From: "Günther Noack" <gnoack3000@gmail.com>
To: "Mickaël Salaün" <mic@digikod.net>
Cc: "Wang Yan" <wangyan01@kylinos.cn>,
linux-kselftest@vger.kernel.org,
"Günther Noack" <gnoack3000@gmail.com>,
"Günther Noack" <gnoack@google.com>,
"Shuah Khan" <shuah@kernel.org>,
linux-security-module@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: [PATCH 24/27] selftests/landlock: Use ASSERT for syscall failures before errno checks
Date: Thu, 8 Oct 2026 16:25:53 +0200 [thread overview]
Message-ID: <20261008142604.39107-26-gnoack3000@gmail.com> (raw)
In-Reply-To: <20261008142604.39107-2-gnoack3000@gmail.com>
In cases where a syscall is expected to fail, but unexpectedly
succeeds, the resulting errno is undefined and we should not proceed
to check the errno. Replace EXPECT* with ASSERT* macros for syscall
invocations where this is the case, so that we abort the tests early
in such cases.
In the errata test, check errno with EXPECT after the combined VERSION
and ERRATA flags, since nothing depends on it.
Assisted-by: LLM
Signed-off-by: Günther Noack <gnoack3000@gmail.com>
---
tools/testing/selftests/landlock/audit_test.c | 8 +--
tools/testing/selftests/landlock/base_test.c | 40 +++++++--------
tools/testing/selftests/landlock/fs_test.c | 50 +++++++++----------
tools/testing/selftests/landlock/net_test.c | 24 ++++-----
.../testing/selftests/landlock/ptrace_test.c | 14 +++---
.../landlock/scoped_abstract_unix_test.c | 14 +++---
6 files changed, 75 insertions(+), 75 deletions(-)
diff --git a/tools/testing/selftests/landlock/audit_test.c b/tools/testing/selftests/landlock/audit_test.c
index b38d0c5d5869..392e75ddfa3c 100644
--- a/tools/testing/selftests/landlock/audit_test.c
+++ b/tools/testing/selftests/landlock/audit_test.c
@@ -100,7 +100,7 @@ TEST_F(audit, layers)
EXPECT_EQ(0, landlock_restrict_self(ruleset_fd, 0));
/* Creates a denial to get the domain ID. */
- EXPECT_EQ(-1, kill(getppid(), 0));
+ ASSERT_EQ(-1, kill(getppid(), 0));
EXPECT_EQ(EPERM, errno);
EXPECT_EQ(0,
matches_log_signal(_metadata, self->audit_fd,
@@ -119,7 +119,7 @@ TEST_F(audit, layers)
}
/* Checks that we reached the maximum number of layers. */
- EXPECT_EQ(-1, landlock_restrict_self(ruleset_fd, 0));
+ ASSERT_EQ(-1, landlock_restrict_self(ruleset_fd, 0));
EXPECT_EQ(E2BIG, errno);
/* Updates filter rules to match the drop record. */
@@ -711,7 +711,7 @@ TEST_F(audit_flags, signal)
EXPECT_EQ(0, close(ruleset_fd));
/* First signal checks to test log entries. */
- EXPECT_EQ(-1, kill(getppid(), 0));
+ ASSERT_EQ(-1, kill(getppid(), 0));
EXPECT_EQ(EPERM, errno);
if (!expect_audit) {
@@ -736,7 +736,7 @@ TEST_F(audit_flags, signal)
}
/* Second signal checks to test audit_count_records(). */
- EXPECT_EQ(-1, kill(getppid(), 0));
+ ASSERT_EQ(-1, kill(getppid(), 0));
EXPECT_EQ(EPERM, errno);
/* Makes sure there is no superfluous logged records. */
diff --git a/tools/testing/selftests/landlock/base_test.c b/tools/testing/selftests/landlock/base_test.c
index 5f10300a60cd..c19aa20609d6 100644
--- a/tools/testing/selftests/landlock/base_test.c
+++ b/tools/testing/selftests/landlock/base_test.c
@@ -136,7 +136,7 @@ TEST(errata)
NULL, 0,
LANDLOCK_CREATE_RULESET_VERSION |
LANDLOCK_CREATE_RULESET_ERRATA));
- ASSERT_EQ(EINVAL, errno);
+ EXPECT_EQ(EINVAL, errno);
ASSERT_EQ(-1, landlock_create_ruleset(NULL, 0,
LANDLOCK_CREATE_RULESET_ERRATA |
@@ -333,7 +333,7 @@ TEST(restrict_self_fd)
fd = open("/dev/null", O_RDONLY | O_CLOEXEC);
ASSERT_LE(0, fd);
- EXPECT_EQ(-1, landlock_restrict_self(fd, 0));
+ ASSERT_EQ(-1, landlock_restrict_self(fd, 0));
EXPECT_EQ(EBADFD, errno);
EXPECT_EQ(0, close(fd));
@@ -350,12 +350,12 @@ TEST(restrict_self_fd_flags)
* LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF accepts -1 but not any file
* descriptor.
