selftests/landlock: Drain stale audit records on init

Non-audit Landlock tests generate audit records as side effects when
audit_enabled is non-zero (e.g. from boot configuration).  These records
accumulate in the kernel audit backlog while no audit daemon socket is
open.  When the next test opens a new netlink socket and registers as
the audit daemon, the stale backlog is delivered, causing baseline
record count checks to fail spuriously.

Fix this by draining all pending records in audit_init() right after
setting the receive timeout.  The 1-usec SO_RCVTIMEO causes audit_recv()
to return -EAGAIN once the backlog is empty, naturally terminating the
drain loop.

Domain deallocation records are emitted asynchronously from a work
queue, so they may still arrive after the drain.  Remove records.domain
== 0 checks that are not preceded by audit_match_record() calls, which
would otherwise consume stale records before the count.  Document this
constraint above audit_count_records().

Increasing the drain timeout to catch in-flight deallocation records was
considered but rejected: a longer timeout adds latency to every
audit_init() call even when no stale record is pending, and any fixed
timeout is still not guaranteed to catch all records under load.
Removing the unprotected checks is simpler and avoids the spurious
failures.

Cc: Günther Noack <gnoack@google.com>
Cc: stable@vger.kernel.org
Fixes: 6a500b22971c ("selftests/landlock: Add tests for audit flags and domain IDs")
Reviewed-by: Günther Noack <gnoack3000@gmail.com>
Link: https://lore.kernel.org/r/20260402192608.1458252-4-mic@digikod.net
Signed-off-by: Mickaël Salaün <mic@digikod.net>

diff --git a/tools/testing/selftests/landlock/audit.h b/tools/testing/selftests/landlock/audit.h
index 6422943fc69e1918d68f141eefc781b095360559..74e1c3d763be2187c00f046afeb52f56a09a2e07 100644 (file)
--- a/tools/testing/selftests/landlock/audit.h
+++ b/tools/testing/selftests/landlock/audit.h
@@ -338,6 +338,15 @@ struct audit_records {
        size_t domain;
 };
 
+/*
+ * WARNING: Do not assert records.domain == 0 without a preceding
+ * audit_match_record() call.  Domain deallocation records are emitted
+ * asynchronously from kworker threads and can arrive after the drain in
+ * audit_init(), corrupting the domain count.  A preceding audit_match_record()
+ * call consumes stale records while scanning, making the assertion safe in
+ * practice because stale deallocation records arrive before the expected access
+ * records.
+ */
 static int audit_count_records(int audit_fd, struct audit_records *records)
 {
        struct audit_message msg;
@@ -393,6 +402,16 @@ static int audit_init(void)
                goto err_close;
        }
 
+       /*
+        * Drains stale audit records that accumulated in the kernel backlog
+        * while no audit daemon socket was open.  This happens when non-audit
+        * Landlock tests generate records while audit_enabled is non-zero (e.g.
+        * from boot configuration), or when domain deallocation records arrive
+        * asynchronously after a previous test's socket was closed.
+        */
+       while (audit_recv(fd, NULL) == 0)
+               ;
+
        return fd;
 
 err_close:

diff --git a/tools/testing/selftests/landlock/audit_test.c b/tools/testing/selftests/landlock/audit_test.c
index 897596cd7c80e57c64cb532d8b776f0a45c5d951..c697e22d8f68a60b6bdada90ba71004fb659f7f0 100644 (file)
--- a/tools/testing/selftests/landlock/audit_test.c
+++ b/tools/testing/selftests/landlock/audit_test.c
@@ -733,7 +733,6 @@ TEST_F(audit_flags, signal)
                } else {
                        EXPECT_EQ(1, records.access);
                }
-               EXPECT_EQ(0, records.domain);
 
                /* Updates filter rules to match the drop record. */
                set_cap(_metadata, CAP_AUDIT_CONTROL);
@@ -922,7 +921,6 @@ TEST_F(audit_exec, signal_and_open)
        /* Tests that there was no denial until now. */
        EXPECT_EQ(0, audit_count_records(self->audit_fd, &records));
        EXPECT_EQ(0, records.access);
-       EXPECT_EQ(0, records.domain);
 
        /*
         * Wait for the child to do a first denied action by layer1 and

diff --git a/tools/testing/selftests/landlock/ptrace_test.c b/tools/testing/selftests/landlock/ptrace_test.c
index 4f64c90583cd61a79aa5c95f895cfb7e1421d523..1b6c8b53bf33a664be61be007cb91124637d497b 100644 (file)
--- a/tools/testing/selftests/landlock/ptrace_test.c
+++ b/tools/testing/selftests/landlock/ptrace_test.c
@@ -342,7 +342,6 @@ TEST_F(audit, trace)
        /* Makes sure there is no superfluous logged records. */
        EXPECT_EQ(0, audit_count_records(self->audit_fd, &records));
        EXPECT_EQ(0, records.access);
-       EXPECT_EQ(0, records.domain);
 
        yama_ptrace_scope = get_yama_ptrace_scope();
        ASSERT_LE(0, yama_ptrace_scope);

diff --git a/tools/testing/selftests/landlock/scoped_abstract_unix_test.c b/tools/testing/selftests/landlock/scoped_abstract_unix_test.c
index 72f97648d4a7d4ac40a64901c875d8259a3d4e06..c47491d2d1c142a80a9d2cfe2a4a53e443d41582 100644 (file)
--- a/tools/testing/selftests/landlock/scoped_abstract_unix_test.c
+++ b/tools/testing/selftests/landlock/scoped_abstract_unix_test.c
@@ -312,7 +312,6 @@ TEST_F(scoped_audit, connect_to_child)
        /* Makes sure there is no superfluous logged records. */
        EXPECT_EQ(0, audit_count_records(self->audit_fd, &records));
        EXPECT_EQ(0, records.access);
-       EXPECT_EQ(0, records.domain);
 
        ASSERT_EQ(0, pipe2(pipe_child, O_CLOEXEC));
        ASSERT_EQ(0, pipe2(pipe_parent, O_CLOEXEC));