diff mbox series

[03/10] Add landlock SAFE_* macros

Message ID 20240701-landlock-v1-3-58e9af649a72@suse.com
State Superseded
Headers show
Series landlock testing suite | expand

Commit Message

Andrea Cervesato July 1, 2024, 3:42 p.m. UTC 
From: Andrea Cervesato <andrea.cervesato@suse.com>

Added three more SAFE_* macros for landlock sandbox:

- SAFE_LANDLOCK_CREATE_RULESET
- SAFE_LANDLOCK_ADD_RULE
- SAFE_LANDLOCK_RESTRICT_SELF

Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
 include/tst_safe_macros.h | 19 ++++++++++++++++++
 lib/tst_safe_macros.c     | 50 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 69 insertions(+)

Comments

Li Wang July 2, 2024, 7:47 a.m. UTC | #1 
Reviewed-by: Li Wang <liwang@redhat.com>

On Mon, Jul 1, 2024 at 11:43 PM Andrea Cervesato <andrea.cervesato@suse.de>
wrote:

> From: Andrea Cervesato <andrea.cervesato@suse.com>
>
> Added three more SAFE_* macros for landlock sandbox:
>
> - SAFE_LANDLOCK_CREATE_RULESET
> - SAFE_LANDLOCK_ADD_RULE
> - SAFE_LANDLOCK_RESTRICT_SELF
>
> Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
> ---
>  include/tst_safe_macros.h | 19 ++++++++++++++++++
>  lib/tst_safe_macros.c     | 50
> +++++++++++++++++++++++++++++++++++++++++++++++
>  2 files changed, 69 insertions(+)
>
> diff --git a/include/tst_safe_macros.h b/include/tst_safe_macros.h
> index 08b8e930a..7748bd34f 100644
> --- a/include/tst_safe_macros.h
> +++ b/include/tst_safe_macros.h
> @@ -14,6 +14,7 @@
>  #include <sys/stat.h>
>  #include <sys/vfs.h>
>  #include <sys/sysinfo.h>
> +#include <linux/landlock.h>
>  #include <fcntl.h>
>  #include <libgen.h>
>  #include <signal.h>
> @@ -503,4 +504,22 @@ int safe_sscanf(const char *file, const int lineno,
> const char *restrict buffer,
>  #define SAFE_SSCANF(buffer, format, ...) \
>         safe_sscanf(__FILE__, __LINE__, (buffer), (format),
>  ##__VA_ARGS__)
>
> +int safe_landlock_create_ruleset(const char *file, const int lineno,
> +       const struct landlock_ruleset_attr *attr,
> +       size_t size , uint32_t flags);
> +#define SAFE_LANDLOCK_CREATE_RULESET(attr, size, flags) \
> +       safe_landlock_create_ruleset(__FILE__, __LINE__, (attr), (size),
> (flags))
> +
> +int safe_landlock_add_rule(const char *file, const int lineno,
> +       int ruleset_fd, enum landlock_rule_type rule_type,
> +       const void *rule_attr, uint32_t flags);
> +#define SAFE_LANDLOCK_ADD_RULE(ruleset_fd, rule_type, rule_attr, flags) \
> +       safe_landlock_add_rule(__FILE__, __LINE__, \
> +               (ruleset_fd), (rule_type), (rule_attr), (flags))
> +
> +int safe_landlock_restrict_self(const char *file, const int lineno,
> +       int ruleset_fd, int flags);
> +#define SAFE_LANDLOCK_RESTRICT_SELF(ruleset_fd, flags) \
> +       safe_landlock_restrict_self(__FILE__, __LINE__, (ruleset_fd),
> (flags))
> +
>  #endif /* TST_SAFE_MACROS_H__ */
> diff --git a/lib/tst_safe_macros.c b/lib/tst_safe_macros.c
> index 4e48c427b..ba997eb7c 100644
> --- a/lib/tst_safe_macros.c
> +++ b/lib/tst_safe_macros.c
> @@ -710,3 +710,53 @@ int safe_mprotect(const char *file, const int lineno,
>
>         return rval;
>  }
> +
> +
> +int safe_landlock_create_ruleset(const char *file, const int lineno,
> +       const struct landlock_ruleset_attr *attr,
> +       size_t size , uint32_t flags)
> +{
> +       int rval;
> +
> +       rval = tst_syscall(__NR_landlock_create_ruleset, attr, size,
> flags);
> +       if (rval == -1) {
> +               tst_brk_(file, lineno, TBROK | TERRNO,
> +                       "landlock_create_ruleset(%p, %lu, %u)",
> +                       attr, size, flags);
> +       }
> +
> +       return rval;
> +}
> +
> +int safe_landlock_add_rule(const char *file, const int lineno,
> +       int ruleset_fd, enum landlock_rule_type rule_type,
> +       const void *rule_attr, uint32_t flags)
> +{
> +       int rval;
> +
> +       rval = tst_syscall(__NR_landlock_add_rule,
> +               ruleset_fd, rule_type, rule_attr, flags);
> +
> +       if (rval == -1) {
> +               tst_brk_(file, lineno, TBROK | TERRNO,
> +                       "landlock_add_rule(%d, %d, %p, %u)",
> +                       ruleset_fd, rule_type, rule_attr, flags);
> +       }
> +
> +       return rval;
> +}
> +
> +int safe_landlock_restrict_self(const char *file, const int lineno,
> +       int ruleset_fd, int flags)
> +{
> +       int rval;
> +
> +       rval = tst_syscall(__NR_landlock_restrict_self, ruleset_fd, flags);
> +       if (rval == -1) {
> +               tst_brk_(file, lineno, TBROK | TERRNO,
> +                       "landlock_restrict_self(%d, %u)",
> +                       ruleset_fd, flags);
> +       }
> +
> +       return rval;
> +}
>
> --
> 2.43.0
>
>
> --
> Mailing list info: https://lists.linux.it/listinfo/ltp
>
>
Petr Vorel July 10, 2024, 3:53 p.m. UTC | #2 
Hi Andrea, Li,

