Merge tag 'landlock-7.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux

Pull Landlock fixes from Mickaël Salaün:
 "This mainly fixes the Landlock tracepoint support merged this cycle so
  that denial and rule events report the intended policy context,
  whether through tracefs or BTF-visible callbacks.

  The size of this all is mainly from propagating the corrected contract
  through event definitions and producers, adding new tests for the
  reported context, and updating the documentation.

  Also improve annotation and fix a GCC 16 build warning"

* tag 'landlock-7.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux:
  landlock: Widen ruleset versions to 64 bits
  landlock: Add counted_by in landlock_domain
  landlock: Fix tracepoint contract documentation
  selftests/landlock: Test network denial context
  selftests/landlock: Test filesystem denial blockers
  landlock: Report the effective signal number
  landlock: Report the actual ptrace tracer
  landlock: Fix network denial trace context
  landlock: Fix rule tracepoint context
  landlock: Fix filesystem denial blocker reporting
  landlock: Fix tracepoint fixed-width type names
  landlock: Work around gcc-16 -Wuninitialized warning

8 files changed, 210 insertions, 68 deletions

diff --git a/security/landlock/access.h b/security/landlock/access.h
index bbbb41f41147..f843835851d0 100644
--- a/security/landlock/access.h
+++ b/security/landlock/access.h
@@ -61,6 +61,10 @@ union access_masks_all {
 static_assert(sizeof(typeof_member(union access_masks_all, masks)) ==
 	      sizeof(typeof_member(union access_masks_all, all)));
 
+#define _LANDLOCK_LAYER_MASK_PADDING                              \
+	(BITS_PER_TYPE(access_mask_t) - LANDLOCK_NUM_ACCESS_MAX - \
+	 IS_ENABLED(CONFIG_SECURITY_LANDLOCK_LOG))
+
 /**
  * struct layer_mask - The access rights and rule flags for a layer.
  *
@@ -81,6 +85,10 @@ struct layer_mask {
 	 */
 	access_mask_t quiet : 1;
 #endif /* CONFIG_SECURITY_LANDLOCK_LOG */
+	/**
+	 * @__pad: Padding for the compiler's bitfield initialization.
+	 */
+	access_mask_t __pad : _LANDLOCK_LAYER_MASK_PADDING;
 } __packed __aligned(sizeof(access_mask_t));
 
 /*
diff --git a/security/landlock/domain.h b/security/landlock/domain.h
index 5ce2f91488d5..caa3d19d2c43 100644
--- a/security/landlock/domain.h
+++ b/security/landlock/domain.h
@@ -243,7 +243,8 @@ struct landlock_domain {
 			 * overlapping access rights.  These layers are set once
 			 * and never changed for the lifetime of the domain.
 			 */
-			struct access_masks handled_masks[];
+			struct access_masks
+				handled_masks[] __counted_by(num_layers);
 		};
 	};
 };
diff --git a/security/landlock/fs.c b/security/landlock/fs.c
index 330a1871bf94..cab43892ec2f 100644
--- a/security/landlock/fs.c
+++ b/security/landlock/fs.c
@@ -356,14 +356,14 @@ int landlock_append_fs_rule(struct landlock_ruleset *const ruleset,
 	 * held for BTF consistency (enforced by lockdep_assert_held in
 	 * TP_fast_assign).
 	 */
-	if (!err && trace_landlock_add_rule_fs_enabled()) {
+	if (!err && trace_landlock_add_rule_path_beneath_enabled()) {
 		char *buffer __free(__putname) = __getname();
 		const char *pathname =
 			buffer ? resolve_path_for_trace(path, buffer) :
 				 "<no_mem>";
 
-		trace_landlock_add_rule_fs(ruleset, access_rights, path,
-					   pathname);
+		trace_landlock_add_rule_path_beneath(
+			ruleset, flags, access_rights, path, pathname);
 	}
 	mutex_unlock(&ruleset->lock);
 
