Merge tag 'landlock-7.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux

Pull Landlock fixes from Mickaël Salaün:
 "This mainly fixes the Landlock tracepoint support merged this cycle so
  that denial and rule events report the intended policy context,
  whether through tracefs or BTF-visible callbacks.

  The size of this all is mainly from propagating the corrected contract
  through event definitions and producers, adding new tests for the
  reported context, and updating the documentation.

  Also improve annotation and fix a GCC 16 build warning"

* tag 'landlock-7.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux:
  landlock: Widen ruleset versions to 64 bits
  landlock: Add counted_by in landlock_domain
  landlock: Fix tracepoint contract documentation
  selftests/landlock: Test network denial context
  selftests/landlock: Test filesystem denial blockers
  landlock: Report the effective signal number
  landlock: Report the actual ptrace tracer
  landlock: Fix network denial trace context
  landlock: Fix rule tracepoint context
  landlock: Fix filesystem denial blocker reporting
  landlock: Fix tracepoint fixed-width type names
  landlock: Work around gcc-16 -Wuninitialized warning

5 files changed, 334 insertions, 229 deletions

diff --git a/tools/testing/selftests/landlock/fs_test.c b/tools/testing/selftests/landlock/fs_test.c
index 18dbdb99aeba..6e979cef884d 100644
--- a/tools/testing/selftests/landlock/fs_test.c
+++ b/tools/testing/selftests/landlock/fs_test.c
@@ -10493,9 +10493,9 @@ FIXTURE_TEARDOWN_PARENT(trace_layout1)
 }
 
 /*
- * Verifies that check_rule_fs events include correct field values: domain, dev,
- * ino, access_request, and grants.  All values are verified against stat() of
- * the rule path on a deterministic tmpfs layout.
+ * Verifies that check_rule_inode events include correct field values: domain,
+ * dev, ino, access_request, and grants.  All values are verified against stat()
+ * of the rule path on a deterministic tmpfs layout.
  */
 TEST_F(trace_layout1, check_rule_fs_fields)
 {
@@ -10529,7 +10529,7 @@ TEST_F(trace_layout1, check_rule_fs_fields)
 	EXPECT_EQ(1,
 		  tracefs_count_matches(buf, REGEX_CHECK_RULE_FS(TRACE_TASK)))
 	{
-		TH_LOG("Expected 1 check_rule_fs event\n%s", buf);
+		TH_LOG("Expected 1 check_rule_inode event\n%s", buf);
 	}
 
 	ASSERT_EQ(0, tracefs_extract_field(buf, REGEX_CHECK_RULE_FS(TRACE_TASK),
@@ -10570,8 +10570,8 @@ TEST_F(trace_layout1, check_rule_fs_fields)
 }
 
 /*
- * Verifies check_rule_fs behavior with multiple rules.  With rules at s1d1 and
- * s1d2 (a child of s1d1), accessing s1d2 produces only 1 event because the
+ * Verifies check_rule_inode behavior with multiple rules.  With rules at s1d1
+ * and s1d2 (a child of s1d1), accessing s1d2 produces only 1 event because the
  * pathwalk short-circuits after the first rule fully unmasks the single layer.
  */
 TEST_F(trace_layout1, check_rule_fs_multiple_rules)
@@ -10643,14 +10643,14 @@ TEST_F(trace_layout1, check_rule_fs_multiple_rules)
 	ASSERT_NE(NULL, buf);
 
 	/*
-	 * Only 1 check_rule_fs event: the rule on dir_s1d2 fully unmasked the
-	 * single layer, so the pathwalk short-circuits before reaching the
+	 * Only one check_rule_inode event: the rule on dir_s1d2 fully unmasks
+	 * the single layer, so the pathwalk short-circuits before reaching the
 	 * dir_s1d1 rule.
 	 */
 	count = tracefs_count_matches(buf, REGEX_CHECK_RULE_FS(TRACE_TASK));
 	EXPECT_EQ(1, count)
 	{
-		TH_LOG("Expected 1 check_rule_fs event, got %d\n%s", count,
+		TH_LOG("Expected 1 check_rule_inode event, got %d\n%s", count,
 		       buf);
 	}
 
@@ -10777,7 +10777,7 @@ TEST_F(trace_layout1, check_rule_fs_optional_access)
 	count = tracefs_count_matches(buf, REGEX_CHECK_RULE_FS(TRACE_TASK));
 	EXPECT_EQ(1, count)
 	{
-		TH_LOG("Expected 1 check_rule_fs event, got %d\n%s", count,
+		TH_LOG("Expected 1 check_rule_inode event, got %d\n%s", count,
 		       buf);
 	}
 
@@ -10796,7 +10796,7 @@ TEST_F(trace_layout1, check_rule_fs_optional_access)
 }
 
 /*
- * Verifies that check_rule_fs fires for a rule that matches the inode even when
+ * Verifies that check_rule_inode fires for a rule matching the inode even when
  * it grants none of the requested rights, so the grants set is empty.  Landlock
  * cannot know a rule ignores the request before reading it, so the event is
  * still emitted (grants={}), which lets a tracer see that the rule matched.
@@ -10884,7 +10884,7 @@ TEST_F(trace_layout1, check_rule_fs_empty_grant)
 	count = tracefs_count_matches(buf, REGEX_CHECK_RULE_FS(TRACE_TASK));
 	EXPECT_EQ(2, count)
 	{
-		TH_LOG("Expected 2 check_rule_fs events, got %d\n%s", count,
+		TH_LOG("Expected 2 check_rule_inode events, got %d\n%s", count,
 		       buf);
 	}
 
