From: "Günther Noack" <gnoack@google.com>
To: "Mickaël Salaün" <mic@digikod.net>
Cc: linux-security-module@vger.kernel.org
Subject: Re: [PATCH v1 1/2] selftests/landlock: Fix trace variant formatting
Date: Fri, 11 Sep 2026 14:47:38 +0200 [thread overview]
Message-ID: <aqP4alTn-mtM3Heh@google.com> (raw)
In-Reply-To: <20260907160710.126525-1-mic@digikod.net>
On Mon, Sep 07, 2026 at 06:07:06PM +0200, Mickaël Salaün wrote:
> Group-wide clang-format exclusions also cover comments and unrelated
> initializers, hiding which construct needs protection and leaving some
> variant fields bin-packed.
>
> Use per-variant guards and format designated fields one per line. End
> each guard after the macro header when clang-format preserves the
> initializer. Keep the initializer guarded only where re-enabling
> clang-format would bin-pack its fields.
>
> Cc: Günther Noack <gnoack@google.com>
> Signed-off-by: Mickaël Salaün <mic@digikod.net>
> ---
> tools/testing/selftests/landlock/net_test.c | 13 ++--
> .../landlock/scoped_abstract_unix_test.c | 56 ++++++++++++-----
> tools/testing/selftests/landlock/trace_test.c | 62 ++++++++++++++-----
> 3 files changed, 95 insertions(+), 36 deletions(-)
>
> diff --git a/tools/testing/selftests/landlock/net_test.c b/tools/testing/selftests/landlock/net_test.c
> index a18761e0fd82..0d13556c50f2 100644
> --- a/tools/testing/selftests/landlock/net_test.c
> +++ b/tools/testing/selftests/landlock/net_test.c
> @@ -3569,31 +3569,34 @@ FIXTURE_VARIANT(trace_net_connect) {
> bool deny_connect;
> };
>
> -/* clang-format off */
> -
> /* Denied connect(): sport=0, dport=<denied port>. */
> +/* clang-format off */
> FIXTURE_VARIANT_ADD(trace_net_connect, connect_denied) {
> + /* clang-format on */
> .handled = LANDLOCK_ACCESS_NET_CONNECT_TCP,
> .bind_base_first = false,
> .deny_connect = true,
> };
>
> /* Denied bind(): sport=<denied port>, dport=0. */
> +/* clang-format off */
> FIXTURE_VARIANT_ADD(trace_net_connect, bind_fields) {
> + /* clang-format on */
> .handled = LANDLOCK_ACCESS_NET_BIND_TCP,
> .bind_base_first = false,
> .deny_connect = false,
> };
>
> /* Denied connect() after an allowed bind(): the connect fields (sport=0). */
> +/* clang-format off */
> FIXTURE_VARIANT_ADD(trace_net_connect, connect_after_bind) {
> - .handled = LANDLOCK_ACCESS_NET_BIND_TCP | LANDLOCK_ACCESS_NET_CONNECT_TCP,
> + /* clang-format on */
> + .handled = LANDLOCK_ACCESS_NET_BIND_TCP |
> + LANDLOCK_ACCESS_NET_CONNECT_TCP,
> .bind_base_first = true,
> .deny_connect = true,
> };
>
> -/* clang-format on */
> -
> /*
> * A denied TCP bind(2) or connect(2) emits one deny_access_net event. The port
> * is reported in the field matching the denied operation, in host endianness
> diff --git a/tools/testing/selftests/landlock/scoped_abstract_unix_test.c b/tools/testing/selftests/landlock/scoped_abstract_unix_test.c
> index eed684d4c364..54bc4081cd56 100644
> --- a/tools/testing/selftests/landlock/scoped_abstract_unix_test.c
> +++ b/tools/testing/selftests/landlock/scoped_abstract_unix_test.c
> @@ -1268,27 +1268,38 @@ FIXTURE_VARIANT(trace_unix) {
> size_t name_len;
> };
>
> -/* clang-format off */
> -
> /* Stream: sandboxed client connect() to an unsandboxed peer (peer_domain=0). */
> +/* clang-format off */
> FIXTURE_VARIANT_ADD(trace_unix, stream_denied) {
> - .sock_type = SOCK_STREAM, .sandbox = true,