*/
- EXPECT_EQ(-1, landlock_restrict_self(
+ ASSERT_EQ(-1, landlock_restrict_self(
fd, LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF));
EXPECT_EQ(EBADFD, errno);
/* LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS requires a ruleset FD. */
- EXPECT_EQ(-1, landlock_restrict_self(
+ ASSERT_EQ(-1, landlock_restrict_self(
fd, LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS));
EXPECT_EQ(EBADFD, errno);
@@ -368,40 +368,40 @@ TEST(restrict_self_flags)
/* Tests invalid flag combinations. */
- EXPECT_EQ(-1, landlock_restrict_self(-1, last_flag << 1));
+ ASSERT_EQ(-1, landlock_restrict_self(-1, last_flag << 1));
EXPECT_EQ(EINVAL, errno);
- EXPECT_EQ(-1, landlock_restrict_self(-1, -1));
+ ASSERT_EQ(-1, landlock_restrict_self(-1, -1));
EXPECT_EQ(EINVAL, errno);
/* Tests valid flag combinations. */
- EXPECT_EQ(-1, landlock_restrict_self(-1, 0));
+ ASSERT_EQ(-1, landlock_restrict_self(-1, 0));
EXPECT_EQ(EBADF, errno);
- EXPECT_EQ(-1, landlock_restrict_self(
+ ASSERT_EQ(-1, landlock_restrict_self(
-1, LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF));
EXPECT_EQ(EBADF, errno);
- EXPECT_EQ(-1,
+ ASSERT_EQ(-1,
landlock_restrict_self(
-1,
LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF |
LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF));
EXPECT_EQ(EBADF, errno);
- EXPECT_EQ(-1,
+ ASSERT_EQ(-1,
landlock_restrict_self(
-1,
LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON |
LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF));
EXPECT_EQ(EBADF, errno);
- EXPECT_EQ(-1, landlock_restrict_self(
+ ASSERT_EQ(-1, landlock_restrict_self(
-1, LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON));
EXPECT_EQ(EBADF, errno);
- EXPECT_EQ(-1,
+ ASSERT_EQ(-1,
landlock_restrict_self(
-1, LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF |
LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON));
@@ -409,18 +409,18 @@ TEST(restrict_self_flags)
/* LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS requires a ruleset FD. */
- EXPECT_EQ(-1, landlock_restrict_self(
+ ASSERT_EQ(-1, landlock_restrict_self(
-1, LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS));
EXPECT_EQ(EBADF, errno);
- EXPECT_EQ(-1, landlock_restrict_self(
+ ASSERT_EQ(-1, landlock_restrict_self(
-1, LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF |
LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS));
EXPECT_EQ(EBADF, errno);
/* Tests with an invalid ruleset_fd. */
- EXPECT_EQ(-1, landlock_restrict_self(
+ ASSERT_EQ(-1, landlock_restrict_self(
-2, LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF));
EXPECT_EQ(EBADF, errno);
@@ -446,7 +446,7 @@ TEST(restrict_self_no_new_privs)
ASSERT_EQ(0, prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0));
/* Checks that a failed call does not set no_new_privs. */
- EXPECT_EQ(-1, landlock_restrict_self(
+ ASSERT_EQ(-1, landlock_restrict_self(
-1, LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS));
EXPECT_EQ(EBADF, errno);
EXPECT_EQ(0, prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0));
@@ -577,7 +577,7 @@ TEST(cred_transfer)
EXPECT_EQ(0, close(ruleset_fd));
/* Checks ruleset enforcement. */
- EXPECT_EQ(-1, open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC));
+ ASSERT_EQ(-1, open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC));
EXPECT_EQ(EACCES, errno);
/* Needed for KEYCTL_SESSION_TO_PARENT permission checks */
@@ -591,7 +591,7 @@ TEST(cred_transfer)
ASSERT_LE(0, child);
if (child == 0) {
/* Checks ruleset enforcement. */
- EXPECT_EQ(-1, open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC));
