| Message ID | 20240814030151.2380280-9-ivanov.mikhail1@huawei-partners.com (mailing list archive) |
|---|---|
| State | RFC |
| Headers | show |
| Series | Support TCP listen access-control | expand |
| Context | Check | Description |
|---|---|---|
| netdev/tree_selection | success | Not a local patch, async |
On Wed, Aug 14, 2024 at 11:01:50AM +0800, Mikhail Ivanov wrote: > listen(2) can be used to change length of the pending connections queue > of the listening socket. Such scenario shouldn't be restricted by Landlock > since socket doesn't change its state. Yes, this behavior makes sense to me as well.
On 10/5/2024 7:57 PM, Günther Noack wrote: > On Wed, Aug 14, 2024 at 11:01:50AM +0800, Mikhail Ivanov wrote: >> listen(2) can be used to change length of the pending connections queue >> of the listening socket. Such scenario shouldn't be restricted by Landlock >> since socket doesn't change its state. > > Yes, this behavior makes sense to me as well.
diff --git a/tools/testing/selftests/landlock/net_test.c b/tools/testing/selftests/landlock/net_test.c index 6831d8a2e9aa..dafc433a0068 100644 --- a/tools/testing/selftests/landlock/net_test.c +++ b/tools/testing/selftests/landlock/net_test.c @@ -1768,6 +1768,32 @@ TEST_F(ipv4_tcp, with_fs) EXPECT_EQ(-EACCES, bind_variant(bind_fd, &self->srv1)); } +TEST_F(ipv4_tcp, double_listen) +{ + const struct landlock_ruleset_attr ruleset_attr = { + .handled_access_net = LANDLOCK_ACCESS_NET_LISTEN_TCP, + }; + int ruleset_fd; + int listen_fd; + + listen_fd = socket_variant(&self->srv0); + ASSERT_LE(0, listen_fd); + + EXPECT_EQ(0, bind_variant(listen_fd, &self->srv0)); + EXPECT_EQ(0, listen_variant(listen_fd, backlog)); + + ruleset_fd = + landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); + ASSERT_LE(0, ruleset_fd); + + /* Denies listen. */ + enforce_ruleset(_metadata, ruleset_fd); + EXPECT_EQ(0, close(ruleset_fd)); + + /* Tries to change backlog value of listening socket. */ + EXPECT_EQ(0, listen_variant(listen_fd, backlog + 1)); +} + FIXTURE(port_specific) { struct service_fixture srv0;
listen(2) can be used to change length of the pending connections queue of the listening socket. Such scenario shouldn't be restricted by Landlock since socket doesn't change its state. * Implement test that validates this case. Signed-off-by: Mikhail Ivanov <ivanov.mikhail1@huawei-partners.com> --- tools/testing/selftests/landlock/net_test.c | 26 +++++++++++++++++++++ 1 file changed, 26 insertions(+)