From: "Günther Noack" <gnoack@google.com>
To: "Mickaël Salaün" <mic@digikod.net>
Cc: linux-security-module@vger.kernel.org
Subject: Re: [PATCH v1 1/2] selftests/landlock: Fix trace variant formatting
Date: Fri, 11 Sep 2026 14:47:38 +0200 [thread overview]
Message-ID: <aqP4alTn-mtM3Heh@google.com> (raw)
In-Reply-To: <20260907160710.126525-1-mic@digikod.net>
On Mon, Sep 07, 2026 at 06:07:06PM +0200, Mickaël Salaün wrote:
> Group-wide clang-format exclusions also cover comments and unrelated
> initializers, hiding which construct needs protection and leaving some
> variant fields bin-packed.
>
> Use per-variant guards and format designated fields one per line. End
> each guard after the macro header when clang-format preserves the
> initializer. Keep the initializer guarded only where re-enabling
> clang-format would bin-pack its fields.
>
> Cc: Günther Noack <gnoack@google.com>
> Signed-off-by: Mickaël Salaün <mic@digikod.net>
> ---
> tools/testing/selftests/landlock/net_test.c | 13 ++--
> .../landlock/scoped_abstract_unix_test.c | 56 ++++++++++++-----
> tools/testing/selftests/landlock/trace_test.c | 62 ++++++++++++++-----
> 3 files changed, 95 insertions(+), 36 deletions(-)
>
> diff --git a/tools/testing/selftests/landlock/net_test.c b/tools/testing/selftests/landlock/net_test.c
> index a18761e0fd82..0d13556c50f2 100644
> --- a/tools/testing/selftests/landlock/net_test.c
> +++ b/tools/testing/selftests/landlock/net_test.c
> @@ -3569,31 +3569,34 @@ FIXTURE_VARIANT(trace_net_connect) {
> bool deny_connect;
> };
>
> -/* clang-format off */
> -
> /* Denied connect(): sport=0, dport=<denied port>. */
> +/* clang-format off */
> FIXTURE_VARIANT_ADD(trace_net_connect, connect_denied) {
> + /* clang-format on */
> .handled = LANDLOCK_ACCESS_NET_CONNECT_TCP,
> .bind_base_first = false,
> .deny_connect = true,
> };
>
> /* Denied bind(): sport=<denied port>, dport=0. */
> +/* clang-format off */
> FIXTURE_VARIANT_ADD(trace_net_connect, bind_fields) {
> + /* clang-format on */
> .handled = LANDLOCK_ACCESS_NET_BIND_TCP,
> .bind_base_first = false,
> .deny_connect = false,
> };
>
> /* Denied connect() after an allowed bind(): the connect fields (sport=0). */
> +/* clang-format off */
> FIXTURE_VARIANT_ADD(trace_net_connect, connect_after_bind) {
> - .handled = LANDLOCK_ACCESS_NET_BIND_TCP | LANDLOCK_ACCESS_NET_CONNECT_TCP,
> + /* clang-format on */
> + .handled = LANDLOCK_ACCESS_NET_BIND_TCP |
> + LANDLOCK_ACCESS_NET_CONNECT_TCP,
> .bind_base_first = true,
> .deny_connect = true,
> };
>
> -/* clang-format on */
> -
> /*
> * A denied TCP bind(2) or connect(2) emits one deny_access_net event. The port
> * is reported in the field matching the denied operation, in host endianness
> diff --git a/tools/testing/selftests/landlock/scoped_abstract_unix_test.c b/tools/testing/selftests/landlock/scoped_abstract_unix_test.c
> index eed684d4c364..54bc4081cd56 100644
> --- a/tools/testing/selftests/landlock/scoped_abstract_unix_test.c
> +++ b/tools/testing/selftests/landlock/scoped_abstract_unix_test.c
> @@ -1268,27 +1268,38 @@ FIXTURE_VARIANT(trace_unix) {
> size_t name_len;
> };
>
> -/* clang-format off */
> -
> /* Stream: sandboxed client connect() to an unsandboxed peer (peer_domain=0). */
> +/* clang-format off */
> FIXTURE_VARIANT_ADD(trace_unix, stream_denied) {
> - .sock_type = SOCK_STREAM, .sandbox = true,
