tools/testing/selftests/landlock/audit_test.c

Source file repositories/reference/linux-study-clean/tools/testing/selftests/landlock/audit_test.c

File Facts

System
Linux kernel
Corpus path
tools/testing/selftests/landlock/audit_test.c
Extension
.c
Size
28121 bytes
Lines
1001
Domain
Support Tooling And Documentation
Bucket
tools
Inferred role
Support Tooling And Documentation: implementation source
Status
source implementation candidate

Why This File Exists

Repository support layer: documentation, build tooling, samples, user-space helper tools, generated initramfs support, licenses, and validation utilities.

Dependency Surface

Detected Declarations

Annotated Snippet

struct thread_data {
	pid_t parent_pid;
	int ruleset_fd, pipe_child, pipe_parent;
	bool mute_subdomains;
};

static void *thread_audit_test(void *arg)
{
	const struct thread_data *data = (struct thread_data *)arg;
	uintptr_t err = 0;
	char buffer;

	/* TGID and TID are different for a second thread. */
	if (getpid() == gettid()) {
		err = 1;
		goto out;
	}

	if (landlock_restrict_self(data->ruleset_fd, 0)) {
		err = 2;
		goto out;
	}

	if (close(data->ruleset_fd)) {
		err = 3;
		goto out;
	}

	/* Creates a denial to get the domain ID. */
	if (kill(data->parent_pid, 0) != -1) {
		err = 4;
		goto out;
	}

	if (EPERM != errno) {
		err = 5;
		goto out;
	}

	/* Signals the parent to read denial logs. */
	if (write(data->pipe_child, ".", 1) != 1) {
		err = 6;
		goto out;
	}

	/* Waits for the parent to update audit filters. */
	if (read(data->pipe_parent, &buffer, 1) != 1) {
		err = 7;
		goto out;
	}

out:
	close(data->pipe_child);
	close(data->pipe_parent);
	return (void *)err;
}

/* Checks that the PID tied to a domain is not a TID but the TGID. */
TEST_F(audit, thread)
{
	const struct landlock_ruleset_attr ruleset_attr = {
		.scoped = LANDLOCK_SCOPE_SIGNAL,
	};
	__u64 denial_dom = 1;
	__u64 allocated_dom = 2;
	__u64 deallocated_dom = 3;
	pthread_t thread;
	int pipe_child[2], pipe_parent[2];
	char buffer;
	struct thread_data child_data;

	child_data.parent_pid = getppid();
	ASSERT_EQ(0, pipe2(pipe_child, O_CLOEXEC));
	child_data.pipe_child = pipe_child[1];
	ASSERT_EQ(0, pipe2(pipe_parent, O_CLOEXEC));
	child_data.pipe_parent = pipe_parent[0];
	child_data.ruleset_fd =
		landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
	ASSERT_LE(0, child_data.ruleset_fd);

	/* TGID and TID are the same for the initial thread . */
	EXPECT_EQ(getpid(), gettid());
	EXPECT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0));
	ASSERT_EQ(0, pthread_create(&thread, NULL, thread_audit_test,
				    &child_data));

	/* Waits for the child to generate a denial. */
	ASSERT_EQ(1, read(pipe_child[0], &buffer, 1));
	EXPECT_EQ(0, close(pipe_child[0]));

Annotation

Implementation Notes