Re: [PATCH 2/2] selftests/landlock: Test a long executable path

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [Medium] selftests/landlock: TMP_DIR leak on audit setup failure in
  fs_test [1]
--

commit f00c6c9b2b3886a7e8767a4a9aab53cc1603cea4
Author: Daejun Park <daejun7.park@samsung.com>

selftests/landlock: Test a long executable path

This commit adds two selftests, layout0.long_exe_path and
audit_layout0.long_exe_path, to verify that a task executed from a path
longer than LANDLOCK_PATH_MAX_SIZE can sandbox itself and logs
exe="<too_long>" in audit domain records.

> diff --git a/tools/testing/selftests/landlock/fs_test.c b/tools/testing/selftests/landlock/fs_test.c
> index f725882fa4a78..738a7175d94cb 100644
> --- a/tools/testing/selftests/landlock/fs_test.c
> +++ b/tools/testing/selftests/landlock/fs_test.c

[ ... ]

> +FIXTURE_SETUP(audit_layout0)
> +{
> +	prepare_layout(_metadata);
> +
> +	/*
> +	 * No executable filter: audit_init_with_exe_filter() would only keep
> +	 * the records of this test binary, and the path of the executed copy
> +	 * is too long for a rule. The test matches its records by PID.
> +	 */
> +	set_cap(_metadata, CAP_AUDIT_CONTROL);
> +	self->audit_fd = audit_init();
> +	clear_cap(_metadata, CAP_AUDIT_CONTROL);
> +	if (self->audit_fd < 0) {
> +		/*
> +		 * FIXTURE_TEARDOWN_PARENT() is not called when FIXTURE_SETUP()
> +		 * failed, so we need to remove TMP_DIR to avoid cascading
> +		 * errors with the next tests.
> +		 */
> +		cleanup_layout(_metadata);
> +	}
> +	ASSERT_LE(0, self->audit_fd);
> +}

[Severity: Medium]
This problem wasn't introduced by this patch, but do the existing
FIXTURE_SETUP(audit_layout1), FIXTURE_SETUP(audit_quiet_layout1) and
FIXTURE_SETUP(audit_quiet_rename) fixtures leak TMP_DIR [1] in the
same way when audit_init_with_exe_filter() fails?

In those fixtures, prepare_layout() and create_layout1() create TMP_DIR
before calling audit_init_with_exe_filter(), which has no error-path
cleanup:

tools/testing/selftests/landlock/fs_test.c:FIXTURE_SETUP(audit_layout1) {
	prepare_layout(_metadata);

	create_layout1(_metadata);

	set_cap(_metadata, CAP_AUDIT_CONTROL);
	self->audit_fd = audit_init_with_exe_filter(&self->audit_filter);
	EXPECT_LE(0, self->audit_fd);
	disable_caps(_metadata);
}

When audit_init_with_exe_filter() returns a negative error (for example
-EEXIST when auditd holds the audit netlink socket), EXPECT_LE() marks the
setup as failed and skips FIXTURE_TEARDOWN_PARENT(), leaving TMP_DIR on the
filesystem and causing subsequent tests to fail in create_directory() with
EEXIST.

[1] https://sashiko.dev/#/bug/linux-e22dd50d-22f3-469c-81cf-fd03bb763237

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261111-landlock-long-exe-v1-0-588cfd174a10@samsung.com?part=2