From: "Günther Noack" <gnoack3000@gmail.com>
To: "Mickaël Salaün" <mic@digikod.net>
Cc: "Matthieu Baerts" <matttbe@kernel.org>,
"Mat Martineau" <martineau@kernel.org>,
"Geliang Tang" <geliang@kernel.org>,
"Mikhail Ivanov" <ivanov.mikhail1@huawei-partners.com>,
mptcp@lists.linux.dev, netdev@vger.kernel.org,
linux-security-module@vger.kernel.org,
"Günther Noack" <gnoack3000@gmail.com>
Subject: [PATCH 2/6] selftests/landlock: Generalize net test helpers for multiple socket types
Date: Sun, 30 Aug 2026 22:16:46 +0200 [thread overview]
Message-ID: <20260830201650.67050-3-gnoack3000@gmail.com> (raw)
In-Reply-To: <20260830201650.67050-1-gnoack3000@gmail.com>
Create helper methods for determining the access rights to be tested
based on socket type (TCP or UDP). This makes it simpler to add more
socket types with similar bind(2) and connect(2) restrictions in the
future.
Signed-off-by: Günther Noack <gnoack3000@gmail.com>
---
tools/testing/selftests/landlock/net_test.c | 85 +++++++++++----------
1 file changed, 46 insertions(+), 39 deletions(-)
diff --git a/tools/testing/selftests/landlock/net_test.c b/tools/testing/selftests/landlock/net_test.c
index a18761e0fd82..3a0482beca5f 100644
--- a/tools/testing/selftests/landlock/net_test.c
+++ b/tools/testing/selftests/landlock/net_test.c
@@ -108,11 +108,41 @@ static bool prot_is_udp(const struct protocol_variant *const prot)
static bool is_restricted(const struct protocol_variant *const prot,
const enum sandbox_type sandbox)
{
- if (sandbox == TCP_SANDBOX)
+ switch (sandbox) {
+ case TCP_SANDBOX:
return prot_is_tcp(prot);
- else if (sandbox == UDP_SANDBOX)
+ case UDP_SANDBOX:
return prot_is_udp(prot);
- return false;
+ case NO_SANDBOX:
+ default:
+ return false;
+ }
+}
+
+static __u64 sandbox_bind_access(const enum sandbox_type sandbox)
+{
+ switch (sandbox) {
+ case TCP_SANDBOX:
+ return LANDLOCK_ACCESS_NET_BIND_TCP;
+ case UDP_SANDBOX:
+ return LANDLOCK_ACCESS_NET_BIND_UDP;
+ case NO_SANDBOX:
+ default:
+ return 0;
+ }
+}
+
+static __u64 sandbox_connect_access(const enum sandbox_type sandbox)
+{
+ switch (sandbox) {
+ case TCP_SANDBOX:
+ return LANDLOCK_ACCESS_NET_CONNECT_TCP;
+ case UDP_SANDBOX:
+ return LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP;
+ case NO_SANDBOX:
+ default:
+ return 0;
+ }
}
static int socket_variant(const struct service_fixture *const srv)
@@ -916,16 +946,10 @@ static void test_bind_and_connect(struct __test_metadata *const _metadata,
TEST_F(protocol, bind)
{
- if (variant->sandbox == TCP_SANDBOX ||
- variant->sandbox == UDP_SANDBOX) {
- const __u64 bind_access =
- (variant->sandbox == TCP_SANDBOX ?
- LANDLOCK_ACCESS_NET_BIND_TCP :
- LANDLOCK_ACCESS_NET_BIND_UDP);
+ if (variant->sandbox != NO_SANDBOX) {
+ const __u64 bind_access = sandbox_bind_access(variant->sandbox);
const __u64 conn_access =
- (variant->sandbox == TCP_SANDBOX ?
- LANDLOCK_ACCESS_NET_CONNECT_TCP :
- LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP);
+ sandbox_connect_access(variant->sandbox);
const struct landlock_ruleset_attr ruleset_attr = {
.handled_access_net = bind_access | conn_access,
};
@@ -987,16 +1011,10 @@ TEST_F(protocol, bind)
TEST_F(protocol, connect)
{
- if (variant->sandbox == TCP_SANDBOX ||
- variant->sandbox == UDP_SANDBOX) {
- const __u64 bind_access =
- (variant->sandbox == TCP_SANDBOX ?
- LANDLOCK_ACCESS_NET_BIND_TCP :
- LANDLOCK_ACCESS_NET_BIND_UDP);
+ if (variant->sandbox != NO_SANDBOX) {
+ const __u64 bind_access = sandbox_bind_access(variant->sandbox);
const __u64 conn_access =
- (variant->sandbox == TCP_SANDBOX ?