@@ -423,8 +423,8 @@ static bool unmask_layers_fs(const struct landlock_domain *const domain,
 
 	ret = landlock_unmask_layers(domain, id, masks, &rule);
 	if (rule)
-		trace_landlock_check_rule_fs(domain, rule, access_request,
-					     dentry);
+		trace_landlock_check_rule_inode(domain, rule, access_request,
+						dentry);
 	return ret;
 }
 
diff --git a/security/landlock/log.h b/security/landlock/log.h
index e0a6e44f3ddd..faa30e26e42a 100644
--- a/security/landlock/log.h
+++ b/security/landlock/log.h
@@ -15,6 +15,8 @@
 
 struct landlock_cred_security;
 struct landlock_hierarchy;
+struct sockaddr;
+struct task_struct;
 
 enum landlock_request_type {
 	LANDLOCK_REQUEST_PTRACE = 1,
@@ -25,6 +27,31 @@ enum landlock_request_type {
 	LANDLOCK_REQUEST_SCOPE_SIGNAL,
 };
 
+struct landlock_blockers {
+	access_mask_t access;
+	enum landlock_request_type type;
+};
+
+#ifdef CONFIG_TRACEPOINTS
+
+struct landlock_net_trace {
+	const struct sockaddr *address;
+	int addrlen;
+	u16 socket_family;
+};
+
+struct landlock_ptrace_trace {
+	u64 tracee_domain_id;
+	const struct task_struct *tracer;
+};
+
+struct landlock_signal_trace {
+	u64 target_domain_id;
+	int signal;
+};
+
+#endif /* CONFIG_TRACEPOINTS */
+
 /*
  * We should be careful to only use a variable of this type for
  * landlock_log_denial().  This way, the compiler can remove it entirely if
@@ -52,13 +79,24 @@ struct landlock_request {
 	deny_masks_t deny_masks;
 	optional_access_t quiet_optional_accesses;
 
-	/*
-	 * Other-party domain ID for a relational (scope/ptrace) denial, or 0 if
-	 * that party is unsandboxed.  An ID, not a pointer: the other task can
-	 * replace its credential and free the domain it referenced.  Trace path
-	 * only; audit ignores it.
-	 */
-	u64 other_domain_id;
+#ifdef CONFIG_TRACEPOINTS
+	union {
+		/*
+		 * Other-party domain ID for an abstract UNIX socket scope
+		 * denial, or 0 if that party is unsandboxed.  Store an ID, not
+		 * a pointer: the other task can replace its credential and free
+		 * the domain it referenced.
+		 */
+		u64 other_domain_id;
+
+		/* Synchronous context for a network denial. */
+		const struct landlock_net_trace *trace_net;
+		/* Synchronous context for a ptrace denial. */
+		const struct landlock_ptrace_trace *trace_ptrace;
+		/* Synchronous context for a signal denial. */
+		const struct landlock_signal_trace *trace_signal;
+	};
+#endif /* CONFIG_TRACEPOINTS */
 };
 
 #ifdef CONFIG_SECURITY_LANDLOCK_LOG
diff --git a/security/landlock/net.c b/security/landlock/net.c
index 8f2aaac54b33..6fe0dbde3b78 100644
--- a/security/landlock/net.c
+++ b/security/landlock/net.c
@@ -47,7 +47,8 @@ int landlock_append_net_rule(struct landlock_ruleset *const ruleset,
 	 * TP_fast_assign).
 	 */
 	if (!err)
-		trace_landlock_add_rule_net(ruleset, access_rights, port);
+		trace_landlock_add_rule_net_port(ruleset, flags, access_rights,
+						 port);
 	mutex_unlock(&ruleset->lock);
 
 	return err;
@@ -63,7 +64,7 @@ static bool unmask_layers_net(const struct landlock_domain *const domain,
 
 	ret = landlock_unmask_layers(domain, id, masks, &rule);
 	if (rule)
-		trace_landlock_check_rule_net(
+		trace_landlock_check_rule_net_port(
 			domain, rule, access_request,
 			ntohs((__force __be16)id.key.data));
 	return ret;
@@ -92,7 +93,7 @@ static int current_check_access_socket(struct socket *const sock,
 		return 0;
 
 	/* Checks for minimal header length to safely read sa_family. */
-	if (addrlen < offsetofend(typeof(*address), sa_family))
+	if (addrlen < (int)offsetofend(typeof(*address), sa_family))
 		return -EINVAL;
 