+ ASSERT_EQ(-1, open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC));
EXPECT_EQ(EACCES, errno);
/*
@@ -610,7 +610,7 @@ TEST(cred_transfer)
0, 0, 0));
/* Re-checks ruleset enforcement. */
- EXPECT_EQ(-1, open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC));
+ ASSERT_EQ(-1, open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC));
EXPECT_EQ(EACCES, errno);
_exit(_metadata->exit_code);
@@ -622,7 +622,7 @@ TEST(cred_transfer)
EXPECT_EQ(EXIT_SUCCESS, WEXITSTATUS(status));
/* Re-checks ruleset enforcement. */
- EXPECT_EQ(-1, open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC));
+ ASSERT_EQ(-1, open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC));
EXPECT_EQ(EACCES, errno);
}
diff --git a/tools/testing/selftests/landlock/fs_test.c b/tools/testing/selftests/landlock/fs_test.c
index ba3b39ad5882..c73a438e088f 100644
--- a/tools/testing/selftests/landlock/fs_test.c
+++ b/tools/testing/selftests/landlock/fs_test.c
@@ -678,7 +678,7 @@ TEST_F_FORK(layout0, rule_with_unknown_access)
for (access = 1ULL << 63; access != ACCESS_LAST; access >>= 1) {
path_beneath.allowed_access = access;
- EXPECT_EQ(-1, landlock_add_rule(ruleset_fd,
+ ASSERT_EQ(-1, landlock_add_rule(ruleset_fd,
LANDLOCK_RULE_PATH_BENEATH,
&path_beneath, 0));
EXPECT_EQ(EINVAL, errno);
@@ -712,7 +712,7 @@ TEST_F_FORK(layout1, rule_with_unhandled_access)
if (access == ruleset_attr.handled_access_fs) {
EXPECT_EQ(0, err);
} else {
- EXPECT_EQ(-1, err);
+ ASSERT_EQ(-1, err);
EXPECT_EQ(EINVAL, errno);
}
}
@@ -2069,7 +2069,7 @@ TEST_F_FORK(layout1, umount_sandboxer)
/* Tests that the sandboxer is tied to its mount point. */
set_cap(_metadata, CAP_SYS_ADMIN);
- EXPECT_EQ(-1, umount(dir_s3d2));
+ ASSERT_EQ(-1, umount(dir_s3d2));
EXPECT_EQ(EBUSY, errno);
clear_cap(_metadata, CAP_SYS_ADMIN);
@@ -2264,7 +2264,7 @@ TEST_F_FORK(layout1, rename_whiteout_denied)
* file1_s3d3 is in dir_s3d2 (tmpfs), so it supports RENAME_WHITEOUT.
* Denied, because whiteout creation is guarded with MAKE_REG.
*/
- EXPECT_EQ(-1, renameat2(AT_FDCWD, file1_s3d3, AT_FDCWD,
+ ASSERT_EQ(-1, renameat2(AT_FDCWD, file1_s3d3, AT_FDCWD,
TMP_DIR "/s3d1/s3d2/s3d3/f2", RENAME_WHITEOUT));
EXPECT_EQ(EACCES, errno);
}
@@ -2354,7 +2354,7 @@ TEST_F_FORK(layout1, rename_whiteout_reparenting)
* there, even though it is granted in the destination directory
* dir_s3d3.
*/
- EXPECT_EQ(-1, renameat2(AT_FDCWD, file1_s3d4, AT_FDCWD,
+ ASSERT_EQ(-1, renameat2(AT_FDCWD, file1_s3d4, AT_FDCWD,
TMP_DIR "/s3d1/s3d2/s3d3/f2", RENAME_WHITEOUT));
EXPECT_EQ(EACCES, errno);
@@ -2404,7 +2404,7 @@ TEST_F_FORK(layout1, rename_whiteout_exchange)
* dir_s3d4, even though it is granted in the whiteout object's own
* directory dir_s3d3.
*/
- EXPECT_EQ(-1, renameat2(AT_FDCWD, file1_s3d4, AT_FDCWD, whiteout_s3d3,
+ ASSERT_EQ(-1, renameat2(AT_FDCWD, file1_s3d4, AT_FDCWD, whiteout_s3d3,
RENAME_EXCHANGE));
EXPECT_EQ(EACCES, errno);
@@ -2637,11 +2637,11 @@ TEST_F_FORK(layout1, refer_mount_root_deny)
enforce_fs(_metadata, LANDLOCK_ACCESS_FS_MAKE_DIR, NULL);
/* Link denied by Landlock: EACCES. */
- EXPECT_EQ(-1, linkat(root_fd, ".", root_fd, "does_not_exist", 0));
+ ASSERT_EQ(-1, linkat(root_fd, ".", root_fd, "does_not_exist", 0));
EXPECT_EQ(EACCES, errno);
/* renameat2() always returns EBUSY. */
- EXPECT_EQ(-1, renameat2(root_fd, ".", root_fd, "does_not_exist", 0));
+ ASSERT_EQ(-1, renameat2(root_fd, ".", root_fd, "does_not_exist", 0));
EXPECT_EQ(EBUSY, errno);
EXPECT_EQ(0, close(root_fd));
@@ -5398,14 +5398,14 @@ TEST_F_FORK(layout1_bind, path_disconnected_rename)
* Tests that access widening checks indeed prevents us from renaming it
* back.
