyright © 2026 Cloudflare, Inc.h]h"Copyright © 2026 Cloudflare, Inc.}hhsbah}(h]h ]h"]h$]h&]hhuh1hhhhhhhhKubhsection)}(hhh](htitle)}(h Landlock: system-wide managementh]h Landlock: system-wide management}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhhhhhKubh field_list)}(hhh](hfield)}(hhh](h field_name)}(hAuthorh]hAuthor}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjhhhKubh field_body)}(hMickaël Salaünh]h paragraph)}(hjh]hMickaël Salaün}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK hjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1hhhhK hhhhubh)}(hhh](j)}(hDateh]hDate}(hj7hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj4hhhKubj)}(h August 2026 h]j)}(h August 2026h]h August 2026}(hjIhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK hjEubah}(h]h ]h"]h$]h&]uh1jhj4ubeh}(h]h ]h"]h$]h&]uh1hhhhK hhhhubeh}(h]h ]h"]h$]h&]uh1hhhhhhhhK ubj)}(h8Landlock can leverage the audit framework to log events.h]h8Landlock can leverage the audit framework to log events.}(hjihhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK hhhhubj)}(hUUser space documentation can be found here: Documentation/userspace-api/landlock.rst.h]hUUser space documentation can be found here: Documentation/userspace-api/landlock.rst.}(hjwhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhKhhhhubh)}(hhh](h)}(hAudith]hAudit}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKubj)}(hXDenied access requests are logged by default for a sandboxed program if `audit` is enabled. This default behavior can be changed with the sys_landlock_restrict_self() flags (cf. Documentation/userspace-api/landlock.rst), or suppressed on a per-object basis by using ``LANDLOCK_ADD_RULE_QUIET`` (ABI 10+). Landlock logs can also be masked thanks to audit rules. Landlock can generate 2 audit record types.h](hHDenied access requests are logged by default for a sandboxed program if }(hjhhhNhNubhtitle_reference)}(h`audit`h]haudit}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh is enabled. This default behavior can be changed with the sys_landlock_restrict_self() flags (cf. Documentation/userspace-api/landlock.rst), or suppressed on a per-object basis by using }(hjhhhNhNubhliteral)}(h``LANDLOCK_ADD_RULE_QUIET``h]hLANDLOCK_ADD_RULE_QUIET}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhq (ABI 10+). Landlock logs can also be masked thanks to audit rules. Landlock can generate 2 audit record types.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKhjhhubh)}(hhh](h)}(h Record typesh]h Record types}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKubhdefinition_list)}(hhh](hdefinition_list_item)}(hXAUDIT_LANDLOCK_ACCESS This record type identifies a denied access request to a kernel resource. The ``domain`` field indicates the ID of the domain that blocked the request. The ``blockers`` field indicates the cause(s) of this denial (separated by a comma), and the following fields identify the kernel object (similar to SELinux). There may be more than one of this record type per audit event. Example with a file link request generating two records in the same event:: domain=195ba459b blockers=fs.refer path="/usr/bin" dev="vda2" ino=351 domain=195ba459b blockers=fs.make_reg,fs.refer path="/usr/local" dev="vda2" ino=365 The ``blockers`` field uses dot-separated prefixes to indicate the type of restriction that caused the denial: **fs.*** - Filesystem access rights (ABI 1+): - fs.execute, fs.write_file, fs.read_file, fs.read_dir - fs.remove_dir, fs.remove_file - fs.make_char, fs.make_dir, fs.make_reg, fs.make_sock - fs.make_fifo, fs.make_block, fs.make_sym - fs.refer (ABI 2+) - fs.truncate (ABI 3+) - fs.ioctl_dev (ABI 5+) - fs.resolve_unix (ABI 9+) **net.*** - Network access rights (ABI 4+): - net.bind_tcp - TCP port binding was denied - net.connect_tcp - TCP connection was denied - net.bind_udp - UDP port binding was denied - net.connect_send_udp - UDP connection and send was denied **scope.*** - IPC scoping restrictions (ABI 6+): - scope.abstract_unix_socket - Abstract UNIX socket connection denied - scope.signal - Signal sending denied Multiple blockers can appear in a single event (comma-separated) when multiple access rights are missing. For example, creating a regular file in a directory that lacks both ``make_reg`` and ``refer`` rights would show ``blockers=fs.make_reg,fs.refer``. The object identification fields (path, dev, ino for filesystem; opid, ocomm for signals) depend on the type of access being blocked and provide context about what resource was involved in the denial. h](hterm)}(hAUDIT_LANDLOCK_ACCESSh]hAUDIT_LANDLOCK_ACCESS}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhKLhjubh definition)}(hhh](j)}(hXxThis record type identifies a denied access request to a kernel resource. The ``domain`` field indicates the ID of the domain that blocked the request. The ``blockers`` field indicates the cause(s) of this denial (separated by a comma), and the following fields identify the kernel object (similar to SELinux). There may be more than one of this record type per audit event.h](hNThis record type identifies a denied access request to a kernel resource. The }(hjhhhNhNubj)}(h ``domain``h]hdomain}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhE field indicates the ID of the domain that blocked the request. The }(hjhhhNhNubj)}(h ``blockers``h]hblockers}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh field indicates the cause(s) of this denial (separated by a comma), and the following fields identify the kernel object (similar to SELinux). There may be more than one of this record type per audit event.