tools/testing/selftests/landlock/audit_test.c
Source file repositories/reference/linux-study-clean/tools/testing/selftests/landlock/audit_test.c
File Facts
- System
- Linux kernel
- Corpus path
tools/testing/selftests/landlock/audit_test.c- Extension
.c- Size
- 28121 bytes
- Lines
- 1001
- Domain
- Support Tooling And Documentation
- Bucket
- tools
- Inferred role
- Support Tooling And Documentation: implementation source
- Status
- source implementation candidate
Why This File Exists
Repository support layer: documentation, build tooling, samples, user-space helper tools, generated initramfs support, licenses, and validation utilities.
- Repository support layer: documentation, build tooling, samples, user-space helper tools, generated initramfs support, licenses, and validation utilities.
- Defines or uses C structs; map object ownership, embedded links, reference counts, and lock ownership.
Dependency Surface
errno.hfcntl.hlimits.hlinux/landlock.hpthread.hstdlib.hsys/mount.hsys/prctl.hsys/types.hsys/wait.hunistd.haudit.hcommon.h
Detected Declarations
struct thread_datafunction matches_log_signalfunction EXPECT_EQfunction hook_cred_transferfunction matches_log_fs_read_rootfunction ASSERT_EQ
Annotated Snippet
struct thread_data {
pid_t parent_pid;
int ruleset_fd, pipe_child, pipe_parent;
bool mute_subdomains;
};
static void *thread_audit_test(void *arg)
{
const struct thread_data *data = (struct thread_data *)arg;
uintptr_t err = 0;
char buffer;
/* TGID and TID are different for a second thread. */
if (getpid() == gettid()) {
err = 1;
goto out;
}
if (landlock_restrict_self(data->ruleset_fd, 0)) {
err = 2;
goto out;
}
if (close(data->ruleset_fd)) {
err = 3;
goto out;
}
/* Creates a denial to get the domain ID. */
if (kill(data->parent_pid, 0) != -1) {
err = 4;
goto out;
}
if (EPERM != errno) {
err = 5;
goto out;
}
/* Signals the parent to read denial logs. */
if (write(data->pipe_child, ".", 1) != 1) {
err = 6;
goto out;
}
/* Waits for the parent to update audit filters. */
if (read(data->pipe_parent, &buffer, 1) != 1) {
err = 7;
goto out;
}
out:
close(data->pipe_child);
close(data->pipe_parent);
return (void *)err;
}
/* Checks that the PID tied to a domain is not a TID but the TGID. */
TEST_F(audit, thread)
{
const struct landlock_ruleset_attr ruleset_attr = {
.scoped = LANDLOCK_SCOPE_SIGNAL,
};
__u64 denial_dom = 1;
__u64 allocated_dom = 2;
__u64 deallocated_dom = 3;
pthread_t thread;
int pipe_child[2], pipe_parent[2];
char buffer;
struct thread_data child_data;
child_data.parent_pid = getppid();
ASSERT_EQ(0, pipe2(pipe_child, O_CLOEXEC));
child_data.pipe_child = pipe_child[1];
ASSERT_EQ(0, pipe2(pipe_parent, O_CLOEXEC));
child_data.pipe_parent = pipe_parent[0];
child_data.ruleset_fd =
landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
ASSERT_LE(0, child_data.ruleset_fd);
/* TGID and TID are the same for the initial thread . */
EXPECT_EQ(getpid(), gettid());
EXPECT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0));
ASSERT_EQ(0, pthread_create(&thread, NULL, thread_audit_test,
&child_data));
/* Waits for the child to generate a denial. */
ASSERT_EQ(1, read(pipe_child[0], &buffer, 1));
EXPECT_EQ(0, close(pipe_child[0]));
Annotation
- Immediate include surface: `errno.h`, `fcntl.h`, `limits.h`, `linux/landlock.h`, `pthread.h`, `stdlib.h`, `sys/mount.h`, `sys/prctl.h`.
- Detected declarations: `struct thread_data`, `function matches_log_signal`, `function EXPECT_EQ`, `function hook_cred_transfer`, `function matches_log_fs_read_root`, `function ASSERT_EQ`.
- Atlas domain: Support Tooling And Documentation / tools.
- Implementation status: source implementation candidate.
Implementation Notes
- This generated page is the file-by-file coverage layer; curated subsystem chapters should link here when they synthesize a multi-file control flow.
- Core OS pages should be promoted from atlas-only to deep-reviewed when they explain data structures, invariants, locking, lifecycle, and C implementation snippets.
- Driver-family pages are intentionally pattern-oriented unless they are part of the selected PCIe/NVMe representative device path.