[LTP] [PATCH v4 4/7] Add lsm_get_self_attr03 test

[Cyril Hrubis]

Hi!
> Verify that LSM_ATTR_CURRENT attribute is correctly recognizing
> the current, active security context of the process. This is done by
> checking that /proc/self/attr/current matches with the obtained value.
> 
> Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
> ---
>  runtest/syscalls                                   |  1 +
>  testcases/kernel/syscalls/lsm/.gitignore           |  1 +
>  .../kernel/syscalls/lsm/lsm_get_self_attr03.c      | 68 ++++++++++++++++++++++
>  3 files changed, 70 insertions(+)
> 
> diff --git a/runtest/syscalls b/runtest/syscalls
> index 73b6b98c7748f5ed31ad23d7464f1ab4fbc5f42e..d45cda4082ed87bf674ca34d315af9c162a41fe9 100644
> --- a/runtest/syscalls
> +++ b/runtest/syscalls
> @@ -761,6 +761,7 @@ lseek11 lseek11
>  
>  lsm_get_self_attr01 lsm_get_self_attr01
>  lsm_get_self_attr02 lsm_get_self_attr02
> +lsm_get_self_attr03 lsm_get_self_attr03
>  
>  lstat01 lstat01
>  lstat01_64 lstat01_64
> diff --git a/testcases/kernel/syscalls/lsm/.gitignore b/testcases/kernel/syscalls/lsm/.gitignore
> index 9f7c9b00b026a377f1b36f483ac2c1a0adba6249..19956fdf8b9952b4850c3a20826e29ec67ea3560 100644
> --- a/testcases/kernel/syscalls/lsm/.gitignore
> +++ b/testcases/kernel/syscalls/lsm/.gitignore
> @@ -1,2 +1,3 @@
>  lsm_get_self_attr01
>  lsm_get_self_attr02
> +lsm_get_self_attr03
> diff --git a/testcases/kernel/syscalls/lsm/lsm_get_self_attr03.c b/testcases/kernel/syscalls/lsm/lsm_get_self_attr03.c
> new file mode 100644
> index 0000000000000000000000000000000000000000..3b767b94c025e350b9cc83d9bf2dc3061b3c6a1c
> --- /dev/null
> +++ b/testcases/kernel/syscalls/lsm/lsm_get_self_attr03.c
> @@ -0,0 +1,68 @@
> +// SPDX-License-Identifier: GPL-2.0-or-later
> +/*
> + * Copyright (C) 2024 SUSE LLC Andrea Cervesato <andrea.cervesato@suse.com>
> + */
> +
> +/*\
> + * Verify that LSM_ATTR_CURRENT attribute is correctly recognizing
> + * the current, active security context of the process. This is done by
> + * checking that /proc/self/attr/current matches with the obtained value.
> + */
> +
> +#include "lsm_common.h"
> +
> +static struct lsm_ctx *ctx;
> +static uint32_t page_size;
> +
> +static void run(void)
> +{
> +	tst_res(TINFO, "Verifying 'LSM_ATTR_CURRENT' attribute");
> +
> +	uint32_t count;
> +	uint32_t size = page_size;
> +	char attr[size];
> +
> +	memset(attr, 0, size);
> +	memset(ctx, 0, LSM_CTX_SIZE_DEFAULT);
> +
> +	count = TST_EXP_POSITIVE(
> +		lsm_get_self_attr(LSM_ATTR_CURRENT, ctx, &size, 0));
> +
> +	if (TST_RET == -1)
> +		return;
> +
> +	if (!count) {
> +		tst_res(TFAIL, "Can't read any attribute");
> +		return;
> +	}
> +
> +	read_proc_attr("current", attr, page_size);
> +
> +	TST_EXP_EQ_STR(attr, (char *)ctx->ctx);
> +
> +	struct lsm_ctx *next = ctx;
                                ^
				next_ctx(next)

Otherwise we will fail the check below.

> +	for (uint32_t i = 1; i < count; i++) {
> +		TST_EXP_EXPR(strcmp(attr, (char *)next->ctx) != 0,
> +			"Attribute and next LSM context must be different");
> +
> +		next = next_ctx(next);
> +	}

Have you actually tried this on a machine with more than one LSM active?


-- 
Cyril Hrubis
chrubis@suse.cz