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhK hjubj)}(hKExample with a file link request generating two records in the same event::h]hJExample with a file link request generating two records in the same event:}(hj/hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK'hjubh literal_block)}(hdomain=195ba459b blockers=fs.refer path="/usr/bin" dev="vda2" ino=351 domain=195ba459b blockers=fs.make_reg,fs.refer path="/usr/local" dev="vda2" ino=365h]hdomain=195ba459b blockers=fs.refer path="/usr/bin" dev="vda2" ino=351 domain=195ba459b blockers=fs.make_reg,fs.refer path="/usr/local" dev="vda2" ino=365}hj?sbah}(h]h ]h"]h$]h&]hhuh1j=hhhK)hjubj)}(hnThe ``blockers`` field uses dot-separated prefixes to indicate the type of restriction that caused the denial:h](hThe }(hjMhhhNhNubj)}(h ``blockers``h]hblockers}(hjUhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjMubh^ field uses dot-separated prefixes to indicate the type of restriction that caused the denial:}(hjMhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhK-hjubj)}(hhh](j)}(hXE**fs.*** - Filesystem access rights (ABI 1+): - fs.execute, fs.write_file, fs.read_file, fs.read_dir - fs.remove_dir, fs.remove_file - fs.make_char, fs.make_dir, fs.make_reg, fs.make_sock - fs.make_fifo, fs.make_block, fs.make_sym - fs.refer (ABI 2+) - fs.truncate (ABI 3+) - fs.ioctl_dev (ABI 5+) - fs.resolve_unix (ABI 9+) h](j)}(h-**fs.*** - Filesystem access rights (ABI 1+):h](hstrong)}(h**fs.***h]hfs.*}(hjzhhhNhNubah}(h]h ]h"]h$]h&]uh1jxhjtubh% - Filesystem access rights (ABI 1+):}(hjthhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhK8hjpubj)}(hhh]h bullet_list)}(hhh](h list_item)}(h4fs.execute, fs.write_file, fs.read_file, fs.read_dirh]j)}(hjh]h4fs.execute, fs.write_file, fs.read_file, fs.read_dir}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK1hjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hfs.remove_dir, fs.remove_fileh]j)}(hjh]hfs.remove_dir, fs.remove_file}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK2hjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(h4fs.make_char, fs.make_dir, fs.make_reg, fs.make_sockh]j)}(hjh]h4fs.make_char, fs.make_dir, fs.make_reg, fs.make_sock}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK3hjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(h(fs.make_fifo, fs.make_block, fs.make_symh]j)}(hjh]h(fs.make_fifo, fs.make_block, fs.make_sym}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK4hjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hfs.refer (ABI 2+)h]j)}(hjh]hfs.refer (ABI 2+)}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK5hjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hfs.truncate (ABI 3+)h]j)}(hjh]hfs.truncate (ABI 3+)}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK6hjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hfs.ioctl_dev (ABI 5+)h]j)}(hj(h]hfs.ioctl_dev (ABI 5+)}(hj*hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK7hj&ubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hfs.resolve_unix (ABI 9+) h]j)}(hfs.resolve_unix (ABI 9+)h]hfs.resolve_unix (ABI 9+)}(hjAhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK8hj=ubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]bullet-uh1jhhhK1hjubah}(h]h ]h"]h$]h&]uh1jhjpubeh}(h]h ]h"]h$]h&]uh1jhhhK8hjmubj)}(h**net.*** - Network access rights (ABI 4+): - net.bind_tcp - TCP port binding was denied - net.connect_tcp - TCP connection was denied - net.bind_udp - UDP port binding was denied - net.connect_send_udp - UDP connection and send was denied h](j)}(h+**net.*** - Network access rights (ABI 4+):h](jy)}(h **net.***h]hnet.*}(hjqhhhNhNubah}(h]h ]h"]h$]h&]uh1jxhjmubh" - Network access rights (ABI 4+):}(hjmhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhK>hjiubj)}(hhh]j)}(hhh](j)}(h*net.bind_tcp - TCP port binding was deniedh]j)}(hjh]h*net.bind_tcp - TCP port binding was denied}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK;hjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(h+net.connect_tcp - TCP connection was deniedh]j)}(hjh]h+net.connect_tcp - TCP connection was denied}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhKhjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]j[j\uh1jhhhK;hjubah}(h]h ]h"]h$]h&]uh1jhjiubeh}(h]h ]h"]h$]h&]uh1jhhhK>hjmubj)}(h**scope.*** - IPC scoping restrictions (ABI 6+): - scope.abstract_unix_socket - Abstract UNIX socket connection denied - scope.signal - Signal sending denied h](j)}(h0**scope.*** - IPC scoping restrictions (ABI 6+):h](jy)}(h **scope.***h]hscope.