landlock: Fix rule tracepoint context

Name each event after the identity it reports. Add-rule events describe
UAPI rule insertion, so rename them after LANDLOCK_RULE_PATH_BENEATH and
LANDLOCK_RULE_NET_PORT. Check-rule events describe matches in internal
rule trees, so rename them after LANDLOCK_KEY_INODE and
LANDLOCK_KEY_NET_PORT. This remains accurate if multiple UAPI rule types
share one lookup and stored rule. Keep denial event names based on
filesystem and network families because they describe final access
decisions.

Use u64 for growable access masks passed by value to add-rule and
check-rule typed BTF callbacks. CO-RE can relocate pointer-reached
fields, but it cannot widen a scalar callback slot declared by a BPF
program. Keep native access_mask_t for internal state and trace records.

For add-rule callbacks, report the normalized per-call contribution
passed to landlock_insert_rule() and expose the complete validated flags
value. Put the ruleset and flags first as a common invocation prefix.
This distinguishes duplicate and effective-zero additions without
recovering arguments from saved syscall registers.

Cc: Günther Noack <gnoack@google.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Fixes: 63747c94774d ("landlock: Add landlock_add_rule_fs and landlock_add_rule_net tracepoints")
Fixes: 3f1f106e4c14 ("landlock: Add tracepoints for rule checking")
Link: https://patch.msgid.link/20260918185036.608651-4-mic@digikod.net
Signed-off-by: Mickaël Salaün <mic@digikod.net>

5 files changed, 108 insertions, 92 deletions

diff --git a/tools/testing/selftests/landlock/fs_test.c b/tools/testing/selftests/landlock/fs_test.c
index 18dbdb99aeba..6e979cef884d 100644
--- a/tools/testing/selftests/landlock/fs_test.c
+++ b/tools/testing/selftests/landlock/fs_test.c
@@ -10493,9 +10493,9 @@ FIXTURE_TEARDOWN_PARENT(trace_layout1)
 }
 
 /*
- * Verifies that check_rule_fs events include correct field values: domain, dev,
- * ino, access_request, and grants.  All values are verified against stat() of
- * the rule path on a deterministic tmpfs layout.
+ * Verifies that check_rule_inode events include correct field values: domain,
+ * dev, ino, access_request, and grants.  All values are verified against stat()
+ * of the rule path on a deterministic tmpfs layout.
  */
 TEST_F(trace_layout1, check_rule_fs_fields)
 {
@@ -10529,7 +10529,7 @@ TEST_F(trace_layout1, check_rule_fs_fields)
 	EXPECT_EQ(1,
 		  tracefs_count_matches(buf, REGEX_CHECK_RULE_FS(TRACE_TASK)))
 	{
-		TH_LOG("Expected 1 check_rule_fs event\n%s", buf);
+		TH_LOG("Expected 1 check_rule_inode event\n%s", buf);
 	}
 
 	ASSERT_EQ(0, tracefs_extract_field(buf, REGEX_CHECK_RULE_FS(TRACE_TASK),
@@ -10570,8 +10570,8 @@ TEST_F(trace_layout1, check_rule_fs_fields)
 }
 
 /*
- * Verifies check_rule_fs behavior with multiple rules.  With rules at s1d1 and
- * s1d2 (a child of s1d1), accessing s1d2 produces only 1 event because the
+ * Verifies check_rule_inode behavior with multiple rules.  With rules at s1d1
+ * and s1d2 (a child of s1d1), accessing s1d2 produces only 1 event because the
  * pathwalk short-circuits after the first rule fully unmasks the single layer.
  */
 TEST_F(trace_layout1, check_rule_fs_multiple_rules)
@@ -10643,14 +10643,14 @@ TEST_F(trace_layout1, check_rule_fs_multiple_rules)
 	ASSERT_NE(NULL, buf);
 
 	/*
-	 * Only 1 check_rule_fs event: the rule on dir_s1d2 fully unmasked the
-	 * single layer, so the pathwalk short-circuits before reaching the
+	 * Only one check_rule_inode event: the rule on dir_s1d2 fully unmasks
+	 * the single layer, so the pathwalk short-circuits before reaching the
 	 * dir_s1d1 rule.
 	 */
 	count = tracefs_count_matches(buf, REGEX_CHECK_RULE_FS(TRACE_TASK));
 	EXPECT_EQ(1, count)
 	{
-		TH_LOG("Expected 1 check_rule_fs event, got %d\n%s", count,
+		TH_LOG("Expected 1 check_rule_inode event, got %d\n%s", count,
 		       buf);
 	}
 
