Re: [PATCH 2/6] selftests/landlock: Generalize net test helpers for multiple socket types

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Incomplete refactoring: Several test fixtures retain hardcoded TCP/UDP checks instead of using the newly introduced generalized sandbox access helpers.
--

commit e9dd22f54640c7d9439f23efd0049803e698947e
Author: Günther Noack <gnoack3000@gmail.com>

selftests/landlock: Generalize net test helpers for multiple socket types

Create helper methods for determining the access rights to be tested
based on socket type (TCP or UDP). This makes it simpler to add more
socket types with similar bind(2) and connect(2) restrictions in the
future.

> diff --git a/tools/testing/selftests/landlock/net_test.c b/tools/testing/selftests/landlock/net_test.c
> index a18761e0fd82f..3a0482beca5f4 100644
> --- a/tools/testing/selftests/landlock/net_test.c
> +++ b/tools/testing/selftests/landlock/net_test.c
[ ... ]
> @@ -108,11 +108,41 @@ static bool prot_is_udp(const struct protocol_variant *const prot)
>  static bool is_restricted(const struct protocol_variant *const prot,
>  			  const enum sandbox_type sandbox)
>  {
> -	if (sandbox == TCP_SANDBOX)
> +	switch (sandbox) {
> +	case TCP_SANDBOX:
>  		return prot_is_tcp(prot);
> -	else if (sandbox == UDP_SANDBOX)
> +	case UDP_SANDBOX:
>  		return prot_is_udp(prot);
> -	return false;
> +	case NO_SANDBOX:
> +	default:
> +		return false;
> +	}
> +}
> +
> +static __u64 sandbox_bind_access(const enum sandbox_type sandbox)
> +{
> +	switch (sandbox) {
> +	case TCP_SANDBOX:
> +		return LANDLOCK_ACCESS_NET_BIND_TCP;
> +	case UDP_SANDBOX:
> +		return LANDLOCK_ACCESS_NET_BIND_UDP;
> +	case NO_SANDBOX:
> +	default:
> +		return 0;
> +	}
> +}
> +
> +static __u64 sandbox_connect_access(const enum sandbox_type sandbox)
> +{
> +	switch (sandbox) {
> +	case TCP_SANDBOX:
> +		return LANDLOCK_ACCESS_NET_CONNECT_TCP;
> +	case UDP_SANDBOX:
> +		return LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP;
> +	case NO_SANDBOX:
> +	default:
> +		return 0;
> +	}
>  }

[Severity: Medium]
Are there other test fixtures that also need to be updated to use these new
helpers?

It looks like TEST_F(ipv4, from_unix_to_inet), TEST_F(port_specific,
bind_connect_zero), and TEST_F(port_specific, bind_connect_1023) still use
the hardcoded TCP_SANDBOX and UDP_SANDBOX checks instead of the generalized
sandbox access helpers:

tools/testing/selftests/landlock/net_test.c:TEST_F(ipv4, from_unix_to_inet)() {
    ...
	if (variant->sandbox == TCP_SANDBOX ||
	    variant->sandbox == UDP_SANDBOX) {
		const __u64 access_rights =
			(variant->sandbox == TCP_SANDBOX ?
				 LANDLOCK_ACCESS_NET_BIND_TCP |
					 LANDLOCK_ACCESS_NET_CONNECT_TCP :
				 LANDLOCK_ACCESS_NET_BIND_UDP |
					 LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP);
    ...
}

Will this cause these tests to silently skip ruleset application or incorrectly
fail if a new sandbox variant (such as MPTCP) is added in the future?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260830201650.67050-1-gnoack3000@gmail.com?part=2