Re: [LTP] [PATCH v4 7/7] Add lsm_set_self_attr01 test

[Petr Vorel <pvorel@suse.cz>]

Hi Andrea, all,

> Verify that lsm_set_self_attr syscall is raising errors when invalid
> data is provided.

...
> diff --git a/testcases/kernel/syscalls/lsm/lsm_set_self_attr01.c b/testcases/kernel/syscalls/lsm/lsm_set_self_attr01.c
> new file mode 100644
> index 0000000000000000000000000000000000000000..caccdda7ecf2edaac1fa8e2dc2ccdd0aff020804
> --- /dev/null
> +++ b/testcases/kernel/syscalls/lsm/lsm_set_self_attr01.c
> @@ -0,0 +1,110 @@
> +// SPDX-License-Identifier: GPL-2.0-or-later
> +/*
> + * Copyright (C) 2024 SUSE LLC Andrea Cervesato <andrea.cervesato@suse.com>
> + */
> +
> +/*\
> + * Verify that lsm_set_self_attr syscall is raising errors when invalid data is
> + * provided.
> + */
> +
> +#include "lsm_common.h"
> +
> +static struct lsm_ctx *ctx;
> +static struct lsm_ctx *ctx_orig;
> +static struct lsm_ctx *ctx_null;
> +static uint32_t ctx_size;
> +static uint32_t ctx_size_small;
> +static uint32_t ctx_size_big;
> +static uint32_t page_size;
> +
> +static struct tcase {
> +	uint32_t attr;
> +	struct lsm_ctx **ctx;
> +	uint32_t *size;
> +	uint32_t flags;
> +	int exp_errno;
> +	char *msg;
> +} tcases[] = {
> +	{
> +		.attr = LSM_ATTR_CURRENT,
> +		.ctx = &ctx_null,
> +		.size = &ctx_size,
> +		.exp_errno = EFAULT,
> +		.msg = "ctx is NULL",
> +	},
> +	{
> +		.attr = LSM_ATTR_CURRENT,
> +		.ctx = &ctx,
> +		.size = &ctx_size_small,
> +		.exp_errno = EINVAL,
> +		.msg = "size is too small",
> +	},
> +	{
> +		.attr = LSM_ATTR_CURRENT,
> +		.ctx = &ctx,
> +		.size = &ctx_size_big,
> +		.exp_errno = E2BIG,
> +		.msg = "size is too big",
> +	},
> +	{
> +		.attr = LSM_ATTR_CURRENT,
> +		.ctx = &ctx,
> +		.size = &ctx_size,
> +		.flags = 1,
> +		.exp_errno = EINVAL,
> +		.msg = "flags must be zero",
> +	},
> +	{
> +		.attr = LSM_ATTR_CURRENT | LSM_ATTR_EXEC,
> +		.ctx = &ctx,
> +		.size = &ctx_size,
> +		.exp_errno = EINVAL,
> +		.msg = "attr is overset",

FYI The test fails on this check on current Tumbleweed with new
6.15.0-1-default. It worked on 6.14.

Looking at 6.15 landlock related changes (added Landlock audit support and
Landlock signal scope fixes) test might needs to be updated.
https://kernelnewbies.org/Linux_6.15#Security

@Andrea could you please have a look?

Kind regards,
Petr