Re: [PATCH v13 11/11] LSM: selftests for Linux Security Module syscalls

Mickaël Salaün
2023-08-23T17:27:33Z

On Wed, Aug 02, 2023 at 10:44:34AM -0700, Casey Schaufler wrote:
> Add selftests for the three system calls supporting the LSM
> infrastructure. This set of tests is limited by the differences
> in access policy enforced by the existing security modules.
>
> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
> ---
> MAINTAINERS | 1 +
> tools/testing/selftests/Makefile | 1 +
> tools/testing/selftests/lsm/Makefile | 19 ++
> tools/testing/selftests/lsm/common.c | 81 ++++++
> tools/testing/selftests/lsm/common.h | 33 +++
> tools/testing/selftests/lsm/config | 3 +
> .../selftests/lsm/lsm_get_self_attr_test.c | 240 ++++++++++++++++++
> .../selftests/lsm/lsm_list_modules_test.c | 140 ++++++++++
> .../selftests/lsm/lsm_set_self_attr_test.c | 74 ++++++
> 9 files changed, 592 insertions(+)
> create mode 100644 tools/testing/selftests/lsm/Makefile
> create mode 100644 tools/testing/selftests/lsm/common.c
> create mode 100644 tools/testing/selftests/lsm/common.h
> create mode 100644 tools/testing/selftests/lsm/config
> create mode 100644 tools/testing/selftests/lsm/lsm_get_self_attr_test.c
> create mode 100644 tools/testing/selftests/lsm/lsm_list_modules_test.c
> create mode 100644 tools/testing/selftests/lsm/lsm_set_self_attr_test.c

> diff --git a/tools/testing/selftests/lsm/Makefile b/tools/testing/selftests/lsm/Makefile
> new file mode 100644
> index 000000000000..bae6c1e3bba4
> --- /dev/null
> +++ b/tools/testing/selftests/lsm/Makefile
> @@ -0,0 +1,19 @@
> +# SPDX-License-Identifier: GPL-2.0
> +#
> +# First run: make -C ../../../.. headers_install
> +
> +CFLAGS += -Wall -O2 $(KHDR_INCLUDES)
> +LOCAL_HDRS += common.h
> +
> +TEST_GEN_PROGS := lsm_get_self_attr_test lsm_list_modules_test \
> + lsm_set_self_attr_test

You could use the wildcard approach to avoid explicitly listing output
files here, but it's not a big deal.

> +
> +include ../lib.mk
> +
> +$(TEST_GEN_PROGS):
> +
> +$(OUTPUT)/lsm_get_self_attr_test: lsm_get_self_attr_test.c common.c
> +$(OUTPUT)/lsm_set_self_attr_test: lsm_set_self_attr_test.c common.c
> +$(OUTPUT)/lsm_list_modules_test: lsm_list_modules_test.c common.c

It would be nice to add /*_test to a .gitignore file

> +
> +EXTRA_CLEAN = $(OUTPUT)/common.o

Anyway, this Makefile works with all kind of test builds (cf. commit
a52540522c9541bfa3e499d2edba7bc0ca73a4ca).

I'll send another review for this file soon.