*/
- EXPECT_EQ(-1, rename(dir_s4d2, dir_s1d3));
+ ASSERT_EQ(-1, rename(dir_s4d2, dir_s1d3));
EXPECT_EQ(EXDEV, errno);
/*
* Including through the now disconnected fd (but it should return
* EXDEV).
*/
- EXPECT_EQ(-1, renameat(bind_s1d3_fd, file1_name, AT_FDCWD,
+ ASSERT_EQ(-1, renameat(bind_s1d3_fd, file1_name, AT_FDCWD,
file1_s2d2));
EXPECT_EQ(EXDEV, errno);
_exit(_metadata->exit_code);
@@ -7630,12 +7630,12 @@ TEST_F(audit_layout1, remove_dir)
enforce_fs(_metadata, ACCESS_ALL, NULL);
- EXPECT_EQ(-1, rmdir(dir_s1d3));
+ ASSERT_EQ(-1, rmdir(dir_s1d3));
EXPECT_EQ(EACCES, errno);
EXPECT_EQ(0, matches_log_fs(_metadata, self->audit_fd,
"fs\\.remove_dir", dir_s1d2));
- EXPECT_EQ(-1, unlinkat(AT_FDCWD, dir_s1d3, AT_REMOVEDIR));
+ ASSERT_EQ(-1, unlinkat(AT_FDCWD, dir_s1d3, AT_REMOVEDIR));
EXPECT_EQ(EACCES, errno);
EXPECT_EQ(0, matches_log_fs(_metadata, self->audit_fd,
"fs\\.remove_dir", dir_s1d2));
@@ -7651,7 +7651,7 @@ TEST_F(audit_layout1, remove_file)
enforce_fs(_metadata, ACCESS_ALL, NULL);
- EXPECT_EQ(-1, unlink(file1_s1d3));
+ ASSERT_EQ(-1, unlink(file1_s1d3));
EXPECT_EQ(EACCES, errno);
EXPECT_EQ(0, matches_log_fs(_metadata, self->audit_fd,
"fs\\.remove_file", dir_s1d3));
@@ -7669,7 +7669,7 @@ TEST_F(audit_layout1, make_char)
enforce_fs(_metadata, ACCESS_ALL, NULL);
- EXPECT_EQ(-1, mknod(file1_s1d3, S_IFCHR | 0644, makedev(7, 0)));
+ ASSERT_EQ(-1, mknod(file1_s1d3, S_IFCHR | 0644, makedev(7, 0)));
EXPECT_EQ(EACCES, errno);
EXPECT_EQ(0, matches_log_fs(_metadata, self->audit_fd, "fs\\.make_char",
dir_s1d3));
@@ -7688,7 +7688,7 @@ TEST_F(audit_layout1, make_whiteout)
enforce_fs(_metadata, ACCESS_ALL, NULL);
/* Whiteout creation is denied and logged as fs.make_reg. */
- EXPECT_EQ(-1, mknod(file1_s1d3, S_IFCHR | 0644, makedev(0, 0)));
+ ASSERT_EQ(-1, mknod(file1_s1d3, S_IFCHR | 0644, makedev(0, 0)));
EXPECT_EQ(EACCES, errno);
EXPECT_EQ(0, matches_log_fs(_metadata, self->audit_fd, "fs\\.make_reg",
dir_s1d3));
@@ -7706,7 +7706,7 @@ TEST_F(audit_layout1, make_dir)
enforce_fs(_metadata, ACCESS_ALL, NULL);
- EXPECT_EQ(-1, mkdir(file1_s1d3, 0755));
+ ASSERT_EQ(-1, mkdir(file1_s1d3, 0755));
EXPECT_EQ(EACCES, errno);
EXPECT_EQ(0, matches_log_fs(_metadata, self->audit_fd, "fs\\.make_dir",
dir_s1d3));
@@ -7724,7 +7724,7 @@ TEST_F(audit_layout1, make_reg)
enforce_fs(_metadata, ACCESS_ALL, NULL);
- EXPECT_EQ(-1, mknod(file1_s1d3, S_IFREG | 0644, 0));
+ ASSERT_EQ(-1, mknod(file1_s1d3, S_IFREG | 0644, 0));
EXPECT_EQ(EACCES, errno);
EXPECT_EQ(0, matches_log_fs(_metadata, self->audit_fd, "fs\\.make_reg",
dir_s1d3));
@@ -7742,7 +7742,7 @@ TEST_F(audit_layout1, make_sock)
enforce_fs(_metadata, ACCESS_ALL, NULL);
- EXPECT_EQ(-1, mknod(file1_s1d3, S_IFSOCK | 0644, 0));
+ ASSERT_EQ(-1, mknod(file1_s1d3, S_IFSOCK | 0644, 0));
EXPECT_EQ(EACCES, errno);
EXPECT_EQ(0, matches_log_fs(_metadata, self->audit_fd, "fs\\.make_sock",
dir_s1d3));
@@ -7760,7 +7760,7 @@ TEST_F(audit_layout1, make_fifo)
enforce_fs(_metadata, ACCESS_ALL, NULL);
- EXPECT_EQ(-1, mknod(file1_s1d3, S_IFIFO | 0644, 0));
+ ASSERT_EQ(-1, mknod(file1_s1d3, S_IFIFO | 0644, 0));
EXPECT_EQ(EACCES, errno);
EXPECT_EQ(0, matches_log_fs(_metadata, self->audit_fd, "fs\\.make_fifo",
