[PATCH v4 6/8] selftests/landlock: Add capability restriction tests

[Mickaël Salaün]

On Fri, Oct 02, 2026 at 12:53:55PM +0000, sashiko-bot at kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Medium] selftests/landlock: host hostname modification in cap_without_nnp test failure
> --
> 
> commit 359c59ecc043d1cac20779ee8cc6bc19e3b8e705
> Author: Mickaël Salaün <mic at digikod.net>
> selftests/landlock: Add capability restriction tests
> 
> This commit adds tests to exercise capability restrictions enforced by
> Landlock. It covers various standard capability evaluations, stacking
> combinations, and non-standard contexts such as enforcing a domain
> without no_new_privs.
> 
> > diff --git a/tools/testing/selftests/landlock/cap_test.c b/tools/testing/selftests/landlock/cap_test.c
> > new file mode 100644
> > index 0000000000000..8673934aac11e
> > --- /dev/null
> > +++ b/tools/testing/selftests/landlock/cap_test.c
> [ ... ]
> > +TEST(cap_without_nnp)
> > +{
> > +	int ruleset_fd;
> > +
> > +	disable_caps(_metadata);
> > +
> > +	ruleset_fd = create_cap_ruleset();
> > +	ASSERT_LE(0, ruleset_fd);
> > +
> > +	/* Allow CAP_SYS_CHROOT but not CAP_SYS_ADMIN. */
> > +	ASSERT_EQ(0, add_cap_rule(ruleset_fd, CAP_SYS_CHROOT));
> > +
> > +	/*
> > +	 * Enforce WITHOUT NNP: landlock_restrict_self() succeeds when the
> > +	 * caller has CAP_SYS_ADMIN (checked before the new domain takes
> > +	 * effect).
> > +	 */
> > +	set_cap(_metadata, CAP_SYS_ADMIN);
> > +	ASSERT_EQ(0, landlock_restrict_self(ruleset_fd, 0));
> > +	EXPECT_EQ(0, close(ruleset_fd));
> > +
> > +	/*
> > +	 * CAP_SYS_ADMIN is still in effective set but Landlock denies it:
> > +	 * cap_capable() returns 0, then hook_capable() returns -EPERM.
> > +	 */
> > +	EXPECT_EQ(-1, sethostname("test", 4));
> 
> [Severity: Medium]
> Will this modify the host system's hostname if the test fails?
> 
> The cap_without_nnp test does not appear to isolate its UTS namespace via
> unshare(CLONE_NEWUTS) before verifying the sethostname() restriction. If the
> Landlock enforcement does not block the operation during a failing test run,
> could the sethostname("test", 4) call succeed and unexpectedly change the
> test machine's global hostname?

I'll fix these issues.

> 
> > +	EXPECT_EQ(EPERM, errno);
> > +
> > +	/* CAP_SYS_CHROOT is allowed by the rule. */
> > +	set_cap(_metadata, CAP_SYS_CHROOT);
> > +	EXPECT_EQ(0, chroot("/"));
> > +}
> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/20261002124409.1277970-1-mic@digikod.net?part=6
>