On 10/5/2024 7:57 PM, Günther Noack wrote:
On Wed, Aug 14, 2024 at 11:01:50AM +0800, Mikhail Ivanov wrote:
listen(2) can be used to change length of the pending connections queue
of the listening socket. Such scenario shouldn't be restricted by Landlock
since socket doesn't change its state.
Yes, this behavior makes sense to me as well. 👍 __inet_listen_sk()
only changes sk->sk_max_ack_backlog when listen() gets called a second
time.
* Implement test that validates this case.
Signed-off-by: Mikhail Ivanov <ivanov.mikhail1@xxxxxxxxxxxxxxxxxxx>
---
tools/testing/selftests/landlock/net_test.c | 26 +++++++++++++++++++++
1 file changed, 26 insertions(+)
diff --git a/tools/testing/selftests/landlock/net_test.c b/tools/testing/selftests/landlock/net_test.c
index 6831d8a2e9aa..dafc433a0068 100644
--- a/tools/testing/selftests/landlock/net_test.c
+++ b/tools/testing/selftests/landlock/net_test.c
@@ -1768,6 +1768,32 @@ TEST_F(ipv4_tcp, with_fs)
EXPECT_EQ(-EACCES, bind_variant(bind_fd, &self->srv1));
}
+TEST_F(ipv4_tcp, double_listen)
+{
+ const struct landlock_ruleset_attr ruleset_attr = {
+ .handled_access_net = LANDLOCK_ACCESS_NET_LISTEN_TCP,
+ };
+ int ruleset_fd;
+ int listen_fd;
+
+ listen_fd = socket_variant(&self->srv0);
+ ASSERT_LE(0, listen_fd);
+
+ EXPECT_EQ(0, bind_variant(listen_fd, &self->srv0));
+ EXPECT_EQ(0, listen_variant(listen_fd, backlog));
+
+ ruleset_fd =
+ landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
+ ASSERT_LE(0, ruleset_fd);
+
+ /* Denies listen. */
+ enforce_ruleset(_metadata, ruleset_fd);
+ EXPECT_EQ(0, close(ruleset_fd));
+
+ /* Tries to change backlog value of listening socket. */
+ EXPECT_EQ(0, listen_variant(listen_fd, backlog + 1));
For test clarity: Without reading the commit message, I believe it
might not be obvious to the reader *why* the second listen() is
supposed to work. This might be worth a comment.
Ofc, thanks!
+}
+
FIXTURE(port_specific)
{
struct service_fixture srv0;
--
2.34.1
Reviewed-by: Günther Noack <gnoack3000@xxxxxxxxx>