 	/*
@@ -144,6 +145,17 @@ static int current_check_access_socket(struct socket *const sock,
 						.audit.u.net = &audit_net,
 						.access = access_request,
 						.layer_masks = &layer_masks,
+#ifdef CONFIG_TRACEPOINTS
+						.trace_net =
+							&(struct landlock_net_trace){
+								.address =
+									address,
+								.addrlen =
+									addrlen,
+								.socket_family =
+									sock_family,
+							},
+#endif /* CONFIG_TRACEPOINTS */
 					});
 				return -EACCES;
 			}
@@ -275,14 +287,22 @@ static int current_check_access_socket(struct socket *const sock,
 
 	audit_net.family = address->sa_family;
 	audit_net.sk = sock->sk;
-	landlock_log_denial(subject,
-			    &(struct landlock_request){
-				    .type = LANDLOCK_REQUEST_NET_ACCESS,
-				    .audit.type = LSM_AUDIT_DATA_NET,
-				    .audit.u.net = &audit_net,
-				    .access = access_request,
-				    .layer_masks = &layer_masks,
-			    });
+	landlock_log_denial(
+		subject, &(struct landlock_request){
+				 .type = LANDLOCK_REQUEST_NET_ACCESS,
+				 .audit.type = LSM_AUDIT_DATA_NET,
+				 .audit.u.net = &audit_net,
+				 .access = access_request,
+				 .layer_masks = &layer_masks,
+#ifdef CONFIG_TRACEPOINTS
+				 .trace_net =
+					 &(struct landlock_net_trace){
+						 .address = address,
+						 .addrlen = addrlen,
+						 .socket_family = sock_family,
+					 },
+#endif /* CONFIG_TRACEPOINTS */
+			 });
 	return -EACCES;
 }
 
diff --git a/security/landlock/ruleset.h b/security/landlock/ruleset.h
index b536fa0425b7..cf77f1806a95 100644
--- a/security/landlock/ruleset.h
+++ b/security/landlock/ruleset.h
@@ -171,9 +171,10 @@ struct landlock_ruleset {
 	 * @version: Counter incremented on each successful
 	 * landlock_add_rule(2), including when it only extends an existing
 	 * rule's access rights.  Used by tracepoints to correlate a domain with
-	 * the exact ruleset state it was created from.  Protected by @lock.
+	 * the exact successful rule history it was created from.  Protected by
+	 * @lock.
 	 */
-	u32 version;
+	u64 version;
 	/**
 	 * @id: Unique identifier for this ruleset, used for tracing.
 	 */
diff --git a/security/landlock/task.c b/security/landlock/task.c
index 4491ce31ae04..d9eae86fc552 100644
--- a/security/landlock/task.c
+++ b/security/landlock/task.c
@@ -88,7 +88,9 @@ static int hook_ptrace_access_check(struct task_struct *const child,
 				    const unsigned int mode)
 {
 	const struct landlock_cred_security *parent_subject;
+#ifdef CONFIG_TRACEPOINTS
 	u64 tracee_domain_id = 0;
+#endif /* CONFIG_TRACEPOINTS */
 	int err;
 
 	/* Quick return for non-landlocked tasks. */
@@ -100,10 +102,10 @@ static int hook_ptrace_access_check(struct task_struct *const child,
 		const struct landlock_domain *const child_dom =
 			landlock_get_task_domain(child);
 		err = domain_ptrace(parent_subject->domain, child_dom);
-#ifdef CONFIG_SECURITY_LANDLOCK_LOG
+#ifdef CONFIG_TRACEPOINTS
 		if (child_dom)
 			tracee_domain_id = child_dom->hierarchy->id;
-#endif /* CONFIG_SECURITY_LANDLOCK_LOG */
+#endif /* CONFIG_TRACEPOINTS */
 	}
 
 	if (!err)
@@ -121,7 +123,12 @@ static int hook_ptrace_access_check(struct task_struct *const child,
 				.u.tsk = child,
 			},
 			.layer_plus_one = parent_subject->domain->num_layers,
-			.other_domain_id = tracee_domain_id,
+#ifdef CONFIG_TRACEPOINTS
+			.trace_ptrace = &(struct landlock_ptrace_trace) {
+				.tracee_domain_id = tracee_domain_id,
+				.tracer = current,
+			},
+#endif /* CONFIG_TRACEPOINTS */
 		});
 
 	return err;
@@ -142,7 +149,6 @@ static int hook_ptrace_traceme(struct task_struct *const parent)
 {
 	const struct landlock_cred_security *parent_subject;
 	const struct landlock_domain *child_dom;
-	u64 tracee_domain_id = 0;
 	int err;
 
 	child_dom = landlock_get_current_domain();
@@ -154,12 +160,6 @@ static int hook_ptrace_traceme(struct task_struct *const parent)
 	if (!err)
 		return 0;
 
