linux-kernel - [PATCH v4 30/30] selftests/landlock: Test compatibility with audit rule lists

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250108154338.1129069-31-mic@digikod.net>
Date: Wed,  8 Jan 2025 16:43:38 +0100
From: Mickaël Salaün <mic@...ikod.net>
To: Eric Paris <eparis@...hat.com>,
	Paul Moore <paul@...l-moore.com>,
	Günther Noack <gnoack@...gle.com>,
	"Serge E . Hallyn" <serge@...lyn.com>
Cc: Mickaël Salaün <mic@...ikod.net>,
	Ben Scarlato <akhna@...gle.com>,
	Casey Schaufler <casey@...aufler-ca.com>,
	Charles Zaffery <czaffery@...lox.com>,
	Daniel Burgener <dburgener@...ux.microsoft.com>,
	Francis Laniel <flaniel@...ux.microsoft.com>,
	James Morris <jmorris@...ei.org>,
	Jann Horn <jannh@...gle.com>,
	Jeff Xu <jeffxu@...gle.com>,
	Jorge Lucangeli Obes <jorgelo@...gle.com>,
	Kees Cook <kees@...nel.org>,
	Konstantin Meskhidze <konstantin.meskhidze@...wei.com>,
	Matt Bobrowski <mattbobrowski@...gle.com>,
	Mikhail Ivanov <ivanov.mikhail1@...wei-partners.com>,
	Phil Sutter <phil@....cc>,
	Praveen K Paladugu <prapal@...ux.microsoft.com>,
	Robert Salvet <robert.salvet@...lox.com>,
	Shervin Oloumi <enlightened@...gle.com>,
	Song Liu <song@...nel.org>,
	Tahera Fahimi <fahimitahera@...il.com>,
	Tyler Hicks <code@...icks.com>,
	audit@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	linux-security-module@...r.kernel.org
Subject: [PATCH v4 30/30] selftests/landlock: Test compatibility with audit rule lists

Add compatibility.lists tests to make sure AUDIT_EXE_LANDLOCK_DENY is
only allowed for AUDIT_FILTER_EXCLUDE, AUDIT_FILTER_EXIT, and
AUDIT_FILTER_URING_EXIT.

Test coverage for security/landlock is 93.5% of 1635 lines according to
gcc/gcov-14.

Cc: Günther Noack <gnoack@...gle.com>
Cc: Paul Moore <paul@...l-moore.com>
Signed-off-by: Mickaël Salaün <mic@...ikod.net>
Link: https://lore.kernel.org/r/20250108154338.1129069-31-mic@digikod.net
---

Changes since v3:
- New patch.
---
 tools/testing/selftests/landlock/audit_test.c | 78 +++++++++++++++++++
 1 file changed, 78 insertions(+)

diff --git a/tools/testing/selftests/landlock/audit_test.c b/tools/testing/selftests/landlock/audit_test.c
index 921f316ddbf8..d9f227680641 100644
--- a/tools/testing/selftests/landlock/audit_test.c
+++ b/tools/testing/selftests/landlock/audit_test.c
@@ -308,4 +308,82 @@ TEST_F(audit_rule, exe_landlock_deny)
 	ASSERT_EQ(0, WEXITSTATUS(status));
 }
 
+FIXTURE(compatibility)
+{
+	struct audit_filter filter_self;
+	int audit_fd;
+};
+
+FIXTURE_SETUP(compatibility)
+{
+	disable_caps(_metadata);
+	set_cap(_metadata, CAP_AUDIT_CONTROL);
+	self->audit_fd = audit_init_with_exe_filter(&self->filter_self);
+	EXPECT_LE(0, self->audit_fd)
+	{
+		const char *error_msg;
+
+		/* kill "$(auditctl -s | sed -ne 's/^pid \([0-9]\+\)$/\1/p')" */
+		if (self->audit_fd == -EEXIST)
+			error_msg = "socket already in use (e.g. auditd)";
+		else
+			error_msg = strerror(-self->audit_fd);
+		TH_LOG("Failed to initialize audit: %s", error_msg);
+	}
+	clear_cap(_metadata, CAP_AUDIT_CONTROL);
+}
+
+FIXTURE_TEARDOWN(compatibility)
+{
+	set_cap(_metadata, CAP_AUDIT_CONTROL);
+	EXPECT_EQ(0, audit_cleanup(self->audit_fd, &self->filter_self));
+	clear_cap(_metadata, CAP_AUDIT_CONTROL);
+}
+
+TEST_F(compatibility, lists)
+{
+	struct audit_filter filter_test;
+	size_t num_ok = 0;
+	__u32 list;
+
+	EXPECT_EQ(0, audit_init_filter_exe(AUDIT_EXE_LANDLOCK_DENY,
+					   &filter_test, NULL));
+	set_cap(_metadata, CAP_AUDIT_CONTROL);
+
+	for (list = 0; list < AUDIT_NR_FILTERS; list++) {
+		int err;
+
+		switch (list) {
+		case AUDIT_FILTER_EXIT:
+		case AUDIT_FILTER_EXCLUDE:
+		case AUDIT_FILTER_URING_EXIT:
+			num_ok++;
+			err = 0;
+			break;
+		default:
+			err = -EINVAL;
+			break;
+		}
+
+		/*
+		 * Testing AUDIT_FILTER_ENTRY prints "auditfilter:
+		 * AUDIT_FILTER_ENTRY is deprecated" in kernel logs.
+		 */
+		EXPECT_EQ(err, audit_filter_exe(self->audit_fd, &filter_test,
+						AUDIT_ADD_RULE, list))
+		{
+			TH_LOG("Unexpected result for list %u", list);
+		}
+		EXPECT_EQ(err, audit_filter_exe(self->audit_fd, &filter_test,
+						AUDIT_DEL_RULE, list))
+		{
+			TH_LOG("Unexpected result for list %u", list);
+		}
+	}
+
+	/* Makes sure the three accepted lists are checked. */
+	EXPECT_EQ(3, num_ok);
+	clear_cap(_metadata, CAP_AUDIT_CONTROL);
+}
+
 TEST_HARNESS_MAIN
-- 
2.47.1