- LANDLOCK_ACCESS_NET_CONNECT_TCP :
- LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP);
+ sandbox_connect_access(variant->sandbox);
const struct landlock_ruleset_attr ruleset_attr = {
.handled_access_net = bind_access | conn_access,
};
@@ -1054,9 +1072,7 @@ TEST_F(protocol, connect)
TEST_F(protocol, bind_unspec)
{
- const __u64 bind_access = (variant->sandbox == TCP_SANDBOX ?
- LANDLOCK_ACCESS_NET_BIND_TCP :
- LANDLOCK_ACCESS_NET_BIND_UDP);
+ const __u64 bind_access = sandbox_bind_access(variant->sandbox);
const struct landlock_ruleset_attr ruleset_attr = {
.handled_access_net = bind_access,
};
@@ -1066,8 +1082,7 @@ TEST_F(protocol, bind_unspec)
};
int bind_fd, ret;
- if (variant->sandbox == TCP_SANDBOX ||
- variant->sandbox == UDP_SANDBOX) {
+ if (variant->sandbox != NO_SANDBOX) {
const int ruleset_fd = landlock_create_ruleset(
&ruleset_attr, sizeof(ruleset_attr), 0);
ASSERT_LE(0, ruleset_fd);
@@ -1103,8 +1118,7 @@ TEST_F(protocol, bind_unspec)
}
EXPECT_EQ(0, close(bind_fd));
- if (variant->sandbox == TCP_SANDBOX ||
- variant->sandbox == UDP_SANDBOX) {
+ if (variant->sandbox != NO_SANDBOX) {
const int ruleset_fd = landlock_create_ruleset(
&ruleset_attr, sizeof(ruleset_attr), 0);
ASSERT_LE(0, ruleset_fd);
@@ -1150,13 +1164,8 @@ TEST_F(protocol, bind_unspec)
TEST_F(protocol, connect_unspec)
{
- const __u64 connect_right =
- (variant->sandbox == TCP_SANDBOX ?
- LANDLOCK_ACCESS_NET_CONNECT_TCP :
- LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP);
- const __u64 bind_right = (variant->sandbox == TCP_SANDBOX ?
- LANDLOCK_ACCESS_NET_BIND_TCP :
- LANDLOCK_ACCESS_NET_BIND_UDP);
+ const __u64 connect_right = sandbox_connect_access(variant->sandbox);
+ const __u64 bind_right = sandbox_bind_access(variant->sandbox);
const struct landlock_ruleset_attr ruleset_conn = {
.handled_access_net = connect_right,
};
@@ -1197,8 +1206,7 @@ TEST_F(protocol, connect_unspec)
EXPECT_EQ(0, ret);
}
- if (variant->sandbox == TCP_SANDBOX ||
- variant->sandbox == UDP_SANDBOX) {
+ if (variant->sandbox != NO_SANDBOX) {
const int ruleset_fd = landlock_create_ruleset(
&ruleset_conn, sizeof(ruleset_conn), 0);
ASSERT_LE(0, ruleset_fd);
@@ -1229,8 +1237,7 @@ TEST_F(protocol, connect_unspec)
EXPECT_EQ(0, ret);
}
- if (variant->sandbox == TCP_SANDBOX ||
- variant->sandbox == UDP_SANDBOX) {
+ if (variant->sandbox != NO_SANDBOX) {
const int ruleset_fd = landlock_create_ruleset(
&ruleset_conn_bind, sizeof(ruleset_conn_bind),
0);
--
2.55.0
next prev parent reply other threads:[~2026-08-30 20:17 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-30 20:16 [PATCH 0/6] landlock: Support MPTCP bind and connect restrictions Günther Noack
2026-08-30 20:16 ` [PATCH 1/6] samples/landlock: Implement best-effort fallback for network rules Günther Noack
2026-08-30 20:16 ` Günther Noack [this message]
2026-08-30 20:16 ` [PATCH 3/6] landlock: Add MPTCP bind and connect access rights Günther Noack
2026-08-31 4:09 ` Geliang Tang
2026-08-30 20:16 ` [PATCH 4/6] selftests/landlock: Add MPTCP network access tests Günther Noack
2026-08-30 20:16 ` [PATCH 5/6] samples/landlock: Support MPTCP access rights Günther Noack
2026-08-30 20:16 ` [PATCH 6/6] landlock: Document " Günther Noack
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260830201650.67050-3-gnoack3000@gmail.com \
--to=gnoack3000@gmail.com \
--cc=geliang@kernel.org \
--cc=ivanov.mikhail1@huawei-partners.com \
--cc=linux-security-module@vger.kernel.org \
--cc=martineau@kernel.org \
--cc=matttbe@kernel.org \
--cc=mic@digikod.net \
--cc=mptcp@lists.linux.dev \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox