[LTP] [PATCH] keyctl05: Use DNS_LOOKUP_GOOD to avoid false-negatives due to EKEYEXPIRED

[Florian Schmaus]

On 14/10/2026 09.43, Andrea Cervesato wrote:
> Hi Florian,
> 
> 
>> In keyctl05, test_update_nonupdatable() verifies that
>> keyctl(KEYCTL_UPDATE) fails with EOPNOTSUPP on key types without an
>> ->update() method (such as 'dns_resolver').
>>
>> Commit 4e9400050683 ("keyctl05: Improve the dns_res_payload for boundary
>> testing") changed the dns_res_payload to a 6-byte V1 server-list header:
>>      { 0x00, 0x00, 0x01, 0xff, 0x00, 0x00 }
>>
>> Byte 4 represents the lookup status (enum dns_lookup_status). Setting it
>> to 0x00 (DNS_LOOKUP_NOT_DONE) causes the kernel's dns_resolver_preparse()
>> (net/dns_resolver/dns_key.c) to treat it as a failed lookup:
>>      if ((v1->status != DNS_LOOKUP_GOOD &&
>>           v1->status != DNS_LOOKUP_GOOD_WITH_BAD)) {
>>          if (prep->expiry == TIME64_MAX)
>>              prep->expiry = ktime_get_real_seconds() + 1;
>>      }
>>
>> This sets an aggressive 1-second expiration on the key. On slower
>> environments, such as QEMU, more than 1 second may elapse between
>> add_key() and keyctl(KEYCTL_UPDATE), causing the update call in
>> test_update_nonupdatable() to fail with EKEYEXPIRED (127) rather than
>> EOPNOTSUPP:
>>      keyctl05.c:143: TFAIL: updating 'dns_resolver' key unexpectedly failed: EKEYEXPIRED (127)
>>
>> Set status (byte 4) in dns_res_payload to 0x01 (DNS_LOOKUP_GOOD) so
>> that the kernel does not set a 1-second negative expiry, while still
>> retaining the 6-byte boundary payload check for commit acc657692aed.
> 
> Good catch. I'm wondering if it makes sense to use KEYCTL_SET_TIMEOUT in
> this case, but I guess we can rely on the test timeout in this case.
> 
> did you explore this option already?

Sorry, no. This seemed like the less intrusive fix.


> Otherwise LGTM
> 
> Reviewed-by: Andrea Cervesato <andrea.cervesato@suse.com>

Thanks!


> 
> --
> Andrea Cervesato
> SUSE QE Automation Engineer Linux
> andrea.cervesato@suse.com