[PATCH v4 3/5] selftests/landlock: Add tests for whiteout object creation
From: "Günther Noack" <gnoack@google.com>
Date: 2026-07-24 16:10:26
Subsystem:
kernel selftest framework, landlock security module, the rest · Maintainers:
Shuah Khan, Mickaël Salaün, Linus Torvalds
Add a test to check that whiteout object creation is guarded by LANDLOCK_ACCESS_FS_MAKE_REG, in the cases where these are created from userspace: * Conventional creation with mknod() * Linking or renaming an existing whiteout object * renameat2() with RENAME_WHITEOUT, which creates a new whiteout object in the source location Signed-off-by: Günther Noack <gnoack@google.com> --- tools/testing/selftests/landlock/fs_test.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+)
diff --git a/tools/testing/selftests/landlock/fs_test.c b/tools/testing/selftests/landlock/fs_test.c
index e82b56a74c5f..fe5faeca83eb 100644
--- a/tools/testing/selftests/landlock/fs_test.c
+++ b/tools/testing/selftests/landlock/fs_test.c@@ -2247,6 +2247,19 @@ TEST_F_FORK(layout1, rename_file) RENAME_EXCHANGE)); } +TEST_F_FORK(layout1, rename_whiteout_denied) +{ + enforce_fs(_metadata, LANDLOCK_ACCESS_FS_MAKE_REG, NULL); + + /* + * Try to rename a file with RENAME_WHITEOUT. + * file1_s3d3 is in dir_s3d2 (tmpfs), so it supports RENAME_WHITEOUT. + */ + EXPECT_EQ(-1, renameat2(AT_FDCWD, file1_s3d3, AT_FDCWD, + TMP_DIR "/s3d1/s3d2/s3d3/f2", RENAME_WHITEOUT)); + EXPECT_EQ(EACCES, errno); +} + TEST_F_FORK(layout1, rename_dir) { const struct rule rules[] = {
@@ -3270,6 +3283,14 @@ TEST_F_FORK(layout1, make_char) makedev(1, 3)); } +TEST_F_FORK(layout1, make_whiteout) +{ + /* Creates a whiteout object (creation guarded by MAKE_REG). */ + set_cap(_metadata, CAP_MKNOD); + test_make_file(_metadata, LANDLOCK_ACCESS_FS_MAKE_REG, S_IFCHR, + makedev(0, 0)); +} + TEST_F_FORK(layout1, make_block) { /* Creates a /dev/loop0 device. */
@@ -6951,6 +6972,7 @@ TEST_F_FORK(layout2_overlay, same_content_different_file) } } + FIXTURE(layout3_fs) { bool has_created_dir;
--
2.55.0.229.g6434b31f56-goog