@@ -10894,7 +10894,7 @@ TEST_F(trace_layout1, check_rule_fs_empty_grant)
 		tracefs_count_matches(
 			buf,
 			TRACE_PREFIX(
-				TRACE_TASK) "landlock_check_rule_fs: domain=[0-9a-f]\\+ "
+				TRACE_TASK) "landlock_check_rule_inode: domain=[0-9a-f]\\+ "
 					    "access_request=read_dir "
 					    "dev=[0-9]\\+:[0-9]\\+ ino=[0-9]\\+ "
 					    "grants={}$"))
@@ -10908,7 +10908,7 @@ TEST_F(trace_layout1, check_rule_fs_empty_grant)
 		tracefs_count_matches(
 			buf,
 			TRACE_PREFIX(
-				TRACE_TASK) "landlock_check_rule_fs: domain=[0-9a-f]\\+ "
+				TRACE_TASK) "landlock_check_rule_inode: domain=[0-9a-f]\\+ "
 					    "access_request=read_dir "
 					    "dev=[0-9]\\+:[0-9]\\+ ino=[0-9]\\+ "
 					    "grants={read_dir}$"))
diff --git a/tools/testing/selftests/landlock/net_test.c b/tools/testing/selftests/landlock/net_test.c
index a18761e0fd82..16afbfdf06bb 100644
--- a/tools/testing/selftests/landlock/net_test.c
+++ b/tools/testing/selftests/landlock/net_test.c
@@ -3481,13 +3481,14 @@ TEST_F(trace_net, deny_access_net_bind)
 }
 
 /*
- * Anchors the denial fields shared by every deny_access_net event so a field
- * test proves more than sport/dport: the denying domain, the same-exec bit, the
- * audit-logging verdict, and the blocked access all stay populated.
+ * Anchors the denial fields shared by every deny_access_net event so a port
+ * test also proves the denying domain, execution status, logging verdict, and
+ * exact blocked access.
  */
 static void
 expect_net_deny_common_fields(struct __test_metadata *const _metadata,
-			      const char *const buf)
+			      const char *const buf,
+			      const char *const expected_blockers)
 {
 	char field[64];
 
@@ -3511,18 +3512,21 @@ expect_net_deny_common_fields(struct __test_metadata *const _metadata,
 	ASSERT_EQ(0,
 		  tracefs_extract_field(buf, REGEX_DENY_ACCESS_NET(TRACE_TASK),
 					"blockers", field, sizeof(field)));
-	EXPECT_STRNE("", field);
+	EXPECT_STREQ(expected_blockers, field);
 }
 
-/* Connect and field-check tests use a separate fixture without variants. */
+enum trace_net_operation {
+	TRACE_NET_BIND,
+	TRACE_NET_SEND,
+};
 
 /* clang-format off */
-FIXTURE(trace_net_connect) {
+FIXTURE(trace_net_address) {
 	/* clang-format on */
 	int tracefs_ok;
 };
 
-FIXTURE_SETUP(trace_net_connect)
+FIXTURE_SETUP(trace_net_address)
 {
 	int ret;
 
@@ -3547,7 +3551,7 @@ FIXTURE_SETUP(trace_net_connect)
 	clear_cap(_metadata, CAP_SYS_ADMIN);
 }
 
-FIXTURE_TEARDOWN(trace_net_connect)
+FIXTURE_TEARDOWN(trace_net_address)
 {
 	if (!self->tracefs_ok)
 		return;
@@ -3559,160 +3563,183 @@ FIXTURE_TEARDOWN(trace_net_connect)
 }
 
 /* clang-format off */
-FIXTURE_VARIANT(trace_net_connect) {
+FIXTURE_VARIANT(trace_net_address) {
 	/* clang-format on */
-	/* handled_access_net, also the access allowed on the base port. */
-	__u64 handled;
-	/* Bind the allowed base port before the denied operation. */
-	bool bind_base_first;
-	/* Denied operation on the next port: connect (true) or bind (false). */
-	bool deny_connect;
+	int socket_family;
+	int socket_type;
+	enum trace_net_operation operation;
+	int address_family;
+	socklen_t addrlen;
+	__u64 handled_access;
+	const char *expected_blockers;
+	bool address_port_zero;
+	bool expected_address_port;
+	int expected_port;
 };
 
 /* clang-format off */
-
-/* Denied connect(): sport=0, dport=<denied port>. */
-FIXTURE_VARIANT_ADD(trace_net_connect, connect_denied) {
-	.handled = LANDLOCK_ACCESS_NET_CONNECT_TCP,
-	.bind_base_first = false,
-	.deny_connect = true,
+FIXTURE_VARIANT_ADD(trace_net_address, ipv4_tcp_bind) {
+	/* clang-format on */
+	.socket_family = AF_INET,
+	.socket_type = SOCK_STREAM,
+	.operation = TRACE_NET_BIND,
+	.address_family = AF_INET,
+	.addrlen = sizeof(struct sockaddr_in),
+	.handled_access = LANDLOCK_ACCESS_NET_BIND_TCP,
+	.expected_blockers = "bind_tcp",
+	.expected_address_port = true,
 };
 
-/* Denied bind(): sport=<denied port>, dport=0. */
-FIXTURE_VARIANT_ADD(trace_net_connect, bind_fields) {
-	.handled = LANDLOCK_ACCESS_NET_BIND_TCP,
-	.bind_base_first = false,
-	.deny_connect = false,
+/* Explicit bind(0) has a checked zero port. */
+/* clang-format off */
+FIXTURE_VARIANT_ADD(trace_net_address, ipv4_udp_bind_zero) {
+	/* clang-format on */
+	.socket_family = AF_INET,
+	.socket_type = SOCK_DGRAM,
+	.operation = TRACE_NET_BIND,
+	.address_family = AF_INET,
+	.addrlen = sizeof(struct sockaddr_in),
+	.handled_access = LANDLOCK_ACCESS_NET_BIND_UDP,
+	.expected_blockers = "bind_udp",
+	.address_port_zero = true,
+	.expected_port = 0,
+};
+
+/* A UDP send can deny its synthetic unspecified bind endpoint. */
+/* clang-format off */
+FIXTURE_VARIANT_ADD(trace_net_address, ipv6_udp_autobind) {
+	/* clang-format on */
+	.socket_family = AF_INET6,
+	.socket_type = SOCK_DGRAM,
+	.operation = TRACE_NET_SEND,
+	.address_family = AF_INET6,
+	.addrlen = sizeof(struct sockaddr_in6),
+	.handled_access = LANDLOCK_ACCESS_NET_BIND_UDP,
+	.expected_blockers = "bind_udp",
+	.expected_port = 0,
 };
 
