Unverified Commit a5c369e4 authored by Mickaël Salaün's avatar Mickaël Salaün
Browse files

selftests/landlock: Add audit tests for network 

Test all network blockers:
- net.bind_tcp
- net.connect_tcp

Test coverage for security/landlock is 94.0% of 1525 lines according to
gcc/gcov-14.

Cc: Günther Noack <gnoack@google.com>
Cc: Paul Moore <paul@paul-moore.com>
Link: https://lore.kernel.org/r/20250320190717.2287696-28-mic@digikod.net


[mic: Update test coverage]
Signed-off-by: default avatarMickaël Salaün <mic@digikod.net>
parent 316d06b0

tools/testing/selftests/landlock/net_test.c

+132 −0
Original line number Diff line number Diff line
@@ -20,6 +20,7 @@ 
#include <sys/syscall.h>

#include <sys/un.h>



#include "audit.h"

#include "common.h"



const short sock_port_start = (1 << 10);
@@ -1868,4 +1869,135 @@ TEST_F(port_specific, bind_connect_1023) 
	EXPECT_EQ(0, close(bind_fd));

}



static int matches_log_tcp(const int audit_fd, const char *const blockers,

			   const char *const dir_addr, const char *const addr,

			   const char *const dir_port)

{

	static const char log_template[] = REGEX_LANDLOCK_PREFIX

		" blockers=%s %s=%s %s=1024$";

	/*

	 * Max strlen(blockers): 16

	 * Max strlen(dir_addr): 5

	 * Max strlen(addr): 12

	 * Max strlen(dir_port): 4

	 */

	char log_match[sizeof(log_template) + 37];

	int log_match_len;



	log_match_len = snprintf(log_match, sizeof(log_match), log_template,

				 blockers, dir_addr, addr, dir_port);

	if (log_match_len > sizeof(log_match))

		return -E2BIG;



	return audit_match_record(audit_fd, AUDIT_LANDLOCK_ACCESS, log_match,

				  NULL);

}



FIXTURE(audit)

{

	struct service_fixture srv0;

	struct audit_filter audit_filter;

	int audit_fd;

};



FIXTURE_VARIANT(audit)

{

	const char *const addr;

	const struct protocol_variant prot;

};



/* clang-format off */

FIXTURE_VARIANT_ADD(audit, ipv4) {

	/* clang-format on */

	.addr = "127\\.0\\.0\\.1",

	.prot = {

		.domain = AF_INET,

		.type = SOCK_STREAM,

	},

};



/* clang-format off */

FIXTURE_VARIANT_ADD(audit, ipv6) {

	/* clang-format on */

	.addr = "::1",

	.prot = {

		.domain = AF_INET6,

		.type = SOCK_STREAM,

	},

};



FIXTURE_SETUP(audit)

{

	ASSERT_EQ(0, set_service(&self->srv0, variant->prot, 0));

	setup_loopback(_metadata);



	set_cap(_metadata, CAP_AUDIT_CONTROL);

	self->audit_fd = audit_init_with_exe_filter(&self->audit_filter);

	EXPECT_LE(0, self->audit_fd);

	disable_caps(_metadata);

};



FIXTURE_TEARDOWN(audit)

{

	set_cap(_metadata, CAP_AUDIT_CONTROL);

	EXPECT_EQ(0, audit_cleanup(self->audit_fd, &self->audit_filter));

	clear_cap(_metadata, CAP_AUDIT_CONTROL);

}



TEST_F(audit, bind)

{

	const struct landlock_ruleset_attr ruleset_attr = {

		.handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP |

				      LANDLOCK_ACCESS_NET_CONNECT_TCP,

	};

	struct audit_records records;

	int ruleset_fd, sock_fd;



	ruleset_fd =

		landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);

	ASSERT_LE(0, ruleset_fd);

	enforce_ruleset(_metadata, ruleset_fd);

	EXPECT_EQ(0, close(ruleset_fd));



	sock_fd = socket_variant(&self->srv0);

	ASSERT_LE(0, sock_fd);

	EXPECT_EQ(-EACCES, bind_variant(sock_fd, &self->srv0));

	EXPECT_EQ(0, matches_log_tcp(self->audit_fd, "net\\.bind_tcp", "saddr",

				     variant->addr, "src"));



	EXPECT_EQ(0, audit_count_records(self->audit_fd, &records));

	EXPECT_EQ(0, records.access);

	EXPECT_EQ(1, records.domain);



	EXPECT_EQ(0, close(sock_fd));

}



TEST_F(audit, connect)

{

	const struct landlock_ruleset_attr ruleset_attr = {

		.handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP |

				      LANDLOCK_ACCESS_NET_CONNECT_TCP,

	};

	struct audit_records records;

	int ruleset_fd, sock_fd;



	ruleset_fd =

		landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);

	ASSERT_LE(0, ruleset_fd);

	enforce_ruleset(_metadata, ruleset_fd);

	EXPECT_EQ(0, close(ruleset_fd));



	sock_fd = socket_variant(&self->srv0);

	ASSERT_LE(0, sock_fd);

	EXPECT_EQ(-EACCES, connect_variant(sock_fd, &self->srv0));

	EXPECT_EQ(0, matches_log_tcp(self->audit_fd, "net\\.connect_tcp",

				     "daddr", variant->addr, "dest"));



	EXPECT_EQ(0, audit_count_records(self->audit_fd, &records));

	EXPECT_EQ(0, records.access);

	EXPECT_EQ(1, records.domain);



	EXPECT_EQ(0, close(sock_fd));

}



TEST_HARNESS_MAIN