dir_s1d3));
@@ -7778,7 +7778,7 @@ TEST_F(audit_layout1, make_block)
enforce_fs(_metadata, ACCESS_ALL, NULL);
- EXPECT_EQ(-1, mknod(file1_s1d3, S_IFBLK | 0644, 0));
+ ASSERT_EQ(-1, mknod(file1_s1d3, S_IFBLK | 0644, 0));
EXPECT_EQ(EACCES, errno);
EXPECT_EQ(0, matches_log_fs(_metadata, self->audit_fd,
"fs\\.make_block", dir_s1d3));
@@ -7796,7 +7796,7 @@ TEST_F(audit_layout1, make_sym)
enforce_fs(_metadata, ACCESS_ALL, NULL);
- EXPECT_EQ(-1, symlink("target", file1_s1d3));
+ ASSERT_EQ(-1, symlink("target", file1_s1d3));
EXPECT_EQ(EACCES, errno);
EXPECT_EQ(0, matches_log_fs(_metadata, self->audit_fd, "fs\\.make_sym",
dir_s1d3));
@@ -7814,7 +7814,7 @@ TEST_F(audit_layout1, refer_handled)
enforce_fs(_metadata, LANDLOCK_ACCESS_FS_REFER, NULL);
- EXPECT_EQ(-1, link(file1_s1d1, file1_s1d3));
+ ASSERT_EQ(-1, link(file1_s1d1, file1_s1d3));
EXPECT_EQ(EXDEV, errno);
EXPECT_EQ(0, matches_log_fs(_metadata, self->audit_fd, "fs\\.refer",
dir_s1d1));
@@ -7838,7 +7838,7 @@ TEST_F(audit_layout1, refer_make)
LANDLOCK_ACCESS_FS_MAKE_REG | LANDLOCK_ACCESS_FS_REFER,
NULL);
- EXPECT_EQ(-1, link(file1_s1d1, file1_s1d3));
+ ASSERT_EQ(-1, link(file1_s1d1, file1_s1d3));
EXPECT_EQ(EACCES, errno);
EXPECT_EQ(0, matches_log_fs(_metadata, self->audit_fd, "fs\\.refer",
dir_s1d1));
@@ -7935,7 +7935,7 @@ TEST_F(audit_layout1, truncate)
enforce_fs(_metadata, ACCESS_ALL, NULL);
- EXPECT_EQ(-1, truncate(file1_s1d3, 0));
+ ASSERT_EQ(-1, truncate(file1_s1d3, 0));
EXPECT_EQ(EACCES, errno);
EXPECT_EQ(0, matches_log_fs(_metadata, self->audit_fd, "fs\\.truncate",
file1_s1d3));
@@ -8008,7 +8008,7 @@ TEST_F(audit_layout1, mount)
enforce_fs(_metadata, LANDLOCK_ACCESS_FS_EXECUTE, NULL);
set_cap(_metadata, CAP_SYS_ADMIN);
- EXPECT_EQ(-1, mount(NULL, dir_s3d2, NULL, MS_RDONLY, NULL));
+ ASSERT_EQ(-1, mount(NULL, dir_s3d2, NULL, MS_RDONLY, NULL));
EXPECT_EQ(EPERM, errno);
clear_cap(_metadata, CAP_SYS_ADMIN);
EXPECT_EQ(0, matches_log_fs(_metadata, self->audit_fd,
diff --git a/tools/testing/selftests/landlock/net_test.c b/tools/testing/selftests/landlock/net_test.c
index 563e2214390b..51bcb4740dde 100644
--- a/tools/testing/selftests/landlock/net_test.c
+++ b/tools/testing/selftests/landlock/net_test.c
@@ -1361,11 +1361,11 @@ TEST_F(protocol, tcp_fastopen)
}
if (restricted) {
- EXPECT_EQ(-1, read(client_fd, &buf, 1));
+ ASSERT_EQ(-1, read(client_fd, &buf, 1));
EXPECT_EQ(ENOTCONN, errno);
} else if (self->srv0.protocol.domain == AF_UNIX &&
self->srv0.protocol.type == SOCK_STREAM) {
- EXPECT_EQ(-1, read(client_fd, &buf, 1));
+ ASSERT_EQ(-1, read(client_fd, &buf, 1));
EXPECT_EQ(EINVAL, errno);
} else {
EXPECT_EQ(1, read(client_fd, &buf, 1));
@@ -2261,7 +2261,7 @@ TEST_F(mini, ruleset_with_unknown_access)
.handled_access_net = access_mask,
};
- EXPECT_EQ(-1, landlock_create_ruleset(&ruleset_attr,
+ ASSERT_EQ(-1, landlock_create_ruleset(&ruleset_attr,
sizeof(ruleset_attr), 0));
EXPECT_EQ(EINVAL, errno);
}
@@ -2284,7 +2284,7 @@ TEST_F(mini, rule_with_unknown_access)
for (access = 1ULL << 63; access != ACCESS_LAST; access >>= 1) {
net_port.allowed_access = access;
- EXPECT_EQ(-1,
+ ASSERT_EQ(-1,
landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