-/* Denied connect() after an allowed bind(): the connect fields (sport=0). */
-FIXTURE_VARIANT_ADD(trace_net_connect, connect_after_bind) {
-	.handled = LANDLOCK_ACCESS_NET_BIND_TCP | LANDLOCK_ACCESS_NET_CONNECT_TCP,
-	.bind_base_first = true,
-	.deny_connect = true,
+/* A family-only address has no checked port. */
+/* clang-format off */
+FIXTURE_VARIANT_ADD(trace_net_address, ipv6_unspec_udp_send_min) {
+	/* clang-format on */
+	.socket_family = AF_INET6,
+	.socket_type = SOCK_DGRAM,
+	.operation = TRACE_NET_SEND,
+	.address_family = AF_UNSPEC,
+	.addrlen = sizeof(sa_family_t),
+	.handled_access = LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP,
+	.expected_blockers = "connect_send_udp",
+	.expected_port = -1,
 };
 
-/* clang-format on */
+static void set_trace_net_address(struct sockaddr_storage *const storage,
+				  const int socket_family,
+				  const int address_family,
+				  const unsigned short port)
+{
+	memset(storage, 0, sizeof(*storage));
 
-/*
- * A denied TCP bind(2) or connect(2) emits one deny_access_net event.  The port
- * is reported in the field matching the denied operation, in host endianness
- * (the UAPI landlock_net_port_attr.port convention): a connect denial reports
- * sport=0 dport=<port>, a bind denial reports sport=<port> dport=0, so a
- * byte-order or field-swap bug is caught.  A prior allowed bind
- * (connect_after_bind) does not change the connect denial's fields.
- */
-TEST_F(trace_net_connect, deny_access_net)
+	if (socket_family == AF_INET) {
+		struct sockaddr_in *const addr4 = (struct sockaddr_in *)storage;
+
+		addr4->sin_family = address_family;
+		addr4->sin_port = htons(port);
+		addr4->sin_addr.s_addr = htonl(INADDR_LOOPBACK);
+	} else {
+		struct sockaddr_in6 *const addr6 =
+			(struct sockaddr_in6 *)storage;
+
+		addr6->sin6_family = address_family;
+		addr6->sin6_port = htons(port);
+		addr6->sin6_addr = in6addr_loopback;
+	}
+}
+
+/* Verifies the actionable signed port for representative checked shapes. */
+TEST_F(trace_net_address, deny_access_net)
 {
-	pid_t child;
-	int status;
-	char *buf;
+	const char *const event_regex = REGEX_DENY_ACCESS_NET(TRACE_TASK);
+	const unsigned short address_port =
+		variant->address_port_zero ? 0 : sock_port_start + 1;
+	const int expected_port = variant->expected_address_port ?
+					  address_port :
+					  variant->expected_port;
+	const struct landlock_ruleset_attr ruleset_attr = {
+		.handled_access_net = variant->handled_access,
+	};
+	struct sockaddr_storage address;
 	char field[64], expected[16];
+	char *buf;
+	int count, ret, ruleset_fd, socket_fd, status;
+	pid_t child;
 
 	if (!self->tracefs_ok)
 		SKIP(return, "tracefs not available");
 
+	set_trace_net_address(&address, variant->socket_family,
+			      variant->address_family, address_port);
+	socket_fd = socket(variant->socket_family,
+			   variant->socket_type | SOCK_CLOEXEC, 0);
+	ASSERT_LE(0, socket_fd);
+	ruleset_fd =
+		landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
+	ASSERT_LE(0, ruleset_fd);
+	ASSERT_EQ(0, tracefs_clear_buf());
+
 	child = fork();
 	ASSERT_LE(0, child);
-
 	if (child == 0) {
-		struct landlock_ruleset_attr ruleset_attr = {
-			.handled_access_net = variant->handled,
-		};
-		struct landlock_net_port_attr port_attr = {
-			.allowed_access = variant->handled,
-			.port = sock_port_start,
-		};
-		struct sockaddr_in addr = {
-			.sin_family = AF_INET,
-			.sin_addr.s_addr = htonl(INADDR_LOOPBACK),
-		};
-		int ruleset_fd, sock_fd, optval = 1, ret;
-
-		ruleset_fd = landlock_create_ruleset(&ruleset_attr,
-						     sizeof(ruleset_attr), 0);
-		if (ruleset_fd < 0)
+		if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0))
 			_exit(1);
-		if (landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
-				      &port_attr, 0)) {
-			close(ruleset_fd);
-			_exit(1);
-		}
-		prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
-		if (landlock_restrict_self(ruleset_fd, 0)) {
-			close(ruleset_fd);
-			_exit(1);
-		}
+		if (landlock_restrict_self(ruleset_fd, 0))
+			_exit(2);
 		close(ruleset_fd);
 
-		sock_fd = socket(AF_INET, SOCK_STREAM | SOCK_CLOEXEC, 0);
-		if (sock_fd < 0)
-			_exit(1);
-
-		/* Bind the allowed base port first (succeeds, no event). */
-		if (variant->bind_base_first) {
-			setsockopt(sock_fd, SOL_SOCKET, SO_REUSEADDR, &optval,
-				   sizeof(optval));
-			addr.sin_port = htons(sock_port_start);
-			if (bind(sock_fd, (struct sockaddr *)&addr,
-				 sizeof(addr))) {
-				close(sock_fd);
-				_exit(1);
-			}
-		}
-
-		/* Denied operation on the next port. */
-		addr.sin_port = htons(sock_port_start + 1);
-		if (variant->deny_connect)
-			ret = connect(sock_fd, (struct sockaddr *)&addr,
-				      sizeof(addr));
-		else
-			ret = bind(sock_fd, (struct sockaddr *)&addr,
-				   sizeof(addr));
-		if (ret == 0) {
-			close(sock_fd);
-			_exit(2);
-		}
-		if (errno != EACCES) {
-			close(sock_fd);
+		switch (variant->operation) {
+		case TRACE_NET_BIND:
+			ret = bind(socket_fd, (const struct sockaddr *)&address,
+				   variant->addrlen);
+			break;
+		case TRACE_NET_SEND:
+			ret = sendto(socket_fd, "A", 1, MSG_NOSIGNAL,
+				     (const struct sockaddr *)&address,
+				     variant->addrlen);
+			break;
+		default:
 			_exit(3);
 		}
-		close(sock_fd);
+		if (ret >= 0 || errno != EACCES)
+			_exit(4);
+		close(socket_fd);
+
 		_exit(0);
 	}
+	close(ruleset_fd);
+	close(socket_fd);
 