> - .sandbox_target = false, .expect_denied = 1,
> + /* clang-format on */
> + .sock_type = SOCK_STREAM,
> + .sandbox = true,
> + .sandbox_target = false,
> + .expect_denied = 1,
> };
>
> /* Stream: peer socket owned by a domain, so peer_domain != 0. */
> +/* clang-format off */
> FIXTURE_VARIANT_ADD(trace_unix, stream_denied_scoped_peer) {
> - .sock_type = SOCK_STREAM, .sandbox = true,
> - .sandbox_target = true, .expect_denied = 1,
> + /* clang-format on */
> + .sock_type = SOCK_STREAM,
> + .sandbox = true,
> + .sandbox_target = true,
> + .expect_denied = 1,
> };
>
> /* Stream: unsandboxed client, connect() succeeds, no event. */
> +/* clang-format off */
> FIXTURE_VARIANT_ADD(trace_unix, stream_allowed) {
> - .sock_type = SOCK_STREAM, .sandbox = false,
> - .sandbox_target = false, .expect_denied = 0,
> + /* clang-format on */
> + .sock_type = SOCK_STREAM,
> + .sandbox = false,
> + .sandbox_target = false,
> + .expect_denied = 0,
> };
>
> /* Stream: lower abstract-name length boundary. */
> +/* clang-format off */
> FIXTURE_VARIANT_ADD(trace_unix, stream_denied_empty_name) {
> .sock_type = SOCK_STREAM,
> .sandbox = true,
> @@ -1297,9 +1308,12 @@ FIXTURE_VARIANT_ADD(trace_unix, stream_denied_empty_name) {
> .name = "",
> .name_len = 0,
> };
> +/* clang-format on */
>
> /* Stream: upper abstract-name length boundary. */
> +/* clang-format off */
> FIXTURE_VARIANT_ADD(trace_unix, stream_denied_max_name) {
> + /* clang-format on */
> .sock_type = SOCK_STREAM,
> .sandbox = true,
> .sandbox_target = false,
> @@ -1309,25 +1323,35 @@ FIXTURE_VARIANT_ADD(trace_unix, stream_denied_max_name) {
> };
>
> /* Datagram: sandboxed client sendto() an unsandboxed peer (peer_domain=0). */
> +/* clang-format off */
> FIXTURE_VARIANT_ADD(trace_unix, dgram_denied) {
> - .sock_type = SOCK_DGRAM, .sandbox = true,
> - .sandbox_target = false, .expect_denied = 1,
> + /* clang-format on */
> + .sock_type = SOCK_DGRAM,
> + .sandbox = true,
> + .sandbox_target = false,
> + .expect_denied = 1,
> };
>
> /* Datagram: peer socket owned by a domain, so peer_domain != 0. */
> +/* clang-format off */
> FIXTURE_VARIANT_ADD(trace_unix, dgram_denied_scoped_peer) {
> - .sock_type = SOCK_DGRAM, .sandbox = true,
> - .sandbox_target = true, .expect_denied = 1,
> + /* clang-format on */
> + .sock_type = SOCK_DGRAM,
> + .sandbox = true,
> + .sandbox_target = true,
> + .expect_denied = 1,
> };
>
> /* Datagram: unsandboxed client, sendto() succeeds, no event. */
> +/* clang-format off */
> FIXTURE_VARIANT_ADD(trace_unix, dgram_allowed) {
> - .sock_type = SOCK_DGRAM, .sandbox = false,
> - .sandbox_target = false, .expect_denied = 0,
> + /* clang-format on */
> + .sock_type = SOCK_DGRAM,
> + .sandbox = false,
> + .sandbox_target = false,
> + .expect_denied = 0,
> };
>
> -/* clang-format on */
> -
> /*
> * A sandboxed thread reaching an abstract unix socket peer through connect(2)
> * (stream) or sendto(2) (datagram) is denied and emits
> diff --git a/tools/testing/selftests/landlock/trace_test.c b/tools/testing/selftests/landlock/trace_test.c
> index afdaf8511b3a..a28a2ac55687 100644
> --- a/tools/testing/selftests/landlock/trace_test.c
> +++ b/tools/testing/selftests/landlock/trace_test.c
> @@ -1243,45 +1243,77 @@ FIXTURE_VARIANT(trace_enforce) {
> int no_new_privs;
> };
>
> -/* clang-format off */
> -
> /* Single thread, no flags: prctl-backed no_new_privs. */
