[PATCH v1 5/9] landlock: Report the actual ptrace tracer

[sashiko-bot at kernel.org]

> The ptrace denial callback identifies only the tracee. Current is the
> tracer during hook_ptrace_access_check(), but it is the tracee during
> PTRACE_TRACEME, where the parent is the actual tracer. A consumer
> therefore cannot infer both parties from the existing arguments.
> 
> Append the actual tracer task to the typed-BPF callback: current for
> hook_ptrace_access_check() and parent for hook_ptrace_traceme(). Carry
> it with the tracee domain ID in a private ptrace context. Both hooks
> keep the selected tasks alive through synchronous dispatch, so no extra
> task reference is needed.
> 
> Keep the tracefs record unchanged. The new context is available only to
> typed BPF, while same_exec continues to describe the tracer that owns
> the denying policy.
> 
> Cc: Günther Noack <gnoack at google.com>
> Cc: Steven Rostedt <rostedt at goodmis.org>
> Fixes: bb91730f16c0 ("landlock: Add tracepoints for ptrace and scope denials")
> Signed-off-by: Mickaël Salaün <mic at digikod.net>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260918185036.608651-1-mic@digikod.net?part=5