[PATCH v1 3/9] landlock: Fix rule tracepoint context

[sashiko-bot at kernel.org]

> Name each event after the identity it reports. Add-rule events describe
> UAPI rule insertion, so rename them after LANDLOCK_RULE_PATH_BENEATH and
> LANDLOCK_RULE_NET_PORT. Check-rule events describe matches in internal
> rule trees, so rename them after LANDLOCK_KEY_INODE and
> LANDLOCK_KEY_NET_PORT. This remains accurate if multiple UAPI rule types
> share one lookup and stored rule. Keep denial event names based on
> filesystem and network families because they describe final access
> decisions.
> 
> Use u64 for growable access masks passed by value to add-rule and
> check-rule typed BTF callbacks. CO-RE can relocate pointer-reached
> fields, but it cannot widen a scalar callback slot declared by a BPF
> program. Keep native access_mask_t for internal state and trace records.
> 
> For add-rule callbacks, report the normalized per-call contribution
> passed to landlock_insert_rule() and expose the complete validated flags
> value. Put the ruleset and flags first as a common invocation prefix.
> This distinguishes duplicate and effective-zero additions without
> recovering arguments from saved syscall registers.
> 
> Cc: Günther Noack <gnoack at google.com>
> Cc: Steven Rostedt <rostedt at goodmis.org>
> Fixes: 63747c94774d ("landlock: Add landlock_add_rule_fs and landlock_add_rule_net tracepoints")
> Fixes: 3f1f106e4c14 ("landlock: Add tracepoints for rule checking")
> Signed-off-by: Mickaël Salaün <mic at digikod.net>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260918185036.608651-1-mic@digikod.net?part=3