*}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jxhjubh% - IPC scoping restrictions (ABI 6+):}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKBhjubj)}(hhh]j)}(hhh](j)}(hCscope.abstract_unix_socket - Abstract UNIX socket connection deniedh]j)}(hj&h]hCscope.abstract_unix_socket - Abstract UNIX socket connection denied}(hj(hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhKAhj$ubah}(h]h ]h"]h$]h&]uh1jhj!ubj)}(h%scope.signal - Signal sending denied h]j)}(h$scope.signal - Signal sending deniedh]h$scope.signal - Signal sending denied}(hj?hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhKBhj;ubah}(h]h ]h"]h$]h&]uh1jhj!ubeh}(h]h ]h"]h$]h&]j[j\uh1jhhhKAhjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhhhKBhjmubeh}(h]h ]h"]h$]h&]uh1jhjubj)}(hMultiple blockers can appear in a single event (comma-separated) when multiple access rights are missing. For example, creating a regular file in a directory that lacks both ``make_reg`` and ``refer`` rights would show ``blockers=fs.make_reg,fs.refer``.h](hMultiple blockers can appear in a single event (comma-separated) when multiple access rights are missing. For example, creating a regular file in a directory that lacks both }(hjkhhhNhNubj)}(h ``make_reg``h]hmake_reg}(hjshhhNhNubah}(h]h ]h"]h$]h&]uh1jhjkubh and }(hjkhhhNhNubj)}(h ``refer``h]hrefer}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjkubh rights would show }(hjkhhhNhNubj)}(h!``blockers=fs.make_reg,fs.refer``h]hblockers=fs.make_reg,fs.refer}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjkubh.}(hjkhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKDhjubj)}(hThe object identification fields (path, dev, ino for filesystem; opid, ocomm for signals) depend on the type of access being blocked and provide context about what resource was involved in the denial.h]hThe object identification fields (path, dev, ino for filesystem; opid, ocomm for signals) depend on the type of access being blocked and provide context about what resource was involved in the denial.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhKIhjubeh}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhhhKLhjubj)}(hXAUDIT_LANDLOCK_DOMAIN This record type describes the status of a Landlock domain. The ``status`` field can be either ``allocated`` or ``deallocated``. The ``allocated`` status is part of the same audit event and follows the first logged ``AUDIT_LANDLOCK_ACCESS`` record of a domain. It identifies Landlock domain information at the time of the sys_landlock_restrict_self() call with the following fields: - the ``domain`` ID - the enforcement ``mode`` - the domain creator's ``pid`` - the domain creator's ``uid`` - the domain creator's executable path (``exe``) - the domain creator's command line (``comm``) Example:: domain=195ba459b status=allocated mode=enforcing pid=300 uid=0 exe="/root/sandboxer" comm="sandboxer" The ``deallocated`` status is an event on its own and it identifies a Landlock domain release. After such event, it is guarantee that the related domain ID will never be reused during the lifetime of the system. The ``domain`` field indicates the ID of the domain which is released, and the ``denials`` field indicates the total number of denied access request, which might not have been logged according to the audit rules and sys_landlock_restrict_self()'s flags. Example:: domain=195ba459b status=deallocated denials=3 h](j)}(hAUDIT_LANDLOCK_DOMAINh]hAUDIT_LANDLOCK_DOMAIN}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhKmhjubj)}(hhh](j)}(hThis record type describes the status of a Landlock domain. The ``status`` field can be either ``allocated`` or ``deallocated``.h](hAThis record type describes the status of a Landlock domain. The }(hjhhhNhNubj)}(h ``status``h]hstatus}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh field can be either }(hjhhhNhNubj)}(h ``allocated``h]h allocated}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh or }(hjhhhNhNubj)}(h``deallocated``h]h deallocated}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKOhjubj)}(hThe ``allocated`` status is part of the same audit event and follows the first logged ``AUDIT_LANDLOCK_ACCESS`` record of a domain. It identifies Landlock domain information at the time of the sys_landlock_restrict_self() call with the following fields:h](hThe }(hj"hhhNhNubj)}(h ``allocated``h]h allocated}(hj*hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj"ubhE status is part of the same audit event and follows the first logged }(hj"hhhNhNubj)}(h``AUDIT_LANDLOCK_ACCESS``h]hAUDIT_LANDLOCK_ACCESS}(hj<hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj"ubh record of a domain. It identifies Landlock domain information at the time of the sys_landlock_restrict_self() call with the following fields:}(hj"hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKRhjubj)}(hhh](j)}(hthe ``domain`` IDh]j)}(hjYh](hthe }(hj[hhhNhNubj)}(h ``domain``h]hdomain}(hjbhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj[ubh ID}(hj[hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKWhjWubah}(h]h ]h"]h$]h&]uh1jhjTubj)}(hthe enforcement ``mode``h]j)}(hjh](hthe enforcement }(hjhhhNhNubj)}(h``mode``h]hmode}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhhhKXhjubah}(h]h ]h"]h$]h&]uh1jhjTubj)}(hthe domain creator's ``pid``h]j)}(hjh](hthe domain creator’s }(hjhhhNhNubj)}(h``pid``h]hpid}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhhhKYhjubah}(h]h ]h"]h$]h&]uh1jhjTubj)}(hthe domain creator's ``uid``h]j)}(hjh](hthe domain creator’s }(hjhhhNhNubj)}(h``uid``h]huid}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhhhKZhjubah}(h]h ]h"]h$]h&]uh1jhjTubj)}(h.the domain creator's executable path (``exe``)h]j)}(hjh](h(the domain creator’s executable path (}(hjhhhNhNubj)}(h``exe``h]hexe}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh)}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhK[hjubah}(h]h ]h"]h$]h&]uh1jhjTubj)}(h-the domain creator's command line (``comm``) h]j)}(h,the domain creator's command line (``comm``)h](h%the domain creator’s command line (}(hjhhhNhNubj)}(h``comm``h]hcomm}(hj$hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh)}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhK\hjubah}(h]h ]h"]h$]h&]uh1jhjTubeh}(h]h ]h"]h$]h&]j[j\uh1jhhhKWhjubj)}(h Example::h]hExample:}(hjHhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK^hjubj>)}(hedomain=195ba459b status=allocated mode=enforcing pid=300 uid=0 exe="/root/sandboxer" comm="sandboxer"h]hedomain=195ba459b status=allocated mode=enforcing pid=300 uid=0 exe="/root/sandboxer" comm="sandboxer"}hjVsbah}(h]h ]h"]h$]h&]hhuh1j=hhhK`hjubj)}(hXThe ``deallocated`` status is an event on its own and it identifies a Landlock domain release. After such event, it is guarantee that the related domain ID will never be reused during the lifetime of the system. The ``domain`` field indicates the ID of the domain which is released, and the ``denials`` field indicates the total number of denied access request, which might not have been logged according to the audit rules and sys_landlock_restrict_self()'s flags.h](hThe }(hjdhhhNhNubj)}(h``deallocated``h]h deallocated}(hjlhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjdubh status is an event on its own and it identifies a Landlock domain release. After such event, it is guarantee that the related domain ID will never be reused during the lifetime of the system. The }(hjdhhhNhNubj)}(h ``domain``h]hdomain}(hj~hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjdubhA field indicates the ID of the domain which is released, and the }(hjdhhhNhNubj)}(h ``denials``h]hdenials}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjdubh field indicates the total number of denied access request, which might not have been logged according to the audit rules and sys_landlock_restrict_self()’s flags.}(hjdhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKbhjubj)}(h Example::h]hExample:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhKjhjubj>)}(h-domain=195ba459b status=deallocated denials=3h]h-domain=195ba459b status=deallocated denials=3}hjsbah}(h]h ]h"]h$]h&]hhuh1j=hhhKlhjubeh}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhhhKmhjhhubeh}(h]h ]h"]h$]h&]uh1jhjhhhhhNubeh}(h] record-typesah ]h"] record typesah$]h&]uh1hhjhhhhhKubh)}(hhh](h)}(h Event samplesh]h Event samples}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKpubj)}(h9Here are two examples of log events (see serial numbers).h]h9Here are two examples of log events (see serial numbers).}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhKrhjhhubj)}(hIn this example a sandboxed program (``kill``) tries to send a signal to the init process, which is denied because of the signal scoping restriction (``LL_SCOPED=s``)::h](h%In this example a sandboxed program (}(hjhhhNhNubj)}(h``kill``h]hkill}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhi) tries to send a signal to the init process, which is denied because of the signal scoping restriction (}(hjhhhNhNubj)}(h``LL_SCOPED=s``h]h LL_SCOPED=s}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh):}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKthjhhubj>)}(hE$ LL_FS_RO=/ LL_FS_RW=/ LL_SCOPED=s LL_FORCE_LOG=1 ./sandboxer kill 1h]hE$ LL_FS_RO=/ LL_FS_RW=/ LL_SCOPED=s LL_FORCE_LOG=1 ./sandboxer kill 1}hj/sbah}(h]h ]h"]h$]h&]hhuh1j=hhhKxhjhhubj)}(hXThis command generates two events, each identified with a unique serial number following a timestamp (``msg=audit(1729738800.268:30)``). The first event (serial ``30``) contains 4 records. The first record (``type=LANDLOCK_ACCESS``) shows an access denied by the domain `1a6fdc66f`. The cause of this denial is signal scoping restriction (``blockers=scope.signal``). The process that would have receive this signal is the init process (``opid=1 ocomm="systemd"``).h](hfThis command generates two events, each identified with a unique serial number following a timestamp (}(hj=hhhNhNubj)}(h ``msg=audit(1729738800.268:30)``h]hmsg=audit(1729738800.268:30)}(hjEhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj=ubh). The first event (serial }(hj=hhhNhNubj)}(h``30``h]h30}(hjWhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj=ubh)) contains 4 records. The first record (}(hj=hhhNhNubj)}(h``type=LANDLOCK_ACCESS``h]htype=LANDLOCK_ACCESS}(hjihhhNhNubah}(h]h ]h"]h$]h&]uh1jhj=ubh') shows an access denied by the domain }(hj=hhhNhNubj)}(h `1a6fdc66f`h]h 1a6fdc66f}(hj{hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj=ubh:. The cause of this denial is signal scoping restriction (}(hj=hhhNhNubj)}(h``blockers=scope.signal``h]hblockers=scope.signal}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj=ubhI). The process that would have receive this signal is the init process (}(hj=hhhNhNubj)}(h``opid=1 ocomm="systemd"``h]hopid=1 ocomm="systemd"}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj=ubh).