Add the restrict_self_flags test suite to check that LANDLOCK_RESTRICT_SELF_QUIET, LANDLOCK_RESTRICT_SELF_QUIET_SUBDOMAINS, and LANDLOCK_RESTRICT_SELF_LOG_CROSS_EXEC are valid but not the next bit. Also test flags incompatibility. Some checks are similar to restrict_self_checks_ordering's ones.
Cc: Günther Noack <[email protected]> Cc: Paul Moore <[email protected]> Signed-off-by: Mickaël Salaün <[email protected]> Link: https://lore.kernel.org/r/[email protected] --- Changes since v4: - Update with LANDLOCK_RESTRICT_SELF_QUIET_SUBDOMAINS, and LANDLOCK_RESTRICT_SELF_LOG_CROSS_EXEC. Changes since v3: - Use a last_flag variable. Changes since v2: - New patch. --- tools/testing/selftests/landlock/base_test.c | 41 ++++++++++++++++++++ 1 file changed, 41 insertions(+) diff --git a/tools/testing/selftests/landlock/base_test.c b/tools/testing/selftests/landlock/base_test.c index fbd687691b3c..9e21f7535ab6 100644 --- a/tools/testing/selftests/landlock/base_test.c +++ b/tools/testing/selftests/landlock/base_test.c @@ -233,6 +233,47 @@ TEST(restrict_self_checks_ordering) ASSERT_EQ(0, close(ruleset_fd)); } +TEST(restrict_self_flags) +{ + const __u32 last_flag = LANDLOCK_RESTRICT_SELF_LOG_CROSS_EXEC; + + /* Tests valid flag combinations. */ + + ASSERT_EQ(-1, landlock_restrict_self(-1, 0)); + ASSERT_EQ(EBADF, errno); + + ASSERT_EQ(-1, landlock_restrict_self(-1, LANDLOCK_RESTRICT_SELF_QUIET)); + ASSERT_EQ(EBADF, errno); + + ASSERT_EQ(-1, landlock_restrict_self( + -1, LANDLOCK_RESTRICT_SELF_QUIET_SUBDOMAINS)); + ASSERT_EQ(EBADF, errno); + + ASSERT_EQ(-1, + landlock_restrict_self( + -1, LANDLOCK_RESTRICT_SELF_QUIET | + LANDLOCK_RESTRICT_SELF_QUIET_SUBDOMAINS)); + ASSERT_EQ(EBADF, errno); + + ASSERT_EQ(-1, landlock_restrict_self( + -1, LANDLOCK_RESTRICT_SELF_LOG_CROSS_EXEC)); + ASSERT_EQ(EBADF, errno); + + /* Tests invalid flag combinations. */ + + ASSERT_EQ(-1, + landlock_restrict_self( + -1, LANDLOCK_RESTRICT_SELF_QUIET | + LANDLOCK_RESTRICT_SELF_LOG_CROSS_EXEC)); + ASSERT_EQ(EINVAL, errno); + + ASSERT_EQ(-1, landlock_restrict_self(-1, last_flag << 1)); + ASSERT_EQ(EINVAL, errno); + + ASSERT_EQ(-1, landlock_restrict_self(-1, -1)); + ASSERT_EQ(EINVAL, errno); +} + TEST(ruleset_fd_io) { struct landlock_ruleset_attr ruleset_attr = { -- 2.48.1
