Re: [PATCH v6 6/8] selftests/landlock: Add capability restriction tests

["Mickaël Salaün" <mic@digikod.net>]

On Sat, Oct 17, 2026 at 12:20:12PM +0200, Günther Noack wrote:
> On Wed, Oct 14, 2026 at 10:27:12AM +0200, Mickaël Salaün wrote:
> > Add tests to exercise LANDLOCK_PERMISSION_CAPABILITY_USE enforcement.  A
> > sandboxed process is denied a handled capability when no rule grants it,
> > and an explicit rule restores it.  Unknown capability values above
> > CAP_LAST_CAP are accepted at rule-add time yet have no runtime effect,
> > because deny-by-default still applies once the domain is enforced.
> > Stacking tests cover the per-layer allow/deny combinations, including a
> > layer that does not handle the permission, and invalid rule attributes
> > return the expected errors.
> > 
> > Three tests exercise non-standard capability contexts: enforcing a
> > domain via CAP_SYS_ADMIN authorization without no_new_privs, restricting
> > capabilities gained through the kernel's user namespace ownership bypass
> > (cap_capable_helper), and checking CAP_SYS_ADMIN against a descendant
> > user namespace, with an unsandboxed positive control, to confirm the
> > decision is independent of the target.
> > 
> > Audit tests verify denied and allowed capabilities, per-member quiet
> > interactions, and CAP_OPT_NOAUDIT suppression.  Trace tests cover
> > accepted, rejected, and no-op rule adds, and normal, quiet, and
> > CAP_OPT_NOAUDIT denials.
> > 
> > Test coverage for security/landlock is 91.8% of 2864 lines according to
> > LLVM 22.
> > 
> > Cc: Christian Brauner <brauner@kernel.org>
> > Cc: Günther Noack <gnoack@google.com>
> > Cc: Paul Moore <paul@paul-moore.com>
> > Cc: Serge E. Hallyn <serge@hallyn.com>
> > Signed-off-by: Mickaël Salaün <mic@digikod.net>
> > ---

> Same comments as in the preceding commit as well;
> specifically,
> * some helper functions could call ASSERT directly
> * EXPECT instead of ASSERT in various places

Agreed