 	ASSERT_EQ(child, waitpid(child, &status, 0));
 	ASSERT_TRUE(WIFEXITED(status));
-	EXPECT_EQ(0, WEXITSTATUS(status));
+	ASSERT_EQ(0, WEXITSTATUS(status));
 
 	buf = tracefs_read_buf();
 	ASSERT_NE(NULL, buf);
-
-	EXPECT_EQ(1, tracefs_count_matches(buf,
-					   REGEX_DENY_ACCESS_NET(TRACE_TASK)));
-
-	expect_net_deny_common_fields(_metadata, buf);
-
-	/*
-	 * The denied operation's port field carries the port; the other is 0.
-	 */
-	snprintf(expected, sizeof(expected), "%llu",
-		 (unsigned long long)(sock_port_start + 1));
-
-	ASSERT_EQ(0,
-		  tracefs_extract_field(buf, REGEX_DENY_ACCESS_NET(TRACE_TASK),
-					"sport", field, sizeof(field)));
-	EXPECT_STREQ(variant->deny_connect ? "0" : expected, field);
-
-	ASSERT_EQ(0,
-		  tracefs_extract_field(buf, REGEX_DENY_ACCESS_NET(TRACE_TASK),
-					"dport", field, sizeof(field)));
-	EXPECT_STREQ(variant->deny_connect ? expected : "0", field);
+	count = tracefs_count_matches(buf, event_regex);
+	if (count != 1)
+		TH_LOG("Expected 1 denial event, got %d\n%s", count, buf);
+	ASSERT_EQ(1, count);
+	expect_net_deny_common_fields(_metadata, buf,
+				      variant->expected_blockers);
+
+	ASSERT_EQ(0, tracefs_extract_field(buf, event_regex, "port", field,
+					   sizeof(field)));
+	snprintf(expected, sizeof(expected), "%d", expected_port);
+	EXPECT_STREQ(expected, field);
 
 	free(buf);
 }
 
-/* Field verification for the check_rule_net event on an allowed access. */
+/* Field verification for the check_rule_net_port event on an allowed access. */
 
 /* clang-format off */
 FIXTURE(trace_net_check_rule) {
@@ -3757,10 +3784,11 @@ FIXTURE_TEARDOWN(trace_net_check_rule)
 
 /*
  * Verifies that an allowed bind matching a net-port rule emits exactly one
- * landlock_check_rule_net event with the enforcing domain, the requested
+ * landlock_check_rule_net_port event with the enforcing domain, the requested
  * access, the checked port (host endianness), and the per-layer grants.  The
- * whole event is anchored to exact values so a revert of the check_rule_net
- * emit (or a byte-order or field-plumbing regression) fails the test.
+ * whole event is anchored to exact values so removing the check_rule_net_port
+ * emission or introducing a byte-order or field-plumbing regression fails the
+ * test.
  */
 TEST_F(trace_net_check_rule, check_rule_net_fields)
 {
@@ -3832,7 +3860,7 @@ TEST_F(trace_net_check_rule, check_rule_net_fields)
 	EXPECT_EQ(1,
 		  tracefs_count_matches(buf, REGEX_CHECK_RULE_NET(TRACE_TASK)))
 	{
-		TH_LOG("Expected 1 check_rule_net event\n%s", buf);
+		TH_LOG("Expected 1 check_rule_net_port event\n%s", buf);
 	}
 
 	ASSERT_EQ(0,
@@ -3866,11 +3894,4 @@ TEST_F(trace_net_check_rule, check_rule_net_fields)
 	free(buf);
 }
 
-/*
- * IPv6 network trace tests are intentionally elided.  IPv6 hook dispatch uses
- * the same current_check_access_socket() code path as IPv4, validated by the
- * audit tests in this file.  The trace events use the same blockers/sport/dport
- * fields regardless of address family.
- */
-
 TEST_HARNESS_MAIN
diff --git a/tools/testing/selftests/landlock/trace.h b/tools/testing/selftests/landlock/trace.h
index ba0c5e92001f..2ec863362173 100644
--- a/tools/testing/selftests/landlock/trace.h
+++ b/tools/testing/selftests/landlock/trace.h
@@ -27,14 +27,14 @@
 	TRACEFS_LANDLOCK_DIR "/landlock_create_domain/enable"
 #define TRACEFS_ENFORCE_DOMAIN_ENABLE \
 	TRACEFS_LANDLOCK_DIR "/landlock_enforce_domain/enable"
-#define TRACEFS_ADD_RULE_FS_ENABLE \
-	TRACEFS_LANDLOCK_DIR "/landlock_add_rule_fs/enable"
-#define TRACEFS_ADD_RULE_NET_ENABLE \
-	TRACEFS_LANDLOCK_DIR "/landlock_add_rule_net/enable"
+#define TRACEFS_ADD_RULE_PATH_BENEATH_ENABLE \
+	TRACEFS_LANDLOCK_DIR "/landlock_add_rule_path_beneath/enable"
+#define TRACEFS_ADD_RULE_NET_PORT_ENABLE \
+	TRACEFS_LANDLOCK_DIR "/landlock_add_rule_net_port/enable"
 #define TRACEFS_CHECK_RULE_FS_ENABLE \
-	TRACEFS_LANDLOCK_DIR "/landlock_check_rule_fs/enable"
+	TRACEFS_LANDLOCK_DIR "/landlock_check_rule_inode/enable"
 #define TRACEFS_CHECK_RULE_NET_ENABLE \
-	TRACEFS_LANDLOCK_DIR "/landlock_check_rule_net/enable"
+	TRACEFS_LANDLOCK_DIR "/landlock_check_rule_net_port/enable"
 #define TRACEFS_DENY_ACCESS_FS_ENABLE \
 	TRACEFS_LANDLOCK_DIR "/landlock_deny_access_fs/enable"
 #define TRACEFS_DENY_ACCESS_NET_ENABLE \
@@ -79,18 +79,18 @@
  */
 #define KWORKER_TASK "kworker/[0-9]\\+:[0-9]\\+"
 
