[LTP] [PATCH v3 27/36] keyctl31: Test KEYCTL_PKEY_ENCRYPT and KEYCTL_PKEY_DECRYPT

[Petr Vorel]

Hi Cyril,

> Hi!
> > diff --git a/testcases/kernel/syscalls/keyctl/keyctl31.c b/testcases/kernel/syscalls/keyctl/keyctl31.c
> > new file mode 100644
> > index 0000000000..c1e6723ac8
> > --- /dev/null
> > +++ b/testcases/kernel/syscalls/keyctl/keyctl31.c
> > @@ -0,0 +1,110 @@
> > +// SPDX-License-Identifier: GPL-2.0-or-later
> > +/*
> > + * Copyright (c) 2026 Andrea Cervesato <andrea.cervesato@suse.com>
> > + */
> > +
> > +/*\
> > + * Test ``KEYCTL_PKEY_ENCRYPT`` and ``KEYCTL_PKEY_DECRYPT`` of :manpage:`keyctl(2)`.
> > + *
> > + * ``KEYCTL_PKEY_ENCRYPT`` encrypts a data blob using an asymmetric public key
> > + * and ``KEYCTL_PKEY_DECRYPT`` decrypts the encrypted blob using the matching
> > + * private key.
> > + *
> > + * Requires root (CAP_SYS_MODULE) to load the ``x509_key_parser`` and
> > + * ``pkcs8_key_parser`` modules.
> > + *
> > + * [Algorithm]
> > + *
> > + * - encrypt a 32-byte plaintext using an RSA-2048 X.509 public key with ``enc=pkcs1``
> > + * - decrypt the 256-byte ciphertext using the matching PKCS#8 private key
> > + * - verify the decrypted output matches the original 32-byte plaintext
> > + */
> > +
> > +#include "keyctl_common.h"
> > +#include "keyctl_pkey_data.h"
> > +#include "tst_module.h"
> > +
> > +#define CIPHERTEXT_SIZE	256
> > +
> > +static const char plaintext[] = "LTP_PKEY_ENCRYPT_DECRYPT_TEST_32";
> > +#define PLAINTEXT_SIZE	(sizeof(plaintext) - 1)
> > +static unsigned char ciphertext[CIPHERTEXT_SIZE];
> > +static unsigned char decrypted[CIPHERTEXT_SIZE];

> Shouldn't these two be in the guarded buffers as well? I would say that
> it's pretty much important that the kernel does not touch anything
> outside of these arrays during encryption/decryption.

Make sense to me, I'll amend.

Kind regards,
Petr

+++ testcases/kernel/syscalls/keyctl/keyctl31.c
@@ -103,6 +103,8 @@ static struct tst_test test = {
 		NULL
 	},
 	.bufs = (struct tst_buffers []) {
+		{&ciphertext, .size = sizeof(*ciphertext)},
+		{&decrypted, .size = sizeof(*decrypted)},
 		{&enc_params, .size = sizeof(*enc_params)},
 		{&dec_params, .size = sizeof(*dec_params)},
 		{},