From: Paul Moore <paul@paul-moore.com>
To: "Mickaël Salaün" <mic@digikod.net>
Cc: "Mickaël Salaün" <mic@digikod.net>,
"Günther Noack" <gnoack@google.com>,
"Jeff Vander Stoep" <jeffv@google.com>,
"Nick Kralevich" <nnk@google.com>,
"Ondrej Mosnacek" <omosnace@redhat.com>,
"Serge E . Hallyn" <serge@hallyn.com>,
"Stephen Smalley" <stephen.smalley.work@gmail.com>,
audit@vger.kernel.org, kernel-team@cloudflare.com,
linux-kernel@vger.kernel.org,
linux-security-module@vger.kernel.org, selinux@vger.kernel.org
Subject: Re: [PATCH v1 2/2] selftests/landlock: Check full ioctl commands in audit records
Date: Mon, 14 Sep 2026 16:41:52 -0400 [thread overview]
Message-ID: <506803b6b6c4a74551bc5c0d6e31cf71@paul-moore.com> (raw)
In-Reply-To: <20260910144837.381855-3-mic@digikod.net>
On Sep 10, 2026 =?UTF-8?q?Micka=C3=ABl=20Sala=C3=BCn?= <mic@digikod.net> wrote:
>
> The ioctl audit test uses FIONREAD, whose command value fits in 16 bits.
> It therefore cannot detect truncation of encoded direction and size
> bits.
>
> Use an architecture-independent unknown command with set upper bits and
> require its complete value in the audit record. Landlock rejects the
> command before the device handles it, and the existing ioctl enforcement
> test already exercises the same request. The new expectation fails with
> ioctlcmd=0xfeee on an unfixed kernel and passes with ioctlcmd=0xc00ffeee
> after the shared audit field is widened.
>
> Signed-off-by: Mickaël Salaün <mic@digikod.net>
> Reviewed-by: Günther Noack <gnoack@google.com>
> ---
> tools/testing/selftests/landlock/fs_test.c | 10 +++++++---
> 1 file changed, 7 insertions(+), 3 deletions(-)
Merged into lsm/dev, thanks.
--
paul-moore.com
prev parent reply other threads:[~2026-09-14 20:41 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-10 14:48 [PATCH v1 0/2] lsm: Preserve full ioctl commands in audit records Mickaël Salaün
2026-09-10 14:48 ` [PATCH v1 1/2] " Mickaël Salaün
2026-09-10 14:56 ` sashiko-bot
2026-09-14 20:41 ` Paul Moore
2026-09-10 14:48 ` [PATCH v1 2/2] selftests/landlock: Check " Mickaël Salaün
2026-09-10 15:02 ` sashiko-bot
2026-09-11 11:24 ` Günther Noack
2026-09-14 20:41 ` Paul Moore [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=506803b6b6c4a74551bc5c0d6e31cf71@paul-moore.com \
--to=paul@paul-moore.com \
--cc=audit@vger.kernel.org \
--cc=gnoack@google.com \
--cc=jeffv@google.com \
--cc=kernel-team@cloudflare.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=mic@digikod.net \
--cc=nnk@google.com \
--cc=omosnace@redhat.com \
--cc=selinux@vger.kernel.org \
--cc=serge@hallyn.com \
--cc=stephen.smalley.work@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.