mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-05-17 11:55:00 -04:00
Code Issues Packages Projects Releases Wiki Activity

selftests/landlock: Audit test for LANDLOCK_ACCESS_FS_RESOLVE_UNIX

Browse Source 
Add an audit test to check that Landlock denials from
LANDLOCK_ACCESS_FS_RESOLVE_UNIX result in audit logs in the expected
format.  (There is one audit test for each filesystem access right, so
we should add one for LANDLOCK_ACCESS_FS_RESOLVE_UNIX as well.)

Signed-off-by: Günther Noack <gnoack3000@gmail.com>
Link: https://lore.kernel.org/r/20260327164838.38231-10-gnoack3000@gmail.com
Signed-off-by: Mickaël Salaün <mic@digikod.net>
This commit is contained in:
Günther Noack
2026-03-27 17:48:34 +01:00
committed by Mickaël Salaün
parent 9da41c65c9
commit 0f42f5be0b
1 changed files with 40 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
tools/testing/selftests/landlock/fs_test.c
View File

@@ -7961,6 +7961,46 @@ TEST_F(audit_layout1, ioctl_dev)
EXPECT_EQ(1, records.domain);
}
TEST_F(audit_layout1, resolve_unix)
{
struct audit_records records;
const char *const path = "sock";
int srv_fd, cli_fd, status;
pid_t child_pid;
srv_fd = set_up_named_unix_server(_metadata, SOCK_STREAM, path);
child_pid = fork();
ASSERT_LE(0, child_pid);
if (!child_pid) {
drop_access_rights(_metadata,
&(struct landlock_ruleset_attr){
.handled_access_fs = ACCESS_ALL,
});
cli_fd = socket(AF_UNIX, SOCK_STREAM, 0);
ASSERT_LE(0, cli_fd);
EXPECT_EQ(EACCES,
test_connect_named_unix(_metadata, cli_fd, path));
EXPECT_EQ(0, close(cli_fd));
_exit(_metadata->exit_code);
}
ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
EXPECT_EQ(1, WIFEXITED(status));
EXPECT_EQ(EXIT_SUCCESS, WEXITSTATUS(status));
EXPECT_EQ(0, matches_log_fs_extra(_metadata, self->audit_fd,
"fs\\.resolve_unix", path, NULL));
EXPECT_EQ(0, audit_count_records(self->audit_fd, &records));
EXPECT_EQ(0, records.access);
EXPECT_EQ(1, records.domain);
EXPECT_EQ(0, close(srv_fd));
}
TEST_F(audit_layout1, mount)
{
struct audit_records records;