[PATCH v1 1/2] selftests/landlock: Fix trace variant formatting

[Mickaël Salaün]

Group-wide clang-format exclusions also cover comments and unrelated
initializers, hiding which construct needs protection and leaving some
variant fields bin-packed.

Use per-variant guards and format designated fields one per line.  End
each guard after the macro header when clang-format preserves the
initializer.  Keep the initializer guarded only where re-enabling
clang-format would bin-pack its fields.

Cc: Günther Noack <gnoack at google.com>
Signed-off-by: Mickaël Salaün <mic at digikod.net>
---
 tools/testing/selftests/landlock/net_test.c   | 13 ++--
 .../landlock/scoped_abstract_unix_test.c      | 56 ++++++++++++-----
 tools/testing/selftests/landlock/trace_test.c | 62 ++++++++++++++-----
 3 files changed, 95 insertions(+), 36 deletions(-)

diff --git a/tools/testing/selftests/landlock/net_test.c b/tools/testing/selftests/landlock/net_test.c
index a18761e0fd82..0d13556c50f2 100644
--- a/tools/testing/selftests/landlock/net_test.c
+++ b/tools/testing/selftests/landlock/net_test.c
@@ -3569,31 +3569,34 @@ FIXTURE_VARIANT(trace_net_connect) {
 	bool deny_connect;
 };
 
-/* clang-format off */
-
 /* Denied connect(): sport=0, dport=<denied port>. */
+/* clang-format off */
 FIXTURE_VARIANT_ADD(trace_net_connect, connect_denied) {
+	/* clang-format on */
 	.handled = LANDLOCK_ACCESS_NET_CONNECT_TCP,
 	.bind_base_first = false,
 	.deny_connect = true,
 };
 
 /* Denied bind(): sport=<denied port>, dport=0. */
+/* clang-format off */
 FIXTURE_VARIANT_ADD(trace_net_connect, bind_fields) {
+	/* clang-format on */
 	.handled = LANDLOCK_ACCESS_NET_BIND_TCP,
 	.bind_base_first = false,
 	.deny_connect = false,
 };
 
 /* Denied connect() after an allowed bind(): the connect fields (sport=0). */
+/* clang-format off */
 FIXTURE_VARIANT_ADD(trace_net_connect, connect_after_bind) {
-	.handled = LANDLOCK_ACCESS_NET_BIND_TCP | LANDLOCK_ACCESS_NET_CONNECT_TCP,
+	/* clang-format on */
+	.handled = LANDLOCK_ACCESS_NET_BIND_TCP |
+		   LANDLOCK_ACCESS_NET_CONNECT_TCP,
 	.bind_base_first = true,
 	.deny_connect = true,
 };
 
-/* clang-format on */
-
 /*
  * A denied TCP bind(2) or connect(2) emits one deny_access_net event.  The port
  * is reported in the field matching the denied operation, in host endianness
diff --git a/tools/testing/selftests/landlock/scoped_abstract_unix_test.c b/tools/testing/selftests/landlock/scoped_abstract_unix_test.c
index eed684d4c364..54bc4081cd56 100644
--- a/tools/testing/selftests/landlock/scoped_abstract_unix_test.c
+++ b/tools/testing/selftests/landlock/scoped_abstract_unix_test.c
@@ -1268,27 +1268,38 @@ FIXTURE_VARIANT(trace_unix) {
 	size_t name_len;
 };
 
-/* clang-format off */
-
 /* Stream: sandboxed client connect() to an unsandboxed peer (peer_domain=0). */
+/* clang-format off */
 FIXTURE_VARIANT_ADD(trace_unix, stream_denied) {
-	.sock_type = SOCK_STREAM, .sandbox = true,
-	.sandbox_target = false, .expect_denied = 1,
+	/* clang-format on */
+	.sock_type = SOCK_STREAM,
+	.sandbox = true,
+	.sandbox_target = false,
+	.expect_denied = 1,
 };
 
