selftests/landlock: Add test to check rule tied to covered mount point

This test checks that a rule on a directory used as a mount point does
not grant access to the mount covering it.  It is a generalization of
the bind mount case in layout3_fs.hostfs.release_inodes [1] that tests
hidden mount points.

Cc: Günther Noack <gnoack@google.com>
Cc: Song Liu <song@kernel.org>
Cc: Tingmao Wang <m@maowtm.org>
Link: https://lore.kernel.org/r/20250606.zo5aekae6Da6@digikod.net
Link: https://lore.kernel.org/r/20250606110811.211297-1-mic@digikod.net
Signed-off-by: Mickaël Salaün <mic@digikod.net>

diff --git a/tools/testing/selftests/landlock/fs_test.c b/tools/testing/selftests/landlock/fs_test.c
index 73729382d40f829a0425fe8e748d45be00bc5df4..fa0f18ec62c41e649eb654d6b16f5009485e57ce 100644 (file)
--- a/tools/testing/selftests/landlock/fs_test.c
+++ b/tools/testing/selftests/landlock/fs_test.c
@@ -1832,6 +1832,46 @@ TEST_F_FORK(layout1, release_inodes)
        ASSERT_EQ(ENOENT, test_open(dir_s3d3, O_RDONLY));
 }
 
+/*
+ * This test checks that a rule on a directory used as a mount point does not
+ * grant access to the mount covering it.  It is a generalization of the bind
+ * mount case in layout3_fs.hostfs.release_inodes that tests hidden mount points.
+ */
+TEST_F_FORK(layout1, covered_rule)
+{
+       const struct rule layer1[] = {
+               {
+                       .path = dir_s3d2,
+                       .access = LANDLOCK_ACCESS_FS_READ_DIR,
+               },
+               {},
+       };
+       int ruleset_fd;
+
+       /* Unmount to simplify FIXTURE_TEARDOWN. */
+       set_cap(_metadata, CAP_SYS_ADMIN);
+       ASSERT_EQ(0, umount(dir_s3d2));
+       clear_cap(_metadata, CAP_SYS_ADMIN);
+
+       /* Creates a ruleset with the future hidden directory. */
+       ruleset_fd =
+               create_ruleset(_metadata, LANDLOCK_ACCESS_FS_READ_DIR, layer1);
+       ASSERT_LE(0, ruleset_fd);
+
+       /* Covers with a new mount point. */
+       set_cap(_metadata, CAP_SYS_ADMIN);
+       ASSERT_EQ(0, mount_opt(&mnt_tmp, dir_s3d2));
+       clear_cap(_metadata, CAP_SYS_ADMIN);
+
+       ASSERT_EQ(0, test_open(dir_s3d2, O_RDONLY));
+
+       enforce_ruleset(_metadata, ruleset_fd);
+       ASSERT_EQ(0, close(ruleset_fd));
+
+       /* Checks that access to the new mount point is denied. */
+       ASSERT_EQ(EACCES, test_open(dir_s3d2, O_RDONLY));
+}
+
 enum relative_access {
        REL_OPEN,
        REL_CHDIR,