&net_port, 0));
EXPECT_EQ(EINVAL, errno);
@@ -2316,7 +2316,7 @@ TEST_F(mini, rule_with_unhandled_access)
if (access == ruleset_attr.handled_access_net) {
EXPECT_EQ(0, err);
} else {
- EXPECT_EQ(-1, err);
+ ASSERT_EQ(-1, err);
EXPECT_EQ(EINVAL, errno);
}
}
@@ -2349,12 +2349,12 @@ TEST_F(mini, inval)
ASSERT_LE(0, ruleset_fd);
/* Checks unhandled allowed_access. */
- EXPECT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
+ ASSERT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
&tcp_bind_connect, 0));
EXPECT_EQ(EINVAL, errno);
/* Checks zero access value. */
- EXPECT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
+ ASSERT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
&tcp_denied, 0));
EXPECT_EQ(ENOMSG, errno);
@@ -2414,15 +2414,15 @@ TEST_F(mini, tcp_port_overflow)
ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
&port_max_bind, 0));
- EXPECT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
+ ASSERT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
&port_overflow1, 0));
EXPECT_EQ(EINVAL, errno);
- EXPECT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
+ ASSERT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
&port_overflow2, 0));
EXPECT_EQ(EINVAL, errno);
- EXPECT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
+ ASSERT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
&port_overflow3, 0));
EXPECT_EQ(EINVAL, errno);
@@ -2430,7 +2430,7 @@ TEST_F(mini, tcp_port_overflow)
ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
&port_max_connect, 0));
- EXPECT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
+ ASSERT_EQ(-1, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
&port_overflow4, 0));
EXPECT_EQ(EINVAL, errno);
@@ -2549,7 +2549,7 @@ TEST_F(ipv4_tcp, with_fs)
EXPECT_EQ(0, close(dir_fd));
dir_fd = open("/", O_RDONLY);
- EXPECT_EQ(-1, dir_fd);
+ ASSERT_EQ(-1, dir_fd);
EXPECT_EQ(EACCES, errno);
/* Tests port binding. */
diff --git a/tools/testing/selftests/landlock/ptrace_test.c b/tools/testing/selftests/landlock/ptrace_test.c
index 4fd2b440aa45..ea8e4be6659e 100644
--- a/tools/testing/selftests/landlock/ptrace_test.c
+++ b/tools/testing/selftests/landlock/ptrace_test.c
@@ -204,7 +204,7 @@ TEST_F(scoped_domains, trace)
if (can_trace_parent) {
EXPECT_EQ(0, ret);
} else {
- EXPECT_EQ(-1, ret);
+ ASSERT_EQ(-1, ret);
EXPECT_EQ(EPERM, errno);
}
if (ret == 0) {
@@ -218,7 +218,7 @@ TEST_F(scoped_domains, trace)
if (can_trace_child) {
EXPECT_EQ(0, ret);
} else {
- EXPECT_EQ(-1, ret);
+ ASSERT_EQ(-1, ret);
EXPECT_EQ(EPERM, errno);
}
@@ -259,7 +259,7 @@ TEST_F(scoped_domains, trace)
ASSERT_EQ(0, ptrace(PTRACE_DETACH, child, NULL, 0));
} else {
/* The child should not be traced by the parent. */
- EXPECT_EQ(-1, ptrace(PTRACE_DETACH, child, NULL, 0));
+ ASSERT_EQ(-1, ptrace(PTRACE_DETACH, child, NULL, 0));
EXPECT_EQ(ESRCH, errno);
}
@@ -276,7 +276,7 @@ TEST_F(scoped_domains, trace)
if (can_trace_child) {
EXPECT_EQ(0, ret);
} else {
- EXPECT_EQ(-1, ret);
+ ASSERT_EQ(-1, ret);
EXPECT_EQ(EPERM, errno);
}
@@ -377,7 +377,7 @@ TEST_F(audit, trace)
ASSERT_EQ(1, read(pipe_parent[0], &buf_child, 1));
/* Tests child PTRACE_TRACEME. */
- EXPECT_EQ(-1, ptrace(PTRACE_TRACEME));
