kernel/git/stable/linux.git/tools/testing/selftests/landlock, branch master

landlock: Test trace path output boundaries

2026-09-08T09:49:39+00:00

Use focused KUnit tests to exercise the renderer's internal boundary and composition contracts with synthetic scratch states, including both sibling-helper evaluation orders. Check the exact output and reservation boundaries, including a four-byte octal escape accepted at exact capacity and rejected one byte short. Also verify an unchanged cursor on failure, that bracketed process names and embedded NUL bytes remain data, and that input ellipsis bytes are escaped rather than mistaken for the raw truncation marker. The composition test requires generic trace output helpers. Enable CONFIG_FTRACE and CONFIG_SCHED_TRACER because the latter selects the otherwise-hidden CONFIG_TRACING support required by trace_print_flags_seq(). Use kselftests to exercise the complete tracefs path for both affected filesystem events. A valid path containing 2640 spaces exceeds the scratch output budget. Require its escaped prefix to end in the raw UTF-8 ellipsis while access_rights and blockers remain intact. This division keeps the exact safety contract compiler-independent while proving that real tracepoints preserve their surrounding symbolic fields. The end-to-end assertions fail after a full fix revert with both GCC and Clang, while the composition KUnit test fails if the scratch reserve is removed. Cc: Günther Noack Link: https://patch.msgid.link/20260907154401.124362-2-mic@digikod.net Signed-off-by: Mickaël Salaün

selftests/landlock: Test abstract socket trace name limits

2026-09-07T10:38:01+00:00

The landlock_deny_scope_abstract_unix_socket event captures binary socket names with __string_len(), whose dynamic field reserves an extra byte for the NUL terminator. The printer subtracts this byte before escaping the content. Exercise the minimum accepted address length, which has no name content, and the maximum sockaddr_un length, which has 107 content bytes. Check the exact trace output at both boundaries. The existing stream and datagram variants share this event, so the boundary variants only need the stream path. Because these boundary names are fixed, run the fixture in a private network namespace. Abstract UNIX socket names are scoped by network namespace, preventing concurrent bind() calls from colliding. The lower-bound test confirms that the subtraction recovers zero instead of underflowing. Cc: Günther Noack Link: https://patch.msgid.link/CAL4aGcVcT0VWVFmGi_vLqxxZ9KdOHfGXYZtKjBdvoUyFjbu5=A@mail.gmail.com Link: https://patch.msgid.link/20260907103503.109461-1-mic@digikod.net Signed-off-by: Mickaël Salaün

selftests/landlock: Add landlock_enforce_domain trace tests

2026-08-17T08:17:19+00:00

Add trace tests for the landlock_enforce_domain event in trace_test.c, asserting field counts after the syscall returns rather than line ordering across per-CPU buffers. They cover single-threaded and TSYNC enforcement (complete and process_wide set), a multi-threaded non-TSYNC process (process_wide clear), the single-threaded non-leader edge case, the flags-only path that creates no domain, and a thread-sync abort that emits create_domain and free_domain but no enforce_domain. landlock_enforce_domain is added to the fixture enable path and every disable list so its zero-events assertions cannot be tripped by a stray enforcement event. Test coverage for security/landlock is 91.6% of 2571 lines according to LLVM 22. Cc: Günther Noack Cc: Tingmao Wang Link: https://patch.msgid.link/20260811094338.288094-19-mic@digikod.net Signed-off-by: Mickaël Salaün

