* [LTP] [PATCH 1/5] Fallback landlock network support
2024-09-19 10:23 [LTP] [PATCH 0/5] landlock network coverage support Andrea Cervesato
@ 2024-09-19 10:23 ` Andrea Cervesato
2024-10-23 14:37 ` Cyril Hrubis
2024-09-19 10:23 ` [LTP] [PATCH 2/5] Network helpers in landlock suite common functions Andrea Cervesato
` (3 subsequent siblings)
4 siblings, 1 reply; 7+ messages in thread
From: Andrea Cervesato @ 2024-09-19 10:23 UTC (permalink / raw)
To: ltp
From: Andrea Cervesato <andrea.cervesato@suse.com>
Landlock network support has been added in the ABI v4, adding features
for bind() and connect() syscalls. It also defined one more member in
the landlock_ruleset_attr struct, breaking our LTP fallbacks, used to
build landlock testing suite. For this reason, we introduce a
tst_landlock_ruleset_attr struct that wraps the base struct definition
and it adds the handled_access_net member.
This struct is then passed to the SAFE_LANDLOCK_CREATE_RULESET in order
to create our ruleset.
Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
configure.ac | 1 -
include/lapi/landlock.h | 39 +++++++++++++++-------
testcases/kernel/syscalls/landlock/landlock01.c | 18 +++++-----
testcases/kernel/syscalls/landlock/landlock02.c | 10 +++---
testcases/kernel/syscalls/landlock/landlock03.c | 8 ++---
testcases/kernel/syscalls/landlock/landlock04.c | 8 ++---
testcases/kernel/syscalls/landlock/landlock05.c | 8 ++---
testcases/kernel/syscalls/landlock/landlock06.c | 8 ++---
testcases/kernel/syscalls/landlock/landlock07.c | 8 ++---
.../kernel/syscalls/landlock/landlock_common.h | 4 +--
10 files changed, 63 insertions(+), 49 deletions(-)
diff --git a/configure.ac b/configure.ac
index ebbf49e28..52860ecdc 100644
--- a/configure.ac
+++ b/configure.ac
@@ -172,7 +172,6 @@ AC_CHECK_MEMBERS([struct utsname.domainname],,,[
])
AC_CHECK_TYPES([enum kcmp_type],,,[#include <linux/kcmp.h>])
-AC_CHECK_TYPES([enum landlock_rule_type],,,[#include <linux/landlock.h>])
AC_CHECK_TYPES([struct acct_v3],,,[#include <sys/acct.h>])
AC_CHECK_TYPES([struct af_alg_iv, struct sockaddr_alg],,,[# include <linux/if_alg.h>])
AC_CHECK_TYPES([struct fanotify_event_info_fid, struct fanotify_event_info_error,
diff --git a/include/lapi/landlock.h b/include/lapi/landlock.h
index 211d171eb..326e9c7b6 100644
--- a/include/lapi/landlock.h
+++ b/include/lapi/landlock.h
@@ -7,6 +7,7 @@
#define LAPI_LANDLOCK_H__
#include "config.h"
+#include <stdint.h>
#ifdef HAVE_LINUX_LANDLOCK_H
# include <linux/landlock.h>
@@ -14,13 +15,27 @@
#include "lapi/syscalls.h"
-#ifndef HAVE_STRUCT_LANDLOCK_RULESET_ATTR
-struct landlock_ruleset_attr
+/*
+ * This is a complete fallback struct for the landlock_ruleset_attr struct
+ */
+struct tst_landlock_ruleset_attr_fallback
{
uint64_t handled_access_fs;
uint64_t handled_access_net;
};
-#endif
+
+struct tst_landlock_ruleset_attr
+{
+ union {
+#if !defined(HAVE_STRUCT_LANDLOCK_RULESET_ATTR) || \
+ !defined(HAVE_STRUCT_LANDLOCK_RULESET_ATTR_HANDLED_ACCESS_NET)
+ struct tst_landlock_ruleset_attr_fallback base;
+#else
+ struct landlock_ruleset_attr base;
+#endif
+ struct tst_landlock_ruleset_attr_fallback data;
+ };
+};
#ifndef HAVE_STRUCT_LANDLOCK_PATH_BENEATH_ATTR
struct landlock_path_beneath_attr
@@ -30,12 +45,12 @@ struct landlock_path_beneath_attr
} __attribute__((packed));
#endif
-#ifndef HAVE_ENUM_LANDLOCK_RULE_TYPE
-enum landlock_rule_type
-{
- LANDLOCK_RULE_PATH_BENEATH = 1,
- LANDLOCK_RULE_NET_PORT,
-};
+#ifndef LANDLOCK_RULE_PATH_BENEATH
+# define LANDLOCK_RULE_PATH_BENEATH 1
+#endif
+
+#ifndef LANDLOCK_RULE_NET_PORT
+# define LANDLOCK_RULE_NET_PORT 2
#endif
#ifndef HAVE_STRUCT_LANDLOCK_NET_PORT_ATTR
@@ -123,12 +138,12 @@ struct landlock_net_port_attr
#endif
static inline int safe_landlock_create_ruleset(const char *file, const int lineno,
- const struct landlock_ruleset_attr *attr,
+ const struct tst_landlock_ruleset_attr *attr,
size_t size , uint32_t flags)
{
int rval;
- rval = tst_syscall(__NR_landlock_create_ruleset, attr, size, flags);
+ rval = tst_syscall(__NR_landlock_create_ruleset, &attr->base, size, flags);
if (rval == -1) {
tst_brk_(file, lineno, TBROK | TERRNO,
"landlock_create_ruleset(%p, %zi, %u)",
@@ -143,7 +158,7 @@ static inline int safe_landlock_create_ruleset(const char *file, const int linen
}
static inline int safe_landlock_add_rule(const char *file, const int lineno,
- int ruleset_fd, enum landlock_rule_type rule_type,
+ int ruleset_fd, int rule_type,
const void *rule_attr, uint32_t flags)
{
int rval;
diff --git a/testcases/kernel/syscalls/landlock/landlock01.c b/testcases/kernel/syscalls/landlock/landlock01.c
index 083685c64..7f767c007 100644
--- a/testcases/kernel/syscalls/landlock/landlock01.c
+++ b/testcases/kernel/syscalls/landlock/landlock01.c
@@ -17,14 +17,14 @@
#include "landlock_common.h"
-static struct landlock_ruleset_attr *ruleset_attr;
-static struct landlock_ruleset_attr *null_attr;
+static struct tst_landlock_ruleset_attr *ruleset_attr;
+static struct tst_landlock_ruleset_attr *null_attr;
static size_t rule_size;
static size_t rule_small_size;
static size_t rule_big_size;
static struct tcase {
- struct landlock_ruleset_attr **attr;
+ struct tst_landlock_ruleset_attr **attr;
uint64_t access_fs;
size_t *size;