+ ASSERT_EQ(-1, ptrace(PTRACE_TRACEME));
EXPECT_EQ(EPERM, errno);
/* We should see the child process. */
EXPECT_EQ(0, matches_log_ptrace(_metadata, self->audit_fd,
@@ -414,11 +414,11 @@ TEST_F(audit, trace)
ASSERT_EQ(1, read(pipe_child[0], &buf_parent, 1));
/* The child should not be traced by the parent. */
- EXPECT_EQ(-1, ptrace(PTRACE_DETACH, child, NULL, 0));
+ ASSERT_EQ(-1, ptrace(PTRACE_DETACH, child, NULL, 0));
EXPECT_EQ(ESRCH, errno);
/* Tests PTRACE_ATTACH on the child. */
- EXPECT_EQ(-1, ptrace(PTRACE_ATTACH, child, NULL, 0));
+ ASSERT_EQ(-1, ptrace(PTRACE_ATTACH, child, NULL, 0));
EXPECT_EQ(EPERM, errno);
EXPECT_EQ(0, matches_log_ptrace(_metadata, self->audit_fd, child));
diff --git a/tools/testing/selftests/landlock/scoped_abstract_unix_test.c b/tools/testing/selftests/landlock/scoped_abstract_unix_test.c
index df41da5f2ab0..4c7f9c102d50 100644
--- a/tools/testing/selftests/landlock/scoped_abstract_unix_test.c
+++ b/tools/testing/selftests/landlock/scoped_abstract_unix_test.c
@@ -122,7 +122,7 @@ TEST_F(scoped_domains, connect_to_parent)
if (can_connect_to_parent) {
EXPECT_EQ(0, err);
} else {
- EXPECT_EQ(-1, err);
+ ASSERT_EQ(-1, err);
EXPECT_EQ(EPERM, errno);
}
EXPECT_EQ(0, close(stream_client));
@@ -132,7 +132,7 @@ TEST_F(scoped_domains, connect_to_parent)
if (can_connect_to_parent) {
EXPECT_EQ(0, err);
} else {
- EXPECT_EQ(-1, err);
+ ASSERT_EQ(-1, err);
EXPECT_EQ(EPERM, errno);
}
EXPECT_EQ(0, close(dgram_client));
@@ -417,7 +417,7 @@ TEST_F(scoped_audit, connect_to_child)
ASSERT_EQ(1, read(pipe_child[0], &buf, 1));
err_dgram = connect(dgram_client, &self->dgram_address.unix_addr,
self->dgram_address.unix_addr_len);
- EXPECT_EQ(-1, err_dgram);
+ ASSERT_EQ(-1, err_dgram);
EXPECT_EQ(EPERM, errno);
if (should_audit) {
@@ -762,7 +762,7 @@ TEST_F(outside_socket, socket_with_different_domain)
if (variant->child_socket) {
EXPECT_EQ(0, err);
} else {
- EXPECT_EQ(-1, err);
+ ASSERT_EQ(-1, err);
EXPECT_EQ(EPERM, errno);
}
EXPECT_EQ(0, close(client_socket));
@@ -939,7 +939,7 @@ TEST_F(various_address_sockets, scoped_pathname_sockets)
&stream_abstract_addr.unix_addr,
stream_abstract_addr.unix_addr_len);
if (variant->domain == SCOPE_SANDBOX) {
- EXPECT_EQ(-1, err);
+ ASSERT_EQ(-1, err);
EXPECT_EQ(EPERM, errno);
} else {
EXPECT_EQ(0, err);
@@ -954,7 +954,7 @@ TEST_F(various_address_sockets, scoped_pathname_sockets)
&dgram_abstract_addr.unix_addr,
dgram_abstract_addr.unix_addr_len);
if (variant->domain == SCOPE_SANDBOX) {
- EXPECT_EQ(-1, err);
+ ASSERT_EQ(-1, err);
EXPECT_EQ(EPERM, errno);
} else {
EXPECT_EQ(1, err);
@@ -965,7 +965,7 @@ TEST_F(various_address_sockets, scoped_pathname_sockets)
&dgram_abstract_addr.unix_addr,
dgram_abstract_addr.unix_addr_len);
if (variant->domain == SCOPE_SANDBOX) {
- EXPECT_EQ(-1, err);
+ ASSERT_EQ(-1, err);
EXPECT_EQ(EPERM, errno);
} else {
EXPECT_EQ(0, err);
--
2.56.0
next prev parent reply other threads:[~2026-10-08 14:27 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20261008142604.39107-2-gnoack3000@gmail.com>
2026-10-08 14:25 ` [PATCH 01/27] selftests/landlock: Propagate grandchild failures in unix_scoping Günther Noack