-#define REGEX_ADD_RULE_FS(task)           \
-	TRACE_PREFIX(task)                \
-	"landlock_add_rule_fs: "          \
-	"ruleset=[0-9a-f]\\+\\.[0-9]\\+ " \
-	"access_rights=[a-z_|]* "         \
-	"dev=[0-9]\\+:[0-9]\\+ "          \
-	"ino=[0-9]\\+ "                   \
+#define REGEX_ADD_RULE_PATH_BENEATH(task)  \
+	TRACE_PREFIX(task)                 \
+	"landlock_add_rule_path_beneath: " \
+	"ruleset=[0-9a-f]\\+\\.[0-9]\\+ "  \
+	"access_rights=[a-z_|]* "          \
+	"dev=[0-9]\\+:[0-9]\\+ "           \
+	"ino=[0-9]\\+ "                    \
 	"path=[^ ]\\+$"
 
-#define REGEX_ADD_RULE_NET(task)          \
+#define REGEX_ADD_RULE_NET_PORT(task)     \
 	TRACE_PREFIX(task)                \
-	"landlock_add_rule_net: "         \
+	"landlock_add_rule_net_port: "    \
 	"ruleset=[0-9a-f]\\+\\.[0-9]\\+ " \
 	"access_rights=[a-z_|]* "         \
 	"port=[0-9]\\+$"
@@ -110,21 +110,21 @@
 	"parent=[0-9a-f]\\+ "      \
 	"ruleset=[0-9a-f]\\+\\.[0-9]\\+$"
 
-#define REGEX_CHECK_RULE_FS(task)  \
-	TRACE_PREFIX(task)         \
-	"landlock_check_rule_fs: " \
-	"domain=[0-9a-f]\\+ "      \
-	"access_request=[a-z_|]* " \
-	"dev=[0-9]\\+:[0-9]\\+ "   \
-	"ino=[0-9]\\+ "            \
+#define REGEX_CHECK_RULE_FS(task)     \
+	TRACE_PREFIX(task)            \
+	"landlock_check_rule_inode: " \
+	"domain=[0-9a-f]\\+ "         \
+	"access_request=[a-z_|]* "    \
+	"dev=[0-9]\\+:[0-9]\\+ "      \
+	"ino=[0-9]\\+ "               \
 	"grants={[a-z_|,]*}$"
 
-#define REGEX_CHECK_RULE_NET(task)  \
-	TRACE_PREFIX(task)          \
-	"landlock_check_rule_net: " \
-	"domain=[0-9a-f]\\+ "       \
-	"access_request=[a-z_|]* "  \
-	"port=[0-9]\\+ "            \
+#define REGEX_CHECK_RULE_NET(task)       \
+	TRACE_PREFIX(task)               \
+	"landlock_check_rule_net_port: " \
+	"domain=[0-9a-f]\\+ "            \
+	"access_request=[a-z_|]* "       \
+	"port=[0-9]\\+ "                 \
 	"grants={[a-z_|,]*}$"
 
 #define REGEX_DENY_ACCESS_FS(task)  \
@@ -145,8 +145,7 @@
 	"same_exec=[01] "            \
 	"logged=[01] "               \
 	"blockers=[a-z_|]* "         \
-	"sport=[0-9]\\+ "            \
-	"dport=[0-9]\\+$"
+	"port=-\\?[0-9]\\+$"
 
 #define REGEX_DENY_PTRACE(task)      \
 	TRACE_PREFIX(task)           \
diff --git a/tools/testing/selftests/landlock/trace_fs_test.c b/tools/testing/selftests/landlock/trace_fs_test.c
index 4543a25c1f55..64014ade3a0e 100644
--- a/tools/testing/selftests/landlock/trace_fs_test.c
+++ b/tools/testing/selftests/landlock/trace_fs_test.c
@@ -121,7 +121,8 @@ FIXTURE_SETUP(trace_fs)
 	}
 	self->tracefs_ok = 1;
 
-	ASSERT_EQ(0, tracefs_enable_event(TRACEFS_ADD_RULE_FS_ENABLE, true));
+	ASSERT_EQ(0, tracefs_enable_event(TRACEFS_ADD_RULE_PATH_BENEATH_ENABLE,
+					  true));
 	ASSERT_EQ(0, tracefs_enable_event(TRACEFS_CHECK_RULE_FS_ENABLE, true));
 	ASSERT_EQ(0, tracefs_enable_event(TRACEFS_DENY_ACCESS_FS_ENABLE, true));
 	ASSERT_EQ(0, tracefs_clear());
@@ -134,7 +135,7 @@ FIXTURE_TEARDOWN(trace_fs)
 		return;
 
 	set_cap(_metadata, CAP_SYS_ADMIN);
-	tracefs_enable_event(TRACEFS_ADD_RULE_FS_ENABLE, false);
+	tracefs_enable_event(TRACEFS_ADD_RULE_PATH_BENEATH_ENABLE, false);
 	tracefs_enable_event(TRACEFS_CHECK_RULE_FS_ENABLE, false);
 	tracefs_enable_event(TRACEFS_DENY_ACCESS_FS_ENABLE, false);
 	tracefs_fixture_teardown();
@@ -183,11 +184,11 @@ TEST_F(trace_fs, unsandboxed)
 }
 