}(hj=hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKzhjhhubj)}(hThe second record (``type=LANDLOCK_DOMAIN``) describes (``status=allocated``) domain `1a6fdc66f`. This domain was created by process ``286`` executing the ``/root/sandboxer`` program launched by the root user.h](hThe second record (}(hjhhhNhNubj)}(h``type=LANDLOCK_DOMAIN``h]htype=LANDLOCK_DOMAIN}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh ) describes (}(hjhhhNhNubj)}(h``status=allocated``h]hstatus=allocated}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh ) domain }(hjhhhNhNubj)}(h `1a6fdc66f`h]h 1a6fdc66f}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh&. This domain was created by process }(hjhhhNhNubj)}(h``286``h]h286}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh executing the }(hjhhhNhNubj)}(h``/root/sandboxer``h]h/root/sandboxer}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh# program launched by the root user.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKhjhhubj)}(hThe third record (``type=SYSCALL``) describes the syscall, its provided arguments, its result (``success=no exit=-1``), and the process that called it.h](hThe third record (}(hjhhhNhNubj)}(h``type=SYSCALL``h]h type=SYSCALL}(hj'hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh=) describes the syscall, its provided arguments, its result (}(hjhhhNhNubj)}(h``success=no exit=-1``h]hsuccess=no exit=-1}(hj9hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh"), and the process that called it.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKhjhhubj)}(hThe fourth record (``type=PROCTITLE``) shows the command's name as an hexadecimal value. This can be translated with ``python -c 'print(bytes.fromhex("6B696C6C0031"))'``.h](hThe fourth record (}(hjQhhhNhNubj)}(h``type=PROCTITLE``h]htype=PROCTITLE}(hjYhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjQubhS) shows the command’s name as an hexadecimal value. This can be translated with }(hjQhhhNhNubj)}(h4``python -c 'print(bytes.fromhex("6B696C6C0031"))'``h]h0python -c 'print(bytes.fromhex("6B696C6C0031"))'}(hjkhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjQubh.}(hjQhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKhjhhubj)}(hXFinally, the last record (``type=LANDLOCK_DOMAIN``) is also the only one from the second event (serial ``31``). It is not tied to a direct user space action but an asynchronous one to free resources tied to a Landlock domain (``status=deallocated``). This can be useful to know that the following logs will not concern the domain ``1a6fdc66f`` anymore. This record also summarize the number of requests this domain denied (``denials=1``), whether they were logged or not.h](hFinally, the last record (}(hjhhhNhNubj)}(h``type=LANDLOCK_DOMAIN``h]htype=LANDLOCK_DOMAIN}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh5) is also the only one from the second event (serial }(hjhhhNhNubj)}(h``31``h]h31}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhv). It is not tied to a direct user space action but an asynchronous one to free resources tied to a Landlock domain (}(hjhhhNhNubj)}(h``status=deallocated``h]hstatus=deallocated}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhS). This can be useful to know that the following logs will not concern the domain }(hjhhhNhNubj)}(h ``1a6fdc66f``h]h 1a6fdc66f}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhQ anymore. This record also summarize the number of requests this domain denied (}(hjhhhNhNubj)}(h ``denials=1``h]h denials=1}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh#), whether they were logged or not.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKhjhhubj>)}(hXFtype=LANDLOCK_ACCESS msg=audit(1729738800.268:30): domain=1a6fdc66f blockers=scope.signal opid=1 ocomm="systemd" type=LANDLOCK_DOMAIN msg=audit(1729738800.268:30): domain=1a6fdc66f status=allocated mode=enforcing pid=286 uid=0 exe="/root/sandboxer" comm="sandboxer" type=SYSCALL msg=audit(1729738800.268:30): arch=c000003e syscall=62 success=no exit=-1 [..] ppid=272 pid=286 auid=0 uid=0 gid=0 [...] comm="kill" [...] type=PROCTITLE msg=audit(1729738800.268:30): proctitle=6B696C6C0031 type=LANDLOCK_DOMAIN msg=audit(1729738800.324:31): domain=1a6fdc66f status=deallocated denials=1h]hXFtype=LANDLOCK_ACCESS msg=audit(1729738800.268:30): domain=1a6fdc66f blockers=scope.signal opid=1 ocomm="systemd" type=LANDLOCK_DOMAIN msg=audit(1729738800.268:30): domain=1a6fdc66f status=allocated mode=enforcing pid=286 uid=0 exe="/root/sandboxer" comm="sandboxer" type=SYSCALL msg=audit(1729738800.268:30): arch=c000003e syscall=62 success=no exit=-1 [..] ppid=272 pid=286 auid=0 uid=0 gid=0 [...] comm="kill" [...] type=PROCTITLE msg=audit(1729738800.268:30): proctitle=6B696C6C0031 type=LANDLOCK_DOMAIN msg=audit(1729738800.324:31): domain=1a6fdc66f status=deallocated denials=1}hjsbah}(h]h ]h"]h$]h&]hhƌforcelanguagenonehighlight_args}uh1j=hhhKhjhhubj)}(h>Here is another example showcasing filesystem access control::h]h=Here is another example showcasing filesystem access control:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhKhjhhubj>)}(hP$ LL_FS_RO=/ LL_FS_RW=/tmp LL_FORCE_LOG=1 ./sandboxer sh -c "echo > /etc/passwd"h]hP$ LL_FS_RO=/ LL_FS_RW=/tmp LL_FORCE_LOG=1 ./sandboxer sh -c "echo > /etc/passwd"}hj sbah}(h]h ]h"]h$]h&]hhuh1j=hhhKhjhhubj)}(hThe related audit logs contains 8 records from 3 different events (serials 33, 34 and 35) created by the same domain `1a6fdc679`::h](huThe related audit logs contains 8 records from 3 different events (serials 33, 34 and 35) created by the same domain }(hj hhhNhNubj)}(h `1a6fdc679`h]h 1a6fdc679}(hj" hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubh:}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKhjhhubj>)}(hXtype=LANDLOCK_ACCESS