uint32_t flags;
@@ -44,10 +44,10 @@ static void run(unsigned int n)
struct tcase *tc = &tcases[n];
if (*tc->attr)
- (*tc->attr)->handled_access_fs = tc->access_fs;
+ (*tc->attr)->base.handled_access_fs = tc->access_fs;
TST_EXP_FAIL(tst_syscall(__NR_landlock_create_ruleset,
- *tc->attr, *tc->size, tc->flags),
+ &(*tc->attr)->base, *tc->size, tc->flags),
tc->exp_errno,
"%s",
tc->msg);
@@ -60,12 +60,12 @@ static void setup(void)
{
verify_landlock_is_enabled();
- rule_size = sizeof(struct landlock_ruleset_attr);
+ rule_size = sizeof(struct tst_landlock_ruleset_attr);
#ifdef HAVE_STRUCT_LANDLOCK_RULESET_ATTR_HANDLED_ACCESS_NET
- rule_small_size = rule_size - sizeof(uint64_t) - 1;
+ rule_small_size = rule_size - 2*sizeof(uint64_t) - 1;
#else
- rule_small_size = rule_size - 1;
+ rule_small_size = rule_size - sizeof(uint64_t) - 1;
#endif
rule_big_size = SAFE_SYSCONF(_SC_PAGESIZE) + 1;
@@ -77,7 +77,7 @@ static struct tst_test test = {
.setup = setup,
.needs_root = 1,
.bufs = (struct tst_buffers []) {
- {&ruleset_attr, .size = sizeof(struct landlock_ruleset_attr)},
+ {&ruleset_attr, .size = sizeof(struct tst_landlock_ruleset_attr)},
{},
},
.caps = (struct tst_cap []) {
diff --git a/testcases/kernel/syscalls/landlock/landlock02.c b/testcases/kernel/syscalls/landlock/landlock02.c
index 1a3df69c9..bdef57b55 100644
--- a/testcases/kernel/syscalls/landlock/landlock02.c
+++ b/testcases/kernel/syscalls/landlock/landlock02.c
@@ -20,7 +20,7 @@
#include "landlock_common.h"
-static struct landlock_ruleset_attr *ruleset_attr;
+static struct tst_landlock_ruleset_attr *ruleset_attr;
static struct landlock_path_beneath_attr *path_beneath_attr;
static struct landlock_path_beneath_attr *rule_null;
static int ruleset_fd;
@@ -28,7 +28,7 @@ static int invalid_fd = -1;
static struct tcase {
int *fd;
- enum landlock_rule_type rule_type;
+ int rule_type;
struct landlock_path_beneath_attr **attr;
int access;
int parent_fd;
@@ -103,10 +103,10 @@ static void setup(void)
{
verify_landlock_is_enabled();
- ruleset_attr->handled_access_fs = LANDLOCK_ACCESS_FS_EXECUTE;
+ ruleset_attr->base.handled_access_fs = LANDLOCK_ACCESS_FS_EXECUTE;
ruleset_fd = TST_EXP_FD_SILENT(tst_syscall(__NR_landlock_create_ruleset,
- ruleset_attr, sizeof(struct landlock_ruleset_attr), 0));
+ &ruleset_attr->base, sizeof(struct tst_landlock_ruleset_attr), 0));
}
static void cleanup(void)
@@ -122,7 +122,7 @@ static struct tst_test test = {
.cleanup = cleanup,
.needs_root = 1,
.bufs = (struct tst_buffers []) {
- {&ruleset_attr, .size = sizeof(struct landlock_ruleset_attr)},
+ {&ruleset_attr, .size = sizeof(struct tst_landlock_ruleset_attr)},
{&path_beneath_attr, .size = sizeof(struct landlock_path_beneath_attr)},
{},
},
diff --git a/testcases/kernel/syscalls/landlock/landlock03.c b/testcases/kernel/syscalls/landlock/landlock03.c
index 224482255..15ed9bca0 100644
--- a/testcases/kernel/syscalls/landlock/landlock03.c
+++ b/testcases/kernel/syscalls/landlock/landlock03.c
@@ -21,7 +21,7 @@
#define MAX_STACKED_RULESETS 16
-static struct landlock_ruleset_attr *ruleset_attr;
+static struct tst_landlock_ruleset_attr *ruleset_attr;
static int ruleset_fd = -1;
static int ruleset_invalid = -1;
static int file_fd = -1;
@@ -86,10 +86,10 @@ static void setup(void)
{
verify_landlock_is_enabled();
- ruleset_attr->handled_access_fs = LANDLOCK_ACCESS_FS_EXECUTE;
+ ruleset_attr->base.handled_access_fs = LANDLOCK_ACCESS_FS_EXECUTE;
ruleset_fd = TST_EXP_FD_SILENT(tst_syscall(__NR_landlock_create_ruleset,
- ruleset_attr, sizeof(struct landlock_ruleset_attr), 0));
+ &ruleset_attr->base, sizeof(struct tst_landlock_ruleset_attr), 0));
file_fd = SAFE_OPEN("junk.bin", O_CREAT, 0777);
}
@@ -112,7 +112,7 @@ static struct tst_test test = {
.needs_root = 1,
.forks_child = 1,
.bufs = (struct tst_buffers []) {
- {&ruleset_attr, .size = sizeof(struct landlock_ruleset_attr)},
+ {&ruleset_attr, .size = sizeof(struct tst_landlock_ruleset_attr)},
{},
},
.caps = (struct tst_cap []) {
diff --git a/testcases/kernel/syscalls/landlock/landlock04.c b/testcases/kernel/syscalls/landlock/landlock04.c
index e9dedd450..c0644f4d6 100644
--- a/testcases/kernel/syscalls/landlock/landlock04.c
+++ b/testcases/kernel/syscalls/landlock/landlock04.c
@@ -15,7 +15,7 @@
#include "landlock_tester.h"
#include "tst_safe_stdio.h"
-static struct landlock_ruleset_attr *ruleset_attr;
+static struct tst_landlock_ruleset_attr *ruleset_attr;
static struct landlock_path_beneath_attr *path_beneath_attr;
static int ruleset_fd = -1;
@@ -150,10 +150,10 @@ static void setup(void)
tst_res(TINFO, "Testing %s", variant.desc);
- ruleset_attr->handled_access_fs = tester_get_all_fs_rules();
+ ruleset_attr->data.handled_access_fs = tester_get_all_fs_rules();
ruleset_fd = SAFE_LANDLOCK_CREATE_RULESET(
- ruleset_attr, sizeof(struct landlock_ruleset_attr), 0);
+ ruleset_attr, sizeof(struct tst_landlock_ruleset_attr), 0);
/* since our binary is dynamically linked, we need to enable dependences
* to be read and executed
@@ -192,7 +192,7 @@ static struct tst_test test = {
NULL,
},
.bufs = (struct tst_buffers []) {
- {&ruleset_attr, .size = sizeof(struct landlock_ruleset_attr)},
+ {&ruleset_attr, .size = sizeof(struct tst_landlock_ruleset_attr)},