 /*
- * Verifies that adding a filesystem rule emits a landlock_add_rule_fs trace
- * event with the expected path and field values: ruleset ID is non-zero,
- * access_rights is non-zero, and path matches.
+ * Verifies that adding a filesystem rule emits a landlock_add_rule_path_beneath
+ * event with the expected path and field values: the ruleset ID and
+ * access_rights are non-zero, and the path matches.
  */
-TEST_F(trace_fs, add_rule_fs)
+TEST_F(trace_fs, add_rule_path_beneath)
 {
 	struct landlock_ruleset_attr ruleset_attr = {
 		.handled_access_fs = LANDLOCK_ACCESS_FS_READ_FILE |
@@ -215,28 +216,30 @@ TEST_F(trace_fs, add_rule_fs)
 	buf = tracefs_read_buf();
 	ASSERT_NE(NULL, buf);
 
-	count = tracefs_count_matches(buf, REGEX_ADD_RULE_FS(TRACE_TASK));
+	count = tracefs_count_matches(buf,
+				      REGEX_ADD_RULE_PATH_BENEATH(TRACE_TASK));
 	EXPECT_EQ(1, count)
 	{
-		TH_LOG("Expected 1 add_rule_fs event, got %d\n%s", count, buf);
+		TH_LOG("Expected 1 add_rule_path_beneath event, got %d\n%s",
+		       count, buf);
 	}
 
 	/* Ruleset ID should be non-zero. */
-	ASSERT_EQ(0, tracefs_extract_field(buf, REGEX_ADD_RULE_FS(TRACE_TASK),
-					   "ruleset", field_buf,
-					   sizeof(field_buf)));
+	ASSERT_EQ(0, tracefs_extract_field(
+			     buf, REGEX_ADD_RULE_PATH_BENEATH(TRACE_TASK),
+			     "ruleset", field_buf, sizeof(field_buf)));
 	EXPECT_STRNE("0", field_buf);
 
 	/* Access rights should be non-zero. */
-	ASSERT_EQ(0, tracefs_extract_field(buf, REGEX_ADD_RULE_FS(TRACE_TASK),
-					   "access_rights", field_buf,
-					   sizeof(field_buf)));
+	ASSERT_EQ(0, tracefs_extract_field(
+			     buf, REGEX_ADD_RULE_PATH_BENEATH(TRACE_TASK),
+			     "access_rights", field_buf, sizeof(field_buf)));
 	EXPECT_STRNE("", field_buf);
 
 	/* Path should be /usr. */
-	ASSERT_EQ(0,
-		  tracefs_extract_field(buf, REGEX_ADD_RULE_FS(TRACE_TASK),
-					"path", field_buf, sizeof(field_buf)));
+	ASSERT_EQ(0, tracefs_extract_field(
+			     buf, REGEX_ADD_RULE_PATH_BENEATH(TRACE_TASK),
+			     "path", field_buf, sizeof(field_buf)));
 	EXPECT_STREQ("/usr", field_buf);
 
 	free(buf);
@@ -246,7 +249,7 @@ TEST_F(trace_fs, add_rule_fs)
  * Verifies that a path whose escaping exceeds the trace scratch sequence does
  * not corrupt a sibling symbolic field.
  */
-TEST_F(trace_fs, add_rule_fs_escaped_path_overflow)
+TEST_F(trace_fs, add_rule_path_beneath_escaped_path_overflow)
 {
 	static const char access_prefix[] = "execute|write_file|read_file|";
 	static const char access_suffix[] = "|ioctl_dev|resolve_unix";
@@ -277,10 +280,12 @@ TEST_F(trace_fs, add_rule_fs_escaped_path_overflow)
 	buf = tracefs_read_buf();
 	ASSERT_NE(NULL, buf);
 
-	count = tracefs_count_matches(buf, REGEX_ADD_RULE_FS(TRACE_TASK));
+	count = tracefs_count_matches(buf,
+				      REGEX_ADD_RULE_PATH_BENEATH(TRACE_TASK));
 	EXPECT_EQ(1, count)
 	{
-		TH_LOG("Expected 1 add_rule_fs event, got %d\n%s", count, buf);
+		TH_LOG("Expected 1 add_rule_path_beneath event, got %d\n%s",
+		       count, buf);
 	}
 
 	/*
@@ -288,9 +293,9 @@ TEST_F(trace_fs, add_rule_fs_escaped_path_overflow)
 	 * field also catches scratch-sequence poisoning when the compiler
 	 * evaluates the overflowing path first, as GCC currently does.
 	 */
-	ASSERT_EQ(0, tracefs_extract_field(buf, REGEX_ADD_RULE_FS(TRACE_TASK),
-					   "access_rights", field_buf,
-					   sizeof(field_buf)));
+	ASSERT_EQ(0, tracefs_extract_field(
+			     buf, REGEX_ADD_RULE_PATH_BENEATH(TRACE_TASK),
+			     "access_rights", field_buf, sizeof(field_buf)));
 	EXPECT_EQ(0,
 		  strncmp(field_buf, access_prefix, sizeof(access_prefix) - 1));
 	EXPECT_EQ(NULL, strstr(field_buf, "|refer|"));
@@ -298,7 +303,8 @@ TEST_F(trace_fs, add_rule_fs_escaped_path_overflow)
 	ASSERT_LE(sizeof(access_suffix) - 1, field_len);
 	EXPECT_STREQ(access_suffix,
 		     field_buf + field_len - (sizeof(access_suffix) - 1));
-	expect_truncated_path(_metadata, buf, REGEX_ADD_RULE_FS(TRACE_TASK));
+	expect_truncated_path(_metadata, buf,
+			      REGEX_ADD_RULE_PATH_BENEATH(TRACE_TASK));
 
 	free(buf);
 }
@@ -542,7 +548,8 @@ TEST_F(trace_fs, check_rule_nested)
  */
 TEST_F(trace_fs, deny_access_fs_denied)
 {
-	char *buf;
+	const char *const event_regex = REGEX_DENY_ACCESS_FS(TRACE_TASK);
+	char *buf, blockers[64];
 	int count;
 