...
> +++ b/include/tst_safe_macros.h
> @@ -14,6 +14,7 @@
>  #include <sys/stat.h>
>  #include <sys/vfs.h>
>  #include <sys/sysinfo.h>
> +#include <linux/landlock.h>

This will break build for more than half of the distros:

https://github.com/pevik/ltp/actions/runs/9876952862

It's mostly due missing <linux/landlock.h> on old distros, but there were also
redefinition of 'landlock_net_port_attr' at least on Fedora.

You even have some fixed version in your CI where only Leap 42 fails due
different problem), please send it (or post a diff here).
https://github.com/acerv/ltp/actions/runs/9778823237

Kind regards,
Petr
Andrea Cervesato July 10, 2024, 5:53 p.m. UTC | #3 
Hi Petr,

this is already done in the v2 which has not been sent yet.

On 7/10/24 17:53, Petr Vorel wrote:
> Hi Andrea, Li,
>
> ...
>> +++ b/include/tst_safe_macros.h
>> @@ -14,6 +14,7 @@
>>   #include <sys/stat.h>
>>   #include <sys/vfs.h>
>>   #include <sys/sysinfo.h>
>> +#include <linux/landlock.h>
> This will break build for more than half of the distros:
>
> https://github.com/pevik/ltp/actions/runs/9876952862
>
> It's mostly due missing <linux/landlock.h> on old distros, but there were also
> redefinition of 'landlock_net_port_attr' at least on Fedora.
>
> You even have some fixed version in your CI where only Leap 42 fails due
> different problem), please send it (or post a diff here).
> https://github.com/acerv/ltp/actions/runs/9778823237
>
> Kind regards,
> Petr

Andrea
Petr Vorel July 11, 2024, 5:27 a.m. UTC | #4 
> Hi Petr,

> this is already done in the v2 which has not been sent yet.

Thanks for info, this was not obvious until I check github actions in your fork
(or I miss some message). I keep patches with NEW state so that other can have
look until you send v2.

Kind regards,
Petr

> On 7/10/24 17:53, Petr Vorel wrote:
> > Hi Andrea, Li,

> > ...
> > > +++ b/include/tst_safe_macros.h
> > > @@ -14,6 +14,7 @@
> > >   #include <sys/stat.h>
> > >   #include <sys/vfs.h>
> > >   #include <sys/sysinfo.h>
> > > +#include <linux/landlock.h>
> > This will break build for more than half of the distros:

> > https://github.com/pevik/ltp/actions/runs/9876952862

> > It's mostly due missing <linux/landlock.h> on old distros, but there were also
> > redefinition of 'landlock_net_port_attr' at least on Fedora.

