[PATCH v5 20/24] selftests/landlock: Extend tests for landlock_restrict_self()'s flags

Mickaël Salaün
2025-01-31T16:31:58Z

Add the restrict_self_flags test suite to check that
LANDLOCK_RESTRICT_SELF_QUIET, LANDLOCK_RESTRICT_SELF_QUIET_SUBDOMAINS,
and LANDLOCK_RESTRICT_SELF_LOG_CROSS_EXEC are valid but not the next
bit. Also test flags incompatibility. Some checks are similar to
restrict_self_checks_ordering's ones.

Cc: Günther Noack <gnoack@google.com>
Cc: Paul Moore <paul@paul-moore.com>
Signed-off-by: Mickaël Salaün <mic@digikod.net>
Link: https://lore.kernel.org/r/20250131163059.1139617-21-mic@digikod.net
---

Changes since v4:
- Update with LANDLOCK_RESTRICT_SELF_QUIET_SUBDOMAINS, and
LANDLOCK_RESTRICT_SELF_LOG_CROSS_EXEC.

Changes since v3:
- Use a last_flag variable.

Changes since v2:
- New patch.
---
tools/testing/selftests/landlock/base_test.c | 41 ++++++++++++++++++++
1 file changed, 41 insertions(+)

diff --git a/tools/testing/selftests/landlock/base_test.c b/tools/testing/selftests/landlock/base_test.c
index fbd687691b3c..9e21f7535ab6 100644
--- a/tools/testing/selftests/landlock/base_test.c
+++ b/tools/testing/selftests/landlock/base_test.c
@@ -233,6 +233,47 @@ TEST(restrict_self_checks_ordering)
ASSERT_EQ(0, close(ruleset_fd));
}

+TEST(restrict_self_flags)
+{
+ const __u32 last_flag = LANDLOCK_RESTRICT_SELF_LOG_CROSS_EXEC;
+
+ /* Tests valid flag combinations. */
+
+ ASSERT_EQ(-1, landlock_restrict_self(-1, 0));
+ ASSERT_EQ(EBADF, errno);
+
+ ASSERT_EQ(-1, landlock_restrict_self(-1, LANDLOCK_RESTRICT_SELF_QUIET));
+ ASSERT_EQ(EBADF, errno);
+
+ ASSERT_EQ(-1, landlock_restrict_self(
+ -1, LANDLOCK_RESTRICT_SELF_QUIET_SUBDOMAINS));
+ ASSERT_EQ(EBADF, errno);
+
+ ASSERT_EQ(-1,
+ landlock_restrict_self(
+ -1, LANDLOCK_RESTRICT_SELF_QUIET |
+ LANDLOCK_RESTRICT_SELF_QUIET_SUBDOMAINS));
+ ASSERT_EQ(EBADF, errno);
+
+ ASSERT_EQ(-1, landlock_restrict_self(
+ -1, LANDLOCK_RESTRICT_SELF_LOG_CROSS_EXEC));
+ ASSERT_EQ(EBADF, errno);
+
+ /* Tests invalid flag combinations. */
+
+ ASSERT_EQ(-1,
+ landlock_restrict_self(
+ -1, LANDLOCK_RESTRICT_SELF_QUIET |
+ LANDLOCK_RESTRICT_SELF_LOG_CROSS_EXEC));
+ ASSERT_EQ(EINVAL, errno);
+
+ ASSERT_EQ(-1, landlock_restrict_self(-1, last_flag << 1));
+ ASSERT_EQ(EINVAL, errno);
+
+ ASSERT_EQ(-1, landlock_restrict_self(-1, -1));
+ ASSERT_EQ(EINVAL, errno);
+}
+
TEST(ruleset_fd_io)
{
struct landlock_ruleset_attr ruleset_attr = {
--
2.48.1