{&path_beneath_attr, .size = sizeof(struct landlock_path_beneath_attr)},
{},
},
diff --git a/testcases/kernel/syscalls/landlock/landlock05.c b/testcases/kernel/syscalls/landlock/landlock05.c
index 703f7d81c..4efe19eb5 100644
--- a/testcases/kernel/syscalls/landlock/landlock05.c
+++ b/testcases/kernel/syscalls/landlock/landlock05.c
@@ -28,7 +28,7 @@
#define FILENAME2 DIR2"/file"
#define FILENAME3 DIR3"/file"
-static struct landlock_ruleset_attr *ruleset_attr;
+static struct tst_landlock_ruleset_attr *ruleset_attr;
static struct landlock_path_beneath_attr *path_beneath_attr;
static void run(void)
@@ -62,13 +62,13 @@ static void setup(void)
tst_res(TINFO, "Applying LANDLOCK_ACCESS_FS_REFER");
- ruleset_attr->handled_access_fs =
+ ruleset_attr->data.handled_access_fs =
LANDLOCK_ACCESS_FS_READ_FILE |
LANDLOCK_ACCESS_FS_WRITE_FILE |
LANDLOCK_ACCESS_FS_REFER;
ruleset_fd = SAFE_LANDLOCK_CREATE_RULESET(
- ruleset_attr, sizeof(struct landlock_ruleset_attr), 0);
+ ruleset_attr, sizeof(struct tst_landlock_ruleset_attr), 0);
apply_landlock_rule(
path_beneath_attr,
@@ -93,7 +93,7 @@ static struct tst_test test = {
.needs_root = 1,
.forks_child = 1,
.bufs = (struct tst_buffers []) {
- {&ruleset_attr, .size = sizeof(struct landlock_ruleset_attr)},
+ {&ruleset_attr, .size = sizeof(struct tst_landlock_ruleset_attr)},
{&path_beneath_attr, .size = sizeof(struct landlock_path_beneath_attr)},
{},
},
diff --git a/testcases/kernel/syscalls/landlock/landlock06.c b/testcases/kernel/syscalls/landlock/landlock06.c
index 1a6e59241..39e0856e3 100644
--- a/testcases/kernel/syscalls/landlock/landlock06.c
+++ b/testcases/kernel/syscalls/landlock/landlock06.c
@@ -18,7 +18,7 @@
#define MNTPOINT "sandbox"
#define FILENAME MNTPOINT"/fifo"
-static struct landlock_ruleset_attr *ruleset_attr;
+static struct tst_landlock_ruleset_attr *ruleset_attr;
static struct landlock_path_beneath_attr *path_beneath_attr;
static int file_fd = -1;
static int dev_fd = -1;
@@ -54,10 +54,10 @@ static void setup(void)
tst_res(TINFO, "Applying LANDLOCK_ACCESS_FS_IOCTL_DEV");
- ruleset_attr->handled_access_fs = LANDLOCK_ACCESS_FS_IOCTL_DEV;
+ ruleset_attr->data.handled_access_fs = LANDLOCK_ACCESS_FS_IOCTL_DEV;
ruleset_fd = SAFE_LANDLOCK_CREATE_RULESET(
- ruleset_attr, sizeof(struct landlock_ruleset_attr), 0);
+ ruleset_attr, sizeof(struct tst_landlock_ruleset_attr), 0);
apply_landlock_layer(
ruleset_attr,
@@ -85,7 +85,7 @@ static struct tst_test test = {
.needs_root = 1,
.forks_child = 1,
.bufs = (struct tst_buffers []) {
- {&ruleset_attr, .size = sizeof(struct landlock_ruleset_attr)},
+ {&ruleset_attr, .size = sizeof(struct tst_landlock_ruleset_attr)},
{&path_beneath_attr, .size = sizeof(struct landlock_path_beneath_attr)},
{},
},
diff --git a/testcases/kernel/syscalls/landlock/landlock07.c b/testcases/kernel/syscalls/landlock/landlock07.c
index 6115ad538..bb9f22df7 100644
--- a/testcases/kernel/syscalls/landlock/landlock07.c
+++ b/testcases/kernel/syscalls/landlock/landlock07.c
@@ -25,7 +25,7 @@
#include "lapi/prctl.h"
#include "landlock_common.h"
-static struct landlock_ruleset_attr *ruleset_attr;
+static struct tst_landlock_ruleset_attr *ruleset_attr;
static int ruleset_fd;
static pid_t spawn_houdini(void)
@@ -74,10 +74,10 @@ static void setup(void)
{
verify_landlock_is_enabled();
- ruleset_attr->handled_access_fs = LANDLOCK_ACCESS_FS_WRITE_FILE;
+ ruleset_attr->data.handled_access_fs = LANDLOCK_ACCESS_FS_WRITE_FILE;
ruleset_fd = SAFE_LANDLOCK_CREATE_RULESET(
ruleset_attr,
- sizeof(struct landlock_ruleset_attr),
+ sizeof(struct tst_landlock_ruleset_attr),
0);
}
@@ -93,7 +93,7 @@ static struct tst_test test = {
.cleanup = cleanup,
.forks_child = 1,
.bufs = (struct tst_buffers []) {
- {&ruleset_attr, .size = sizeof(struct landlock_ruleset_attr)},
+ {&ruleset_attr, .size = sizeof(struct tst_landlock_ruleset_attr)},
{},
},
.caps = (struct tst_cap []) {
diff --git a/testcases/kernel/syscalls/landlock/landlock_common.h b/testcases/kernel/syscalls/landlock/landlock_common.h
index da91daeab..c0bf88e4c 100644
--- a/testcases/kernel/syscalls/landlock/landlock_common.h
+++ b/testcases/kernel/syscalls/landlock/landlock_common.h
@@ -58,7 +58,7 @@ static inline void enforce_ruleset(const int ruleset_fd)
}
static inline void apply_landlock_layer(
- struct landlock_ruleset_attr *ruleset_attr,
+ struct tst_landlock_ruleset_attr *ruleset_attr,
struct landlock_path_beneath_attr *path_beneath_attr,
const char *path,
const int access)
@@ -66,7 +66,7 @@ static inline void apply_landlock_layer(
int ruleset_fd;
ruleset_fd = SAFE_LANDLOCK_CREATE_RULESET(
- ruleset_attr, sizeof(struct landlock_ruleset_attr), 0);
+ ruleset_attr, sizeof(struct tst_landlock_ruleset_attr), 0);
apply_landlock_rule(path_beneath_attr, ruleset_fd, access, path);
enforce_ruleset(ruleset_fd);
--
2.43.0
--
Mailing list info: https://lists.linux.it/listinfo/ltp
^ permalink raw reply related [flat|nested] 7+ messages in thread* Re: [LTP] [PATCH 1/5] Fallback landlock network support
2024-09-19 10:23 ` [LTP] [PATCH 1/5] Fallback landlock network support Andrea Cervesato
@ 2024-10-23 14:37 ` Cyril Hrubis
0 siblings, 0 replies; 7+ messages in thread
From: Cyril Hrubis @ 2024-10-23 14:37 UTC (permalink / raw)
To: Andrea Cervesato; +Cc: ltp
Hi!
