9/4/2024 1:48 PM, Mikhail Ivanov wrote:
Add test validating that Landlock provides restriction of user space
sockets only.
Signed-off-by: Mikhail Ivanov <ivanov.mikhail1@xxxxxxxxxxxxxxxxxxx>
---
.../testing/selftests/landlock/socket_test.c | 39 ++++++++++++++++++-
1 file changed, 38 insertions(+), 1 deletion(-)
diff --git a/tools/testing/selftests/landlock/socket_test.c b/tools/testing/selftests/landlock/socket_test.c
index ff5ace711697..23698b8c2f4d 100644
--- a/tools/testing/selftests/landlock/socket_test.c
+++ b/tools/testing/selftests/landlock/socket_test.c
@@ -7,7 +7,7 @@
#define _GNU_SOURCE
-#include <linux/landlock.h>
+#include "landlock.h"
typo, will be fixed
#include <linux/pfkeyv2.h>
#include <linux/kcm.h>
#include <linux/can.h>
@@ -628,4 +628,41 @@ TEST(unsupported_af_and_prot)
EXPECT_EQ(ESOCKTNOSUPPORT, test_socket(AF_UNIX, SOCK_PACKET, 0));
}
+TEST(kernel_socket)
+{
+ const struct landlock_ruleset_attr ruleset_attr = {
+ .handled_access_socket = LANDLOCK_ACCESS_SOCKET_CREATE,
+ };
+ struct landlock_socket_attr smc_socket_create = {
+ .allowed_access = LANDLOCK_ACCESS_SOCKET_CREATE,
+ .family = AF_SMC,
+ .type = SOCK_STREAM,
+ };
+ int ruleset_fd;
+
+ /*
+ * Checks that SMC socket is created sucessfuly without
+ * landlock restrictions.
+ */
+ ASSERT_EQ(0, test_socket(AF_SMC, SOCK_STREAM, 0));
+
+ ruleset_fd =
+ landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
+ ASSERT_LE(0, ruleset_fd);
+
+ ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_SOCKET,
+ &smc_socket_create, 0));
+ enforce_ruleset(_metadata, ruleset_fd);
+ ASSERT_EQ(0, close(ruleset_fd));
+
+ /*
+ * During the creation of an SMC socket, an internal service TCP socket
+ * is also created (Cf. smc_create_clcsk).
+ *
+ * Checks that Landlock does not restrict creation of the kernel space
+ * socket.
+ */
+ EXPECT_EQ(0, test_socket(AF_SMC, SOCK_STREAM, 0));
+}
+
TEST_HARNESS_MAIN