@@ -10777,7 +10777,7 @@ TEST_F(trace_layout1, check_rule_fs_optional_access)
 	count = tracefs_count_matches(buf, REGEX_CHECK_RULE_FS(TRACE_TASK));
 	EXPECT_EQ(1, count)
 	{
-		TH_LOG("Expected 1 check_rule_fs event, got %d\n%s", count,
+		TH_LOG("Expected 1 check_rule_inode event, got %d\n%s", count,
 		       buf);
 	}
 
@@ -10796,7 +10796,7 @@ TEST_F(trace_layout1, check_rule_fs_optional_access)
 }
 
 /*
- * Verifies that check_rule_fs fires for a rule that matches the inode even when
+ * Verifies that check_rule_inode fires for a rule matching the inode even when
  * it grants none of the requested rights, so the grants set is empty.  Landlock
  * cannot know a rule ignores the request before reading it, so the event is
  * still emitted (grants={}), which lets a tracer see that the rule matched.
@@ -10884,7 +10884,7 @@ TEST_F(trace_layout1, check_rule_fs_empty_grant)
 	count = tracefs_count_matches(buf, REGEX_CHECK_RULE_FS(TRACE_TASK));
 	EXPECT_EQ(2, count)
 	{
-		TH_LOG("Expected 2 check_rule_fs events, got %d\n%s", count,
+		TH_LOG("Expected 2 check_rule_inode events, got %d\n%s", count,
 		       buf);
 	}
 
@@ -10894,7 +10894,7 @@ TEST_F(trace_layout1, check_rule_fs_empty_grant)
 		tracefs_count_matches(
 			buf,
 			TRACE_PREFIX(
-				TRACE_TASK) "landlock_check_rule_fs: domain=[0-9a-f]\\+ "
+				TRACE_TASK) "landlock_check_rule_inode: domain=[0-9a-f]\\+ "
 					    "access_request=read_dir "
 					    "dev=[0-9]\\+:[0-9]\\+ ino=[0-9]\\+ "
 					    "grants={}$"))
@@ -10908,7 +10908,7 @@ TEST_F(trace_layout1, check_rule_fs_empty_grant)
 		tracefs_count_matches(
 			buf,
 			TRACE_PREFIX(
-				TRACE_TASK) "landlock_check_rule_fs: domain=[0-9a-f]\\+ "
+				TRACE_TASK) "landlock_check_rule_inode: domain=[0-9a-f]\\+ "
 					    "access_request=read_dir "
 					    "dev=[0-9]\\+:[0-9]\\+ ino=[0-9]\\+ "
 					    "grants={read_dir}$"))
diff --git a/tools/testing/selftests/landlock/net_test.c b/tools/testing/selftests/landlock/net_test.c
index a18761e0fd82..4fb705e1596d 100644
--- a/tools/testing/selftests/landlock/net_test.c
+++ b/tools/testing/selftests/landlock/net_test.c
@@ -3712,7 +3712,7 @@ TEST_F(trace_net_connect, deny_access_net)
 	free(buf);
 }
 
-/* Field verification for the check_rule_net event on an allowed access. */
+/* Field verification for the check_rule_net_port event on an allowed access. */
 
 /* clang-format off */
 FIXTURE(trace_net_check_rule) {
@@ -3757,10 +3757,11 @@ FIXTURE_TEARDOWN(trace_net_check_rule)
 
 /*
  * Verifies that an allowed bind matching a net-port rule emits exactly one
- * landlock_check_rule_net event with the enforcing domain, the requested
+ * landlock_check_rule_net_port event with the enforcing domain, the requested
  * access, the checked port (host endianness), and the per-layer grants.  The
- * whole event is anchored to exact values so a revert of the check_rule_net
- * emit (or a byte-order or field-plumbing regression) fails the test.
+ * whole event is anchored to exact values so removing the check_rule_net_port
+ * emission or introducing a byte-order or field-plumbing regression fails the
+ * test.
  */
 TEST_F(trace_net_check_rule, check_rule_net_fields)
 {
@@ -3832,7 +3833,7 @@ TEST_F(trace_net_check_rule, check_rule_net_fields)
 	EXPECT_EQ(1,
 		  tracefs_count_matches(buf, REGEX_CHECK_RULE_NET(TRACE_TASK)))
 	{
-		TH_LOG("Expected 1 check_rule_net event\n%s", buf);
+		TH_LOG("Expected 1 check_rule_net_port event\n%s", buf);
 	}
 