-#ifdef CONFIG_SECURITY_LANDLOCK_LOG
-	/* The tracee is the current task; its domain is stable here. */
-	if (child_dom)
-		tracee_domain_id = child_dom->hierarchy->id;
-#endif /* CONFIG_SECURITY_LANDLOCK_LOG */
-
 	/*
 	 * For the ptrace_traceme case, we log the domain which is the cause of
 	 * the denial, which means the parent domain instead of the current
@@ -174,7 +174,13 @@ static int hook_ptrace_traceme(struct task_struct *const parent)
 			.u.tsk = current,
 		},
 		.layer_plus_one = parent_subject->domain->num_layers,
-		.other_domain_id = tracee_domain_id,
+#ifdef CONFIG_TRACEPOINTS
+		.trace_ptrace = &(struct landlock_ptrace_trace) {
+			/* The current task's domain is stable here. */
+			.tracee_domain_id = child_dom ? child_dom->hierarchy->id : 0,
+			.tracer = parent,
+		},
+#endif /* CONFIG_TRACEPOINTS */
 	});
 	return err;
 }
@@ -250,8 +256,7 @@ static bool domain_is_scoped(const struct landlock_domain *const client,
 }
 
 static bool sock_is_scoped(struct sock *const other,
-			   const struct landlock_domain *const domain,
-			   u64 *const peer_domain_id)
+			   const struct landlock_domain *const domain)
 {
 	const struct landlock_domain *dom_other;
 
@@ -269,13 +274,23 @@ static bool sock_is_scoped(struct sock *const other,
 		return false;
 
 	dom_other = landlock_cred(other->sk_socket->file->f_cred)->domain;
-#ifdef CONFIG_SECURITY_LANDLOCK_LOG
-	*peer_domain_id = dom_other ? dom_other->hierarchy->id : 0;
-#endif /* CONFIG_SECURITY_LANDLOCK_LOG */
 	return domain_is_scoped(domain, dom_other,
 				LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET);
 }
 
+#ifdef CONFIG_TRACEPOINTS
+
+static u64 get_socket_domain_id(const struct sock *const other)
+{
+	const struct landlock_domain *domain;
+
+	lockdep_assert_held(&unix_sk(other)->lock);
+	domain = landlock_cred(other->sk_socket->file->f_cred)->domain;
+	return domain ? domain->hierarchy->id : 0;
+}
+
+#endif /* CONFIG_TRACEPOINTS */
+
 static bool is_abstract_socket(struct sock *const sock)
 {
 	struct unix_address *addr = unix_sk(sock)->addr;
@@ -299,7 +314,6 @@ static int hook_unix_stream_connect(struct sock *const sock,
 				    struct sock *const newsk)
 {
 	size_t handle_layer;
-	u64 peer_domain_id = 0;
 	const struct landlock_cred_security *const subject =
 		landlock_get_applicable_subject(current_cred(), unix_scope,
 						&handle_layer);
@@ -311,7 +325,7 @@ static int hook_unix_stream_connect(struct sock *const sock,
 	if (!is_abstract_socket(other))
 		return 0;
 
-	if (!sock_is_scoped(other, subject->domain, &peer_domain_id))
+	if (!sock_is_scoped(other, subject->domain))
 		return 0;
 
 	landlock_log_denial(subject, &(struct landlock_request) {
@@ -323,7 +337,9 @@ static int hook_unix_stream_connect(struct sock *const sock,
 			},
 		},
 		.layer_plus_one = handle_layer + 1,
-		.other_domain_id = peer_domain_id,
+#ifdef CONFIG_TRACEPOINTS
+		.other_domain_id = get_socket_domain_id(other),
+#endif /* CONFIG_TRACEPOINTS */
 	});
 	return -EPERM;
 }
@@ -332,7 +348,6 @@ static int hook_unix_may_send(struct socket *const sock,
 			      struct socket *const other)
 {
 	size_t handle_layer;
-	u64 peer_domain_id = 0;
 	const struct landlock_cred_security *const subject =
 		landlock_get_applicable_subject(current_cred(), unix_scope,
 						&handle_layer);
@@ -350,7 +365,7 @@ static int hook_unix_may_send(struct socket *const sock,
 	if (!is_abstract_socket(other->sk))
 		return 0;
 