> -#ifndef HAVE_ENUM_LANDLOCK_RULE_TYPE
> -enum landlock_rule_type
> -{
> - LANDLOCK_RULE_PATH_BENEATH = 1,
> - LANDLOCK_RULE_NET_PORT,
> -};
> +#ifndef LANDLOCK_RULE_PATH_BENEATH
> +# define LANDLOCK_RULE_PATH_BENEATH 1
> +#endif
> +
> +#ifndef LANDLOCK_RULE_NET_PORT
> +# define LANDLOCK_RULE_NET_PORT 2
> #endif
Does this really work?
Because unlike the glibc that does additionally define enum mebers the
Linux kernel headers does not do that.
I.e. in glibc you have:
enum foo {
FOO_AAA,
#define FOO_AAA FOO_AAA
...
};
So that you can do #ifdef FOO_AAA, but there is no such thing in
linux/landlock.h so unfortunatelly we really have to check for each
individual enum member in configure.
> diff --git a/testcases/kernel/syscalls/landlock/landlock01.c b/testcases/kernel/syscalls/landlock/landlock01.c
> index 083685c64..7f767c007 100644
> --- a/testcases/kernel/syscalls/landlock/landlock01.c
> +++ b/testcases/kernel/syscalls/landlock/landlock01.c
> @@ -17,14 +17,14 @@
>
> #include "landlock_common.h"
>
> -static struct landlock_ruleset_attr *ruleset_attr;
> -static struct landlock_ruleset_attr *null_attr;
> +static struct tst_landlock_ruleset_attr *ruleset_attr;
> +static struct tst_landlock_ruleset_attr *null_attr;
> static size_t rule_size;
> static size_t rule_small_size;
> static size_t rule_big_size;
>
> static struct tcase {
> - struct landlock_ruleset_attr **attr;
> + struct tst_landlock_ruleset_attr **attr;
> uint64_t access_fs;
> size_t *size;
> uint32_t flags;
> @@ -44,10 +44,10 @@ static void run(unsigned int n)
> struct tcase *tc = &tcases[n];
>
> if (*tc->attr)
> - (*tc->attr)->handled_access_fs = tc->access_fs;
> + (*tc->attr)->base.handled_access_fs = tc->access_fs;
>
> TST_EXP_FAIL(tst_syscall(__NR_landlock_create_ruleset,
> - *tc->attr, *tc->size, tc->flags),
> + &(*tc->attr)->base, *tc->size, tc->flags),
> tc->exp_errno,
> "%s",
> tc->msg);
> @@ -60,12 +60,12 @@ static void setup(void)
> {
> verify_landlock_is_enabled();
>
> - rule_size = sizeof(struct landlock_ruleset_attr);
> + rule_size = sizeof(struct tst_landlock_ruleset_attr);
>
> #ifdef HAVE_STRUCT_LANDLOCK_RULESET_ATTR_HANDLED_ACCESS_NET
> - rule_small_size = rule_size - sizeof(uint64_t) - 1;
> + rule_small_size = rule_size - 2*sizeof(uint64_t) - 1;
> #else
> - rule_small_size = rule_size - 1;
> + rule_small_size = rule_size - sizeof(uint64_t) - 1;
> #endif
This is also completely wrong. You cannot check the system headers and
deduce anything about the currently running kernel from them. There is
no coupling between the system the tests are compiled on and the system
the test are executed later on.
Which ABI is supported by the kernel has to be deduced at runtime from
the kernel.
Also you have changed the rule_size = sizeof() to the fallback
structure which size is always constant. Which makes the rule_small_size
even more wrong.
What are you trying to do here? It looks to me like the rule_small_size
ends up being set to -1 anyways, because the size of the ruleset_attr
structure is equal to the sizeof() of the uint64_t or two uint64_t.
> rule_big_size = SAFE_SYSCONF(_SC_PAGESIZE) + 1;
> @@ -77,7 +77,7 @@ static struct tst_test test = {
> .setup = setup,
> .needs_root = 1,
> .bufs = (struct tst_buffers []) {
> - {&ruleset_attr, .size = sizeof(struct landlock_ruleset_attr)},
> + {&ruleset_attr, .size = sizeof(struct tst_landlock_ruleset_attr)},
> {},
> },
> .caps = (struct tst_cap []) {
> diff --git a/testcases/kernel/syscalls/landlock/landlock02.c b/testcases/kernel/syscalls/landlock/landlock02.c
> index 1a3df69c9..bdef57b55 100644
> --- a/testcases/kernel/syscalls/landlock/landlock02.c
> +++ b/testcases/kernel/syscalls/landlock/landlock02.c
> @@ -20,7 +20,7 @@
>
> #include "landlock_common.h"
>
> -static struct landlock_ruleset_attr *ruleset_attr;
> +static struct tst_landlock_ruleset_attr *ruleset_attr;
> static struct landlock_path_beneath_attr *path_beneath_attr;
> static struct landlock_path_beneath_attr *rule_null;
> static int ruleset_fd;
> @@ -28,7 +28,7 @@ static int invalid_fd = -1;
>
> static struct tcase {
> int *fd;
> - enum landlock_rule_type rule_type;
> + int rule_type;
> struct landlock_path_beneath_attr **attr;
> int access;
> int parent_fd;
> @@ -103,10 +103,10 @@ static void setup(void)
> {
> verify_landlock_is_enabled();
>
> - ruleset_attr->handled_access_fs = LANDLOCK_ACCESS_FS_EXECUTE;
> + ruleset_attr->base.handled_access_fs = LANDLOCK_ACCESS_FS_EXECUTE;
>
> ruleset_fd = TST_EXP_FD_SILENT(tst_syscall(__NR_landlock_create_ruleset,
> - ruleset_attr, sizeof(struct landlock_ruleset_attr), 0));
> + &ruleset_attr->base, sizeof(struct tst_landlock_ruleset_attr), 0));
And this does not work either as this would disable these tests on older
kernels because it would pass size that is not supported.
So I supose that this is getting out of hand and we should ingore the
structure in the system headers and instead create two different
structures:
struct tst_landlock_ruleset_attr_1 {
uint64_t handled_access_fs;
};
struct tst_landlock_ruleset_attr_2 {
uint64_t handled_access_fs;
uint64_t handled_access_net;
};
And use the tst_landlock_ruleset_attr_1 in the tests where the network
part is not needed.
--
Cyril Hrubis
chrubis@suse.cz
--
Mailing list info: https://lists.linux.it/listinfo/ltp
^ permalink raw reply [flat|nested] 7+ messages in thread
* [LTP] [PATCH 2/5] Network helpers in landlock suite common functions
2024-09-19 10:23 [LTP] [PATCH 0/5] landlock network coverage support Andrea Cervesato
2024-09-19 10:23 ` [LTP] [PATCH 1/5] Fallback landlock network support Andrea Cervesato
@ 2024-09-19 10:23 ` Andrea Cervesato
2024-09-19 10:23 ` [LTP] [PATCH 3/5] Fix landlock06 creating multiple ruleset Andrea Cervesato
` (2 subsequent siblings)
4 siblings, 0 replies; 7+ messages in thread
From: Andrea Cervesato @ 2024-09-19 10:23 UTC (permalink / raw)
To: ltp
From: Andrea Cervesato <andrea.cervesato@suse.com>
Landlock suite helpers functions don't support network features. This
patch adds apply_landlock_net_layer() helper that can be used to apply a
network landlock rule in the current sandbox.
Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
testcases/kernel/syscalls/landlock/landlock05.c | 4 +--
testcases/kernel/syscalls/landlock/landlock06.c | 2 +-
.../kernel/syscalls/landlock/landlock_common.h | 39 ++++++++++++++++++++--
3 files changed, 39 insertions(+), 6 deletions(-)
diff --git a/testcases/kernel/syscalls/landlock/landlock05.c b/testcases/kernel/syscalls/landlock/landlock05.c
index 4efe19eb5..f0afad11a 100644
--- a/testcases/kernel/syscalls/landlock/landlock05.c
+++ b/testcases/kernel/syscalls/landlock/landlock05.c
@@ -70,13 +70,13 @@ static void setup(void)
ruleset_fd = SAFE_LANDLOCK_CREATE_RULESET(
ruleset_attr, sizeof(struct tst_landlock_ruleset_attr), 0);
- apply_landlock_rule(
+ apply_landlock_fs_rule(
path_beneath_attr,
ruleset_fd,
LANDLOCK_ACCESS_FS_REFER,
DIR1);
- apply_landlock_rule(
+ apply_landlock_fs_rule(
path_beneath_attr,
ruleset_fd,
LANDLOCK_ACCESS_FS_REFER,
diff --git a/testcases/kernel/syscalls/landlock/landlock06.c b/testcases/kernel/syscalls/landlock/landlock06.c
index 39e0856e3..f04df2ff1 100644
--- a/testcases/kernel/syscalls/landlock/landlock06.c
+++ b/testcases/kernel/syscalls/landlock/landlock06.c
@@ -59,7 +59,7 @@ static void setup(void)
ruleset_fd = SAFE_LANDLOCK_CREATE_RULESET(
ruleset_attr, sizeof(struct tst_landlock_ruleset_attr), 0);
- apply_landlock_layer(
+ apply_landlock_fs_layer(
ruleset_attr,
path_beneath_attr,
MNTPOINT,
diff --git a/testcases/kernel/syscalls/landlock/landlock_common.h b/testcases/kernel/syscalls/landlock/landlock_common.h
index c0bf88e4c..a955340bf 100644
--- a/testcases/kernel/syscalls/landlock/landlock_common.h
+++ b/testcases/kernel/syscalls/landlock/landlock_common.h
@@ -33,7 +33,7 @@ static inline int verify_landlock_is_enabled(void)
return abi;
}
-static inline void apply_landlock_rule(
+static inline void apply_landlock_fs_rule(
struct landlock_path_beneath_attr *path_beneath_attr,
const int ruleset_fd,
const int access,
@@ -51,13 +51,29 @@ static inline void apply_landlock_rule(
SAFE_CLOSE(path_beneath_attr->parent_fd);
}
+static inline void apply_landlock_net_rule(
+ struct landlock_net_port_attr *net_attr,
+ const int ruleset_fd,
+ const uint64_t port,
+ const uint64_t access)
+{
+ net_attr->port = port;
+ net_attr->allowed_access = access;
+
+ SAFE_LANDLOCK_ADD_RULE(
+ ruleset_fd,
+ LANDLOCK_RULE_NET_PORT,
+ net_attr,
+ 0);
+}
+
static inline void enforce_ruleset(const int ruleset_fd)
{
SAFE_PRCTL(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
SAFE_LANDLOCK_RESTRICT_SELF(ruleset_fd, 0);
}
-static inline void apply_landlock_layer(
+static inline void apply_landlock_fs_layer(
struct tst_landlock_ruleset_attr *ruleset_attr,
struct landlock_path_beneath_attr *path_beneath_attr,
const char *path,
@@ -68,7 +84,24 @@ static inline void apply_landlock_layer(
ruleset_fd = SAFE_LANDLOCK_CREATE_RULESET(
ruleset_attr, sizeof(struct tst_landlock_ruleset_attr), 0);
- apply_landlock_rule(path_beneath_attr, ruleset_fd, access, path);
+ apply_landlock_fs_rule(path_beneath_attr, ruleset_fd, access, path);
+ enforce_ruleset(ruleset_fd);
+
+ SAFE_CLOSE(ruleset_fd);
+}
+
+static inline void apply_landlock_net_layer(
+ struct tst_landlock_ruleset_attr *ruleset_attr,
+ struct landlock_net_port_attr *net_port_attr,
+ const uint64_t port,
+ const uint64_t access)
+{
+ int ruleset_fd;
+
+ ruleset_fd = SAFE_LANDLOCK_CREATE_RULESET(
+ ruleset_attr, sizeof(struct tst_landlock_ruleset_attr), 0);
+
+ apply_landlock_net_rule(net_port_attr, ruleset_fd, port, access);
enforce_ruleset(ruleset_fd);
SAFE_CLOSE(ruleset_fd);
--
2.43.0
--
Mailing list info: https://lists.linux.it/listinfo/ltp
^ permalink raw reply related [flat|nested] 7+ messages in thread* [LTP] [PATCH 3/5] Fix landlock06 creating multiple ruleset
2024-09-19 10:23 [LTP] [PATCH 0/5] landlock network coverage support Andrea Cervesato
2024-09-19 10:23 ` [LTP] [PATCH 1/5] Fallback landlock network support Andrea Cervesato
2024-09-19 10:23 ` [LTP] [PATCH 2/5] Network helpers in landlock suite common functions Andrea Cervesato
@ 2024-09-19 10:23 ` Andrea Cervesato
2024-09-19 10:23 ` [LTP] [PATCH 4/5] Add landlock08 test Andrea Cervesato
2024-09-19 10:23 ` [LTP] [PATCH 5/5] Add error coverage for landlock network support Andrea Cervesato
4 siblings, 0 replies; 7+ messages in thread
From: Andrea Cervesato @ 2024-09-19 10:23 UTC (permalink / raw)
To: ltp
From: Andrea Cervesato <andrea.cervesato@suse.com>
Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
testcases/kernel/syscalls/landlock/landlock06.c | 7 -------
1 file changed, 7 deletions(-)
diff --git a/testcases/kernel/syscalls/landlock/landlock06.c b/testcases/kernel/syscalls/landlock/landlock06.c
index f04df2ff1..139eac904 100644
--- a/testcases/kernel/syscalls/landlock/landlock06.c
+++ b/testcases/kernel/syscalls/landlock/landlock06.c
@@ -42,8 +42,6 @@ static void run(void)
static void setup(void)
{
- int ruleset_fd;
-
if (verify_landlock_is_enabled() < 5)
tst_brk(TCONF, "LANDLOCK_ACCESS_FS_IOCTL_DEV is not supported");
@@ -56,17 +54,12 @@ static void setup(void)
ruleset_attr->data.handled_access_fs = LANDLOCK_ACCESS_FS_IOCTL_DEV;
- ruleset_fd = SAFE_LANDLOCK_CREATE_RULESET(
- ruleset_attr, sizeof(struct tst_landlock_ruleset_attr), 0);
-
apply_landlock_fs_layer(
ruleset_attr,
path_beneath_attr,
MNTPOINT,
LANDLOCK_ACCESS_FS_IOCTL_DEV
);
-
- SAFE_CLOSE(ruleset_fd);
}
static void cleanup(void)
--
2.43.0
--
Mailing list info: https://lists.linux.it/listinfo/ltp
^ permalink raw reply related [flat|nested] 7+ messages in thread* [LTP] [PATCH 4/5] Add landlock08 test
2024-09-19 10:23 [LTP] [PATCH 0/5] landlock network coverage support Andrea Cervesato
` (2 preceding siblings ...)