> - .sandbox_target = false, .expect_denied = 1,
> + /* clang-format on */
> + .sock_type = SOCK_STREAM,
> + .sandbox = true,
> + .sandbox_target = false,
> + .expect_denied = 1,
> };
>
> /* Stream: peer socket owned by a domain, so peer_domain != 0. */
> +/* clang-format off */
> FIXTURE_VARIANT_ADD(trace_unix, stream_denied_scoped_peer) {
> - .sock_type = SOCK_STREAM, .sandbox = true,
> - .sandbox_target = true, .expect_denied = 1,
> + /* clang-format on */
> + .sock_type = SOCK_STREAM,
> + .sandbox = true,
> + .sandbox_target = true,
> + .expect_denied = 1,
> };
>
> /* Stream: unsandboxed client, connect() succeeds, no event. */
> +/* clang-format off */
> FIXTURE_VARIANT_ADD(trace_unix, stream_allowed) {
> - .sock_type = SOCK_STREAM, .sandbox = false,
> - .sandbox_target = false, .expect_denied = 0,
> + /* clang-format on */
> + .sock_type = SOCK_STREAM,
> + .sandbox = false,
> + .sandbox_target = false,
> + .expect_denied = 0,
> };
>
> /* Stream: lower abstract-name length boundary. */
> +/* clang-format off */
> FIXTURE_VARIANT_ADD(trace_unix, stream_denied_empty_name) {
> .sock_type = SOCK_STREAM,
> .sandbox = true,
> @@ -1297,9 +1308,12 @@ FIXTURE_VARIANT_ADD(trace_unix, stream_denied_empty_name) {
> .name = "",
> .name_len = 0,
> };
> +/* clang-format on */
>
> /* Stream: upper abstract-name length boundary. */
> +/* clang-format off */
> FIXTURE_VARIANT_ADD(trace_unix, stream_denied_max_name) {
> + /* clang-format on */
> .sock_type = SOCK_STREAM,
> .sandbox = true,
> .sandbox_target = false,
> @@ -1309,25 +1323,35 @@ FIXTURE_VARIANT_ADD(trace_unix, stream_denied_max_name) {
> };
>
> /* Datagram: sandboxed client sendto() an unsandboxed peer (peer_domain=0). */
> +/* clang-format off */
> FIXTURE_VARIANT_ADD(trace_unix, dgram_denied) {
> - .sock_type = SOCK_DGRAM, .sandbox = true,
> - .sandbox_target = false, .expect_denied = 1,
> + /* clang-format on */
> + .sock_type = SOCK_DGRAM,
> + .sandbox = true,
> + .sandbox_target = false,
> + .expect_denied = 1,
> };
>
> /* Datagram: peer socket owned by a domain, so peer_domain != 0. */
> +/* clang-format off */
> FIXTURE_VARIANT_ADD(trace_unix, dgram_denied_scoped_peer) {
> - .sock_type = SOCK_DGRAM, .sandbox = true,
> - .sandbox_target = true, .expect_denied = 1,
> + /* clang-format on */
> + .sock_type = SOCK_DGRAM,
> + .sandbox = true,
> + .sandbox_target = true,
> + .expect_denied = 1,
> };
>
> /* Datagram: unsandboxed client, sendto() succeeds, no event. */
> +/* clang-format off */
> FIXTURE_VARIANT_ADD(trace_unix, dgram_allowed) {
> - .sock_type = SOCK_DGRAM, .sandbox = false,
> - .sandbox_target = false, .expect_denied = 0,
> + /* clang-format on */
> + .sock_type = SOCK_DGRAM,
> + .sandbox = false,
> + .sandbox_target = false,
> + .expect_denied = 0,
> };
>
> -/* clang-format on */
> -
> /*
> * A sandboxed thread reaching an abstract unix socket peer through connect(2)
> * (stream) or sendto(2) (datagram) is denied and emits
> diff --git a/tools/testing/selftests/landlock/trace_test.c b/tools/testing/selftests/landlock/trace_test.c
> index afdaf8511b3a..a28a2ac55687 100644
> --- a/tools/testing/selftests/landlock/trace_test.c
> +++ b/tools/testing/selftests/landlock/trace_test.c
> @@ -1243,45 +1243,77 @@ FIXTURE_VARIANT(trace_enforce) {
> int no_new_privs;
> };
>
> -/* clang-format off */
> -
> /* Single thread, no flags: prctl-backed no_new_privs. */