 	ASSERT_EQ(0,
diff --git a/tools/testing/selftests/landlock/trace.h b/tools/testing/selftests/landlock/trace.h
index ba0c5e92001f..e6873853376c 100644
--- a/tools/testing/selftests/landlock/trace.h
+++ b/tools/testing/selftests/landlock/trace.h
@@ -27,14 +27,14 @@
 	TRACEFS_LANDLOCK_DIR "/landlock_create_domain/enable"
 #define TRACEFS_ENFORCE_DOMAIN_ENABLE \
 	TRACEFS_LANDLOCK_DIR "/landlock_enforce_domain/enable"
-#define TRACEFS_ADD_RULE_FS_ENABLE \
-	TRACEFS_LANDLOCK_DIR "/landlock_add_rule_fs/enable"
-#define TRACEFS_ADD_RULE_NET_ENABLE \
-	TRACEFS_LANDLOCK_DIR "/landlock_add_rule_net/enable"
+#define TRACEFS_ADD_RULE_PATH_BENEATH_ENABLE \
+	TRACEFS_LANDLOCK_DIR "/landlock_add_rule_path_beneath/enable"
+#define TRACEFS_ADD_RULE_NET_PORT_ENABLE \
+	TRACEFS_LANDLOCK_DIR "/landlock_add_rule_net_port/enable"
 #define TRACEFS_CHECK_RULE_FS_ENABLE \
-	TRACEFS_LANDLOCK_DIR "/landlock_check_rule_fs/enable"
+	TRACEFS_LANDLOCK_DIR "/landlock_check_rule_inode/enable"
 #define TRACEFS_CHECK_RULE_NET_ENABLE \
-	TRACEFS_LANDLOCK_DIR "/landlock_check_rule_net/enable"
+	TRACEFS_LANDLOCK_DIR "/landlock_check_rule_net_port/enable"
 #define TRACEFS_DENY_ACCESS_FS_ENABLE \
 	TRACEFS_LANDLOCK_DIR "/landlock_deny_access_fs/enable"
 #define TRACEFS_DENY_ACCESS_NET_ENABLE \
@@ -79,18 +79,18 @@
  */
 #define KWORKER_TASK "kworker/[0-9]\\+:[0-9]\\+"
 
-#define REGEX_ADD_RULE_FS(task)           \
-	TRACE_PREFIX(task)                \
-	"landlock_add_rule_fs: "          \
-	"ruleset=[0-9a-f]\\+\\.[0-9]\\+ " \
-	"access_rights=[a-z_|]* "         \
-	"dev=[0-9]\\+:[0-9]\\+ "          \
-	"ino=[0-9]\\+ "                   \
+#define REGEX_ADD_RULE_PATH_BENEATH(task)  \
+	TRACE_PREFIX(task)                 \
+	"landlock_add_rule_path_beneath: " \
+	"ruleset=[0-9a-f]\\+\\.[0-9]\\+ "  \
+	"access_rights=[a-z_|]* "          \
+	"dev=[0-9]\\+:[0-9]\\+ "           \
+	"ino=[0-9]\\+ "                    \
 	"path=[^ ]\\+$"
 
-#define REGEX_ADD_RULE_NET(task)          \
+#define REGEX_ADD_RULE_NET_PORT(task)     \
 	TRACE_PREFIX(task)                \
-	"landlock_add_rule_net: "         \
+	"landlock_add_rule_net_port: "    \
 	"ruleset=[0-9a-f]\\+\\.[0-9]\\+ " \
 	"access_rights=[a-z_|]* "         \
 	"port=[0-9]\\+$"
@@ -110,21 +110,21 @@
 	"parent=[0-9a-f]\\+ "      \
 	"ruleset=[0-9a-f]\\+\\.[0-9]\\+$"
 
