Re: [PATCH v2 2/4] selftests/landlock: Test that layering does not break refer

["Mickaël Salaün" <mic@digikod.net>]

On Sun, Nov 08, 2026 at 09:23:49PM +0100, Günther Noack wrote:
> Regression test to exercise that layered Landlock domains do not
> accidentally deny the LANDLOCK_ACCESS_FS_REFER access right.  This
> used to be the case when layering a non-filesystem ruleset with a
> filesystem-enforcing ruleset.  In that case, REFER operations that
> would have been allowed for the individual rulesets would get denied
> when layering the same rulesets.
> 
> Link: https://github.com/landlock-lsm/linux/issues/67
> Link: https://github.com/landlock-lsm/go-landlock/issues/66
> Signed-off-by: Günther Noack <gnoack3000@gmail.com>

This test patch should also be backported (Cc stable@ + Fixes).

> ---
>  tools/testing/selftests/landlock/fs_test.c | 39 ++++++++++++++++++++++++++++++
>  1 file changed, 39 insertions(+)
> 
> diff --git a/tools/testing/selftests/landlock/fs_test.c b/tools/testing/selftests/landlock/fs_test.c
> index f725882fa4a7..b92cb988a39f 100644
> --- a/tools/testing/selftests/landlock/fs_test.c
> +++ b/tools/testing/selftests/landlock/fs_test.c
> @@ -2612,6 +2612,45 @@ TEST_F_FORK(layout1, refer_denied_by_default4)
>  				layer_dir_s1d1_refer);
>  }
>  
> +/*
> + * Regression test for layered domains: The two enforced Landlock layers both do
> + * not restrict the tested "refer" operations on their own, so they should also
> + * not restrict them when they are layered.
> + */
> +static void test_layering_does_not_break_refer(
> +	struct __test_metadata *const _metadata,
> +	const struct landlock_ruleset_attr *const non_fs_attr)
> +{
> +	ASSERT_EQ(0, unlink(file1_s1d2));
> +
> +	enforce_fs(_metadata, LANDLOCK_ACCESS_FS_REFER, layer_dir_s1d1_refer);
> +
> +	drop_access_rights(_metadata, non_fs_attr);
> +
> +	EXPECT_EQ(0, test_rename(file1_s1d1, file1_s1d2));
> +	EXPECT_EQ(0, test_rename(file1_s1d2, file1_s1d1));
> +	EXPECT_EQ(0, test_exchange(file2_s1d1, file2_s1d2));
> +	EXPECT_EQ(0, test_exchange(file2_s1d2, file2_s1d1));
> +}
> +
> +TEST_F_FORK(layout1, layering_with_net_does_not_break_refer)
> +{
> +	const struct landlock_ruleset_attr attr = {
> +		.handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP,
> +	};
> +
> +	test_layering_does_not_break_refer(_metadata, &attr);
> +}
> +
> +TEST_F_FORK(layout1, layering_with_scoped_does_not_break_refer)
> +{
> +	const struct landlock_ruleset_attr attr = {
> +		.scoped = LANDLOCK_SCOPE_SIGNAL,
> +	};
> +
> +	test_layering_does_not_break_refer(_metadata, &attr);
> +}

This looks good, but it would be better to also exercise both
layer-construction orders for non-FS categories (e.g. FS then scope, and
scope then FS).  That would confirm patch 3 is good.

> +
>  /*
>   * Tests walking through a denied root mount.
>   */
> 
> -- 
> 2.56.0
> 
>