> +/* clang-format off */
> FIXTURE_VARIANT_ADD(trace_enforce, single) {
> - .nthreads = 0, .flags = 0,
> - .total = 1, .complete = 1, .process_wide = 1, .no_new_privs = 1,
> + .nthreads = 0,
> + .flags = 0,
> + .total = 1,
> + .complete = 1,
> + .process_wide = 1,
> + .no_new_privs = 1,
> };
> +/* clang-format on */
>
> /* Single thread: the NO_NEW_PRIVS flag sets no_new_privs (no prctl). */
> +/* clang-format off */
> FIXTURE_VARIANT_ADD(trace_enforce, no_new_privs) {
> - .nthreads = 0, .flags = LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS,
> - .total = 1, .complete = 1, .process_wide = 1, .no_new_privs = 1,
> + .nthreads = 0,
> + .flags = LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS,
> + .total = 1,
> + .complete = 1,
> + .process_wide = 1,
> + .no_new_privs = 1,
> };
> +/* clang-format on */
>
> /* TSYNC on a lone thread still concludes, process-wide. */
> +/* clang-format off */
> FIXTURE_VARIANT_ADD(trace_enforce, tsync_single) {
> - .nthreads = 0, .flags = LANDLOCK_RESTRICT_SELF_TSYNC,
> - .total = 1, .complete = 1, .process_wide = 1, .no_new_privs = 1,
> + .nthreads = 0,
> + .flags = LANDLOCK_RESTRICT_SELF_TSYNC,
> + .total = 1,
> + .complete = 1,
> + .process_wide = 1,
> + .no_new_privs = 1,
> };
> +/* clang-format on */
>
> /* TSYNC sweeps N siblings; the caller's prctl-backed nnp propagates to all. */
> +/* clang-format off */
> FIXTURE_VARIANT_ADD(trace_enforce, tsync_multithread) {
> - .nthreads = 3, .flags = LANDLOCK_RESTRICT_SELF_TSYNC,
> - .total = 4, .complete = 1, .process_wide = 4, .no_new_privs = 4,
> + .nthreads = 3,
> + .flags = LANDLOCK_RESTRICT_SELF_TSYNC,
> + .total = 4,
> + .complete = 1,
> + .process_wide = 4,
> + .no_new_privs = 4,
> };
> +/* clang-format on */
>
> /* TSYNC + NO_NEW_PRIVS flag sets nnp on the caller and every swept sibling. */
> +/* clang-format off */
> FIXTURE_VARIANT_ADD(trace_enforce, tsync_no_new_privs) {
> + /* clang-format on */
> .nthreads = 3,
> - .flags = LANDLOCK_RESTRICT_SELF_TSYNC | LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS,
> - .total = 4, .complete = 1, .process_wide = 4, .no_new_privs = 4,
> + .flags = LANDLOCK_RESTRICT_SELF_TSYNC |
> + LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS,
> + .total = 4,
> + .complete = 1,
> + .process_wide = 4,
> + .no_new_privs = 4,
> };
>
> /* Non-TSYNC on a multi-threaded process enforces only the caller. */
> +/* clang-format off */
> FIXTURE_VARIANT_ADD(trace_enforce, multithread_non_tsync) {
> - .nthreads = 3, .flags = 0,
> - .total = 1, .complete = 1, .process_wide = 0, .no_new_privs = 1,
> + .nthreads = 3,
> + .flags = 0,
> + .total = 1,
> + .complete = 1,
> + .process_wide = 0,
> + .no_new_privs = 1,
> };
> -
> /* clang-format on */
>
> /*
> --
> 2.55.0
>
Reviewed-by: Günther Noack <gnoack@google.com>
prev parent reply other threads:[~2026-09-11 12:47 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-07 16:07 [PATCH v1 1/2] selftests/landlock: Fix trace variant formatting Mickaël Salaün
2026-09-07 16:07 ` [PATCH v1 2/2] selftests/landlock: Fix disconnected " Mickaël Salaün
2026-09-11 12:48 ` Günther Noack
2026-09-11 12:47 ` Günther Noack [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aqP4alTn-mtM3Heh@google.com \
--to=gnoack@google.com \
--cc=linux-security-module@vger.kernel.org \
--cc=mic@digikod.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.