[PATCH v6 6/8] selftests/landlock: Add capability restriction tests

[sashiko-bot at kernel.org]

> Add tests to exercise LANDLOCK_PERMISSION_CAPABILITY_USE enforcement.  A
> sandboxed process is denied a handled capability when no rule grants it,
> and an explicit rule restores it.  Unknown capability values above
> CAP_LAST_CAP are accepted at rule-add time yet have no runtime effect,
> because deny-by-default still applies once the domain is enforced.
> Stacking tests cover the per-layer allow/deny combinations, including a
> layer that does not handle the permission, and invalid rule attributes
> return the expected errors.
> 
> Three tests exercise non-standard capability contexts: enforcing a
> domain via CAP_SYS_ADMIN authorization without no_new_privs, restricting
> capabilities gained through the kernel's user namespace ownership bypass
> (cap_capable_helper), and checking CAP_SYS_ADMIN against a descendant
> user namespace, with an unsandboxed positive control, to confirm the
> decision is independent of the target.
> 
> Audit tests verify denied and allowed capabilities, per-member quiet
> interactions, and CAP_OPT_NOAUDIT suppression.  Trace tests cover
> accepted, rejected, and no-op rule adds, and normal, quiet, and
> CAP_OPT_NOAUDIT denials.
> 
> Test coverage for security/landlock is 91.8% of 2864 lines according to
> LLVM 22.
> 
> Cc: Christian Brauner <brauner at kernel.org>
> Cc: Günther Noack <gnoack at google.com>
> Cc: Paul Moore <paul at paul-moore.com>
> Cc: Serge E. Hallyn <serge at hallyn.com>
> Signed-off-by: Mickaël Salaün <mic at digikod.net>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261014082718.1435842-1-mic@digikod.net?part=6