-#define REGEX_CHECK_RULE_FS(task)  \
-	TRACE_PREFIX(task)         \
-	"landlock_check_rule_fs: " \
-	"domain=[0-9a-f]\\+ "      \
-	"access_request=[a-z_|]* " \
-	"dev=[0-9]\\+:[0-9]\\+ "   \
-	"ino=[0-9]\\+ "            \
+#define REGEX_CHECK_RULE_FS(task)     \
+	TRACE_PREFIX(task)            \
+	"landlock_check_rule_inode: " \
+	"domain=[0-9a-f]\\+ "         \
+	"access_request=[a-z_|]* "    \
+	"dev=[0-9]\\+:[0-9]\\+ "      \
+	"ino=[0-9]\\+ "               \
 	"grants={[a-z_|,]*}$"
 
-#define REGEX_CHECK_RULE_NET(task)  \
-	TRACE_PREFIX(task)          \
-	"landlock_check_rule_net: " \
-	"domain=[0-9a-f]\\+ "       \
-	"access_request=[a-z_|]* "  \
-	"port=[0-9]\\+ "            \
+#define REGEX_CHECK_RULE_NET(task)       \
+	TRACE_PREFIX(task)               \
+	"landlock_check_rule_net_port: " \
+	"domain=[0-9a-f]\\+ "            \
+	"access_request=[a-z_|]* "       \
+	"port=[0-9]\\+ "                 \
 	"grants={[a-z_|,]*}$"
 
 #define REGEX_DENY_ACCESS_FS(task)  \
diff --git a/tools/testing/selftests/landlock/trace_fs_test.c b/tools/testing/selftests/landlock/trace_fs_test.c
index 4543a25c1f55..6666d4746cb1 100644
--- a/tools/testing/selftests/landlock/trace_fs_test.c
+++ b/tools/testing/selftests/landlock/trace_fs_test.c
@@ -121,7 +121,8 @@ FIXTURE_SETUP(trace_fs)
 	}
 	self->tracefs_ok = 1;
 
-	ASSERT_EQ(0, tracefs_enable_event(TRACEFS_ADD_RULE_FS_ENABLE, true));
+	ASSERT_EQ(0, tracefs_enable_event(TRACEFS_ADD_RULE_PATH_BENEATH_ENABLE,
+					  true));
 	ASSERT_EQ(0, tracefs_enable_event(TRACEFS_CHECK_RULE_FS_ENABLE, true));
 	ASSERT_EQ(0, tracefs_enable_event(TRACEFS_DENY_ACCESS_FS_ENABLE, true));
 	ASSERT_EQ(0, tracefs_clear());
@@ -134,7 +135,7 @@ FIXTURE_TEARDOWN(trace_fs)
 		return;
 
 	set_cap(_metadata, CAP_SYS_ADMIN);
-	tracefs_enable_event(TRACEFS_ADD_RULE_FS_ENABLE, false);
+	tracefs_enable_event(TRACEFS_ADD_RULE_PATH_BENEATH_ENABLE, false);
 	tracefs_enable_event(TRACEFS_CHECK_RULE_FS_ENABLE, false);
 	tracefs_enable_event(TRACEFS_DENY_ACCESS_FS_ENABLE, false);
 	tracefs_fixture_teardown();
@@ -183,11 +184,11 @@ TEST_F(trace_fs, unsandboxed)
 }
 
 /*
- * Verifies that adding a filesystem rule emits a landlock_add_rule_fs trace
- * event with the expected path and field values: ruleset ID is non-zero,
- * access_rights is non-zero, and path matches.
+ * Verifies that adding a filesystem rule emits a landlock_add_rule_path_beneath
+ * event with the expected path and field values: the ruleset ID and
+ * access_rights are non-zero, and the path matches.
  */
-TEST_F(trace_fs, add_rule_fs)
+TEST_F(trace_fs, add_rule_path_beneath)
 {
 	struct landlock_ruleset_attr ruleset_attr = {
 		.handled_access_fs = LANDLOCK_ACCESS_FS_READ_FILE |
@@ -215,28 +216,30 @@ TEST_F(trace_fs, add_rule_fs)
 	buf = tracefs_read_buf();
 	ASSERT_NE(NULL, buf);
 
-	count = tracefs_count_matches(buf, REGEX_ADD_RULE_FS(TRACE_TASK));
+	count = tracefs_count_matches(buf,
+				      REGEX_ADD_RULE_PATH_BENEATH(TRACE_TASK));
 	EXPECT_EQ(1, count)
 	{
-		TH_LOG("Expected 1 add_rule_fs event, got %d\n%s", count, buf);
+		TH_LOG("Expected 1 add_rule_path_beneath event, got %d\n%s",
+		       count, buf);
 	}
 
