Re: [PATCH 2/2] selftests/landlock: Test PR_SET_SECUREBITS mediation

[sashiko-bot@kernel.org]

> The preceding commoncap fix routes the CAP_SETPCAP check for privileged
> PR_SET_SECUREBITS requests through the ordinary capable hooks.  Add a
> focused Landlock regression test for this path.
> 
> Keep CAP_SETPCAP effective to isolate Landlock mediation and run the
> audit case in a child domain.  A privileged change returns EPERM and
> emits an exact CAP_SETPCAP record, then an unprivileged-only change
> succeeds.  After the child exits, require the domain deallocation record
> to report exactly one denial; this proves that the second operation did
> not create a hidden denial without relying on an asynchronous no-record
> timeout.
> 
> The existing check-exec securebits fixture already covers commoncap's
> privileged, unprivileged, locked, and user-namespace semantics.  Without
> the preceding fix, this Landlock audit test fails.
> 
> Cc: Christian Brauner <brauner@kernel.org>
> Cc: Günther Noack <gnoack@google.com>
> Cc: Paul Moore <paul@paul-moore.com>
> Cc: Serge Hallyn <serge@hallyn.com>
> Signed-off-by: Mickaël Salaün <mic@digikod.net>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261110202811.2409395-1-mic@digikod.net?part=2