From nobody Fri Dec 19 20:58:19 2025 Received: from smtp-8fac.mail.infomaniak.ch (smtp-8fac.mail.infomaniak.ch [83.166.143.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 26CD22054F4 for ; Wed, 8 Jan 2025 15:44:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=83.166.143.172 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1736351075; cv=none; b=EP9b55sd4yeolTlyWCEjqXj65RWcxLc6PckaISjUcHspQ7YjaplnweKN5IH6fsbQ66xC4qrP/2oHOAGd3CmuE/HCKpbY2FF8+X+9C5Q4Z4QSnXBvJ7mL32WFCmG+G5QJ2PeBHlLpOdndr/SCG1pYKAFPdtXwrUM7o6JsRzitNZI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1736351075; c=relaxed/simple; bh=r5WlgHY5ekmzAaYDQq4vreiTxEwpar8BE5d+CF5hpSU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=N6vhgPLdWsWCQrwBuCMKYy1F6H+//EOf9Iqiraf60AInK3UkmhnB2g8jlo6EKYPLpCF4QmSVjFOP8YGUQbLApnpjpjVzXuvlV62LjxzuXhFaSnLsyEWi4CcGTkcimt5ksuV0K06DhnGKremNe0TIKG388Jua0MVbe2ZJvU/OMPs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=digikod.net; spf=pass smtp.mailfrom=digikod.net; dkim=pass (1024-bit key) header.d=digikod.net header.i=@digikod.net header.b=IEl8243x; arc=none smtp.client-ip=83.166.143.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=digikod.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=digikod.net Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=digikod.net header.i=@digikod.net header.b="IEl8243x" Received: from smtp-3-0001.mail.infomaniak.ch (smtp-3-0001.mail.infomaniak.ch [10.4.36.108]) by smtp-3-3000.mail.infomaniak.ch (Postfix) with ESMTPS id 4YSsfm4SSBzCbs; Wed, 8 Jan 2025 16:44:32 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=digikod.net; s=20191114; t=1736351072; bh=L8IBiXUuwC1//+udMff7eh2pXQ6UeLqKYGPADF3RxT0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=IEl8243x6fZmwoZSWNsdBZuf6HXEjefSGABSrAkfHnQAq5cQzG8C8TbV9FmYdJq1f ByUgb0fcvzVp7blT0iNH0ZjsVOS+7RHPytcPKGiU8+U61l7ShNZGPtxQBM3ax4PZhA 3NXymRzDIzlBx4sSnaTQg0dBsOM0TQiUV3a0jEco= Received: from unknown by smtp-3-0001.mail.infomaniak.ch (Postfix) with ESMTPA id 4YSsfl4G3tzKQl; Wed, 8 Jan 2025 16:44:31 +0100 (CET) From: =?UTF-8?q?Micka=C3=ABl=20Sala=C3=BCn?= To: Eric Paris , Paul Moore , =?UTF-8?q?G=C3=BCnther=20Noack?= , "Serge E . Hallyn" Cc: =?UTF-8?q?Micka=C3=ABl=20Sala=C3=BCn?= , Ben Scarlato , Casey Schaufler , Charles Zaffery , Daniel Burgener , Francis Laniel , James Morris , Jann Horn , Jeff Xu , Jorge Lucangeli Obes , Kees Cook , Konstantin Meskhidze , Matt Bobrowski , Mikhail Ivanov , Phil Sutter , Praveen K Paladugu , Robert Salvet , Shervin Oloumi , Song Liu , Tahera Fahimi , Tyler Hicks , audit@vger.kernel.