Re: [PATCH v4 5/8] selftests/landlock: Add namespace restriction tests

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] selftests/landlock: Data truncation of 64-bit namespace flags in audit log string matching
--

commit 5fd29f953c165adc6df65241e36e43cef7dbf0ae
Author: Mickaël Salaün <mic@digikod.net>

selftests/landlock: Add namespace restriction tests

This commit adds extensive tests for the LANDLOCK_PERMISSION_NAMESPACE_USE
restriction, covering namespace creation and entry. It includes rule
validation, forward compatibility checks, layer stacking, and audit logging.

Link: https://patch.msgid.link/20260726161400.3010511-10-mic@digikod.net

> diff --git a/tools/testing/selftests/landlock/ns_test.c b/tools/testing/selftests/landlock/ns_test.c
> new file mode 100644
> index 0000000000000..6faafc110844d
> --- /dev/null
> +++ b/tools/testing/selftests/landlock/ns_test.c

[ ... ]

> +static int matches_log_ns_create(int audit_fd, __u64 ns_type)
> +{
> +	static const char log_template[] = REGEX_LANDLOCK_PREFIX
> +		" blockers=namespace\\.use namespace_type=0x%x namespace_id=0$";
> +	char log_match[sizeof(log_template) + 10];
> +	int log_match_len;
> +
> +	log_match_len = snprintf(log_match, sizeof(log_match), log_template,
> +				 (unsigned int)ns_type);

[Severity: Low]
Does this format string risk truncating the ns_type value? The ns_type
parameter is a 64-bit __u64, but it is explicitly cast to unsigned int
and formatted with %x. If a namespace flag exceeding 32 bits is ever
tested, the upper 32 bits will be truncated, producing an incorrect audit
log match string and causing test failures.

> +	if (log_match_len >= sizeof(log_match))
> +		return -E2BIG;
> +
> +	return audit_match_record(audit_fd, AUDIT_LANDLOCK_ACCESS, log_match,
> +				  NULL);
> +}
> +
> +static int matches_log_ns_setns(int audit_fd, __u64 ns_type, __u64 ns_id)
> +{
> +	static const char log_template[] = REGEX_LANDLOCK_PREFIX
> +		" blockers=namespace\\.use namespace_type=0x%x namespace_id=%llu$";
> +	char log_match[sizeof(log_template) + 32];
> +	int log_match_len;
> +
> +	log_match_len = snprintf(log_match, sizeof(log_match), log_template,
> +				 (unsigned int)ns_type,
> +				 (unsigned long long)ns_id);

[Severity: Low]
This seems to have the same truncation issue as matches_log_ns_create()
above. The 64-bit ns_type parameter is cast to a 32-bit unsigned int and
formatted with %x, which will drop the upper 32 bits.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261002124409.1277970-1-mic@digikod.net?part=5