-	if (!sock_is_scoped(other->sk, subject->domain, &peer_domain_id))
+	if (!sock_is_scoped(other->sk, subject->domain))
 		return 0;
 
 	landlock_log_denial(subject, &(struct landlock_request) {
@@ -362,7 +377,9 @@ static int hook_unix_may_send(struct socket *const sock,
 			},
 		},
 		.layer_plus_one = handle_layer + 1,
-		.other_domain_id = peer_domain_id,
+#ifdef CONFIG_TRACEPOINTS
+		.other_domain_id = get_socket_domain_id(other->sk),
+#endif /* CONFIG_TRACEPOINTS */
 	});
 	return -EPERM;
 }
@@ -377,7 +394,9 @@ static int hook_task_kill(struct task_struct *const p,
 {
 	bool is_scoped;
 	size_t handle_layer;
+#ifdef CONFIG_TRACEPOINTS
 	u64 target_domain_id = 0;
+#endif /* CONFIG_TRACEPOINTS */
 	const struct landlock_cred_security *subject;
 
 	if (!cred) {
@@ -409,10 +428,10 @@ static int hook_task_kill(struct task_struct *const p,
 
 		is_scoped = domain_is_scoped(subject->domain, other,
 					     signal_scope.scope);
-#ifdef CONFIG_SECURITY_LANDLOCK_LOG
+#ifdef CONFIG_TRACEPOINTS
 		if (other)
 			target_domain_id = other->hierarchy->id;
-#endif /* CONFIG_SECURITY_LANDLOCK_LOG */
+#endif /* CONFIG_TRACEPOINTS */
 	}
 
 	if (!is_scoped)
@@ -425,7 +444,12 @@ static int hook_task_kill(struct task_struct *const p,
 			.u.tsk = p,
 		},
 		.layer_plus_one = handle_layer + 1,
-		.other_domain_id = target_domain_id,
+#ifdef CONFIG_TRACEPOINTS
+		.trace_signal = &(struct landlock_signal_trace) {
+			.target_domain_id = target_domain_id,
+			.signal = sig,
+		},
+#endif /* CONFIG_TRACEPOINTS */
 	});
 	return -EPERM;
 }
@@ -435,7 +459,9 @@ static int hook_file_send_sigiotask(struct task_struct *tsk,
 {
 	const struct landlock_cred_security *subject;
 	bool is_scoped = false;
+#ifdef CONFIG_TRACEPOINTS
 	u64 target_domain_id = 0;
+#endif /* CONFIG_TRACEPOINTS */
 
 	/* Lock already held by send_sigio() and send_sigurg(). */
 	lockdep_assert_held(&fown->lock);
@@ -468,10 +494,10 @@ static int hook_file_send_sigiotask(struct task_struct *tsk,
 
 		is_scoped = domain_is_scoped(subject->domain, other,
 					     signal_scope.scope);
-#ifdef CONFIG_SECURITY_LANDLOCK_LOG
+#ifdef CONFIG_TRACEPOINTS
 		if (other)
 			target_domain_id = other->hierarchy->id;
-#endif /* CONFIG_SECURITY_LANDLOCK_LOG */
+#endif /* CONFIG_TRACEPOINTS */
 	}
 
 	if (!is_scoped)
@@ -486,7 +512,12 @@ static int hook_file_send_sigiotask(struct task_struct *tsk,
 #ifdef CONFIG_SECURITY_LANDLOCK_LOG
 		.layer_plus_one = landlock_file(fown->file)->fown_layer + 1,
 #endif /* CONFIG_SECURITY_LANDLOCK_LOG */
-		.other_domain_id = target_domain_id,
+#ifdef CONFIG_TRACEPOINTS
+		.trace_signal = &(struct landlock_signal_trace) {
+			.target_domain_id = target_domain_id,
+			.signal = signum ? signum : SIGIO,
+		},
+#endif /* CONFIG_TRACEPOINTS */
 	});
 	return -EPERM;
 }
diff --git a/security/landlock/trace.c b/security/landlock/trace.c
index 8c21e5de6f0d..225dbf37bab0 100644
--- a/security/landlock/trace.c
+++ b/security/landlock/trace.c
@@ -12,6 +12,7 @@
 #include <linux/err.h>
 #include <linux/fs.h>
 #include <linux/lsm_audit.h>
+#include <linux/socket.h>
 #include <net/sock.h>
 