> > You even have some fixed version in your CI where only Leap 42 fails due
> > different problem), please send it (or post a diff here).
> > https://github.com/acerv/ltp/actions/runs/9778823237

> > Kind regards,
> > Petr

> Andrea
Li Wang July 11, 2024, 6:30 a.m. UTC | #5 
Petr Vorel <pvorel@suse.cz> wrote:



> > this is already done in the v2 which has not been sent yet.
>
> Thanks for info, this was not obvious until I check github actions in your
> fork
> (or I miss some message). I keep patches with NEW state so that other can
> have
> look until you send v2.
>

V2 has been posted, FYI:
https://lists.linux.it/pipermail/ltp/2024-July/039236.html
diff mbox series

Patch

diff --git a/include/tst_safe_macros.h b/include/tst_safe_macros.h
index 08b8e930a..7748bd34f 100644
--- a/include/tst_safe_macros.h
+++ b/include/tst_safe_macros.h
@@ -14,6 +14,7 @@ 
 #include <sys/stat.h>
 #include <sys/vfs.h>
 #include <sys/sysinfo.h>
+#include <linux/landlock.h>
 #include <fcntl.h>
 #include <libgen.h>
 #include <signal.h>
@@ -503,4 +504,22 @@  int safe_sscanf(const char *file, const int lineno, const char *restrict buffer,
 #define SAFE_SSCANF(buffer, format, ...) \
 	safe_sscanf(__FILE__, __LINE__, (buffer), (format),	##__VA_ARGS__)
 
+int safe_landlock_create_ruleset(const char *file, const int lineno,
+	const struct landlock_ruleset_attr *attr,
+	size_t size , uint32_t flags);
+#define SAFE_LANDLOCK_CREATE_RULESET(attr, size, flags) \
+	safe_landlock_create_ruleset(__FILE__, __LINE__, (attr), (size), (flags))
+
+int safe_landlock_add_rule(const char *file, const int lineno,
+	int ruleset_fd, enum landlock_rule_type rule_type,
+	const void *rule_attr, uint32_t flags);
+#define SAFE_LANDLOCK_ADD_RULE(ruleset_fd, rule_type, rule_attr, flags) \
+	safe_landlock_add_rule(__FILE__, __LINE__, \
+		(ruleset_fd), (rule_type), (rule_attr), (flags))
+
+int safe_landlock_restrict_self(const char *file, const int lineno,
+	int ruleset_fd, int flags);
+#define SAFE_LANDLOCK_RESTRICT_SELF(ruleset_fd, flags) \
+	safe_landlock_restrict_self(__FILE__, __LINE__, (ruleset_fd), (flags))
+
 #endif /* TST_SAFE_MACROS_H__ */
diff --git a/lib/tst_safe_macros.c b/lib/tst_safe_macros.c
index 4e48c427b..ba997eb7c 100644
--- a/lib/tst_safe_macros.c
+++ b/lib/tst_safe_macros.c
@@ -710,3 +710,53 @@  int safe_mprotect(const char *file, const int lineno,
 
 	return rval;
 }
+
+
+int safe_landlock_create_ruleset(const char *file, const int lineno,
+	const struct landlock_ruleset_attr *attr,
+	size_t size , uint32_t flags)
+{
+	int rval;
+
+	rval = tst_syscall(__NR_landlock_create_ruleset, attr, size, flags);
+	if (rval == -1) {
+		tst_brk_(file, lineno, TBROK | TERRNO,
+			"landlock_create_ruleset(%p, %lu, %u)",
+			attr, size, flags);
+	}
+
+	return rval;
+}
+
+int safe_landlock_add_rule(const char *file, const int lineno,
+	int ruleset_fd, enum landlock_rule_type rule_type,
+	const void *rule_attr, uint32_t flags)
+{
+	int rval;
+
+	rval = tst_syscall(__NR_landlock_add_rule,
+		ruleset_fd, rule_type, rule_attr, flags);
+
+	if (rval == -1) {
+		tst_brk_(file, lineno, TBROK | TERRNO,
+			"landlock_add_rule(%d, %d, %p, %u)",
+			ruleset_fd, rule_type, rule_attr, flags);
+	}
+
+	return rval;
+}
+
+int safe_landlock_restrict_self(const char *file, const int lineno,
+	int ruleset_fd, int flags)
+{
+	int rval;
+
+	rval = tst_syscall(__NR_landlock_restrict_self, ruleset_fd, flags);
+	if (rval == -1) {
+		tst_brk_(file, lineno, TBROK | TERRNO,
+			"landlock_restrict_self(%d, %u)",
+			ruleset_fd, flags);
+	}
+
+	return rval;
+}