 	/* Ruleset ID should be non-zero. */
-	ASSERT_EQ(0, tracefs_extract_field(buf, REGEX_ADD_RULE_FS(TRACE_TASK),
-					   "ruleset", field_buf,
-					   sizeof(field_buf)));
+	ASSERT_EQ(0, tracefs_extract_field(
+			     buf, REGEX_ADD_RULE_PATH_BENEATH(TRACE_TASK),
+			     "ruleset", field_buf, sizeof(field_buf)));
 	EXPECT_STRNE("0", field_buf);
 
 	/* Access rights should be non-zero. */
-	ASSERT_EQ(0, tracefs_extract_field(buf, REGEX_ADD_RULE_FS(TRACE_TASK),
-					   "access_rights", field_buf,
-					   sizeof(field_buf)));
+	ASSERT_EQ(0, tracefs_extract_field(
+			     buf, REGEX_ADD_RULE_PATH_BENEATH(TRACE_TASK),
+			     "access_rights", field_buf, sizeof(field_buf)));
 	EXPECT_STRNE("", field_buf);
 
 	/* Path should be /usr. */
-	ASSERT_EQ(0,
-		  tracefs_extract_field(buf, REGEX_ADD_RULE_FS(TRACE_TASK),
-					"path", field_buf, sizeof(field_buf)));
+	ASSERT_EQ(0, tracefs_extract_field(
+			     buf, REGEX_ADD_RULE_PATH_BENEATH(TRACE_TASK),
+			     "path", field_buf, sizeof(field_buf)));
 	EXPECT_STREQ("/usr", field_buf);
 
 	free(buf);
@@ -246,7 +249,7 @@ TEST_F(trace_fs, add_rule_fs)
  * Verifies that a path whose escaping exceeds the trace scratch sequence does
  * not corrupt a sibling symbolic field.
  */
-TEST_F(trace_fs, add_rule_fs_escaped_path_overflow)
+TEST_F(trace_fs, add_rule_path_beneath_escaped_path_overflow)
 {
 	static const char access_prefix[] = "execute|write_file|read_file|";
 	static const char access_suffix[] = "|ioctl_dev|resolve_unix";
@@ -277,10 +280,12 @@ TEST_F(trace_fs, add_rule_fs_escaped_path_overflow)
 	buf = tracefs_read_buf();
 	ASSERT_NE(NULL, buf);
 
-	count = tracefs_count_matches(buf, REGEX_ADD_RULE_FS(TRACE_TASK));
+	count = tracefs_count_matches(buf,
+				      REGEX_ADD_RULE_PATH_BENEATH(TRACE_TASK));
 	EXPECT_EQ(1, count)
 	{
-		TH_LOG("Expected 1 add_rule_fs event, got %d\n%s", count, buf);
+		TH_LOG("Expected 1 add_rule_path_beneath event, got %d\n%s",
+		       count, buf);
 	}
 
 	/*
@@ -288,9 +293,9 @@ TEST_F(trace_fs, add_rule_fs_escaped_path_overflow)
 	 * field also catches scratch-sequence poisoning when the compiler
 	 * evaluates the overflowing path first, as GCC currently does.
 	 */
-	ASSERT_EQ(0, tracefs_extract_field(buf, REGEX_ADD_RULE_FS(TRACE_TASK),
-					   "access_rights", field_buf,
-					   sizeof(field_buf)));
+	ASSERT_EQ(0, tracefs_extract_field(
+			     buf, REGEX_ADD_RULE_PATH_BENEATH(TRACE_TASK),
+			     "access_rights", field_buf, sizeof(field_buf)));
 	EXPECT_EQ(0,
 		  strncmp(field_buf, access_prefix, sizeof(access_prefix) - 1));
 	EXPECT_EQ(NULL, strstr(field_buf, "|refer|"));
@@ -298,7 +303,8 @@ TEST_F(trace_fs, add_rule_fs_escaped_path_overflow)
 	ASSERT_LE(sizeof(access_suffix) - 1, field_len);
 	EXPECT_STREQ(access_suffix,
 		     field_buf + field_len - (sizeof(access_suffix) - 1));
-	expect_truncated_path(_metadata, buf, REGEX_ADD_RULE_FS(TRACE_TASK));
+	expect_truncated_path(_metadata, buf,
+			      REGEX_ADD_RULE_PATH_BENEATH(TRACE_TASK));
 
