Re: [PATCH v4 5/8] selftests/landlock: Add namespace restriction tests

["Mickaël Salaün" <mic@digikod.net>]

On Fri, Oct 02, 2026 at 12:56:28PM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Low] selftests/landlock: Data truncation of 64-bit namespace flags in audit log string matching
> --
> 
> commit 5fd29f953c165adc6df65241e36e43cef7dbf0ae
> Author: Mickaël Salaün <mic@digikod.net>
> 
> selftests/landlock: Add namespace restriction tests
> 
> This commit adds extensive tests for the LANDLOCK_PERMISSION_NAMESPACE_USE
> restriction, covering namespace creation and entry. It includes rule
> validation, forward compatibility checks, layer stacking, and audit logging.
> 
> Link: https://patch.msgid.link/20260726161400.3010511-10-mic@digikod.net
> 
> > diff --git a/tools/testing/selftests/landlock/ns_test.c b/tools/testing/selftests/landlock/ns_test.c
> > new file mode 100644
> > index 0000000000000..6faafc110844d
> > --- /dev/null
> > +++ b/tools/testing/selftests/landlock/ns_test.c
> 
> [ ... ]
> 
> > +static int matches_log_ns_create(int audit_fd, __u64 ns_type)
> > +{
> > +	static const char log_template[] = REGEX_LANDLOCK_PREFIX
> > +		" blockers=namespace\\.use namespace_type=0x%x namespace_id=0$";
> > +	char log_match[sizeof(log_template) + 10];
> > +	int log_match_len;
> > +
> > +	log_match_len = snprintf(log_match, sizeof(log_match), log_template,
> > +				 (unsigned int)ns_type);
> 
> [Severity: Low]
> Does this format string risk truncating the ns_type value? The ns_type
> parameter is a 64-bit __u64, but it is explicitly cast to unsigned int
> and formatted with %x. If a namespace flag exceeding 32 bits is ever
> tested, the upper 32 bits will be truncated, producing an incorrect audit
> log match string and causing test failures.

The cast is intentional and doe snot truncate an emitted audit value
(which is 32-bit).

> 
> > +	if (log_match_len >= sizeof(log_match))
> > +		return -E2BIG;
> > +
> > +	return audit_match_record(audit_fd, AUDIT_LANDLOCK_ACCESS, log_match,
> > +				  NULL);
> > +}
> > +
> > +static int matches_log_ns_setns(int audit_fd, __u64 ns_type, __u64 ns_id)
> > +{
> > +	static const char log_template[] = REGEX_LANDLOCK_PREFIX
> > +		" blockers=namespace\\.use namespace_type=0x%x namespace_id=%llu$";
> > +	char log_match[sizeof(log_template) + 32];
> > +	int log_match_len;
> > +
> > +	log_match_len = snprintf(log_match, sizeof(log_match), log_template,
> > +				 (unsigned int)ns_type,
> > +				 (unsigned long long)ns_id);
> 
> [Severity: Low]
> This seems to have the same truncation issue as matches_log_ns_create()
> above. The 64-bit ns_type parameter is cast to a 32-bit unsigned int and
> formatted with %x, which will drop the upper 32 bits.

No issue here as well.

> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/20261002124409.1277970-1-mic@digikod.net?part=5
>