diff options
| author | Mickaël Salaün <mic@digikod.net> | 2026-09-10 16:48:34 +0200 |
|---|---|---|
| committer | Paul Moore <paul@paul-moore.com> | 2026-09-14 16:41:54 -0400 |
| commit | 63b4c8561b436e8950409d6041fce43f12936f59 (patch) | |
| tree | 48139526216fe5151eb56059594646390a5a750a | |
| parent | eb221044db2d687be7253cd203df4ee648232c3b (diff) | |
| download | linux-next-63b4c8561b436e8950409d6041fce43f12936f59.tar.gz linux-next-63b4c8561b436e8950409d6041fce43f12936f59.zip | |
selftests/landlock: Check full ioctl commands in audit records
The ioctl audit test uses FIONREAD, whose command value fits in 16 bits.
It therefore cannot detect truncation of encoded direction and size
bits.
Use an architecture-independent unknown command with set upper bits and
require its complete value in the audit record. Landlock rejects the
command before the device handles it, and the existing ioctl enforcement
test already exercises the same request. The new expectation fails with
ioctlcmd=0xfeee on an unfixed kernel and passes with ioctlcmd=0xc00ffeee
after the shared audit field is widened.
Signed-off-by: Mickaël Salaün <mic@digikod.net>
Reviewed-by: Günther Noack <gnoack@google.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
| -rw-r--r-- | tools/testing/selftests/landlock/fs_test.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/tools/testing/selftests/landlock/fs_test.c b/tools/testing/selftests/landlock/fs_test.c index 18dbdb99aeba..1abdcc9ee784 100644 --- a/tools/testing/selftests/landlock/fs_test.c +++ b/tools/testing/selftests/landlock/fs_test.c @@ -4146,6 +4146,9 @@ TEST_F_FORK(layout1, o_path_ftruncate_and_ioctl) ASSERT_EQ(0, close(fd)); } +/* Arbitrary command with nonzero bits in both 16-bit halves. */ +static const unsigned int unknown_ioctl_cmd = 0xc00ffeee; + /* * ioctl_error - generically call the given ioctl with a pointer to a * sufficiently large zeroed-out memory region. @@ -4249,7 +4252,7 @@ TEST_F_FORK(layout1, blanket_permitted_ioctls) EXPECT_EQ(EACCES, ioctl_error(_metadata, fd, FS_IOC_ZERO_RANGE)); /* Default case is also blocked. */ - EXPECT_EQ(EACCES, ioctl_error(_metadata, fd, 0xc00ffeee)); + EXPECT_EQ(EACCES, ioctl_error(_metadata, fd, unknown_ioctl_cmd)); ASSERT_EQ(0, close(fd)); } @@ -7943,6 +7946,7 @@ TEST_F(audit_layout1, truncate) EXPECT_EQ(1, records.domain); } +/* Checks that audit records preserve every ioctl command bit. */ TEST_F(audit_layout1, ioctl_dev) { struct audit_records records; @@ -7952,10 +7956,10 @@ TEST_F(audit_layout1, ioctl_dev) fd = open("/dev/null", O_RDONLY | O_CLOEXEC); ASSERT_LE(0, fd); - EXPECT_EQ(EACCES, ioctl_error(_metadata, fd, FIONREAD)); + EXPECT_EQ(EACCES, ioctl_error(_metadata, fd, unknown_ioctl_cmd)); EXPECT_EQ(0, matches_log_fs_extra(_metadata, self->audit_fd, "fs\\.ioctl_dev", "/dev/null", - " ioctlcmd=0x541b")); + " ioctlcmd=0xc00ffeee")); EXPECT_EQ(0, audit_count_records(self->audit_fd, &records)); EXPECT_EQ(0, records.access); |