 	free(buf);
 }
diff --git a/tools/testing/selftests/landlock/trace_test.c b/tools/testing/selftests/landlock/trace_test.c
index afdaf8511b3a..f9b293a9dd56 100644
--- a/tools/testing/selftests/landlock/trace_test.c
+++ b/tools/testing/selftests/landlock/trace_test.c
@@ -49,8 +49,10 @@ FIXTURE_SETUP(trace)
 	ASSERT_EQ(0, tracefs_enable_event(TRACEFS_CREATE_RULESET_ENABLE, true));
 	ASSERT_EQ(0, tracefs_enable_event(TRACEFS_CREATE_DOMAIN_ENABLE, true));
 	ASSERT_EQ(0, tracefs_enable_event(TRACEFS_ENFORCE_DOMAIN_ENABLE, true));
-	ASSERT_EQ(0, tracefs_enable_event(TRACEFS_ADD_RULE_FS_ENABLE, true));
-	ASSERT_EQ(0, tracefs_enable_event(TRACEFS_ADD_RULE_NET_ENABLE, true));
+	ASSERT_EQ(0, tracefs_enable_event(TRACEFS_ADD_RULE_PATH_BENEATH_ENABLE,
+					  true));
+	ASSERT_EQ(0,
+		  tracefs_enable_event(TRACEFS_ADD_RULE_NET_PORT_ENABLE, true));
 	ASSERT_EQ(0, tracefs_enable_event(TRACEFS_CHECK_RULE_FS_ENABLE, true));
 	ASSERT_EQ(0, tracefs_enable_event(TRACEFS_CHECK_RULE_NET_ENABLE, true));
 	ASSERT_EQ(0, tracefs_enable_event(TRACEFS_DENY_ACCESS_FS_ENABLE, true));
@@ -72,8 +74,8 @@ FIXTURE_TEARDOWN(trace)
 	tracefs_enable_event(TRACEFS_CREATE_RULESET_ENABLE, false);
 	tracefs_enable_event(TRACEFS_CREATE_DOMAIN_ENABLE, false);
 	tracefs_enable_event(TRACEFS_ENFORCE_DOMAIN_ENABLE, false);
-	tracefs_enable_event(TRACEFS_ADD_RULE_FS_ENABLE, false);
-	tracefs_enable_event(TRACEFS_ADD_RULE_NET_ENABLE, false);
+	tracefs_enable_event(TRACEFS_ADD_RULE_PATH_BENEATH_ENABLE, false);
+	tracefs_enable_event(TRACEFS_ADD_RULE_NET_PORT_ENABLE, false);
 	tracefs_enable_event(TRACEFS_CHECK_RULE_FS_ENABLE, false);
 	tracefs_enable_event(TRACEFS_CHECK_RULE_NET_ENABLE, false);
 	tracefs_enable_event(TRACEFS_DENY_ACCESS_FS_ENABLE, false);
@@ -103,8 +105,10 @@ TEST_F(trace, no_trace_when_disabled)
 	ASSERT_EQ(0, tracefs_enable_event(TRACEFS_CREATE_DOMAIN_ENABLE, false));
 	ASSERT_EQ(0,
 		  tracefs_enable_event(TRACEFS_ENFORCE_DOMAIN_ENABLE, false));
-	ASSERT_EQ(0, tracefs_enable_event(TRACEFS_ADD_RULE_FS_ENABLE, false));
-	ASSERT_EQ(0, tracefs_enable_event(TRACEFS_ADD_RULE_NET_ENABLE, false));
+	ASSERT_EQ(0, tracefs_enable_event(TRACEFS_ADD_RULE_PATH_BENEATH_ENABLE,
+					  false));
+	ASSERT_EQ(0, tracefs_enable_event(TRACEFS_ADD_RULE_NET_PORT_ENABLE,
+					  false));
 	ASSERT_EQ(0, tracefs_enable_event(TRACEFS_CHECK_RULE_FS_ENABLE, false));
 	ASSERT_EQ(0,
 		  tracefs_enable_event(TRACEFS_CHECK_RULE_NET_ENABLE, false));
@@ -265,10 +269,11 @@ TEST_F(trace, ruleset_version)
 	ASSERT_NE(0, !!dot);
 	EXPECT_STREQ("0", dot + 1);
 
