linux-kernel - Re: [PATCH v2 2/3] lockdown/kunit: Introduce kunit tests

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aIlZE8i/XzSFWS2U@rli9-mobl>
Date: Wed, 30 Jul 2025 07:28:19 +0800
From: Philip Li <philip.li@...el.com>
To: Nikolay Borisov <nik.borisov@...e.com>
CC: kernel test robot <lkp@...el.com>,
	<linux-security-module@...r.kernel.org>, <llvm@...ts.linux.dev>,
	<oe-kbuild-all@...ts.linux.dev>, <linux-kernel@...r.kernel.org>,
	<paul@...l-moore.com>, <serge@...lyn.com>, <jmorris@...ei.org>,
	<dan.j.williams@...el.com>
Subject: Re: [PATCH v2 2/3] lockdown/kunit: Introduce kunit tests

On Tue, Jul 29, 2025 at 10:46:48AM +0300, Nikolay Borisov wrote:
> 
> 
> On 29.07.25 г. 1:04 ч., kernel test robot wrote:
> > Hi Nikolay,
> > 
> > kernel test robot noticed the following build warnings:
> > 
> > [auto build test WARNING on linus/master]
> > [also build test WARNING on v6.16 next-20250728]
> > [If your patch is applied to the wrong git tree, kindly drop us a note.
> > And when submitting patch, we suggest to use '--base' as documented in
> > https://git-scm.com/docs/git-format-patch#_base_tree_information]
> > 
> > url:    https://github.com/intel-lab-lkp/linux/commits/Nikolay-Borisov/lockdown-Switch-implementation-to-using-bitmap/20250728-191807
> > base:   linus/master
> > patch link:    https://lore.kernel.org/r/20250728111517.134116-3-nik.borisov%40suse.com
> > patch subject: [PATCH v2 2/3] lockdown/kunit: Introduce kunit tests
> > config: arm-randconfig-004-20250729 (https://download.01.org/0day-ci/archive/20250729/202507290540.9IANrMED-lkp@intel.com/config)
> > compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project 1b4db78d2eaa070b3f364a2d2b2b826a5439b892)
> > reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250729/202507290540.9IANrMED-lkp@intel.com/reproduce)
> > 
> > If you fix the issue in a separate patch/commit (i.e. not just a new version of
> > the same patch/commit), kindly add following tags
> > | Reported-by: kernel test robot <lkp@...el.com>
> > | Closes: https://lore.kernel.org/oe-kbuild-all/202507290540.9IANrMED-lkp@intel.com/
> > 
> > All warnings (new ones prefixed by >>):
> > 
> > > > security/lockdown/lockdown.c:31:5: warning: no previous prototype for function 'lock_kernel_down' [-Wmissing-prototypes]
> >        31 | int lock_kernel_down(const char *where, enum lockdown_reason level)
> >           |     ^
> >     security/lockdown/lockdown.c:31:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
> >        31 | int lock_kernel_down(const char *where, enum lockdown_reason level)
> >           | ^
> >           | static
> >     1 warning generated.
> 
> 
> That's a false positive, since the function is exported only for KUNIT case,
> what's the correct way to make testbot ignore it ?

thanks for the info, i will configure the bot to ignore this firstly, and
later to check whether there's any pattern for more general ignore. Sorry
for the noise.

> > 
> > 
> > vim +/lock_kernel_down +31 security/lockdown/lockdown.c
> > 
> >      20	
> >      21	static const enum lockdown_reason lockdown_levels[] = {LOCKDOWN_NONE,
> >      22							 LOCKDOWN_INTEGRITY_MAX,
> >      23							 LOCKDOWN_CONFIDENTIALITY_MAX};
> >      24	
> >      25	/*
> >      26	 * Put the kernel into lock-down mode.
> >      27	 */
> >      28	#if !IS_ENABLED(CONFIG_KUNIT)
> >      29	static
> >      30	#endif
> >    > 31	int lock_kernel_down(const char *where, enum lockdown_reason level)
> >      32	{
> >      33	
> >      34		if (level > LOCKDOWN_CONFIDENTIALITY_MAX)
> >      35			return -EINVAL;
> >      36	
> >      37		if (level == LOCKDOWN_INTEGRITY_MAX || level == LOCKDOWN_CONFIDENTIALITY_MAX)
> >      38			bitmap_set(kernel_locked_down, 1, level);
> >      39		else
> >      40			bitmap_set(kernel_locked_down, level, 1);
> >      41	
> >      42		pr_notice("Kernel is locked down from %s; see man kernel_lockdown.7\n",
> >      43			  where);
> >      44		return 0;
> >      45	}
> >      46	
> > 
>