2024-09-19 10:23 ` [LTP] [PATCH 3/5] Fix landlock06 creating multiple ruleset Andrea Cervesato
@ 2024-09-19 10:23 ` Andrea Cervesato
2024-09-19 10:23 ` [LTP] [PATCH 5/5] Add error coverage for landlock network support Andrea Cervesato
4 siblings, 0 replies; 7+ messages in thread
From: Andrea Cervesato @ 2024-09-19 10:23 UTC (permalink / raw)
To: ltp
From: Andrea Cervesato <andrea.cervesato@suse.com>
Verify the landlock support for bind()/connect() syscalls in IPV4
and IPV6 protocols. In particular, check that bind() is assigning
the address only on the TCP port enforced by
LANDLOCK_ACCESS_NET_BIND_TCP and check that connect() is connecting
only to a specific TCP port enforced by
LANDLOCK_ACCESS_NET_CONNECT_TCP.
Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
include/lapi/capability.h | 4 +
runtest/syscalls | 1 +
testcases/kernel/syscalls/landlock/.gitignore | 1 +
testcases/kernel/syscalls/landlock/landlock08.c | 199 +++++++++++++++++++++
.../kernel/syscalls/landlock/landlock_common.h | 93 +++++++++-
5 files changed, 297 insertions(+), 1 deletion(-)
diff --git a/include/lapi/capability.h b/include/lapi/capability.h
index 0f317d6d7..14d2d3c12 100644
--- a/include/lapi/capability.h
+++ b/include/lapi/capability.h
@@ -20,6 +20,10 @@
# endif
#endif
+#ifndef CAP_NET_BIND_SERVICE
+# define CAP_NET_BIND_SERVICE 10
+#endif
+
#ifndef CAP_NET_RAW
# define CAP_NET_RAW 13
#endif
diff --git a/runtest/syscalls b/runtest/syscalls
index 02e721df9..e1e9765c7 100644
--- a/runtest/syscalls
+++ b/runtest/syscalls
@@ -708,6 +708,7 @@ landlock04 landlock04
landlock05 landlock05
landlock06 landlock06
landlock07 landlock07
+landlock08 landlock08
lchown01 lchown01
lchown01_16 lchown01_16
diff --git a/testcases/kernel/syscalls/landlock/.gitignore b/testcases/kernel/syscalls/landlock/.gitignore
index db11bff2f..fc7317394 100644
--- a/testcases/kernel/syscalls/landlock/.gitignore
+++ b/testcases/kernel/syscalls/landlock/.gitignore
@@ -6,3 +6,4 @@ landlock04
landlock05
landlock06
landlock07
+landlock08
diff --git a/testcases/kernel/syscalls/landlock/landlock08.c b/testcases/kernel/syscalls/landlock/landlock08.c
new file mode 100644
index 000000000..c886971dc
--- /dev/null
+++ b/testcases/kernel/syscalls/landlock/landlock08.c
@@ -0,0 +1,199 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright (C) 2024 SUSE LLC Andrea Cervesato <andrea.cervesato@suse.com>
+ */
+
+/*\
+ * [Description]
+ *
+ * Verify the landlock support for bind()/connect() syscalls in IPV4 and IPV6
+ * protocols. In particular, check that bind() is assigning the address only on
+ * the TCP port enforced by LANDLOCK_ACCESS_NET_BIND_TCP and check that
+ * connect() is connecting only to a specific TCP port enforced by
+ * LANDLOCK_ACCESS_NET_CONNECT_TCP.
+ *
+ * [Algorithm]
+ *
+ * Repeat the following procedure for IPV4 and IPV6:
+ *
+ * - create a socket on PORT1, bind() it and check if it passes
+ * - enforce the current sandbox with LANDLOCK_ACCESS_NET_BIND_TCP on PORT1
+ * - create a socket on PORT1, bind() it and check if it passes
+ * - create a socket on PORT2, bind() it and check if it fails
+ *
+ * - create a server listening on PORT1
+ * - create a socket on PORT1, connect() to it and check if it passes
+ * - enforce the current sandbox with LANDLOCK_ACCESS_NET_CONNECT_TCP on PORT1
+ * - create a socket on PORT1, connect() to it and check if it passes
+ * - create a socket on PORT2, connect() to it and check if it fails
+ */
+
+#include "landlock_common.h"
+
+#define ADDRESS_PORT 0x7c90
+
+static int variants[] = {
+ AF_INET,
+ AF_INET6,
+};
+
+static struct tst_landlock_ruleset_attr *ruleset_attr;
+static struct landlock_net_port_attr *net_port_attr;
+static in_port_t *server_port;
+
+static void create_server(const int addr_family)
+{
+ struct socket_data socket;
+ struct sockaddr *addr = NULL;
+
+ create_socket(&socket, addr_family, 0);
+ getsocket_addr(&socket, addr_family, &addr);
+
+ SAFE_BIND(socket.fd, addr, socket.address_size);
+ SAFE_LISTEN(socket.fd, 1);
+
+ *server_port = getsocket_port(&socket, addr_family);
+
+ tst_res(TDEBUG, "Server listening on port %u", *server_port);
+
+ TST_CHECKPOINT_WAKE_AND_WAIT(0);
+
+ SAFE_CLOSE(socket.fd);
+}
+
+static void test_bind(const int addr_family, const in_port_t port,
+ const int exp_err)
+{
+ struct socket_data socket;
+ struct sockaddr *addr = NULL;
+
+ create_socket(&socket, addr_family, port);
+ getsocket_addr(&socket, addr_family, &addr);
+
+ if (exp_err) {
+ TST_EXP_FAIL(
+ bind(socket.fd, addr, socket.address_size),
+ exp_err, "bind() access on port %u", port);
+ } else {
+ TST_EXP_PASS(
+ bind(socket.fd, addr, socket.address_size),
+ "bind() access on port %u", port);
+ }
+
+ SAFE_CLOSE(socket.fd);
+}
+
+static void test_connect(const int addr_family, const in_port_t port,
+ const int exp_err)
+{
+ struct socket_data socket;
+ struct sockaddr *addr = NULL;
+
+ create_socket(&socket, addr_family, port);
+ getsocket_addr(&socket, addr_family, &addr);
+
+ if (exp_err) {
+ TST_EXP_FAIL(
+ connect(socket.fd, addr, socket.address_size),
+ exp_err, "connect() on port %u", port);
+ } else {
+ TST_EXP_PASS(
+ connect(socket.fd, addr, socket.address_size),
+ "connect() on port %u", port);
+ }
+
+ SAFE_CLOSE(socket.fd);
+}
+
+static void run(void)
+{
