bybrooklyn/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-04-18 14:53:58 -04:00
Code Issues Packages Projects Releases Wiki Activity

selftests/landlock: Add PID tests for audit records

Browse Source 
Add audit.thread tests to check that the PID tied to a domain is not a
thread ID but the thread group ID.  These new tests would not pass
without the previous TGID fix.

Extend matches_log_domain_allocated() to check against the PID that
created the domain.

Test coverage for security/landlock is 93.6% of 1524 lines according to
gcc/gcov-14.

Cc: Christian Brauner <brauner@kernel.org>
Cc: Günther Noack <gnoack@google.com>
Cc: Paul Moore <paul@paul-moore.com>
Link: https://lore.kernel.org/r/20250410171725.1265860-3-mic@digikod.net
Signed-off-by: Mickaël Salaün <mic@digikod.net>
This commit is contained in:
Mickaël Salaün
2025-04-10 19:17:23 +02:00
parent e4a0f9e0ca
commit 6b4566400a
3 changed files with 141 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
tools/testing/selftests/landlock/audit.h
View File

@@ -300,15 +300,22 @@ out:
return err;
}
static int __maybe_unused matches_log_domain_allocated(int audit_fd,
static int __maybe_unused matches_log_domain_allocated(int audit_fd, pid_t pid,
__u64 *domain_id)
{
return audit_match_record(
audit_fd, AUDIT_LANDLOCK_DOMAIN,
REGEX_LANDLOCK_PREFIX
" status=allocated mode=enforcing pid=[0-9]\\+ uid=[0-9]\\+"
" exe=\"[^\"]\\+\" comm=\".*_test\"$",
domain_id);
static const char log_template[] = REGEX_LANDLOCK_PREFIX
" status=allocated mode=enforcing pid=%d uid=[0-9]\\+"
" exe=\"[^\"]\\+\" comm=\".*_test\"$";
char log_match[sizeof(log_template) + 10];
int log_match_len;
log_match_len =
snprintf(log_match, sizeof(log_match), log_template, pid);
if (log_match_len > sizeof(log_match))
return -E2BIG;
return audit_match_record(audit_fd, AUDIT_LANDLOCK_DOMAIN, log_match,
domain_id);
}
static int __maybe_unused matches_log_domain_deallocated(