In cases where a syscall is expected to fail, but unexpectedly succeeds, the resulting errno is undefined and we should not proceed to check the errno. Replace EXPECT* with ASSERT* macros for syscall invocations where this is the case, so that we abort the tests early in such cases.
In the errata test, check errno with EXPECT after the combined VERSION and ERRATA flags, since nothing depends on it. Assisted-by: LLM Signed-off-by: Günther Noack <[email protected]> --- tools/testing/selftests/landlock/audit_test.c | 8 +-- tools/testing/selftests/landlock/base_test.c | 40 +++++++-------- tools/testing/selftests/landlock/fs_test.c | 50 +++++++++---------- tools/testing/selftests/landlock/net_test.c | 24 ++++----- .../testing/selftests/landlock/ptrace_test.c | 14 +++--- .../landlock/scoped_abstract_unix_test.c | 14 +++--- 6 files changed, 75 insertions(+), 75 deletions(-) diff --git a/tools/testing/selftests/landlock/audit_test.c b/tools/testing/selftests/landlock/audit_test.c index b38d0c5d5869..392e75ddfa3c 100644 --- a/tools/testing/selftests/landlock/audit_test.c +++ b/tools/testing/selftests/landlock/audit_test.c @@ -100,7 +100,7 @@ TEST_F(audit, layers) EXPECT_EQ(0, landlock_restrict_self(ruleset_fd, 0)); /* Creates a denial to get the domain ID. */ - EXPECT_EQ(-1, kill(getppid(), 0)); + ASSERT_EQ(-1, kill(getppid(), 0)); EXPECT_EQ(EPERM, errno); EXPECT_EQ(0, matches_log_signal(_metadata, self->audit_fd, @@ -119,7 +119,7 @@ TEST_F(audit, layers) } /* Checks that we reached the maximum number of layers. */ - EXPECT_EQ(-1, landlock_restrict_self(ruleset_fd, 0)); + ASSERT_EQ(-1, landlock_restrict_self(ruleset_fd, 0)); EXPECT_EQ(E2BIG, errno); /* Updates filter rules to match the drop record. */ @@ -711,7 +711,7 @@ TEST_F(audit_flags, signal) EXPECT_EQ(0, close(ruleset_fd)); /* First signal checks to test log entries. */ - EXPECT_EQ(-1, kill(getppid(), 0)); + ASSERT_EQ(-1, kill(getppid(), 0)); EXPECT_EQ(EPERM, errno); if (!expect_audit) { @@ -736,7 +736,7 @@ TEST_F(audit_flags, signal) } /* Second signal checks to test audit_count_records(). */ - EXPECT_EQ(-1, kill(getppid(), 0)); + ASSERT_EQ(-1, kill(getppid(), 0)); EXPECT_EQ(EPERM, errno); /* Makes sure there is no superfluous logged records. */ diff --git a/tools/testing/selftests/landlock/base_test.c b/tools/testing/selftests/landlock/base_test.c index 5f10300a60cd..c19aa20609d6 100644 --- a/tools/testing/selftests/landlock/base_test.c +++ b/tools/testing/selftests/landlock/base_test.c @@ -136,7 +136,7 @@ TEST(errata) NULL, 0, LANDLOCK_CREATE_RULESET_VERSION | LANDLOCK_CREATE_RULESET_ERRATA)); - ASSERT_EQ(EINVAL, errno); + EXPECT_EQ(EINVAL, errno); ASSERT_EQ(-1, landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_ERRATA | @@ -333,7 +333,7 @@ TEST(restrict_self_fd) fd = open("/dev/null", O_RDONLY | O_CLOEXEC); ASSERT_LE(0, fd); - EXPECT_EQ(-1, landlock_restrict_self(fd, 0)); + ASSERT_EQ(-1, landlock_restrict_self(fd, 0)); EXPECT_EQ(EBADFD, errno); EXPECT_EQ(0, close(fd)); @@ -350,12 +350,12 @@ TEST(restrict_self_fd_flags) * LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF accepts -1 but not any file * descriptor. */ - EXPECT_EQ(-1, landlock_restrict_self( + ASSERT_EQ(-1, landlock_restrict_self( fd, LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF)); EXPECT_EQ(EBADFD, errno); /* LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS requires a ruleset FD. */ - EXPECT_EQ(-1, landlock_restrict_self( + ASSERT_EQ(-1, landlock_restrict_self( fd, LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS)); EXPECT_EQ(EBADFD, errno); @@ -368,40 +368,40 @@ TEST(restrict_self_flags) /* Tests invalid flag combinations. */ - EXPECT_EQ(-1, landlock_restrict_self(-1, last_flag << 1)); + ASSERT_EQ(-1, landlock_restrict_self(-1, last_flag << 1)); EXPECT_EQ(EINVAL, errno); - EXPECT_EQ(-1, landlock_restrict_self(-1, -1)); + ASSERT_EQ(-1, landlock_restrict_self(-1, -1)); EXPECT_EQ(EINVAL, errno); /* Tests valid flag combinations. */ - EXPECT_EQ(-1, landlock_restrict_self(-1, 0)); + ASSERT_EQ(-1, landlock_restrict_self(-1, 0)); EXPECT_EQ(EBADF, errno); - EXPECT_EQ(-1, landlock_restrict_self( + ASSERT_EQ(-1, landlock_restrict_self( -1, LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF)); EXPECT_EQ(EBADF, errno); - EXPECT_EQ(-1, + ASSERT_EQ(-1, landlock_restrict_self( -1, LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF | LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF)); EXPECT_EQ(EBADF, errno); - EXPECT_EQ(-1, + ASSERT_EQ(-1, landlock_restrict_self( -1, LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON | LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF)); EXPECT_EQ(EBADF, errno); - EXPECT_EQ(-1, landlock_restrict_self( + ASSERT_EQ(-1, landlock_restrict_self( -1, LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON)); EXPECT_EQ(EBADF, errno); - EXPECT_EQ(-1, + ASSERT_EQ(-1, landlock_restrict_self( -1, LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF | LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON)); @@ -409,18 +409,18 @@ TEST(restrict_self_flags) /* LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS requires a ruleset FD. */ - EXPECT_EQ(-1, landlock_restrict_self( + ASSERT_EQ(-1, landlock_restrict_self( -1, LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS)); EXPECT_EQ(EBADF, errno); - EXPECT_EQ(-1, landlock_restrict_self( + ASSERT_EQ(-1, landlock_restrict_self( -1, LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF | LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS)); EXPECT_EQ(EBADF, errno); /* Tests with an invalid ruleset_fd. */ - EXPECT_EQ(-1, landlock_restrict_self( + ASSERT_EQ(-1, landlock_restrict_self( -2, LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF)); EXPECT_EQ(EBADF, errno); @@ -446,7 +446,7 @@ TEST(restrict_self_no_new_privs) ASSERT_EQ(0, prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0)); /* Checks that a failed call does not set no_new_privs. */ - EXPECT_EQ(-1, landlock_restrict_self( + ASSERT_EQ(-1, landlock_restrict_self( -1, LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS)); EXPECT_EQ(EBADF, errno); EXPECT_EQ(0, prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0)); @@ -577,7 +577,7 @@ TEST(cred_transfer) EXPECT_EQ(0, close(ruleset_fd)); /* Checks ruleset enforcement. */ - EXPECT_EQ(-1, open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC)); + ASSERT_EQ(-1, open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC)); EXPECT_EQ(EACCES, errno); /* Needed for KEYCTL_SESSION_TO_PARENT permission checks */ @@ -591,7 +591,7 @@ TEST(cred_transfer) ASSERT_LE(0, child); if (child == 0) { /* Checks ruleset enforcement. */ - EXPECT_EQ(-1, open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC)); + ASSERT_EQ(-1, open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC)); EXPECT_EQ(EACCES, errno); /* @@ -610,7 +610,7 @@ TEST(cred_transfer) 0, 0, 0)); /* Re-checks ruleset enforcement. */ - EXPECT_EQ(-1, open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC)); + ASSERT_EQ(-1, open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC)); EXPECT_EQ(EACCES, errno); _exit(_metadata->exit_code); @@ -622,7 +622,7 @@ TEST(cred_transfer) EXPECT_EQ(EXIT_SUCCESS, WEXITSTATUS(status)); /* Re-checks ruleset enforcement. */ - EXPECT_EQ(-1, open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC)); + ASSERT_EQ(-1, open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC)); EXPECT_EQ(EACCES, errno); } diff --git a/tools/testing/selftests/landlock/fs_test.c b/tools/testing/selftests/landlock/fs_test.c index ba3b39ad5882..c73a438e088f 100644 --- a/tools/testing/selftests/landlock/fs_test.c +++ b/tools/testing/selftests/landlock/fs_test.c @@ -678,7 +678,7 @@ TEST_F_FORK(layout0, rule_with_unknown_access) for (access = 1ULL << 63; access != ACCESS_LAST; access >>= 1) { path_beneath.allowed_access = access; - EXPECT_EQ(-1, landlock_add_rule(ruleset_fd, + ASSERT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH, &path_beneath, 0)); EXPECT_EQ(EINVAL, errno); @@ -712,7 +712,7 @@ TEST_F_FORK(layout1, rule_with_unhandled_access) if (access == ruleset_attr.handled_access_fs) { EXPECT_EQ(0, err); } else { - EXPECT_EQ(-1, err); + ASSERT_EQ(-1, err); EXPECT_EQ(EINVAL, errno); } } @@ -2069,7 +2069,7 @@ TEST_F_FORK(layout1, umount_sandboxer) /* Tests that the sandboxer is tied to its mount point. */ set_cap(_metadata, CAP_SYS_ADMIN); - EXPECT_EQ(-1, umount(dir_s3d2)); + ASSERT_EQ(-1, umount(dir_s3d2)); EXPECT_EQ(EBUSY, errno); clear_cap(_metadata, CAP_SYS_ADMIN); @@ -2264,7 +2264,7 @@ TEST_F_FORK(layout1, rename_whiteout_denied) * file1_s3d3 is in dir_s3d2 (tmpfs), so it supports RENAME_WHITEOUT. * Denied, because whiteout creation is guarded with MAKE_REG. */ - EXPECT_EQ(-1, renameat2(AT_FDCWD, file1_s3d3, AT_FDCWD, + ASSERT_EQ(-1, renameat2(AT_FDCWD, file1_s3d3, AT_FDCWD, TMP_DIR "/s3d1/s3d2/s3d3/f2", RENAME_WHITEOUT)); EXPECT_EQ(EACCES, errno); } @@ -2354,7 +2354,7 @@ TEST_F_FORK(layout1, rename_whiteout_reparenting) * there, even though it is granted in the destination directory * dir_s3d3. */ - EXPECT_EQ(-1, renameat2(AT_FDCWD, file1_s3d4, AT_FDCWD, + ASSERT_EQ(-1, renameat2(AT_FDCWD, file1_s3d4, AT_FDCWD, TMP_DIR "/s3d1/s3d2/s3d3/f2", RENAME_WHITEOUT)); EXPECT_EQ(EACCES, errno); @@ -2404,7 +2404,7 @@ TEST_F_FORK(layout1, rename_whiteout_exchange) * dir_s3d4, even though it is granted in the whiteout object's own * directory dir_s3d3. */ - EXPECT_EQ(-1, renameat2(AT_FDCWD, file1_s3d4, AT_FDCWD, whiteout_s3d3, + ASSERT_EQ(-1, renameat2(AT_FDCWD, file1_s3d4, AT_FDCWD, whiteout_s3d3, RENAME_EXCHANGE)); EXPECT_EQ(EACCES, errno); @@ -2637,11 +2637,11 @@ TEST_F_FORK(layout1, refer_mount_root_deny) enforce_fs(_metadata, LANDLOCK_ACCESS_FS_MAKE_DIR, NULL); /* Link denied by Landlock: EACCES. */ - EXPECT_EQ(-1, linkat(root_fd, ".", root_fd, "does_not_exist", 0)); + ASSERT_EQ(-1, linkat(root_fd, ".", root_fd, "does_not_exist", 0)); EXPECT_EQ(EACCES, errno); /* renameat2() always returns EBUSY. */ - EXPECT_EQ(-1, renameat2(root_fd, ".", root_fd, "does_not_exist", 0)); + ASSERT_EQ(-1, renameat2(root_fd, ".", root_fd, "does_not_exist", 0)); EXPECT_EQ(EBUSY, errno); EXPECT_EQ(0, close(root_fd)); @@ -5398,14 +5398,14 @@ TEST_F_FORK(layout1_bind, path_disconnected_rename) * Tests that access widening checks indeed prevents us from renaming it * back. */ - EXPECT_EQ(-1, rename(dir_s4d2, dir_s1d3)); + ASSERT_EQ(-1, rename(dir_s4d2, dir_s1d3)); EXPECT_EQ(EXDEV, errno); /* * Including through the now disconnected fd (but it should return * EXDEV). */ - EXPECT_EQ(-1, renameat(bind_s1d3_fd, file1_name, AT_FDCWD, + ASSERT_EQ(-1, renameat(bind_s1d3_fd, file1_name, AT_FDCWD, file1_s2d2)); EXPECT_EQ(EXDEV, errno); _exit(_metadata->exit_code); @@ -7630,12 +7630,12 @@ TEST_F(audit_layout1, remove_dir) enforce_fs(_metadata, ACCESS_ALL, NULL); - EXPECT_EQ(-1, rmdir(dir_s1d3)); + ASSERT_EQ(-1, rmdir(dir_s1d3)); EXPECT_EQ(EACCES, errno); EXPECT_EQ(0, matches_log_fs(_metadata, self->audit_fd, "fs\\.remove_dir", dir_s1d2)); - EXPECT_EQ(-1, unlinkat(AT_FDCWD, dir_s1d3, AT_REMOVEDIR)); + ASSERT_EQ(-1, unlinkat(AT_FDCWD, dir_s1d3, AT_REMOVEDIR)); EXPECT_EQ(EACCES, errno); EXPECT_EQ(0, matches_log_fs(_metadata, self->audit_fd, "fs\\.remove_dir", dir_s1d2)); @@ -7651,7 +7651,7 @@ TEST_F(audit_layout1, remove_file) enforce_fs(_metadata, ACCESS_ALL, NULL); - EXPECT_EQ(-1, unlink(file1_s1d3)); + ASSERT_EQ(-1, unlink(file1_s1d3)); EXPECT_EQ(EACCES, errno); EXPECT_EQ(0, matches_log_fs(_metadata, self->audit_fd, "fs\\.remove_file", dir_s1d3)); @@ -7669,7 +7669,7 @@ TEST_F(audit_layout1, make_char) enforce_fs(_metadata, ACCESS_ALL, NULL); - EXPECT_EQ(-1, mknod(file1_s1d3, S_IFCHR | 0644, makedev(7, 0))); + ASSERT_EQ(-1, mknod(file1_s1d3, S_IFCHR | 0644, makedev(7, 0))); EXPECT_EQ(EACCES, errno); EXPECT_EQ(0, matches_log_fs(_metadata, self->audit_fd, "fs\\.make_char", dir_s1d3)); @@ -7688,7 +7688,7 @@ TEST_F(audit_layout1, make_whiteout) enforce_fs(_metadata, ACCESS_ALL, NULL); /* Whiteout creation is denied and logged as fs.make_reg. */ - EXPECT_EQ(-1, mknod(file1_s1d3, S_IFCHR | 0644, makedev(0, 0))); + ASSERT_EQ(-1, mknod(file1_s1d3, S_IFCHR | 0644, makedev(0, 0))); EXPECT_EQ(EACCES, errno); EXPECT_EQ(0, matches_log_fs(_metadata, self->audit_fd, "fs\\.make_reg", dir_s1d3)); @@ -7706,7 +7706,7 @@ TEST_F(audit_layout1, make_dir) enforce_fs(_metadata, ACCESS_ALL, NULL); - EXPECT_EQ(-1, mkdir(file1_s1d3, 0755)); + ASSERT_EQ(-1, mkdir(file1_s1d3, 0755)); EXPECT_EQ(EACCES, errno); EXPECT_EQ(0, matches_log_fs(_metadata, self->audit_fd, "fs\\.make_dir", dir_s1d3)); @@ -7724,7 +7724,7 @@ TEST_F(audit_layout1, make_reg) enforce_fs(_metadata, ACCESS_ALL, NULL); - EXPECT_EQ(-1, mknod(file1_s1d3, S_IFREG | 0644, 0)); + ASSERT_EQ(-1, mknod(file1_s1d3, S_IFREG | 0644, 0)); EXPECT_EQ(EACCES, errno); EXPECT_EQ(0, matches_log_fs(_metadata, self->audit_fd, "fs\\.make_reg", dir_s1d3)); @@ -7742,7 +7742,7 @@ TEST_F(audit_layout1, make_sock) enforce_fs(_metadata, ACCESS_ALL, NULL); - EXPECT_EQ(-1, mknod(file1_s1d3, S_IFSOCK | 0644, 0)); + ASSERT_EQ(-1, mknod(file1_s1d3, S_IFSOCK | 0644, 0)); EXPECT_EQ(EACCES, errno); EXPECT_EQ(0, matches_log_fs(_metadata, self->audit_fd, "fs\\.make_sock", dir_s1d3)); @@ -7760,7 +7760,7 @@ TEST_F(audit_layout1, make_fifo) enforce_fs(_metadata, ACCESS_ALL, NULL); - EXPECT_EQ(-1, mknod(file1_s1d3, S_IFIFO | 0644, 0)); + ASSERT_EQ(-1, mknod(file1_s1d3, S_IFIFO | 0644, 0)); EXPECT_EQ(EACCES, errno); EXPECT_EQ(0, matches_log_fs(_metadata, self->audit_fd, "fs\\.make_fifo", dir_s1d3)); @@ -7778,7 +7778,7 @@ TEST_F(audit_layout1, make_block) enforce_fs(_metadata, ACCESS_ALL, NULL); - EXPECT_EQ(-1, mknod(file1_s1d3, S_IFBLK | 0644, 0)); + ASSERT_EQ(-1, mknod(file1_s1d3, S_IFBLK | 0644, 0)); EXPECT_EQ(EACCES, errno); EXPECT_EQ(0, matches_log_fs(_metadata, self->audit_fd, "fs\\.make_block", dir_s1d3)); @@ -7796,7 +7796,7 @@ TEST_F(audit_layout1, make_sym) enforce_fs(_metadata, ACCESS_ALL, NULL); - EXPECT_EQ(-1, symlink("target", file1_s1d3)); + ASSERT_EQ(-1, symlink("target", file1_s1d3)); EXPECT_EQ(EACCES, errno); EXPECT_EQ(0, matches_log_fs(_metadata, self->audit_fd, "fs\\.make_sym", dir_s1d3)); @@ -7814,7 +7814,7 @@ TEST_F(audit_layout1, refer_handled) enforce_fs(_metadata, LANDLOCK_ACCESS_FS_REFER, NULL); - EXPECT_EQ(-1, link(file1_s1d1, file1_s1d3)); + ASSERT_EQ(-1, link(file1_s1d1, file1_s1d3)); EXPECT_EQ(EXDEV, errno); EXPECT_EQ(0, matches_log_fs(_metadata, self->audit_fd, "fs\\.refer", dir_s1d1)); @@ -7838,7 +7838,7 @@ TEST_F(audit_layout1, refer_make) LANDLOCK_ACCESS_FS_MAKE_REG | LANDLOCK_ACCESS_FS_REFER, NULL); - EXPECT_EQ(-1, link(file1_s1d1, file1_s1d3)); + ASSERT_EQ(-1, link(file1_s1d1, file1_s1d3)); EXPECT_EQ(EACCES, errno); EXPECT_EQ(0, matches_log_fs(_metadata, self->audit_fd, "fs\\.refer", dir_s1d1)); @@ -7935,7 +7935,7 @@ TEST_F(audit_layout1, truncate) enforce_fs(_metadata, ACCESS_ALL, NULL); - EXPECT_EQ(-1, truncate(file1_s1d3, 0)); + ASSERT_EQ(-1, truncate(file1_s1d3, 0)); EXPECT_EQ(EACCES, errno); EXPECT_EQ(0, matches_log_fs(_metadata, self->audit_fd, "fs\\.truncate", file1_s1d3)); @@ -8008,7 +8008,7 @@ TEST_F(audit_layout1, mount) enforce_fs(_metadata, LANDLOCK_ACCESS_FS_EXECUTE, NULL); set_cap(_metadata, CAP_SYS_ADMIN); - EXPECT_EQ(-1, mount(NULL, dir_s3d2, NULL, MS_RDONLY, NULL)); + ASSERT_EQ(-1, mount(NULL, dir_s3d2, NULL, MS_RDONLY, NULL)); EXPECT_EQ(EPERM, errno); clear_cap(_metadata, CAP_SYS_ADMIN); EXPECT_EQ(0, matches_log_fs(_metadata, self->audit_fd, diff --git a/tools/testing/selftests/landlock/net_test.c b/tools/testing/selftests/landlock/net_test.c index 563e2214390b..51bcb4740dde 100644 --- a/tools/testing/selftests/landlock/net_test.c +++ b/tools/testing/selftests/landlock/net_test.c @@ -1361,11 +1361,11 @@ TEST_F(protocol, tcp_fastopen) } if (restricted) { - EXPECT_EQ(-1, read(client_fd, &buf, 1)); + ASSERT_EQ(-1, read(client_fd, &buf, 1)); EXPECT_EQ(ENOTCONN, errno); } else if (self->srv0.protocol.domain == AF_UNIX && self->srv0.protocol.type == SOCK_STREAM) { - EXPECT_EQ(-1, read(client_fd, &buf, 1)); + ASSERT_EQ(-1, read(client_fd, &buf, 1)); EXPECT_EQ(EINVAL, errno); } else { EXPECT_EQ(1, read(client_fd, &buf, 1)); @@ -2261,7 +2261,7 @@ TEST_F(mini, ruleset_with_unknown_access) .handled_access_net = access_mask, }; - EXPECT_EQ(-1, landlock_create_ruleset(&ruleset_attr, + ASSERT_EQ(-1, landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0)); EXPECT_EQ(EINVAL, errno); } @@ -2284,7 +2284,7 @@ TEST_F(mini, rule_with_unknown_access) for (access = 1ULL << 63; access != ACCESS_LAST; access >>= 1) { net_port.allowed_access = access; - EXPECT_EQ(-1, + ASSERT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &net_port, 0)); EXPECT_EQ(EINVAL, errno); @@ -2316,7 +2316,7 @@ TEST_F(mini, rule_with_unhandled_access) if (access == ruleset_attr.handled_access_net) { EXPECT_EQ(0, err); } else { - EXPECT_EQ(-1, err); + ASSERT_EQ(-1, err); EXPECT_EQ(EINVAL, errno); } } @@ -2349,12 +2349,12 @@ TEST_F(mini, inval) ASSERT_LE(0, ruleset_fd); /* Checks unhandled allowed_access. */ - EXPECT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, + ASSERT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &tcp_bind_connect, 0)); EXPECT_EQ(EINVAL, errno); /* Checks zero access value. */ - EXPECT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, + ASSERT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &tcp_denied, 0)); EXPECT_EQ(ENOMSG, errno); @@ -2414,15 +2414,15 @@ TEST_F(mini, tcp_port_overflow) ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &port_max_bind, 0)); - EXPECT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, + ASSERT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &port_overflow1, 0)); EXPECT_EQ(EINVAL, errno); - EXPECT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, + ASSERT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &port_overflow2, 0)); EXPECT_EQ(EINVAL, errno); - EXPECT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, + ASSERT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &port_overflow3, 0)); EXPECT_EQ(EINVAL, errno); @@ -2430,7 +2430,7 @@ TEST_F(mini, tcp_port_overflow) ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &port_max_connect, 0)); - EXPECT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, + ASSERT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, &port_overflow4, 0)); EXPECT_EQ(EINVAL, errno); @@ -2549,7 +2549,7 @@ TEST_F(ipv4_tcp, with_fs) EXPECT_EQ(0, close(dir_fd)); dir_fd = open("/", O_RDONLY); - EXPECT_EQ(-1, dir_fd); + ASSERT_EQ(-1, dir_fd); EXPECT_EQ(EACCES, errno); /* Tests port binding. */ diff --git a/tools/testing/selftests/landlock/ptrace_test.c b/tools/testing/selftests/landlock/ptrace_test.c index 4fd2b440aa45..ea8e4be6659e 100644 --- a/tools/testing/selftests/landlock/ptrace_test.c +++ b/tools/testing/selftests/landlock/ptrace_test.c @@ -204,7 +204,7 @@ TEST_F(scoped_domains, trace) if (can_trace_parent) { EXPECT_EQ(0, ret); } else { - EXPECT_EQ(-1, ret); + ASSERT_EQ(-1, ret); EXPECT_EQ(EPERM, errno); } if (ret == 0) { @@ -218,7 +218,7 @@ TEST_F(scoped_domains, trace) if (can_trace_child) { EXPECT_EQ(0, ret); } else { - EXPECT_EQ(-1, ret); + ASSERT_EQ(-1, ret); EXPECT_EQ(EPERM, errno); } @@ -259,7 +259,7 @@ TEST_F(scoped_domains, trace) ASSERT_EQ(0, ptrace(PTRACE_DETACH, child, NULL, 0)); } else { /* The child should not be traced by the parent. */ - EXPECT_EQ(-1, ptrace(PTRACE_DETACH, child, NULL, 0)); + ASSERT_EQ(-1, ptrace(PTRACE_DETACH, child, NULL, 0)); EXPECT_EQ(ESRCH, errno); } @@ -276,7 +276,7 @@ TEST_F(scoped_domains, trace) if (can_trace_child) { EXPECT_EQ(0, ret); } else { - EXPECT_EQ(-1, ret); + ASSERT_EQ(-1, ret); EXPECT_EQ(EPERM, errno); } @@ -377,7 +377,7 @@ TEST_F(audit, trace) ASSERT_EQ(1, read(pipe_parent[0], &buf_child, 1)); /* Tests child PTRACE_TRACEME. */ - EXPECT_EQ(-1, ptrace(PTRACE_TRACEME)); + ASSERT_EQ(-1, ptrace(PTRACE_TRACEME)); EXPECT_EQ(EPERM, errno); /* We