 #include "access.h"
@@ -61,8 +62,8 @@ void landlock_trace_free_domain(const struct landlock_hierarchy *const hierarchy
  *
  * @request: Detail of the user space request.
  * @youngest_denied: The youngest hierarchy node that denied the access.
- * @missing: The set of denied access rights.
- * @same_exec: Whether the current task is the same executable that called
+ * @missing: The final missing access subset, when applicable.
+ * @same_exec: Whether the policy subject is the same executable that called
  *             landlock_restrict_self() for the denying domain, as computed
  *             by landlock_log_denial().
  * @logged: Whether the domain's policy selects this denial for logging, as
@@ -83,6 +84,10 @@ void landlock_trace_denial(
 	case LANDLOCK_REQUEST_FS_ACCESS:
 	case LANDLOCK_REQUEST_FS_CHANGE_TOPOLOGY:
 		if (trace_landlock_deny_access_fs_enabled()) {
+			const struct landlock_blockers blockers = {
+				.access = missing,
+				.type = request->type,
+			};
 			char *buf __free(__putname) = __getname();
 			struct path dentry_path;
 			const char *pathname;
@@ -147,29 +152,67 @@ void landlock_trace_denial(
 
 			trace_landlock_deny_access_fs(youngest_denied,
 						      same_exec, logged,
-						      missing, path, pathname);
+						      &blockers, path,
+						      pathname);
 		}
 		break;
 	case LANDLOCK_REQUEST_NET_ACCESS:
-		if (trace_landlock_deny_access_net_enabled())
+		if (trace_landlock_deny_access_net_enabled()) {
+			const struct landlock_net_trace *const trace_net =
+				request->trace_net;
+			const struct landlock_blockers blockers = {
+				.access = missing,
+				.type = request->type,
+			};
+			struct sockaddr_storage address = {};
+
+			if (WARN_ON_ONCE(!trace_net || !trace_net->address))
+				return;
+
+			if (WARN_ON_ONCE(
+				    trace_net->addrlen <
+					    (int)offsetofend(struct sockaddr,
+							     sa_family) ||
+				    trace_net->addrlen > (int)sizeof(address)))
+				return;
+
+			memcpy(&address, trace_net->address,
+			       trace_net->addrlen);
 			trace_landlock_deny_access_net(
-				youngest_denied, same_exec, logged, missing,
+				youngest_denied, same_exec, logged, &blockers,
 				request->audit.u.net->sk,
-				ntohs(request->audit.u.net->sport),
-				ntohs(request->audit.u.net->dport));
+				trace_net->socket_family, &address,
+				trace_net->addrlen);
+		}
 		break;
 	case LANDLOCK_REQUEST_PTRACE:
-		if (trace_landlock_deny_ptrace_enabled())
-			trace_landlock_deny_ptrace(youngest_denied, same_exec,
-						   logged,
-						   request->other_domain_id,
-						   request->audit.u.tsk);
+		if (trace_landlock_deny_ptrace_enabled()) {
+			const struct landlock_ptrace_trace *const trace_ptrace =
+				request->trace_ptrace;
+
+			if (WARN_ON_ONCE(!trace_ptrace ||
+					 !trace_ptrace->tracer))
+				return;
+
+			trace_landlock_deny_ptrace(
+				youngest_denied, same_exec, logged,
+				trace_ptrace->tracee_domain_id,
+				request->audit.u.tsk, trace_ptrace->tracer);
+		}
 		break;
 	case LANDLOCK_REQUEST_SCOPE_SIGNAL:
-		if (trace_landlock_deny_scope_signal_enabled())
+		if (trace_landlock_deny_scope_signal_enabled()) {
+			const struct landlock_signal_trace *const trace_signal =
+				request->trace_signal;
+
+			if (WARN_ON_ONCE(!trace_signal))
+				return;
+
 			trace_landlock_deny_scope_signal(
 				youngest_denied, same_exec, logged,
-				request->other_domain_id, request->audit.u.tsk);
+				trace_signal->target_domain_id,
+				request->audit.u.tsk, trace_signal->signal);
+		}
 		break;
 	case LANDLOCK_REQUEST_SCOPE_ABSTRACT_UNIX_SOCKET:
 		if (trace_landlock_deny_scope_abstract_unix_socket_enabled())