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org Subject: [PATCH v4 30/30] selftests/landlock: Test compatibility with audit rule lists Date: Wed, 8 Jan 2025 16:43:38 +0100 Message-ID: <20250108154338.1129069-31-mic@digikod.net> In-Reply-To: <20250108154338.1129069-1-mic@digikod.net> References: <20250108154338.1129069-1-mic@digikod.net> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Infomaniak-Routing: alpha Add compatibility.lists tests to make sure AUDIT_EXE_LANDLOCK_DENY is only allowed for AUDIT_FILTER_EXCLUDE, AUDIT_FILTER_EXIT, and AUDIT_FILTER_URING_EXIT. Test coverage for security/landlock is 93.5% of 1635 lines according to gcc/gcov-14. Cc: G=C3=BCnther Noack Cc: Paul Moore Signed-off-by: Micka=C3=ABl Sala=C3=BCn Link: https://lore.kernel.org/r/20250108154338.1129069-31-mic@digikod.net --- Changes since v3: - New patch. --- tools/testing/selftests/landlock/audit_test.c | 78 +++++++++++++++++++ 1 file changed, 78 insertions(+) diff --git a/tools/testing/selftests/landlock/audit_test.c b/tools/testing/= selftests/landlock/audit_test.c index 921f316ddbf8..d9f227680641 100644 --- a/tools/testing/selftests/landlock/audit_test.c +++ b/tools/testing/selftests/landlock/audit_test.c @@ -308,4 +308,82 @@ TEST_F(audit_rule, exe_landlock_deny) ASSERT_EQ(0, WEXITSTATUS(status)); } =20 +FIXTURE(compatibility) +{ + struct audit_filter filter_self; + int audit_fd; +}; + +FIXTURE_SETUP(compatibility) +{ + disable_caps(_metadata); + set_cap(_metadata, CAP_AUDIT_CONTROL); + self->audit_fd =3D audit_init_with_exe_filter(&self->filter_self); + EXPECT_LE(0, self->audit_fd) + { + const char *error_msg; + + /* kill "$(auditctl -s | sed -ne 's/^pid \([0-9]\+\)$/\1/p')" */ + if (self->audit_fd =3D=3D -EEXIST) + error_msg =3D "socket already in use (e.g. auditd)"; + else + error_msg =3D strerror(-self->audit_fd); + TH_LOG("Failed to initialize audit: %s", error_msg); + } + clear_cap(_metadata, CAP_AUDIT_CONTROL); +} + +FIXTURE_TEARDOWN(compatibility) +{ + set_cap(_metadata, CAP_AUDIT_CONTROL); + EXPECT_EQ(0, audit_cleanup(self->audit_fd, &self->filter_self)); + clear_cap(_metadata, CAP_AUDIT_CONTROL); +} + +TEST_F(compatibility, lists) +{ + struct audit_filter filter_test; + size_t num_ok =3D 0; + __u32 list; + + EXPECT_EQ(0, audit_init_filter_exe(AUDIT_EXE_LANDLOCK_DENY, + &filter_test, NULL)); + set_cap(_metadata, CAP_AUDIT_CONTROL); + + for (list =3D 0; list < AUDIT_NR_FILTERS; list++) { + int err; + + switch (list) { + case AUDIT_FILTER_EXIT: + case AUDIT_FILTER_EXCLUDE: + case AUDIT_FILTER_URING_EXIT: + num_ok++; + err =3D 0; + break; + default: + err =3D -EINVAL; + break; + } + + /* + * Testing AUDIT_FILTER_ENTRY prints "auditfilter: + * AUDIT_FILTER_ENTRY is deprecated" in kernel logs. + */ + EXPECT_EQ(err, audit_filter_exe(self->audit_fd, &filter_test, + AUDIT_ADD_RULE, list)) + { + TH_LOG("Unexpected result for list %u", list); + } + EXPECT_EQ(err, audit_filter_exe(self->audit_fd, &filter_test, + AUDIT_DEL_RULE, list)) + { + TH_LOG("Unexpected result for list %u", list); + } + } + + /* Makes sure the three accepted lists are checked. */ + EXPECT_EQ(3, num_ok); + clear_cap(_metadata, CAP_AUDIT_CONTROL); +} + TEST_HARNESS_MAIN --=20 2.47.1