Re: [PATCH v6 5/8] selftests/landlock: Add namespace restriction tests

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] selftests: comment for user_unprivileged variant contradicts kernel behavior and test assertions
--

commit c04f6fe328bef28c5a3925e2b7cac5095784c173
Author: Mickaël Salaün <mic@digikod.net>

selftests/landlock: Add namespace restriction tests

This commit introduces comprehensive tests for the new namespace use
permission in Landlock. It covers namespace creation via unshare and clone,
as well as entry via setns, along with their interactions with capability
restrictions and audit logging.

> diff --git a/tools/testing/selftests/landlock/ns_test.c b/tools/testing/selftests/landlock/ns_test.c
> new file mode 100644
> index 0000000000000..f5d4b86edd303
> --- /dev/null
> +++ b/tools/testing/selftests/landlock/ns_test.c
[ ... ]
> +/*
> + * User namespace creation while unprivileged: the process has no capabilities
> + * but unshare(CLONE_NEWUSER) is an unprivileged operation so it still succeeds.
> + * The Landlock rule allows it.  For setns, the capability check (CAP_SYS_ADMIN)
> + * fails first since the process has no capabilities, yielding EPERM.
> + */

[Severity: Low]
Is the documentation for the setns behavior accurate here?

The comment states that the capability check fails first, yielding EPERM.
However, because the test targets the process's own user namespace
(/proc/self/ns/user), userns_install() checks if the target namespace
is the current user namespace and returns -EINVAL before any capability
checks are performed.

The test implementation correctly handles this by forcing the expected
result to EINVAL for user namespace re-entry:

TEST_F(ns_create, setns)
{
        ...
        if (variant->namespace_types == CLONE_NEWUSER &&
            !variant->expected_result) {
                expected = EINVAL;
        ...

Does the comment need to be updated to match the actual EINVAL expectation
rather than EPERM?

> +/* clang-format off */
> +FIXTURE_VARIANT_ADD(ns_create, user_unprivileged) {
> +	/* clang-format on */
> +	.namespace_types = CLONE_NEWUSER,
> +	.is_sandboxed = true,
> +	.has_rule = true,
> +	.drop_all_caps = true,
> +	.expected_result = 0,
> +};

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261014082718.1435842-1-mic@digikod.net?part=5