 	ASSERT_EQ(0, tracefs_clear_buf());
@@ -558,8 +565,77 @@ TEST_F(trace_fs, deny_access_fs_denied)
 	buf = tracefs_read_buf();
 	ASSERT_NE(NULL, buf);
 
-	count = tracefs_count_matches(buf, REGEX_DENY_ACCESS_FS(TRACE_TASK));
-	EXPECT_LE(1, count);
+	count = tracefs_count_matches(buf, event_regex);
+	EXPECT_EQ(1, count)
+	{
+		TH_LOG("Expected 1 access denial, got %d\n%s", count, buf);
+	}
+	ASSERT_EQ(0, tracefs_extract_field(buf, event_regex, "blockers",
+					   blockers, sizeof(blockers)));
+	EXPECT_STREQ("read_dir", blockers);
+
+	free(buf);
+}
+
+/*
+ * Verifies that a denied mount reports the singleton topology blocker rather
+ * than an empty access mask.
+ */
+TEST_F(trace_fs, deny_change_topology)
+{
+	const char *const event_regex = REGEX_DENY_ACCESS_FS(TRACE_TASK);
+	const struct landlock_ruleset_attr ruleset_attr = {
+		.handled_access_fs = LANDLOCK_ACCESS_FS_REFER,
+	};
+	char *buf, blockers[64];
+	int count, ruleset_fd, status;
+	pid_t pid;
+
+	ruleset_fd =
+		landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
+	ASSERT_LE(0, ruleset_fd);
+	ASSERT_EQ(0, tracefs_clear_buf());
+
+	/* Ensure that Landlock is the only expected mount denial. */
+	set_cap(_metadata, CAP_SYS_ADMIN);
+	pid = fork();
+	ASSERT_LE(0, pid);
+	if (pid == 0) {
+		if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
+			close(ruleset_fd);
+			_exit(1);
+		}
+		if (landlock_restrict_self(ruleset_fd, 0)) {
+			close(ruleset_fd);
+			_exit(2);
+		}
+		close(ruleset_fd);
+
+		if (mount(NULL, "/", NULL, MS_PRIVATE | MS_REC, NULL) != -1)
+			_exit(3);
+
+		if (errno != EPERM)
+			_exit(4);
+
+		_exit(0);
+	}
+	close(ruleset_fd);
+	clear_cap(_metadata, CAP_SYS_ADMIN);
+
+	ASSERT_EQ(pid, waitpid(pid, &status, 0));
+	ASSERT_TRUE(WIFEXITED(status));
+	EXPECT_EQ(0, WEXITSTATUS(status));
+
+	buf = tracefs_read_buf();
+	ASSERT_NE(NULL, buf);
+	count = tracefs_count_matches(buf, event_regex);
+	EXPECT_EQ(1, count)
+	{
+		TH_LOG("Expected 1 topology denial, got %d\n%s", count, buf);
+	}
+	ASSERT_EQ(0, tracefs_extract_field(buf, event_regex, "blockers",
+					   blockers, sizeof(blockers)));
+	EXPECT_STREQ("change_topology", blockers);
 
 	free(buf);
 }
diff --git a/tools/testing/selftests/landlock/trace_test.c b/tools/testing/selftests/landlock/trace_test.c
index afdaf8511b3a..f9b293a9dd56 100644
--- a/tools/testing/selftests/landlock/trace_test.c
+++ b/tools/testing/selftests/landlock/trace_test.c
@@ -49,8 +49,10 @@ FIXTURE_SETUP(trace)
 	ASSERT_EQ(0, tracefs_enable_event(TRACEFS_CREATE_RULESET_ENABLE, true));
 	ASSERT_EQ(0, tracefs_enable_event(TRACEFS_CREATE_DOMAIN_ENABLE, true));
 	ASSERT_EQ(0, tracefs_enable_event(TRACEFS_ENFORCE_DOMAIN_ENABLE, true));
-	ASSERT_EQ(0, tracefs_enable_event(TRACEFS_ADD_RULE_FS_ENABLE, true));
-	ASSERT_EQ(0, tracefs_enable_event(TRACEFS_ADD_RULE_NET_ENABLE, true));
+	ASSERT_EQ(0, tracefs_enable_event(TRACEFS_ADD_RULE_PATH_BENEATH_ENABLE,
+					  true));
+	ASSERT_EQ(0,
+		  tracefs_enable_event(TRACEFS_ADD_RULE_NET_PORT_ENABLE, true));
 	ASSERT_EQ(0, tracefs_enable_event(TRACEFS_CHECK_RULE_FS_ENABLE, true));
 	ASSERT_EQ(0, tracefs_enable_event(TRACEFS_CHECK_RULE_NET_ENABLE, true));
 	ASSERT_EQ(0, tracefs_enable_event(TRACEFS_DENY_ACCESS_FS_ENABLE, true));
@@ -72,8 +74,8 @@ FIXTURE_TEARDOWN(trace)
 	tracefs_enable_event(TRACEFS_CREATE_RULESET_ENABLE, false);
 	tracefs_enable_event(TRACEFS_CREATE_DOMAIN_ENABLE, false);
 	tracefs_enable_event(TRACEFS_ENFORCE_DOMAIN_ENABLE, false);
-	tracefs_enable_event(TRACEFS_ADD_RULE_FS_ENABLE, false);
-	tracefs_enable_event(TRACEFS_ADD_RULE_NET_ENABLE, false);
+	tracefs_enable_event(TRACEFS_ADD_RULE_PATH_BENEATH_ENABLE, false);
+	tracefs_enable_event(TRACEFS_ADD_RULE_NET_PORT_ENABLE, false);
 	tracefs_enable_event(TRACEFS_CHECK_RULE_FS_ENABLE, false);
 	tracefs_enable_event(TRACEFS_CHECK_RULE_NET_ENABLE, false);
 	tracefs_enable_event(TRACEFS_DENY_ACCESS_FS_ENABLE, false);
@@ -103,8 +105,10 @@ TEST_F(trace, no_trace_when_disabled)
 	ASSERT_EQ(0, tracefs_enable_event(TRACEFS_CREATE_DOMAIN_ENABLE, false));
 	ASSERT_EQ(0,
 		  tracefs_enable_event(TRACEFS_ENFORCE_DOMAIN_ENABLE, false));
-	ASSERT_EQ(0, tracefs_enable_event(TRACEFS_ADD_RULE_FS_ENABLE, false));
-	ASSERT_EQ(0, tracefs_enable_event(TRACEFS_ADD_RULE_NET_ENABLE, false));
+	ASSERT_EQ(0, tracefs_enable_event(TRACEFS_ADD_RULE_PATH_BENEATH_ENABLE,
+					  false));
+	ASSERT_EQ(0, tracefs_enable_event(TRACEFS_ADD_RULE_NET_PORT_ENABLE,
+					  false));
 	ASSERT_EQ(0, tracefs_enable_event(TRACEFS_CHECK_RULE_FS_ENABLE, false));
 	ASSERT_EQ(0,
 		  tracefs_enable_event(TRACEFS_CHECK_RULE_NET_ENABLE, false));
@@ -265,10 +269,11 @@ TEST_F(trace, ruleset_version)
 	ASSERT_NE(0, !!dot);
 	EXPECT_STREQ("0", dot + 1);
 
