> Name each event after the identity it reports. Add-rule events describe > UAPI rule insertion, so rename them after LANDLOCK_RULE_PATH_BENEATH and > LANDLOCK_RULE_NET_PORT. Check-rule events describe matches in internal > rule trees, so rename them after LANDLOCK_KEY_INODE and > LANDLOCK_KEY_NET_PORT. This remains accurate if multiple UAPI rule types > share one lookup and stored rule. Keep denial event names based on > filesystem and network families because they describe final access > decisions. > > Use u64 for growable access masks passed by value to add-rule and > check-rule typed BTF callbacks. CO-RE can relocate pointer-reached > fields, but it cannot widen a scalar callback slot declared by a BPF > program. Keep native access_mask_t for internal state and trace records. > > For add-rule callbacks, report the normalized per-call contribution > passed to landlock_insert_rule() and expose the complete validated flags > value. Put the ruleset and flags first as a common invocation prefix. > This distinguishes duplicate and effective-zero additions without > recovering arguments from saved syscall registers. > > Cc: Günther Noack <[email protected]> > Cc: Steven Rostedt <[email protected]> > Fixes: 63747c94774d ("landlock: Add landlock_add_rule_fs and > landlock_add_rule_net tracepoints") > Fixes: 3f1f106e4c14 ("landlock: Add tracepoints for rule checking") > Signed-off-by: Mickaël Salaün <[email protected]>
Sashiko has reviewed this patch and found no issues. It looks great! -- Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=3