msg=audit(1729738800.221:33): domain=1a6fdc679 blockers=fs.write_file path="/dev/tty" dev="devtmpfs" ino=9 type=LANDLOCK_DOMAIN msg=audit(1729738800.221:33): domain=1a6fdc679 status=allocated mode=enforcing pid=289 uid=0 exe="/root/sandboxer" comm="sandboxer" type=SYSCALL msg=audit(1729738800.221:33): arch=c000003e syscall=257 success=no exit=-13 [...] ppid=272 pid=289 auid=0 uid=0 gid=0 [...] comm="sh" [...] type=PROCTITLE msg=audit(1729738800.221:33): proctitle=7368002D63006563686F203E202F6574632F706173737764 type=LANDLOCK_ACCESS msg=audit(1729738800.221:34): domain=1a6fdc679 blockers=fs.write_file path="/etc/passwd" dev="vda2" ino=143821 type=SYSCALL msg=audit(1729738800.221:34): arch=c000003e syscall=257 success=no exit=-13 [...] ppid=272 pid=289 auid=0 uid=0 gid=0 [...] comm="sh" [...] type=PROCTITLE msg=audit(1729738800.221:34): proctitle=7368002D63006563686F203E202F6574632F706173737764 type=LANDLOCK_DOMAIN msg=audit(1729738800.261:35): domain=1a6fdc679 status=deallocated denials=2h]hXtype=LANDLOCK_ACCESS msg=audit(1729738800.221:33): domain=1a6fdc679 blockers=fs.write_file path="/dev/tty" dev="devtmpfs" ino=9 type=LANDLOCK_DOMAIN msg=audit(1729738800.221:33): domain=1a6fdc679 status=allocated mode=enforcing pid=289 uid=0 exe="/root/sandboxer" comm="sandboxer" type=SYSCALL msg=audit(1729738800.221:33): arch=c000003e syscall=257 success=no exit=-13 [...] ppid=272 pid=289 auid=0 uid=0 gid=0 [...] comm="sh" [...] type=PROCTITLE msg=audit(1729738800.221:33): proctitle=7368002D63006563686F203E202F6574632F706173737764 type=LANDLOCK_ACCESS msg=audit(1729738800.221:34): domain=1a6fdc679 blockers=fs.write_file path="/etc/passwd" dev="vda2" ino=143821 type=SYSCALL msg=audit(1729738800.221:34): arch=c000003e syscall=257 success=no exit=-13 [...] ppid=272 pid=289 auid=0 uid=0 gid=0 [...] comm="sh" [...] type=PROCTITLE msg=audit(1729738800.221:34): proctitle=7368002D63006563686F203E202F6574632F706173737764 type=LANDLOCK_DOMAIN msg=audit(1729738800.261:35): domain=1a6fdc679 status=deallocated denials=2}hj: sbah}(h]h ]h"]h$]h&]hhuh1j=hhhKhjhhubeh}(h] event-samplesah ]h"] event samplesah$]h&]uh1hhjhhhhhKpubh)}(hhh](h)}(hEvent filteringh]hEvent filtering}(hjS hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjP hhhhhKubj)}(hIf you get spammed with audit logs related to Landlock, this is either an attack attempt or a bug in the security policy. We can put in place some filters to limit noise with two complementary ways:h]hIf you get spammed with audit logs related to Landlock, this is either an attack attempt or a bug in the security policy. We can put in place some filters to limit noise with two complementary ways:}(hja hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhKhjP hhubj)}(hhh](j)}(hywith sys_landlock_restrict_self()'s flags, or ``LANDLOCK_ADD_RULE_QUIET`` (ABI 10+) if we can fix the sandboxed programs,h]j)}(hywith sys_landlock_restrict_self()'s flags, or ``LANDLOCK_ADD_RULE_QUIET`` (ABI 10+) if we can fix the sandboxed programs,h](h0with sys_landlock_restrict_self()’s flags, or }(hjv hhhNhNubj)}(h``LANDLOCK_ADD_RULE_QUIET``h]hLANDLOCK_ADD_RULE_QUIET}(hj~ hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjv ubh0 (ABI 10+) if we can fix the sandboxed programs,}(hjv hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKhjr ubah}(h]h ]h"]h$]h&]uh1jhjo hhhhhNubj)}(h2or with audit rules (see :manpage:`auditctl(8)`). h]j)}(h1or with audit rules (see :manpage:`auditctl(8)`).h](hor with audit rules (see }(hj hhhNhNubhmanpage)}(h:manpage:`auditctl(8)`h]h auditctl(8)}(hj hhhNhNubah}(h]h ]j ah"]h$]h&]hhƌpath auditctl(8)pageauditctlsection8uh1j hj ubh).}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhjo hhhhhNubeh}(h]h ]h"]h$]h&]j[j\uh1jhhhKhjP hhubeh}(h]event-filteringah ]h"]event filteringah$]h&]uh1hhjhhhhhKubeh}(h]auditah ]h"]auditah$]h&]uh1hhhhhhhhKubh)}(hhh](h)}(h Tracepointsh]h Tracepoints}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj hhhhhKubj)}(hX8Landlock also provides tracepoints as an alternative to audit for debugging and observability. Tracepoints fire unconditionally, independent of audit configuration, ``audit_enabled``, and domain log flags. This makes them suitable for always-on monitoring with eBPF or for ad-hoc debugging with ``trace-pipe``.h](hLandlock also provides tracepoints as an alternative to audit for debugging and observability. Tracepoints fire unconditionally, independent of audit configuration, }(hj hhhNhNubj)}(h``audit_enabled``h]h audit_enabled}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubhr, and domain log flags. This makes them suitable for always-on monitoring with eBPF or for ad-hoc debugging with }(hj hhhNhNubj)}(h``trace-pipe``h]h trace-pipe}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubh.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKhj hhubj)}(hXSee Documentation/trace/events-landlock.rst for the complete event reference: the full event list, how to enable events and read their output, the field formats, the ``check_rule`` interpretation guide, worked event samples, ftrace filtering, and eBPF access.h](hSee Documentation/trace/events-landlock.rst for the complete event reference: the full event list, how to enable events and read their output, the field formats, the }(hj' hhhNhNubj)}(h``check_rule``h]h check_rule}(hj/ hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj' ubhO interpretation guide, worked event samples, ftrace filtering, and eBPF access.