selftests/landlock: Test LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS

Browse source

Check that a successful landlock_restrict_self(2) call with
LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS sets no_new_privs without a prior
prctl(2) call nor CAP_SYS_ADMIN, that a failed call from both an
invalid ruleset and hitting the layer maximum leaves the attribute
unchanged, and that LANDLOCK_RESTRICT_SELF_TSYNC extends it to sibling
threads.  Also check that this flag requires a ruleset.

Turn the multi_threaded_success test into a multi_threaded fixture with
success, no_new_privs, and no_new_privs_max_layers variants to factor
out the threading code.

Finally, rename restrict_self_fd_logging_flags to
restrict_self_fd_flags, and restrict_self_logging_flags to
restrict_self_flags to indicate that non-logging flags are now tested.

Test coverage for security/landlock is 91.8% of 2373 lines according to
LLVM 22.

Signed-off-by: Justin Suess <utilityemal77@gmail.com>
Link: https://patch.msgid.link/20260809154544.1253100-4-utilityemal77@gmail.com
Signed-off-by: Mickaël Salaün <mic@digikod.net>

...

This commit is contained in:

Justin Suess 2026-08-09 11:45:21 -04:00 • committed by Mickaël Salaün

parent 6887c03bf2

commit 71f98bc6e5

No known key found for this signature in database

GPG key ID: E5E3D0E88C82F6D2

2 changed files with 168 additions and 14 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

86

tools/testing/selftests/landlock/base_test.c

View file

96

tools/testing/selftests/landlock/tsync_test.c

View file