+ int addr_family = variants[tst_variant];
+
+ tst_res(TINFO, "Using %s protocol",
+ addr_family == AF_INET ? "IPV4" : "IPV6");
+
+ if (!SAFE_FORK()) {
+ create_server(addr_family);
+ exit(0);
+ }
+
+ TST_CHECKPOINT_WAIT(0);
+
+ /* verify bind() syscall accessibility */
+ if (!SAFE_FORK()) {
+ ruleset_attr->data.handled_access_net =
+ LANDLOCK_ACCESS_NET_BIND_TCP;
+
+ test_bind(addr_family, ADDRESS_PORT, 0);
+
+ tst_res(TINFO, "Enable bind() access only for port %u",
+ ADDRESS_PORT);
+
+ apply_landlock_net_layer(ruleset_attr, net_port_attr,
+ ADDRESS_PORT, LANDLOCK_ACCESS_NET_BIND_TCP);
+
+ test_bind(addr_family, ADDRESS_PORT, 0);
+ test_bind(addr_family, ADDRESS_PORT + 0x80, EACCES);
+
+ exit(0);
+ }
+
+ /* verify connect() syscall accessibility */
+ if (!SAFE_FORK()) {
+ ruleset_attr->data.handled_access_net =
+ LANDLOCK_ACCESS_NET_CONNECT_TCP;
+
+ test_connect(addr_family, *server_port, 0);
+
+ tst_res(TINFO, "Enable connect() access only on port %u",
+ *server_port);
+
+ apply_landlock_net_layer(ruleset_attr, net_port_attr,
+ *server_port, LANDLOCK_ACCESS_NET_CONNECT_TCP);
+
+ test_connect(addr_family, *server_port, 0);
+ test_connect(addr_family, *server_port + 0x80, EACCES);
+
+ TST_CHECKPOINT_WAKE(0);
+
+ exit(0);
+ }
+}
+
+static void setup(void)
+{
+ verify_landlock_is_enabled();
+
+ server_port = SAFE_MMAP(NULL, sizeof(in_port_t), PROT_READ | PROT_WRITE,
+ MAP_SHARED | MAP_ANONYMOUS, -1, 0);
+}
+
+static void cleanup(void)
+{
+ if (server_port)
+ SAFE_MUNMAP(server_port, sizeof(in_port_t));
+}
+
+static struct tst_test test = {
+ .test_all = run,
+ .setup = setup,
+ .cleanup = cleanup,
+ .needs_root = 1,
+ .needs_checkpoints = 1,
+ .forks_child = 1,
+ .test_variants = ARRAY_SIZE(variants),
+ .bufs = (struct tst_buffers[]) {
+ {&ruleset_attr, .size = sizeof(struct tst_landlock_ruleset_attr)},
+ {&net_port_attr, .size = sizeof(struct landlock_net_port_attr)},
+ {},
+ },
+ .caps = (struct tst_cap []) {
+ TST_CAP(TST_CAP_REQ, CAP_SYS_ADMIN),
+ TST_CAP(TST_CAP_REQ, CAP_NET_BIND_SERVICE),
+ {}
+ },
+ .needs_kconfigs = (const char *[]) {
+ "CONFIG_INET=y",
+ NULL
+ },
+};
diff --git a/testcases/kernel/syscalls/landlock/landlock_common.h b/testcases/kernel/syscalls/landlock/landlock_common.h
index a955340bf..db500deb8 100644
--- a/testcases/kernel/syscalls/landlock/landlock_common.h
+++ b/testcases/kernel/syscalls/landlock/landlock_common.h
@@ -11,6 +11,16 @@
#include "lapi/fcntl.h"
#include "lapi/landlock.h"
+#define IPV4_ADDRESS "127.0.0.1"
+#define IPV6_ADDRESS "::1"
+
+struct socket_data {
+ struct sockaddr_in addr_ipv4;
+ struct sockaddr_in6 addr_ipv6;
+ size_t address_size;
+ int fd;
+};
+
static inline int verify_landlock_is_enabled(void)
{
int abi;
@@ -93,7 +103,7 @@ static inline void apply_landlock_fs_layer(
static inline void apply_landlock_net_layer(
struct tst_landlock_ruleset_attr *ruleset_attr,
struct landlock_net_port_attr *net_port_attr,
- const uint64_t port,
+ const in_port_t port,
const uint64_t access)
{
int ruleset_fd;
@@ -107,4 +117,85 @@ static inline void apply_landlock_net_layer(
SAFE_CLOSE(ruleset_fd);
}
+static inline in_port_t getsocket_port(struct socket_data *socket,
+ const int addr_family)
+{
+ struct sockaddr_in addr_ipv4;
+ struct sockaddr_in6 addr_ipv6;
+ socklen_t len;
+ in_port_t port = 0;
+
+ switch (addr_family) {
+ case AF_INET:
+ len = sizeof(addr_ipv4);
+ memset(&addr_ipv4, 0, len);
+
+ SAFE_GETSOCKNAME(socket->fd, (struct sockaddr *)&addr_ipv4, &len);
+ port = ntohs(addr_ipv4.sin_port);
+ break;
+ case AF_INET6:
+ len = sizeof(addr_ipv6);
+ memset(&addr_ipv6, 0, len);
+
+ SAFE_GETSOCKNAME(socket->fd, (struct sockaddr *)&addr_ipv6, &len);
+ port = ntohs(addr_ipv6.sin6_port);
+ break;
+ default:
+ tst_brk(TBROK, "Unsupported protocol");
+ break;
+ };
+
+ return port;
+}
+
+static inline void create_socket(struct socket_data *socket,
+ const int addr_family, const in_port_t port)
+{
+ memset(socket, 0, sizeof(struct socket_data));
+
+ switch (addr_family) {
+ case AF_INET:
+ if (!port) {
+ tst_init_sockaddr_inet_bin(&socket->addr_ipv4,
+ INADDR_ANY, 0);
+ } else {
+ tst_init_sockaddr_inet(&socket->addr_ipv4,
+ IPV4_ADDRESS, port);
+ }
+
+ socket->address_size = sizeof(struct sockaddr_in);
+ break;
+ case AF_INET6:
+ if (!port) {
+ tst_init_sockaddr_inet6_bin(&socket->addr_ipv6,
+ &in6addr_any, 0);
+ } else {
+ tst_init_sockaddr_inet6(&socket->addr_ipv6,
+ IPV6_ADDRESS, port);
+ }
+
+ socket->address_size = sizeof(struct sockaddr_in6);
+ break;
+ default:
+ tst_brk(TBROK, "Unsupported protocol");
+ return;
+ };
+
+ socket->fd = SAFE_SOCKET(addr_family, SOCK_STREAM | SOCK_CLOEXEC, 0);
+}
+
+static inline void getsocket_addr(struct socket_data *socket,
+ const int addr_family, struct sockaddr **addr)
+{
+ switch (addr_family) {
+ case AF_INET:
+ *addr = (struct sockaddr *)&socket->addr_ipv4;
+ break;
+ case AF_INET6:
+ *addr = (struct sockaddr *)&socket->addr_ipv6;
+ break;
+ default:
+ break;
+ };
+}
#endif /* LANDLOCK_COMMON_H__ */
--
2.43.0
--
Mailing list info: https://lists.linux.it/listinfo/ltp
^ permalink raw reply related [flat|nested] 7+ messages in thread* [LTP] [PATCH 5/5] Add error coverage for landlock network support
2024-09-19 10:23 [LTP] [PATCH 0/5] landlock network coverage support Andrea Cervesato
` (3 preceding siblings ...)