}(hj' hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKhj hhubhtarget)}(h.. _landlock_observability:h]h}(h]h ]h"]h$]h&]refidlandlock-observabilityuh1jG hKhj hhhhubh)}(hhh](h)}(hWhen to use tracing vs audith]hWhen to use tracing vs audit}(hjX hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjU hhhhhKubj)}(h/status`` uses ``PTRACE_MODE_NOAUDIT``). When NOAUDIT is set, neither audit records nor trace events are emitted, and the denial is not counted in ``denials``. The denial is still enforced. This avoids performance overhead and noise from speculative probes that test permissions without performing an actual access. h]j)}(hX**NOAUDIT hooks**: Some LSM hooks suppress logging for speculative permission probes (e.g., reading ``/proc//status`` uses ``PTRACE_MODE_NOAUDIT``). When NOAUDIT is set, neither audit records nor trace events are emitted, and the denial is not counted in ``denials``. The denial is still enforced. This avoids performance overhead and noise from speculative probes that test permissions without performing an actual access.h](jy)}(h**NOAUDIT hooks**h]h NOAUDIT hooks}(hjQ hhhNhNubah}(h]h ]h"]h$]h&]uh1jxhjM ubhS: Some LSM hooks suppress logging for speculative permission probes (e.g., reading }(hjM hhhNhNubj)}(h``/proc//status``h]h/proc//status}(hjc hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjM ubh uses }(hjM hhhNhNubj)}(h``PTRACE_MODE_NOAUDIT``h]hPTRACE_MODE_NOAUDIT}(hju hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjM ubhn). When NOAUDIT is set, neither audit records nor trace events are emitted, and the denial is not counted in }(hjM hhhNhNubj)}(h ``denials``h]hdenials}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjM ubh. The denial is still enforced. This avoids performance overhead and noise from speculative probes that test permissions without performing an actual access.}(hjM hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKhjI ubah}(h]h ]h"]h$]h&]uh1jhj hhhhhNubj)}(h**Audit rate limiting**: The audit subsystem may silently drop records when the audit queue is full. Trace events are not rate-limited. h]j)}(h**Audit rate limiting**: The audit subsystem may silently drop records when the audit queue is full. Trace events are not rate-limited.h](jy)}(h**Audit rate limiting**h]hAudit rate limiting}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jxhj ubhq: The audit subsystem may silently drop records when the audit queue is full. Trace events are not rate-limited.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj hhhhhNubj)}(h{**Tracepoint disabled**: When a trace event is disabled (the default state), the tracepoint is a no-op with zero overhead. h]j)}(hz**Tracepoint disabled**: When a trace event is disabled (the default state), the tracepoint is a no-op with zero overhead.h](jy)}(h**Tracepoint disabled**h]hTracepoint disabled}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jxhj ubhc: When a trace event is disabled (the default state), the tracepoint is a no-op with zero overhead.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhKhj ubah}(h]h ]h"]h$]h&]uh1jhj hhhhhNubeh}(h]h ]h"]h$]h&]j[j\uh1jhhhKhj hhubj)}(hXWhen both audit and tracing are active, every denial emits a trace event, and a denial that the domain's log policy selects additionally produces an audit record (subject to the Landlock log flags). The ``denials`` count in ``free_domain`` events is incremented for every denial regardless of the log flags, so it can exceed the number of audit records (which the log flags and audit-side rate-limiting or exclude rules may suppress).h](hWhen both audit and tracing are active, every denial emits a trace event, and a denial that the domain’s log policy selects additionally produces an audit record (subject to the Landlock log flags). The }(hj hhhNhNubj)}(h ``denials``h]hdenials}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubh count in }(hj hhhNhNubj)}(h``free_domain``h]h free_domain}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubh events is incremented for every denial regardless of the log flags, so it can exceed the number of audit records (which the log flags and audit-side rate-limiting or exclude rules may suppress).}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhMhj hhubjH )}(h$.. _landlock_observability_security:h]h}(h]h ]h"]h$]h&]jS landlock-observability-securityuh1jG hM hj hhhhubeh}(h](observability-guarantees-and-limitationsah ]h"](observability guarantees and limitationsah$]h&]uh1hhj hhhhhKubh)}(hhh](h)}(h%Observability security considerationsh]h%Observability security considerations}(hj? hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj< hhhhhM ubj)}(hXBoth audit records and trace events expose information about all Landlock-sandboxed processes on the system, including filesystem paths being accessed, network ports, and process identities. System administrators must ensure that access to audit logs (controlled by the audit subsystem configuration) and to trace events (requiring ``CAP_SYS_ADMIN`` or ``CAP_BPF`` + ``CAP_PERFMON``) is restricted to trusted users.h](hXMBoth audit records and trace events expose information about all Landlock-sandboxed processes on the system, including filesystem paths being accessed, network ports, and process identities. System administrators must ensure that access to audit logs (controlled by the audit subsystem configuration) and to trace events (requiring }(hjM hhhNhNubj)}(h``CAP_SYS_ADMIN``h]h CAP_SYS_ADMIN}(hjU hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjM ubh or }(hjM hhhNhNubj)}(h ``CAP_BPF``h]hCAP_BPF}(hjg hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjM ubh + }(hjM hhhNhNubj)}(h``CAP_PERFMON``h]h CAP_PERFMON}(hjy hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjM ubh!) is restricted to trusted users.