@@ -233,6 +233,47 @@ TEST(restrict_self_checks_ordering)
ASSERT_EQ(0, close(ruleset_fd));
}
+TEST(restrict_self_flags)
+{
+ const __u32 last_flag = LANDLOCK_RESTRICT_SELF_LOG_CROSS_EXEC;
+
+ /* Tests valid flag combinations. */
+
+ ASSERT_EQ(-1, landlock_restrict_self(-1, 0));
+ ASSERT_EQ(EBADF, errno);
+
+ ASSERT_EQ(-1, landlock_restrict_self(-1, LANDLOCK_RESTRICT_SELF_QUIET));
+ ASSERT_EQ(EBADF, errno);
+
+ ASSERT_EQ(-1, landlock_restrict_self(
+ -1, LANDLOCK_RESTRICT_SELF_QUIET_SUBDOMAINS));
+ ASSERT_EQ(EBADF, errno);
+
+ ASSERT_EQ(-1,
+ landlock_restrict_self(
+ -1, LANDLOCK_RESTRICT_SELF_QUIET |
+ LANDLOCK_RESTRICT_SELF_QUIET_SUBDOMAINS));
+ ASSERT_EQ(EBADF, errno);
+
+ ASSERT_EQ(-1, landlock_restrict_self(
+ -1, LANDLOCK_RESTRICT_SELF_LOG_CROSS_EXEC));
+ ASSERT_EQ(EBADF, errno);
+
+ /* Tests invalid flag combinations. */
+
+ ASSERT_EQ(-1,
+ landlock_restrict_self(
+ -1, LANDLOCK_RESTRICT_SELF_QUIET |
+ LANDLOCK_RESTRICT_SELF_LOG_CROSS_EXEC));
+ ASSERT_EQ(EINVAL, errno);
+
+ ASSERT_EQ(-1, landlock_restrict_self(-1, last_flag << 1));
+ ASSERT_EQ(EINVAL, errno);
+
+ ASSERT_EQ(-1, landlock_restrict_self(-1, -1));
+ ASSERT_EQ(EINVAL, errno);
+}
+
TEST(ruleset_fd_io)
{
struct landlock_ruleset_attr ruleset_attr = {
Add the restrict_self_flags test suite to check that LANDLOCK_RESTRICT_SELF_QUIET, LANDLOCK_RESTRICT_SELF_QUIET_SUBDOMAINS, and LANDLOCK_RESTRICT_SELF_LOG_CROSS_EXEC are valid but not the next bit. Also test flags incompatibility. Some checks are similar to restrict_self_checks_ordering's ones. Cc: Günther Noack <gnoack@google.com> Cc: Paul Moore <paul@paul-moore.com> Signed-off-by: Mickaël Salaün <mic@digikod.net> Link: https://lore.kernel.org/r/20250131163059.1139617-21-mic@digikod.net --- Changes since v4: - Update with LANDLOCK_RESTRICT_SELF_QUIET_SUBDOMAINS, and LANDLOCK_RESTRICT_SELF_LOG_CROSS_EXEC. Changes since v3: - Use a last_flag variable. Changes since v2: - New patch. --- tools/testing/selftests/landlock/base_test.c | 41 ++++++++++++++++++++ 1 file changed, 41 insertions(+)