netdev - Re: [PATCH v5 11/15] seltests/landlock: connect() with AF

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <acda6f05-efeb-4f44-9189-589917a45b95@digikod.net>
Date:   Thu, 19 May 2022 17:00:16 +0200
From:   Mickaël Salaün <mic@...ikod.net>
To:     Konstantin Meskhidze <konstantin.meskhidze@...wei.com>
Cc:     willemdebruijn.kernel@...il.com,
        linux-security-module@...r.kernel.org, netdev@...r.kernel.org,
        netfilter-devel@...r.kernel.org, yusongping@...wei.com,
        anton.sirazetdinov@...wei.com
Subject: Re: [PATCH v5 11/15] seltests/landlock: connect() with AF_UNSPEC
 tests


On 19/05/2022 14:31, Konstantin Meskhidze wrote:
> 
> 
> 5/17/2022 11:55 AM, Mickaël Salaün пишет:
>> I guess these tests would also work with IPv6. You can then use the 
>> "alternative" tests I explained.
>>
>    Do you mean adding new helpers such as bind_variant() and 
> connect_variant()??
>> On 16/05/2022 17:20, Konstantin Meskhidze wrote:
>>> Adds two selftests for connect() action with
>>> AF_UNSPEC family flag.
>>> The one is with no landlock restrictions
>>> allows to disconnect already conneted socket
>>> with connect(..., AF_UNSPEC, ...):
>>>      - connect_afunspec_no_restictions;
>>> The second one refuses landlocked process
>>> to disconnect already connected socket:
>>>      - connect_afunspec_with_restictions;
>>>
>>> Signed-off-by: Konstantin Meskhidze <konstantin.meskhidze@...wei.com>
>>> ---
>>>
>>> Changes since v3:
>>> * Add connect_afunspec_no_restictions test.
>>> * Add connect_afunspec_with_restictions test.
>>>
>>> Changes since v4:
>>> * Refactoring code with self->port, self->addr4 variables.
>>> * Adds bind() hook check for with AF_UNSPEC family.
>>>
>>> ---
>>>   tools/testing/selftests/landlock/net_test.c | 121 ++++++++++++++++++++
>>>   1 file changed, 121 insertions(+)
>>>
>>> diff --git a/tools/testing/selftests/landlock/net_test.c 
>>> b/tools/testing/selftests/landlock/net_test.c
>>> index cf914d311eb3..bf8e49466d1d 100644
>>> --- a/tools/testing/selftests/landlock/net_test.c
>>> +++ b/tools/testing/selftests/landlock/net_test.c
>>> @@ -449,6 +449,7 @@ TEST_F_FORK(socket_test, 
>>> connect_with_restrictions_ip6) {
>>>       int new_fd;
>>>       int sockfd_1, sockfd_2;
>>>       pid_t child_1, child_2;
>>> +
>>>       int status;
>>>
>>>       struct landlock_ruleset_attr ruleset_attr = {
>>> @@ -467,10 +468,12 @@ TEST_F_FORK(socket_test, 
>>> connect_with_restrictions_ip6) {
>>>
>>>       const int ruleset_fd = landlock_create_ruleset(&ruleset_attr,
>>>               sizeof(ruleset_attr), 0);
>>> +
>>
>> Please no…
>>
>   Sorry for that. I will apply clang-format-14.

clang-format will not complain about these new lines.


>>
>>>       ASSERT_LE(0, ruleset_fd);
>>>
>>>       /* Allows connect and bind operations to the port[0] socket */
>>>       ASSERT_EQ(0, landlock_add_rule(ruleset_fd, 
>>> LANDLOCK_RULE_NET_SERVICE,
>>> +
>>
>> ditto
> 
>    Ditto. Will be fixed with clang-format.