-	/* Verify 2 add_rule_fs events were emitted. */
-	EXPECT_EQ(2, tracefs_count_matches(buf, REGEX_ADD_RULE_FS(TRACE_TASK)))
+	/* Verify two add_rule_path_beneath events were emitted. */
+	EXPECT_EQ(2, tracefs_count_matches(
+			     buf, REGEX_ADD_RULE_PATH_BENEATH(TRACE_TASK)))
 	{
-		TH_LOG("Expected 2 add_rule_fs events\n%s", buf);
+		TH_LOG("Expected 2 add_rule_path_beneath events\n%s", buf);
 	}
 
 	/*
@@ -373,7 +378,7 @@ TEST_F(trace, create_domain)
 		tracefs_count_matches(buf, REGEX_CHECK_RULE_FS(TRACE_TASK));
 	ASSERT_LE(1, check_count)
 	{
-		TH_LOG("Expected check_rule_fs events\n%s", buf);
+		TH_LOG("Expected check_rule_inode events\n%s", buf);
 	}
 
 	EXPECT_EQ(0, tracefs_extract_field(buf, REGEX_CHECK_RULE_FS(TRACE_TASK),
@@ -508,9 +513,11 @@ TEST_F(trace, add_rule_invalid_fd)
 	buf = tracefs_read_buf();
 	ASSERT_NE(NULL, buf);
 
-	EXPECT_EQ(0, tracefs_count_matches(buf, REGEX_ADD_RULE_FS(TRACE_TASK)))
+	EXPECT_EQ(0, tracefs_count_matches(
+			     buf, REGEX_ADD_RULE_PATH_BENEATH(TRACE_TASK)))
 	{
-		TH_LOG("No add_rule_fs event expected on invalid fd\n%s", buf);
+		TH_LOG("No add_rule_path_beneath event expected on invalid fd\n%s",
+		       buf);
 	}
 
 	free(buf);
@@ -902,10 +909,10 @@ TEST_F(trace, non_audit_visible_denial_counting)
 }
 
 /*
- * Verifies that landlock_add_rule_net emits a trace event with the correct port
- * and allowed access mask fields.
+ * Verifies that landlock_add_rule_net_port emits a trace event with the correct
+ * port and allowed access mask fields.
  */
-TEST_F(trace, add_rule_net_fields)
+TEST_F(trace, add_rule_net_port_fields)
 {
 	struct landlock_ruleset_attr ruleset_attr = {
 		.handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP,
@@ -931,9 +938,10 @@ TEST_F(trace, add_rule_net_fields)
 	buf = tracefs_read_buf();
 	ASSERT_NE(NULL, buf);
 
-	EXPECT_EQ(1, tracefs_count_matches(buf, REGEX_ADD_RULE_NET(TRACE_TASK)))
+	EXPECT_EQ(1, tracefs_count_matches(buf,
+					   REGEX_ADD_RULE_NET_PORT(TRACE_TASK)))
 	{
-		TH_LOG("Expected 1 add_rule_net event\n%s", buf);
+		TH_LOG("Expected 1 add_rule_net_port event\n%s", buf);
 	}
 
 	/*
@@ -941,7 +949,8 @@ TEST_F(trace, add_rule_net_fields)
 	 * (landlock_net_port_attr.port).  On little-endian, htons(8080) is
 	 * 36895, so this comparison catches byte-order bugs.
 	 */
-	EXPECT_EQ(0, tracefs_extract_field(buf, REGEX_ADD_RULE_NET(TRACE_TASK),
+	EXPECT_EQ(0, tracefs_extract_field(buf,
+					   REGEX_ADD_RULE_NET_PORT(TRACE_TASK),
 					   "port", field, sizeof(field)));
 	EXPECT_STREQ("8080", field);
 	/*
@@ -950,9 +959,9 @@ TEST_F(trace, add_rule_net_fields)
 	 * net access bits are unhandled because the ruleset only handles
 	 * BIND_TCP).
 	 */
-	EXPECT_EQ(0,
-		  tracefs_extract_field(buf, REGEX_ADD_RULE_NET(TRACE_TASK),
-					"access_rights", field, sizeof(field)));
+	EXPECT_EQ(0, tracefs_extract_field(
+			     buf, REGEX_ADD_RULE_NET_PORT(TRACE_TASK),
+			     "access_rights", field, sizeof(field)));
 	EXPECT_STREQ("bind_tcp|connect_tcp|bind_udp|connect_send_udp", field);
 
 	free(buf);