should see the child process. */ EXPECT_EQ(0, matches_log_ptrace(_metadata, self->audit_fd, @@ -414,11 +414,11 @@ TEST_F(audit, trace) ASSERT_EQ(1, read(pipe_child[0], &buf_parent, 1)); /* The child should not be traced by the parent. */ - EXPECT_EQ(-1, ptrace(PTRACE_DETACH, child, NULL, 0)); + ASSERT_EQ(-1, ptrace(PTRACE_DETACH, child, NULL, 0)); EXPECT_EQ(ESRCH, errno); /* Tests PTRACE_ATTACH on the child. */ - EXPECT_EQ(-1, ptrace(PTRACE_ATTACH, child, NULL, 0)); + ASSERT_EQ(-1, ptrace(PTRACE_ATTACH, child, NULL, 0)); EXPECT_EQ(EPERM, errno); EXPECT_EQ(0, matches_log_ptrace(_metadata, self->audit_fd, child)); diff --git a/tools/testing/selftests/landlock/scoped_abstract_unix_test.c b/tools/testing/selftests/landlock/scoped_abstract_unix_test.c index df41da5f2ab0..4c7f9c102d50 100644 --- a/tools/testing/selftests/landlock/scoped_abstract_unix_test.c +++ b/tools/testing/selftests/landlock/scoped_abstract_unix_test.c @@ -122,7 +122,7 @@ TEST_F(scoped_domains, connect_to_parent) if (can_connect_to_parent) { EXPECT_EQ(0, err); } else { - EXPECT_EQ(-1, err); + ASSERT_EQ(-1, err); EXPECT_EQ(EPERM, errno); } EXPECT_EQ(0, close(stream_client)); @@ -132,7 +132,7 @@ TEST_F(scoped_domains, connect_to_parent) if (can_connect_to_parent) { EXPECT_EQ(0, err); } else { - EXPECT_EQ(-1, err); + ASSERT_EQ(-1, err); EXPECT_EQ(EPERM, errno); } EXPECT_EQ(0, close(dgram_client)); @@ -417,7 +417,7 @@ TEST_F(scoped_audit, connect_to_child) ASSERT_EQ(1, read(pipe_child[0], &buf, 1)); err_dgram = connect(dgram_client, &self->dgram_address.unix_addr, self->dgram_address.unix_addr_len); - EXPECT_EQ(-1, err_dgram); + ASSERT_EQ(-1, err_dgram); EXPECT_EQ(EPERM, errno); if (should_audit) { @@ -762,7 +762,7 @@ TEST_F(outside_socket, socket_with_different_domain) if (variant->child_socket) { EXPECT_EQ(0, err); } else { - EXPECT_EQ(-1, err); + ASSERT_EQ(-1, err); EXPECT_EQ(EPERM, errno); } EXPECT_EQ(0, close(client_socket)); @@ -939,7 +939,7 @@ TEST_F(various_address_sockets, scoped_pathname_sockets) &stream_abstract_addr.unix_addr, stream_abstract_addr.unix_addr_len); if (variant->domain == SCOPE_SANDBOX) { - EXPECT_EQ(-1, err); + ASSERT_EQ(-1, err); EXPECT_EQ(EPERM, errno); } else { EXPECT_EQ(0, err); @@ -954,7 +954,7 @@ TEST_F(various_address_sockets, scoped_pathname_sockets) &dgram_abstract_addr.unix_addr, dgram_abstract_addr.unix_addr_len); if (variant->domain == SCOPE_SANDBOX) { - EXPECT_EQ(-1, err); + ASSERT_EQ(-1, err); EXPECT_EQ(EPERM, errno); } else { EXPECT_EQ(1, err); @@ -965,7 +965,7 @@ TEST_F(various_address_sockets, scoped_pathname_sockets) &dgram_abstract_addr.unix_addr, dgram_abstract_addr.unix_addr_len); if (variant->domain == SCOPE_SANDBOX) { - EXPECT_EQ(-1, err); + ASSERT_EQ(-1, err); EXPECT_EQ(EPERM, errno); } else { EXPECT_EQ(0, err); -- 2.56.0