selftests/landlock: Add scope and ptrace tracepoint tests

2026-08-17T08:17:18+00:00

Add trace tests for the landlock_deny_ptrace, landlock_deny_scope_signal, and landlock_deny_scope_abstract_unix_socket tracepoints, each placed alongside the functional tests for its subsystem, mirroring the audit test layout. Each tracepoint is exercised by a fixture with three variants that pin both branches of the other-party domain field: denied against an unsandboxed other party (other-party domain ID 0), denied against a sandboxed other party (non-zero ID), and an allowed baseline that records no event. A second fixture per type exercises an alternate LSM hook that reaches the same tracepoint with the same other-party domain ID, since each denial type can be reached through more than one hook. The datagram abstract-unix variant does not assert peer_pid, which is 0 for a datagram peer (no SO_PEERCRED); sun_path is the reliable peer identifier. The ptrace fixtures install a plain domain-creating ruleset rather than a dedicated flag, since ptrace denial relies on domain ancestry, not on a specific scoped flag. The fixtures unshare the mount namespace and remount / as MS_PRIVATE before mounting tracefs so the helper instance is visible only to the test process. Cc: Günther Noack Cc: Tingmao Wang Link: https://patch.msgid.link/20260811094338.288094-18-mic@digikod.net Signed-off-by: Mickaël Salaün

selftests/landlock: Add network tracepoint tests

2026-08-17T08:17:18+00:00

Add network-specific trace tests, co-located with the existing audit fixture so each subsystem's functional, audit, and trace tests live together. Parameterized fixtures verify the landlock_deny_access_net event: a bind or connect denied outside the ruleset emits exactly one event with the expected sport/dport, an allowed bind or connect emits none, and the unsandboxed baseline emits none. A separate fixture verifies the landlock_check_rule_net event on an allowed bind, anchoring its domain, access_request, port, and grants to exact values; only check_rule_fs had a dedicated field test before. Port fields are read in host endianness, matching the landlock_net_port_attr.port UAPI convention, so the decimal comparisons also catch byte-order regressions in the tracepoint plumbing. IPv6 trace tests are intentionally elided: IPv6 hook dispatch shares the current_check_access_socket() path with IPv4 (covered by the audit tests), and the trace fields do not depend on address family. Cc: Günther Noack Cc: Tingmao Wang Link: https://patch.msgid.link/20260811094338.288094-17-mic@digikod.net Signed-off-by: Mickaël Salaün

selftests/landlock: Add filesystem tracepoint tests

2026-08-17T08:17:17+00:00

Add filesystem-specific trace tests in a dedicated file, following the audit-test pattern of living alongside each subsystem's functional tests. trace_fs_test.c verifies that the add_rule_fs, check_rule_fs, and deny_access_fs events fire with the correct fields on matching rules and denied accesses, that check_rule_fs does not fire for unhandled access types, and that no event fires without a sandbox. A denial covered by a quiet rule still emits a deny_access_fs event but with logged=0, the same suppression verdict audit applies; because that verdict must not depend on CONFIG_AUDIT, the test also runs under a tracepoints-only build. Add trace_layout1 fixture tests in fs_test.c that reuse the layout1 hierarchy to verify the per-layer grants field: field values, multi-rule pathwalk short-circuit, request intersection, the optional truncate right surfacing in the request and grants, and an empty grants set from a rule that grants none of the requested rights. Cc: Günther Noack Cc: Tingmao Wang Link: https://patch.msgid.link/20260811094338.288094-16-mic@digikod.net Signed-off-by: Mickaël Salaün

selftests/landlock: Add trace event test infrastructure and tests

2026-08-17T08:17:17+00:00

Add tracefs test infrastructure in trace.h: helpers for mounting tracefs, enabling/disabling events, reading the trace buffer, counting regex matches, and extracting field values, plus per-event regex patterns. The patterns are anchored with ^ and $, verify every TP_printk field, and use no unescaped dot characters; TRACE_PREFIX matches the ftrace line format with either the expected task name (truncated to TASK_COMM_LEN - 1) or "<...>" for an evicted comm cache entry. Add trace_test.c with the trace fixture (setup enables all available events with a PID filter, teardown disables and clears) and the lifecycle, API, denial-field, and log-flag tests. Extend the existing true helper to open its working directory before exiting, triggering a read_dir denial inside a sandbox, so the exec-based tests can verify same_exec and the logged decision across an exec. Move regex_escape() from audit.h to common.h for shared use by the audit and trace tests. Enable CONFIG_ENABLE_DEFAULT_TRACERS alongside CONFIG_FTRACE in the selftest config: CONFIG_FTRACE alone only enables the tracer menu without activating any tracer, while CONFIG_ENABLE_DEFAULT_TRACERS selects TRACING (and thus TRACEPOINTS and event tracing) without depending on architecture-specific syscall tracepoints. When CONFIG_FTRACE is disabled it cannot be set, so TRACEPOINTS is correctly disabled too. Cc: Günther Noack Cc: Tingmao Wang Link: https://patch.msgid.link/20260811094338.288094-15-mic@digikod.net Signed-off-by: Mickaël Salaün

