[PATCH v5 20/24] selftests/landlock: Extend tests for landlock_restrict_self()'s flags

[Mickaël Salaün]

Add the restrict_self_flags test suite to check that
LANDLOCK_RESTRICT_SELF_QUIET, LANDLOCK_RESTRICT_SELF_QUIET_SUBDOMAINS,
and LANDLOCK_RESTRICT_SELF_LOG_CROSS_EXEC are valid but not the next
bit.  Also test flags incompatibility.  Some checks are similar to
restrict_self_checks_ordering's ones.

Cc: Günther Noack <gnoack at google.com>
Cc: Paul Moore <paul at paul-moore.com>
Signed-off-by: Mickaël Salaün <mic at digikod.net>
Link: https://lore.kernel.org/r/20250131163059.1139617-21-mic@digikod.net
---

Changes since v4:
- Update with LANDLOCK_RESTRICT_SELF_QUIET_SUBDOMAINS, and
  LANDLOCK_RESTRICT_SELF_LOG_CROSS_EXEC.

Changes since v3:
- Use a last_flag variable.

Changes since v2:
- New patch.
---
 tools/testing/selftests/landlock/base_test.c | 41 ++++++++++++++++++++
 1 file changed, 41 insertions(+)

diff --git a/tools/testing/selftests/landlock/base_test.c b/tools/testing/selftests/landlock/base_test.c
index fbd687691b3c..9e21f7535ab6 100644
--- a/tools/testing/selftests/landlock/base_test.c
+++ b/tools/testing/selftests/landlock/base_test.c
@@ -233,6 +233,47 @@ TEST(restrict_self_checks_ordering)
 	ASSERT_EQ(0, close(ruleset_fd));
 }
 
+TEST(restrict_self_flags)
+{
+	const __u32 last_flag = LANDLOCK_RESTRICT_SELF_LOG_CROSS_EXEC;
+
+	/* Tests valid flag combinations. */
+
+	ASSERT_EQ(-1, landlock_restrict_self(-1, 0));
+	ASSERT_EQ(EBADF, errno);
+
+	ASSERT_EQ(-1, landlock_restrict_self(-1, LANDLOCK_RESTRICT_SELF_QUIET));
+	ASSERT_EQ(EBADF, errno);
+
+	ASSERT_EQ(-1, landlock_restrict_self(
+			      -1, LANDLOCK_RESTRICT_SELF_QUIET_SUBDOMAINS));
+	ASSERT_EQ(EBADF, errno);
+
+	ASSERT_EQ(-1,
+		  landlock_restrict_self(
+			  -1, LANDLOCK_RESTRICT_SELF_QUIET |
+				      LANDLOCK_RESTRICT_SELF_QUIET_SUBDOMAINS));
+	ASSERT_EQ(EBADF, errno);
+
+	ASSERT_EQ(-1, landlock_restrict_self(
+			      -1, LANDLOCK_RESTRICT_SELF_LOG_CROSS_EXEC));
+	ASSERT_EQ(EBADF, errno);
+
+	/* Tests invalid flag combinations. */
+
+	ASSERT_EQ(-1,
+		  landlock_restrict_self(
+			  -1, LANDLOCK_RESTRICT_SELF_QUIET |
+				      LANDLOCK_RESTRICT_SELF_LOG_CROSS_EXEC));
+	ASSERT_EQ(EINVAL, errno);
+
+	ASSERT_EQ(-1, landlock_restrict_self(-1, last_flag << 1));
+	ASSERT_EQ(EINVAL, errno);
+
+	ASSERT_EQ(-1, landlock_restrict_self(-1, -1));
+	ASSERT_EQ(EINVAL, errno);
+}
+
 TEST(ruleset_fd_io)
 {
 	struct landlock_ruleset_attr ruleset_attr = {
-- 
2.48.1