mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-29 05:44:11 +00:00
selftests/landlock: Add tests to check unknown rule's access rights
Add two tests to make sure that we cannot add a rule with access rights that are unknown: * fs: layout0.rule_with_unknown_access * net: mini.rule_with_unknown_access Rename unknown_access_rights tests to ruleset_with_unknown_access . Cc: Konstantin Meskhidze <konstantin.meskhidze@huawei.com> Reviewed-by: Günther Noack <gnoack@google.com> Link: https://lore.kernel.org/r/20231130093616.67340-2-mic@digikod.net Signed-off-by: Mickaël Salaün <mic@digikod.net>
This commit is contained in:
parent
b85ea95d08
commit
6471c9c4c4
2 changed files with 54 additions and 2 deletions
|
@ -589,7 +589,7 @@ TEST_F_FORK(layout1, file_and_dir_access_rights)
|
|||
ASSERT_EQ(0, close(ruleset_fd));
|
||||
}
|
||||
|
||||
TEST_F_FORK(layout0, unknown_access_rights)
|
||||
TEST_F_FORK(layout0, ruleset_with_unknown_access)
|
||||
{
|
||||
__u64 access_mask;
|
||||
|
||||
|
@ -605,6 +605,33 @@ TEST_F_FORK(layout0, unknown_access_rights)
|
|||
}
|
||||
}
|
||||
|
||||
TEST_F_FORK(layout0, rule_with_unknown_access)
|
||||
{
|
||||
__u64 access;
|
||||
struct landlock_path_beneath_attr path_beneath = {};
|
||||
const struct landlock_ruleset_attr ruleset_attr = {
|
||||
.handled_access_fs = ACCESS_ALL,
|
||||
};
|
||||
const int ruleset_fd =
|
||||
landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
|
||||
|
||||
ASSERT_LE(0, ruleset_fd);
|
||||
|
||||
path_beneath.parent_fd =
|
||||
open(TMP_DIR, O_PATH | O_DIRECTORY | O_CLOEXEC);
|
||||
ASSERT_LE(0, path_beneath.parent_fd);
|
||||
|
||||
for (access = 1ULL << 63; access != ACCESS_LAST; access >>= 1) {
|
||||
path_beneath.allowed_access = access;
|
||||
EXPECT_EQ(-1, landlock_add_rule(ruleset_fd,
|
||||
LANDLOCK_RULE_PATH_BENEATH,
|
||||
&path_beneath, 0));
|
||||
EXPECT_EQ(EINVAL, errno);
|
||||
}
|
||||
ASSERT_EQ(0, close(path_beneath.parent_fd));
|
||||
ASSERT_EQ(0, close(ruleset_fd));
|
||||
}
|
||||
|
||||
static void add_path_beneath(struct __test_metadata *const _metadata,
|
||||
const int ruleset_fd, const __u64 allowed_access,
|
||||
const char *const path)
|
||||
|
|
|
@ -1260,7 +1260,7 @@ TEST_F(mini, network_access_rights)
|
|||
}
|
||||
|
||||
/* Checks invalid attribute, out of landlock network access range. */
|
||||
TEST_F(mini, unknown_access_rights)
|
||||
TEST_F(mini, ruleset_with_unknown_access)
|
||||
{
|
||||
__u64 access_mask;
|
||||
|
||||
|
@ -1276,6 +1276,31 @@ TEST_F(mini, unknown_access_rights)
|
|||
}
|
||||
}
|
||||
|
||||
TEST_F(mini, rule_with_unknown_access)
|
||||
{
|
||||
const struct landlock_ruleset_attr ruleset_attr = {
|
||||
.handled_access_net = ACCESS_ALL,
|
||||
};
|
||||
struct landlock_net_port_attr net_port = {
|
||||
.port = sock_port_start,
|
||||
};
|
||||
int ruleset_fd;
|
||||
__u64 access;
|
||||
|
||||
ruleset_fd =
|
||||
landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
|
||||
ASSERT_LE(0, ruleset_fd);
|
||||
|
||||
for (access = 1ULL << 63; access != ACCESS_LAST; access >>= 1) {
|
||||
net_port.allowed_access = access;
|
||||
EXPECT_EQ(-1,
|
||||
landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
|
||||
&net_port, 0));
|
||||
EXPECT_EQ(EINVAL, errno);
|
||||
}
|
||||
EXPECT_EQ(0, close(ruleset_fd));
|
||||
}
|
||||
|
||||
TEST_F(mini, inval)
|
||||
{
|
||||
const struct landlock_ruleset_attr ruleset_attr = {
|
||||
|
|
Loading…
Reference in a new issue