[LTP] [PATCH v3 09/36] keyctl15: Test KEYCTL_GET_SECURITY label retrieval

[Li Wang]

> +static void run(void)
> +{
> +	int rc;
> +
> +	memset(buf, 0, sizeof(buf));
> +
> +	rc = SAFE_KEYCTL(KEYCTL_GET_SECURITY, key, (unsigned long)buf, sizeof(buf), 0);
> +
> +	if (buf[0] != '\0')
> +		tst_res(TFAIL, "empty label is not NUL terminated");

The code unconditionally checks if the buffer is empty (buf[0] != '\0')
without verifying the return code (rc) first. On a system has SELinux enabled,
the kernel returns a valid security label (length 54). Therefore, buf[0]
contains a valid character (not \0), which incorrectly triggers failure:

# getenforce
Enforcing

# ./keyctl15
tst_test.c:2067: TINFO: LTP version: 20260529
tst_test.c:2070: TINFO: Tested kernel: 6.6.145-10.sl26.x86_64 #1 SMP Mon Sep 14 12:59:37 CST 2026 x86_64
tst_kconfig.c:90: TINFO: Parsing kernel config '/proc/config.gz'
tst_test.c:1895: TINFO: Overall timeout per run is 0h 00m 30s
keyctl15.c:46: TFAIL: empty label is not NUL terminated
keyctl15.c:58: TPASS: security label returned, full length 54
...

Maybe refine it like below:

static void run(void)
{
	int rc;

	memset(buf, 0, sizeof(buf));

	rc = SAFE_KEYCTL(KEYCTL_GET_SECURITY, key, (unsigned long)buf, sizeof(buf), 0);

	if (rc < 1) {
		tst_res(TFAIL, "returned %d, expected >= 1", rc);
		return;
	}

	if (rc == 1) {
		if (buf[0] != '\0')
			tst_res(TFAIL, "empty label is not NUL terminated");
		else
			tst_res(TPASS, "no label set, empty string returned");
		return;
	}

	if (buf[0] == '\0')
		tst_res(TFAIL, "non-empty label is NUL terminated");
	else
		tst_res(TPASS, "security label returned, full length %d", rc);
}

> +
> +	if (rc < 1) {
> +		tst_res(TFAIL, "returned %d, expected >= 1", rc);
> +		return;
> +	}
> +
> +	if (rc == 1) {
> +		tst_res(TPASS, "no label set, empty string returned");
> +		return;
> +	}
> +
> +	tst_res(TPASS, "security label returned, full length %d", rc);
> +}

-- 
Regards,
Li Wang