This checks that landlock_upgrade_handled_layer_config() and
landlock_get_fs_access_mask() together result in the right handled
access rights being reported by landlock_get_fs_access_mask():
LANDLOCK_ACCESS_FS_REFER is only implicit if any of the other
filesystem access rights are handled.
Signed-off-by: Günther Noack <redacted>
---
security/landlock/domain.c | 44 ++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 44 insertions(+)
diff --git a/security/landlock/domain.c b/security/landlock/domain.c
index 4c0b1f0e1db5..71756c68d08e 100644
--- a/security/landlock/domain.c
+++ b/security/landlock/domain.c
@@ -753,6 +753,49 @@ static void test_landlock_get_deny_masks(struct kunit *const test)
&layers1));
}
+static void test_get_fs_access_mask(struct kunit *const test)
+{
+ static const struct {
+ struct layer_config config;
+ access_mask_t expected_fs;
+ } layers[] = {
+ {
+ .config.handled.net = LANDLOCK_ACCESS_NET_BIND_TCP,
+ .expected_fs = 0,
+ },
+ {
+ .config.handled.scope = LANDLOCK_SCOPE_SIGNAL,
+ .expected_fs = 0,
+ },
+ {
+ .config.handled.fs = LANDLOCK_ACCESS_FS_EXECUTE,
+ .expected_fs = LANDLOCK_ACCESS_FS_EXECUTE |
+ LANDLOCK_ACCESS_FS_REFER,
+ },
+ {
+ .config.handled.fs = LANDLOCK_ACCESS_FS_REFER,
+ .expected_fs = LANDLOCK_ACCESS_FS_REFER,
+ },
+ };
+ struct landlock_domain *domain;
+ size_t i;
+
+ domain = kunit_kzalloc(test,
+ struct_size(domain, layers, ARRAY_SIZE(layers)),
+ GFP_KERNEL);
+ KUNIT_ASSERT_NOT_NULL(test, domain);
+ domain->num_layers = ARRAY_SIZE(layers);
+
+ for (i = 0; i < ARRAY_SIZE(layers); i++)
+ domain->layers[i] =
+ landlock_upgrade_handled_layer_config(layers[i].config);
+
+ for (i = 0; i < ARRAY_SIZE(layers); i++)
+ KUNIT_EXPECT_EQ_MSG(test, layers[i].expected_fs,
+ landlock_get_fs_access_mask(domain, i),
+ "layer %zu", i);
+}
+
#endif /* CONFIG_SECURITY_LANDLOCK_KUNIT_TEST */
#ifdef CONFIG_SECURITY_LANDLOCK_KUNIT_TEST@@ -761,6 +804,7 @@ static struct kunit_case test_cases[] = {
/* clang-format off */
KUNIT_CASE(test_get_layer_deny_mask),
KUNIT_CASE(test_landlock_get_deny_masks),
+ KUNIT_CASE(test_get_fs_access_mask),
{}
/* clang-format on */
};
--
2.56.1