> +/* clang-format off */
> FIXTURE_VARIANT_ADD(trace_enforce, single) {
> - .nthreads = 0, .flags = 0,
> - .total = 1, .complete = 1, .process_wide = 1, .no_new_privs = 1,
> + .nthreads = 0,
> + .flags = 0,
> + .total = 1,
> + .complete = 1,
> + .process_wide = 1,
> + .no_new_privs = 1,
> };
> +/* clang-format on */
>
> /* Single thread: the NO_NEW_PRIVS flag sets no_new_privs (no prctl). */
> +/* clang-format off */
> FIXTURE_VARIANT_ADD(trace_enforce, no_new_privs) {
> - .nthreads = 0, .flags = LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS,
> - .total = 1, .complete = 1, .process_wide = 1, .no_new_privs = 1,
> + .nthreads = 0,
> + .flags = LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS,
> + .total = 1,
> + .complete = 1,
> + .process_wide = 1,
> + .no_new_privs = 1,
> };
> +/* clang-format on */
>
> /* TSYNC on a lone thread still concludes, process-wide. */
> +/* clang-format off */
> FIXTURE_VARIANT_ADD(trace_enforce, tsync_single) {
> - .nthreads = 0, .flags = LANDLOCK_RESTRICT_SELF_TSYNC,
> - .total = 1, .complete = 1, .process_wide = 1, .no_new_privs = 1,
> + .nthreads = 0,
> + .flags = LANDLOCK_RESTRICT_SELF_TSYNC,
> + .total = 1,
> + .complete = 1,
> + .process_wide = 1,
> + .no_new_privs = 1,
> };
> +/* clang-format on */
>
> /* TSYNC sweeps N siblings; the caller's prctl-backed nnp propagates to all. */
> +/* clang-format off */
> FIXTURE_VARIANT_ADD(trace_enforce, tsync_multithread) {
> - .nthreads = 3, .flags = LANDLOCK_RESTRICT_SELF_TSYNC,
> - .total = 4, .complete = 1, .process_wide = 4, .no_new_privs = 4,
> + .nthreads = 3,
> + .flags = LANDLOCK_RESTRICT_SELF_TSYNC,
> + .total = 4,
> + .complete = 1,
> + .process_wide = 4,
> + .no_new_privs = 4,
> };
> +/* clang-format on */
>
> /* TSYNC + NO_NEW_PRIVS flag sets nnp on the caller and every swept sibling. */
> +/* clang-format off */
> FIXTURE_VARIANT_ADD(trace_enforce, tsync_no_new_privs) {
> + /* clang-format on */
> .nthreads = 3,
> - .flags = LANDLOCK_RESTRICT_SELF_TSYNC | LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS,
> - .total = 4, .complete = 1, .process_wide = 4, .no_new_privs = 4,
> + .flags = LANDLOCK_RESTRICT_SELF_TSYNC |
> + LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS,
> + .total = 4,
> + .complete = 1,
> + .process_wide = 4,
> + .no_new_privs = 4,
> };
>
> /* Non-TSYNC on a multi-threaded process enforces only the caller. */
> +/* clang-format off */
> FIXTURE_VARIANT_ADD(trace_enforce, multithread_non_tsync) {
> - .nthreads = 3, .flags = 0,
> - .total = 1, .complete = 1, .process_wide = 0, .no_new_privs = 1,
> + .nthreads = 3,
> + .flags = 0,
> + .total = 1,
> + .complete = 1,
> + .process_wide = 0,
> + .no_new_privs = 1,
> };
> -
> /* clang-format on */
>
> /*
> --
> 2.55.0
>
Reviewed-by: Günther Noack <gnoack@google.com>
prev parent reply other threads:[~2026-09-11 12:47 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-07 16:07 [PATCH v1 1/2] selftests/landlock: Fix trace variant formatting Mickaël Salaün
2026-09-07 16:07 ` [PATCH v1 2/2] selftests/landlock: Fix disconnected " Mickaël Salaün
2026-09-11 12:48 ` Günther Noack
2026-09-11 12:47 ` Günther Noack [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aqP4alTn-mtM3Heh@google.com \
--to=gnoack@google.com \
--cc=linux-security-module@vger.kernel.org \
--cc=mic@digikod.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).