selftests/landlock: Add audit tests for network

Test all network blockers:
- net.bind_tcp
- net.connect_tcp

Test coverage for security/landlock is 94.0% of 1525 lines according to
gcc/gcov-14.

Cc: Günther Noack <gnoack@google.com>
Cc: Paul Moore <paul@paul-moore.com>
Link: https://lore.kernel.org/r/20250320190717.2287696-28-mic@digikod.net
[mic: Update test coverage]
Signed-off-by: Mickaël Salaün <mic@digikod.net>

diff --git a/tools/testing/selftests/landlock/net_test.c b/tools/testing/selftests/landlock/net_test.c
index d9de0ee49ebc270ddf5fabd6bfba2374bca50927..2a45208551e61aa35154c532c1d8fea157ebd2c9 100644 (file)
--- a/tools/testing/selftests/landlock/net_test.c
+++ b/tools/testing/selftests/landlock/net_test.c
@@ -20,6 +20,7 @@
 #include <sys/syscall.h>
 #include <sys/un.h>
 
+#include "audit.h"
 #include "common.h"
 
 const short sock_port_start = (1 << 10);
@@ -1868,4 +1869,135 @@ TEST_F(port_specific, bind_connect_1023)
        EXPECT_EQ(0, close(bind_fd));
 }
 
+static int matches_log_tcp(const int audit_fd, const char *const blockers,
+                          const char *const dir_addr, const char *const addr,
+                          const char *const dir_port)
+{
+       static const char log_template[] = REGEX_LANDLOCK_PREFIX
+               " blockers=%s %s=%s %s=1024$";
+       /*
+        * Max strlen(blockers): 16
+        * Max strlen(dir_addr): 5
+        * Max strlen(addr): 12
+        * Max strlen(dir_port): 4
+        */
+       char log_match[sizeof(log_template) + 37];
+       int log_match_len;
+
+       log_match_len = snprintf(log_match, sizeof(log_match), log_template,
+                                blockers, dir_addr, addr, dir_port);
+       if (log_match_len > sizeof(log_match))
+               return -E2BIG;
+
+       return audit_match_record(audit_fd, AUDIT_LANDLOCK_ACCESS, log_match,
+                                 NULL);
+}
+
+FIXTURE(audit)
+{
+       struct service_fixture srv0;
+       struct audit_filter audit_filter;
+       int audit_fd;
+};
+
+FIXTURE_VARIANT(audit)
+{
+       const char *const addr;
+       const struct protocol_variant prot;
+};
+
+/* clang-format off */
+FIXTURE_VARIANT_ADD(audit, ipv4) {
+       /* clang-format on */
+       .addr = "127\\.0\\.0\\.1",
+       .prot = {
+               .domain = AF_INET,
+               .type = SOCK_STREAM,
+       },
+};
+
+/* clang-format off */
+FIXTURE_VARIANT_ADD(audit, ipv6) {
+       /* clang-format on */
+       .addr = "::1",
+       .prot = {
+               .domain = AF_INET6,
+               .type = SOCK_STREAM,
+       },
+};
+
+FIXTURE_SETUP(audit)
+{
+       ASSERT_EQ(0, set_service(&self->srv0, variant->prot, 0));
+       setup_loopback(_metadata);
+
+       set_cap(_metadata, CAP_AUDIT_CONTROL);
+       self->audit_fd = audit_init_with_exe_filter(&self->audit_filter);
+       EXPECT_LE(0, self->audit_fd);
+       disable_caps(_metadata);
+};
+
+FIXTURE_TEARDOWN(audit)
+{
+       set_cap(_metadata, CAP_AUDIT_CONTROL);
+       EXPECT_EQ(0, audit_cleanup(self->audit_fd, &self->audit_filter));
+       clear_cap(_metadata, CAP_AUDIT_CONTROL);
+}
+
+TEST_F(audit, bind)
+{
+       const struct landlock_ruleset_attr ruleset_attr = {
+               .handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP |
+                                     LANDLOCK_ACCESS_NET_CONNECT_TCP,
+       };
+       struct audit_records records;
+       int ruleset_fd, sock_fd;
+
+       ruleset_fd =
+               landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
+       ASSERT_LE(0, ruleset_fd);
+       enforce_ruleset(_metadata, ruleset_fd);
+       EXPECT_EQ(0, close(ruleset_fd));
+
+       sock_fd = socket_variant(&self->srv0);
+       ASSERT_LE(0, sock_fd);
+       EXPECT_EQ(-EACCES, bind_variant(sock_fd, &self->srv0));
+       EXPECT_EQ(0, matches_log_tcp(self->audit_fd, "net\\.bind_tcp", "saddr",
+                                    variant->addr, "src"));
+
+       EXPECT_EQ(0, audit_count_records(self->audit_fd, &records));
+       EXPECT_EQ(0, records.access);
+       EXPECT_EQ(1, records.domain);
+
+       EXPECT_EQ(0, close(sock_fd));
+}
+
+TEST_F(audit, connect)
+{
+       const struct landlock_ruleset_attr ruleset_attr = {
+               .handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP |
+                                     LANDLOCK_ACCESS_NET_CONNECT_TCP,
+       };
+       struct audit_records records;
+       int ruleset_fd, sock_fd;
+
+       ruleset_fd =
+               landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
+       ASSERT_LE(0, ruleset_fd);
+       enforce_ruleset(_metadata, ruleset_fd);
+       EXPECT_EQ(0, close(ruleset_fd));
+
+       sock_fd = socket_variant(&self->srv0);
+       ASSERT_LE(0, sock_fd);
+       EXPECT_EQ(-EACCES, connect_variant(sock_fd, &self->srv0));
+       EXPECT_EQ(0, matches_log_tcp(self->audit_fd, "net\\.connect_tcp",
+                                    "daddr", variant->addr, "dest"));
+
+       EXPECT_EQ(0, audit_count_records(self->audit_fd, &records));
+       EXPECT_EQ(0, records.access);
+       EXPECT_EQ(1, records.domain);
+
+       EXPECT_EQ(0, close(sock_fd));
+}
+
 TEST_HARNESS_MAIN