 /* Stream: peer socket owned by a domain, so peer_domain != 0. */
+/* clang-format off */
 FIXTURE_VARIANT_ADD(trace_unix, stream_denied_scoped_peer) {
-	.sock_type = SOCK_STREAM, .sandbox = true,
-	.sandbox_target = true, .expect_denied = 1,
+	/* clang-format on */
+	.sock_type = SOCK_STREAM,
+	.sandbox = true,
+	.sandbox_target = true,
+	.expect_denied = 1,
 };
 
 /* Stream: unsandboxed client, connect() succeeds, no event. */
+/* clang-format off */
 FIXTURE_VARIANT_ADD(trace_unix, stream_allowed) {
-	.sock_type = SOCK_STREAM, .sandbox = false,
-	.sandbox_target = false, .expect_denied = 0,
+	/* clang-format on */
+	.sock_type = SOCK_STREAM,
+	.sandbox = false,
+	.sandbox_target = false,
+	.expect_denied = 0,
 };
 
 /* Stream: lower abstract-name length boundary. */
+/* clang-format off */
 FIXTURE_VARIANT_ADD(trace_unix, stream_denied_empty_name) {
 	.sock_type = SOCK_STREAM,
 	.sandbox = true,
@@ -1297,9 +1308,12 @@ FIXTURE_VARIANT_ADD(trace_unix, stream_denied_empty_name) {
 	.name = "",
 	.name_len = 0,
 };
+/* clang-format on */
 
 /* Stream: upper abstract-name length boundary. */
+/* clang-format off */
 FIXTURE_VARIANT_ADD(trace_unix, stream_denied_max_name) {
+	/* clang-format on */
 	.sock_type = SOCK_STREAM,
 	.sandbox = true,
 	.sandbox_target = false,
@@ -1309,25 +1323,35 @@ FIXTURE_VARIANT_ADD(trace_unix, stream_denied_max_name) {
 };
 
 /* Datagram: sandboxed client sendto() an unsandboxed peer (peer_domain=0). */
+/* clang-format off */
 FIXTURE_VARIANT_ADD(trace_unix, dgram_denied) {
-	.sock_type = SOCK_DGRAM, .sandbox = true,
-	.sandbox_target = false, .expect_denied = 1,
+	/* clang-format on */
+	.sock_type = SOCK_DGRAM,
+	.sandbox = true,
+	.sandbox_target = false,
+	.expect_denied = 1,
 };
 
 /* Datagram: peer socket owned by a domain, so peer_domain != 0. */
+/* clang-format off */
 FIXTURE_VARIANT_ADD(trace_unix, dgram_denied_scoped_peer) {
-	.sock_type = SOCK_DGRAM, .sandbox = true,
-	.sandbox_target = true, .expect_denied = 1,
+	/* clang-format on */
+	.sock_type = SOCK_DGRAM,
+	.sandbox = true,
+	.sandbox_target = true,
+	.expect_denied = 1,
 };
 
 /* Datagram: unsandboxed client, sendto() succeeds, no event. */
+/* clang-format off */
 FIXTURE_VARIANT_ADD(trace_unix, dgram_allowed) {
-	.sock_type = SOCK_DGRAM, .sandbox = false,
-	.sandbox_target = false, .expect_denied = 0,
+	/* clang-format on */
+	.sock_type = SOCK_DGRAM,
+	.sandbox = false,
+	.sandbox_target = false,
+	.expect_denied = 0,
 };
 
-/* clang-format on */
-
 /*
  * A sandboxed thread reaching an abstract unix socket peer through connect(2)
  * (stream) or sendto(2) (datagram) is denied and emits
diff --git a/tools/testing/selftests/landlock/trace_test.c b/tools/testing/selftests/landlock/trace_test.c
index afdaf8511b3a..a28a2ac55687 100644
--- a/tools/testing/selftests/landlock/trace_test.c
+++ b/tools/testing/selftests/landlock/trace_test.c
@@ -1243,45 +1243,77 @@ FIXTURE_VARIANT(trace_enforce) {
 	int no_new_privs;
 };
 