}(hjM hhhNhNubeh}(h]h ]h"]h$]h&]uh1jhhhMhj< hhubj)}(hXeBPF programs attached to Landlock trace events have access to the full kernel context of each event (ruleset rules, domain hierarchy, process credentials) via BTF, exposing sensitive state about every sandboxed process. Restrict this access to trusted users, as for the audit logs.h]hXeBPF programs attached to Landlock trace events have access to the full kernel context of each event (ruleset rules, domain hierarchy, process credentials) via BTF, exposing sensitive state about every sandboxed process. Restrict this access to trusted users, as for the audit logs.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhMhj< hhubj)}(hAudit logs and kernel trace events require elevated privileges and are system-wide; they are not designed for per-sandbox unprivileged monitoring.h]hAudit logs and kernel trace events require elevated privileges and are system-wide; they are not designed for per-sandbox unprivileged monitoring.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhMhj< hhubeh}(h](%observability-security-considerationsj3 eh ]h"](%observability security considerationslandlock_observability_securityeh$]h&]uh1hhj hhhhhM j }j j) sj }j3 j) subeh}(h] tracepointsah ]h"] tracepointsah$]h&]uh1hhhhhhhhKubh)}(hhh](h)}(hAdditional documentationh]hAdditional documentation}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj hhhhhM ubj)}(hhh](j)}(h`Linux Audit Documentation`_h]j)}(hj h]h reference)}(hj h]hLinux Audit Documentation}(hj hhhNhNubah}(h]h ]h"]h$]h&]nameLinux Audit Documentationrefuri7https://github.com/linux-audit/audit-documentation/wikiuh1j hj resolvedKubah}(h]h ]h"]h$]h&]uh1jhhhM"hj ubah}(h]h ]h"]h$]h&]uh1jhj hhhhhNubj)}(h(Documentation/userspace-api/landlock.rsth]j)}(hj h]h(Documentation/userspace-api/landlock.rst}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhM#hj ubah}(h]h ]h"]h$]h&]uh1jhj hhhhhNubj)}(h'Documentation/trace/events-landlock.rsth]j)}(hj h]h'Documentation/trace/events-landlock.rst}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhM$hj ubah}(h]h ]h"]h$]h&]uh1jhj hhhhhNubj)}(h#Documentation/security/landlock.rsth]j)}(hj+ h]h#Documentation/security/landlock.rst}(hj- hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhM%hj) ubah}(h]h ]h"]h$]h&]uh1jhj hhhhhNubj)}(hhttps://landlock.io h]j)}(hhttps://landlock.ioh]j )}(hjF h]hhttps://landlock.io}(hjH hhhNhNubah}(h]h ]h"]h$]h&]refurijF uh1j hjD ubah}(h]h ]h"]h$]h&]uh1jhhhM&hj@ ubah}(h]h ]h"]h$]h&]uh1jhj hhhhhNubeh}(h]h ]h"]h$]h&]j[*uh1jhhhM"hj hhubh)}(hLinksh]hLinks}hji sbah}(h]h ]h"]h$]h&]hhuh1hhj hhhhhM(ubjH )}(hY.. _Linux Audit Documentation: https://github.com/linux-audit/audit-documentation/wikih]h}(h]linux-audit-documentationah ]h"]linux audit documentationah$]h&]j j uh1jG hM)hj hhhhnj referencedKubeh}(h]additional-documentationah ]h"]additional documentationah$]h&]uh1hhhhhhhhM ubeh}(h]landlock-system-wide-managementah ]h"] landlock: system-wide managementah$]h&]uh1hhhhhhhhKubeh}(h]h ]h"]h$]h&]sourcehuh1hcurrent_sourceN current_lineNsettingsdocutils.frontendValues)}(hN generatorN datestampN source_linkN source_urlN toc_backlinksentryfootnote_backlinksK sectnum_xformKstrip_commentsNstrip_elements_with_classesN strip_classesN report_levelK halt_levelKexit_status_levelKdebugNwarning_streamN tracebackinput_encoding utf-8-siginput_encoding_error_handlerstrictoutput_encodingutf-8output_encoding_error_handlerj error_encodingutf-8error_encoding_error_handlerbackslashreplace language_codeenrecord_dependenciesNconfigN id_prefixhauto_id_prefixid dump_settingsNdump_internalsNdump_transformsNdump_pseudo_xmlNexpose_internalsNstrict_visitorN_disable_configN_sourcehnj _destinationN _config_files]7/var/lib/git/docbuild/linux/Documentation/docutils.confafile_insertion_enabled raw_enabledKline_length_limitM'pep_referencesN pep_base_urlhttps://peps.python.org/pep_file_url_templatepep-%04drfc_referencesN rfc_base_url&https://datatracker.ietf.org/doc/html/ tab_widthKtrim_footnote_reference_spacesyntax_highlightlong smart_quotessmartquotes_locales]character_level_inline_markupdoctitle_xform docinfo_xformKsectsubtitle_xform image_loadinglinkembed_stylesheetcloak_email_addressessection_self_linkenvNubreporterNindirect_targets]substitution_defs}substitution_names}refnames}linux audit documentation]j asrefids}(jT ]jI aj3 ]j) aunameids}(j j j j jjjM jJ j j j j j jT j j j9 j6 j j3 j j j j j j} u nametypes}(j j jjM j j j j j9 j j j j uh}(j hj jjjjJ jj jP j j jT jU j jU j6 j j3 j< j j< j j j} jw u footnote_refs} citation_refs} autofootnotes]autofootnote_refs]symbol_footnotes]symbol_footnote_refs] footnotes] citations]autofootnote_startKsymbol_footnote_startK id_counter collectionsCounter}Rparse_messages]transform_messages](hsystem_message)}(hhh]j)}(hhh]h