5/19/2022 6:00 PM, Mickaël Salaün пишет:
On 19/05/2022 14:31, Konstantin Meskhidze wrote:
5/17/2022 11:55 AM, Mickaël Salaün пишет:
I guess these tests would also work with IPv6. You can then use the
"alternative" tests I explained.
Do you mean adding new helpers such as bind_variant() and
connect_variant()??
On 16/05/2022 17:20, Konstantin Meskhidze wrote:
Adds two selftests for connect() action with
AF_UNSPEC family flag.
The one is with no landlock restrictions
allows to disconnect already conneted socket
with connect(..., AF_UNSPEC, ...):
- connect_afunspec_no_restictions;
The second one refuses landlocked process
to disconnect already connected socket:
- connect_afunspec_with_restictions;
Signed-off-by: Konstantin Meskhidze <konstantin.meskhidze@xxxxxxxxxx>
---
Changes since v3:
* Add connect_afunspec_no_restictions test.
* Add connect_afunspec_with_restictions test.
Changes since v4:
* Refactoring code with self->port, self->addr4 variables.
* Adds bind() hook check for with AF_UNSPEC family.
---
tools/testing/selftests/landlock/net_test.c | 121
++++++++++++++++++++
1 file changed, 121 insertions(+)
diff --git a/tools/testing/selftests/landlock/net_test.c
b/tools/testing/selftests/landlock/net_test.c
index cf914d311eb3..bf8e49466d1d 100644
--- a/tools/testing/selftests/landlock/net_test.c
+++ b/tools/testing/selftests/landlock/net_test.c
@@ -449,6 +449,7 @@ TEST_F_FORK(socket_test,
connect_with_restrictions_ip6) {
int new_fd;
int sockfd_1, sockfd_2;
pid_t child_1, child_2;
+
int status;
struct landlock_ruleset_attr ruleset_attr = {
@@ -467,10 +468,12 @@ TEST_F_FORK(socket_test,
connect_with_restrictions_ip6) {
const int ruleset_fd = landlock_create_ruleset(&ruleset_attr,
sizeof(ruleset_attr), 0);
+
Please no…
Sorry for that. I will apply clang-format-14.
clang-format will not complain about these new lines.
Anyway I will check that no additional new lines appear.
Thank you.
ASSERT_LE(0, ruleset_fd);
/* Allows connect and bind operations to the port[0] socket */
ASSERT_EQ(0, landlock_add_rule(ruleset_fd,
LANDLOCK_RULE_NET_SERVICE,
+
ditto
Ditto. Will be fixed with clang-format.
.