-/* clang-format off */
-
 /* Single thread, no flags: prctl-backed no_new_privs. */
+/* clang-format off */
 FIXTURE_VARIANT_ADD(trace_enforce, single) {
-	.nthreads = 0, .flags = 0,
-	.total = 1, .complete = 1, .process_wide = 1, .no_new_privs = 1,
+	.nthreads = 0,
+	.flags = 0,
+	.total = 1,
+	.complete = 1,
+	.process_wide = 1,
+	.no_new_privs = 1,
 };
+/* clang-format on */
 
 /* Single thread: the NO_NEW_PRIVS flag sets no_new_privs (no prctl). */
+/* clang-format off */
 FIXTURE_VARIANT_ADD(trace_enforce, no_new_privs) {
-	.nthreads = 0, .flags = LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS,
-	.total = 1, .complete = 1, .process_wide = 1, .no_new_privs = 1,
+	.nthreads = 0,
+	.flags = LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS,
+	.total = 1,
+	.complete = 1,
+	.process_wide = 1,
+	.no_new_privs = 1,
 };
+/* clang-format on */
 
 /* TSYNC on a lone thread still concludes, process-wide. */
+/* clang-format off */
 FIXTURE_VARIANT_ADD(trace_enforce, tsync_single) {
-	.nthreads = 0, .flags = LANDLOCK_RESTRICT_SELF_TSYNC,
-	.total = 1, .complete = 1, .process_wide = 1, .no_new_privs = 1,
+	.nthreads = 0,
+	.flags = LANDLOCK_RESTRICT_SELF_TSYNC,
+	.total = 1,
+	.complete = 1,
+	.process_wide = 1,
+	.no_new_privs = 1,
 };
+/* clang-format on */
 
 /* TSYNC sweeps N siblings; the caller's prctl-backed nnp propagates to all. */
+/* clang-format off */
 FIXTURE_VARIANT_ADD(trace_enforce, tsync_multithread) {
-	.nthreads = 3, .flags = LANDLOCK_RESTRICT_SELF_TSYNC,
-	.total = 4, .complete = 1, .process_wide = 4, .no_new_privs = 4,
+	.nthreads = 3,
+	.flags = LANDLOCK_RESTRICT_SELF_TSYNC,
+	.total = 4,
+	.complete = 1,
+	.process_wide = 4,
+	.no_new_privs = 4,
 };
+/* clang-format on */
 
 /* TSYNC + NO_NEW_PRIVS flag sets nnp on the caller and every swept sibling. */
+/* clang-format off */
 FIXTURE_VARIANT_ADD(trace_enforce, tsync_no_new_privs) {
+	/* clang-format on */
 	.nthreads = 3,
-	.flags = LANDLOCK_RESTRICT_SELF_TSYNC | LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS,
-	.total = 4, .complete = 1, .process_wide = 4, .no_new_privs = 4,
+	.flags = LANDLOCK_RESTRICT_SELF_TSYNC |
+		 LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS,
+	.total = 4,
+	.complete = 1,
+	.process_wide = 4,
+	.no_new_privs = 4,
 };
 
 /* Non-TSYNC on a multi-threaded process enforces only the caller. */
+/* clang-format off */
 FIXTURE_VARIANT_ADD(trace_enforce, multithread_non_tsync) {
-	.nthreads = 3, .flags = 0,
-	.total = 1, .complete = 1, .process_wide = 0, .no_new_privs = 1,
+	.nthreads = 3,
+	.flags = 0,
+	.total = 1,
+	.complete = 1,
+	.process_wide = 0,
+	.no_new_privs = 1,
 };
-
 /* clang-format on */
 
 /*
-- 
2.55.0