selftests/landlock: Test LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS

2026-08-15T07:14:47+00:00

Check that a successful landlock_restrict_self(2) call with LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS sets no_new_privs without a prior prctl(2) call nor CAP_SYS_ADMIN, that a failed call from both an invalid ruleset and hitting the layer maximum leaves the attribute unchanged, and that LANDLOCK_RESTRICT_SELF_TSYNC extends it to sibling threads. Also check that this flag requires a ruleset. Turn the multi_threaded_success test into a multi_threaded fixture with success, no_new_privs, and no_new_privs_max_layers variants to factor out the threading code. Finally, rename restrict_self_fd_logging_flags to restrict_self_fd_flags, and restrict_self_logging_flags to restrict_self_flags to indicate that non-logging flags are now tested. Test coverage for security/landlock is 91.8% of 2373 lines according to LLVM 22. Signed-off-by: Justin Suess Link: https://patch.msgid.link/20260809154544.1253100-4-utilityemal77@gmail.com Signed-off-by: Mickaël Salaün

landlock: Add LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS

2026-08-15T07:14:46+00:00

Add a landlock_restrict_self(2) flag to set the no_new_privs attribute of the calling thread only after enforcement of the ruleset: no_new_privs is set if and only if the call succeeds. This removes the need for a prior prctl(2) PR_SET_NO_NEW_PRIVS call and guarantees that a failed enforcement leaves the attribute unchanged. Because no_new_privs is set by the call itself, the no_new_privs / CAP_SYS_ADMIN requirement of landlock_restrict_self(2) is fulfilled by construction, and the related EPERM check is skipped. Unlike LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF, this flag always requires a valid ruleset: with a ruleset_fd of -1, such a call would be nothing more than a Landlock-flavored prctl(2) PR_SET_NO_NEW_PRIVS, and there is no valid use case for setting no_new_privs (possibly with LANDLOCK_RESTRICT_SELF_TSYNC) without also enforcing Landlock restrictions. Rejecting these calls also keeps the option of giving them a meaning later. The attribute is only set past the last point of failure, just before committing the new credentials. When combined with LANDLOCK_RESTRICT_SELF_TSYNC, no_new_privs is set on the sibling threads as well, in their commit phase, with the same ordering. Bump the Landlock ABI version to 11, and include the minimal related test changes to keep the tests bisectable. Cc: Mickaël Salaün Signed-off-by: Justin Suess Link: https://patch.msgid.link/20260809212459.2427878-1-utilityemal77@gmail.com Signed-off-by: Mickaël Salaün

landlock: Check landlock_restrict_self(2)'s flags before privileges

2026-08-15T07:14:46+00:00

landlock_restrict_self(2) currently checks the no_new_privs / CAP_SYS_ADMIN requirement before validating the flags argument. An unprivileged caller without no_new_privs thus gets EPERM even when the passed flags are invalid, hiding the EINVAL error. Move the no_new_privs / CAP_SYS_ADMIN check just after the flags check so that malformed calls consistently error out with EINVAL whatever the caller's privileges, the same way seccomp(2) validates its flags before checking no_new_privs. Update the restrict_self_checks_ordering test accordingly. Cc: Mickaël Salaün Signed-off-by: Justin Suess Link: https://patch.msgid.link/20260809154544.1253100-2-utilityemal77@gmail.com Signed-off-by: Mickaël Salaün