-	/* Verify 2 add_rule_fs events were emitted. */
-	EXPECT_EQ(2, tracefs_count_matches(buf, REGEX_ADD_RULE_FS(TRACE_TASK)))
+	/* Verify two add_rule_path_beneath events were emitted. */
+	EXPECT_EQ(2, tracefs_count_matches(
+			     buf, REGEX_ADD_RULE_PATH_BENEATH(TRACE_TASK)))
 	{
-		TH_LOG("Expected 2 add_rule_fs events\n%s", buf);
+		TH_LOG("Expected 2 add_rule_path_beneath events\n%s", buf);
 	}
 
 	/*
@@ -373,7 +378,7 @@ TEST_F(trace, create_domain)
 		tracefs_count_matches(buf, REGEX_CHECK_RULE_FS(TRACE_TASK));
 	ASSERT_LE(1, check_count)
 	{
-		TH_LOG("Expected check_rule_fs events\n%s", buf);
+		TH_LOG("Expected check_rule_inode events\n%s", buf);
 	}
 
 	EXPECT_EQ(0, tracefs_extract_field(buf, REGEX_CHECK_RULE_FS(TRACE_TASK),
@@ -508,9 +513,11 @@ TEST_F(trace, add_rule_invalid_fd)
 	buf = tracefs_read_buf();
 	ASSERT_NE(NULL, buf);
 
-	EXPECT_EQ(0, tracefs_count_matches(buf, REGEX_ADD_RULE_FS(TRACE_TASK)))
+	EXPECT_EQ(0, tracefs_count_matches(
+			     buf, REGEX_ADD_RULE_PATH_BENEATH(TRACE_TASK)))
 	{
-		TH_LOG("No add_rule_fs event expected on invalid fd\n%s", buf);
+		TH_LOG("No add_rule_path_beneath event expected on invalid fd\n%s",
+		       buf);
 	}
 
 	free(buf);
@@ -902,10 +909,10 @@ TEST_F(trace, non_audit_visible_denial_counting)
 }
 
 /*
- * Verifies that landlock_add_rule_net emits a trace event with the correct port
- * and allowed access mask fields.
+ * Verifies that landlock_add_rule_net_port emits a trace event with the correct
+ * port and allowed access mask fields.
  */
-TEST_F(trace, add_rule_net_fields)
+TEST_F(trace, add_rule_net_port_fields)
 {
 	struct landlock_ruleset_attr ruleset_attr = {
 		.handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP,
@@ -931,9 +938,10 @@ TEST_F(trace, add_rule_net_fields)
 	buf = tracefs_read_buf();
 	ASSERT_NE(NULL, buf);
 
-	EXPECT_EQ(1, tracefs_count_matches(buf, REGEX_ADD_RULE_NET(TRACE_TASK)))
+	EXPECT_EQ(1, tracefs_count_matches(buf,
+					   REGEX_ADD_RULE_NET_PORT(TRACE_TASK)))
 	{
-		TH_LOG("Expected 1 add_rule_net event\n%s", buf);
+		TH_LOG("Expected 1 add_rule_net_port event\n%s", buf);
 	}
 
 	/*
@@ -941,7 +949,8 @@ TEST_F(trace, add_rule_net_fields)
 	 * (landlock_net_port_attr.port).  On little-endian, htons(8080) is
 	 * 36895, so this comparison catches byte-order bugs.
 	 */
-	EXPECT_EQ(0, tracefs_extract_field(buf, REGEX_ADD_RULE_NET(TRACE_TASK),
+	EXPECT_EQ(0, tracefs_extract_field(buf,
+					   REGEX_ADD_RULE_NET_PORT(TRACE_TASK),
 					   "port", field, sizeof(field)));
 	EXPECT_STREQ("8080", field);
 	/*
@@ -950,9 +959,9 @@ TEST_F(trace, add_rule_net_fields)
 	 * net access bits are unhandled because the ruleset only handles
 	 * BIND_TCP).
 	 */
-	EXPECT_EQ(0,
-		  tracefs_extract_field(buf, REGEX_ADD_RULE_NET(TRACE_TASK),
-					"access_rights", field, sizeof(field)));
+	EXPECT_EQ(0, tracefs_extract_field(
+			     buf, REGEX_ADD_RULE_NET_PORT(TRACE_TASK),
+			     "access_rights", field, sizeof(field)));
 	EXPECT_STREQ("bind_tcp|connect_tcp|bind_udp|connect_send_udp", field);
 
 	free(buf);