2024-09-19 10:23 ` [LTP] [PATCH 4/5] Add landlock08 test Andrea Cervesato
@ 2024-09-19 10:23 ` Andrea Cervesato
4 siblings, 0 replies; 7+ messages in thread
From: Andrea Cervesato @ 2024-09-19 10:23 UTC (permalink / raw)
To: ltp
From: Andrea Cervesato <andrea.cervesato@suse.com>
Add two more errors checks inside the landlock02 which is testing
landlock_add_rule syscall. In particular, test now verifies when the
syscall is raising EINVAL due to invalid network attributes.
Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
testcases/kernel/syscalls/landlock/landlock02.c | 71 +++++++++++++++++++------
1 file changed, 55 insertions(+), 16 deletions(-)
diff --git a/testcases/kernel/syscalls/landlock/landlock02.c b/testcases/kernel/syscalls/landlock/landlock02.c
index bdef57b55..56ed9c00c 100644
--- a/testcases/kernel/syscalls/landlock/landlock02.c
+++ b/testcases/kernel/syscalls/landlock/landlock02.c
@@ -23,22 +23,26 @@
static struct tst_landlock_ruleset_attr *ruleset_attr;
static struct landlock_path_beneath_attr *path_beneath_attr;
static struct landlock_path_beneath_attr *rule_null;
+static struct landlock_net_port_attr *net_port_attr;
static int ruleset_fd;
static int invalid_fd = -1;
static struct tcase {
int *fd;
int rule_type;
- struct landlock_path_beneath_attr **attr;
+ struct landlock_path_beneath_attr **path_attr;
+ struct landlock_net_port_attr **net_attr;
int access;
int parent_fd;
+ int net_port;
uint32_t flags;
int exp_errno;
char *msg;
} tcases[] = {
{
.fd = &ruleset_fd,
- .attr = &path_beneath_attr,
+ .path_attr = &path_beneath_attr,
+ .net_attr = NULL,
.access = LANDLOCK_ACCESS_FS_EXECUTE,
.flags = 1,
.exp_errno = EINVAL,
@@ -46,7 +50,8 @@ static struct tcase {
},
{
.fd = &ruleset_fd,
- .attr = &path_beneath_attr,
+ .path_attr = &path_beneath_attr,
+ .net_attr = NULL,
.access = LANDLOCK_ACCESS_FS_EXECUTE,
.exp_errno = EINVAL,
.msg = "Invalid rule type"
@@ -54,13 +59,15 @@ static struct tcase {
{
.fd = &ruleset_fd,
.rule_type = LANDLOCK_RULE_PATH_BENEATH,
- .attr = &path_beneath_attr,
+ .path_attr = &path_beneath_attr,
+ .net_attr = NULL,
.exp_errno = ENOMSG,
.msg = "Empty accesses"
},
{
.fd = &invalid_fd,
- .attr = &path_beneath_attr,
+ .path_attr = &path_beneath_attr,
+ .net_attr = NULL,
.access = LANDLOCK_ACCESS_FS_EXECUTE,
.exp_errno = EBADF,
.msg = "Invalid file descriptor"
@@ -68,7 +75,8 @@ static struct tcase {
{
.fd = &ruleset_fd,
.rule_type = LANDLOCK_RULE_PATH_BENEATH,
- .attr = &path_beneath_attr,
+ .path_attr = &path_beneath_attr,
+ .net_attr = NULL,
.access = LANDLOCK_ACCESS_FS_EXECUTE,
.parent_fd = -1,
.exp_errno = EBADF,
@@ -77,26 +85,56 @@ static struct tcase {
{
.fd = &ruleset_fd,
.rule_type = LANDLOCK_RULE_PATH_BENEATH,
- .attr = &rule_null,
+ .path_attr = &rule_null,
+ .net_attr = NULL,
.exp_errno = EFAULT,
.msg = "Invalid rule attr"
},
+ {
+ .fd = &ruleset_fd,
+ .rule_type = LANDLOCK_RULE_NET_PORT,
+ .path_attr = NULL,
+ .net_attr = &net_port_attr,
+ .access = LANDLOCK_ACCESS_FS_EXECUTE,
+ .net_port = 448,
+ .exp_errno = EINVAL,
+ .msg = "Invalid access rule for network type"
+ },
+ {
+ .fd = &ruleset_fd,
+ .rule_type = LANDLOCK_RULE_NET_PORT,
+ .path_attr = NULL,
+ .net_attr = &net_port_attr,
+ .access = LANDLOCK_ACCESS_NET_BIND_TCP,
+ .net_port = INT16_MAX + 1,
+ .exp_errno = EINVAL,
+ .msg = "Socket port greater than 65535"
+ },
};
static void run(unsigned int n)
{
struct tcase *tc = &tcases[n];
- if (*tc->attr) {
- (*tc->attr)->allowed_access = tc->access;
- (*tc->attr)->parent_fd = tc->parent_fd;
- }
+ if (tc->path_attr) {
+ if (*tc->path_attr) {
+ (*tc->path_attr)->allowed_access = tc->access;
+ (*tc->path_attr)->parent_fd = tc->parent_fd;
+ }
+
+ TST_EXP_FAIL(tst_syscall(__NR_landlock_add_rule,
+ *tc->fd, tc->rule_type, *tc->path_attr, tc->flags),
+ tc->exp_errno, "%s", tc->msg);
+ } else if (tc->net_attr) {
+ if (*tc->net_attr) {
+ (*tc->net_attr)->allowed_access = tc->access;
+ (*tc->net_attr)->port = tc->net_port;
+ }
- TST_EXP_FAIL(tst_syscall(__NR_landlock_add_rule,
- *tc->fd, tc->rule_type, *tc->attr, tc->flags),
- tc->exp_errno,
- "%s",
- tc->msg);
+ TST_EXP_FAIL(tst_syscall(__NR_landlock_add_rule,
+ *tc->fd, tc->rule_type, *tc->net_attr, tc->flags),
+ tc->exp_errno, "%s", tc->msg);
+ }
}
static void setup(void)
@@ -124,6 +162,7 @@ static struct tst_test test = {
.bufs = (struct tst_buffers []) {
{&ruleset_attr, .size = sizeof(struct tst_landlock_ruleset_attr)},
{&path_beneath_attr, .size = sizeof(struct landlock_path_beneath_attr)},
+ {&net_port_attr, .size = sizeof(struct landlock_net_port_attr)},
{},
},
.caps = (struct tst_cap []) {
--
2.43.0
--
Mailing list info: https://lists.linux.it/listinfo/ltp
^ permalink raw reply related [flat|nested] 7+ messages in thread