2026-10-08 14:25 ` [PATCH 02/27] selftests/landlock: Propagate EXPECT failures from forked children Günther Noack
2026-10-08 14:25 ` [PATCH 03/27] selftests/landlock: Check the thread result in audit.thread Günther Noack
2026-10-08 14:25 ` [PATCH 04/27] selftests/landlock: Zero-initialize the buffer in inconsistent_attr Günther Noack
2026-10-08 14:25 ` [PATCH 05/27] selftests/landlock: Fix the openat() success check in fs_bench Günther Noack
2026-10-08 14:25 ` [PATCH 06/27] selftests/landlock: Fix the reported clock tick rate " Günther Noack
2026-10-08 14:25 ` [PATCH 07/27] selftests/landlock: Fix the ruleset_fd check in empty_or_same_ruleset Günther Noack
2026-10-08 14:25 ` [PATCH 08/27] selftests/landlock: Handle a missing control message in recv_fd() Günther Noack
2026-10-08 14:25 ` [PATCH 09/27] selftests/landlock: Assert tracefs_extract_field() results that are used Günther Noack
2026-10-08 14:25 ` [PATCH 10/27] selftests/landlock: Assert audit initialization in fixture setups Günther Noack
2026-10-08 14:25 ` [PATCH 11/27] selftests/landlock: Assert helper results that are used afterwards Günther Noack
2026-10-08 14:25 ` [PATCH 12/27] selftests/landlock: Assert audit_count_records() before using its result Günther Noack
2026-10-08 14:25 ` [PATCH 13/27] selftests/landlock: Fix memory leak in audit_init_filter_exe() Günther Noack
2026-10-08 14:25 ` [PATCH 14/27] selftests/landlock: Make audit_message large enough for any exe filter Günther Noack
2026-10-08 14:25 ` [PATCH 15/27] selftests/landlock: Close leaked file descriptors Günther Noack
2026-10-08 14:25 ` [PATCH 16/27] selftests/landlock: Check errno for combined VERSION and ERRATA flags Günther Noack
2026-10-08 14:25 ` [PATCH 17/27] selftests/landlock: Fix SIGURG handler setup in scoped_signal_test Günther Noack
2026-10-08 14:25 ` [PATCH 18/27] selftests/landlock: Fix regex_escape() error handling in matches_log_fs_extra() Günther Noack
2026-10-08 14:25 ` [PATCH 19/27] selftests/landlock: Fix off-by-one in regex_escape() Günther Noack
2026-10-08 14:25 ` [PATCH 20/27] selftests/landlock: Fix the snprintf() error check in matches_log_fs_extra() Günther Noack
2026-10-08 14:25 ` [PATCH 21/27] selftests/landlock: Use _exit() in the named_pipe_ioctl child Günther Noack
2026-10-08 14:25 ` [PATCH 22/27] selftests/landlock: Fix messages and comments in helper programs Günther Noack
2026-10-08 14:25 ` [PATCH 23/27] selftests/landlock: Fix stale comments in common.h and audit.h Günther Noack
2026-10-08 14:25 ` Günther Noack [this message]
2026-10-08 14:25 ` [PATCH 25/27] selftests/landlock: Assert WIFEXITED() before checking the exit status Günther Noack
2026-10-08 14:25 ` [PATCH 26/27] selftests/landlock: Use EXPECT for closing FDs and stopping threads Günther Noack
2026-10-08 14:25 ` [PATCH 27/27] selftests/landlock: Use EXPECT for checks that later steps do not need Günther Noack
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261008142604.39107-26-gnoack3000@gmail.com \
--to=gnoack3000@gmail.com \
--cc=gnoack@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=mic@digikod.net \
--cc=shuah@kernel.org \
--cc=wangyan01@kylinos.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®