Re: [PATCH net-next v4 3/3] selftest: Add tests for useful handling of LSM denials on SCM_RIGHTS

[Jori Koolstra]

> Op 07-07-2026 13:02 CEST schreef Christian Brauner <brauner@xxxxxxxxxx>:
> 
> > +
> > +TEST_F(scm_rights_denial_bpf, all_allowed)
> > +{
> > +	int slots[NR_FILES], nr_slots, flags, i;
> > +
> > +	ASSERT_EQ(0, set_notrunc(self->sk[SK_RECEIVER]));
> > +	ASSERT_NE(-1, send_fds(self->sk[SK_SENDER], self->files, NR_FILES));
> > +	nr_slots = recv_fd_slots(self->sk[SK_RECEIVER], slots, &flags);
> > +
> > +	ASSERT_EQ(NR_FILES, nr_slots);
> > +	EXPECT_EQ(0, flags & MSG_CTRUNC);
> > +
> > +	for (i = 0; i < NR_FILES; i++) {
> > +		ASSERT_LE(0, slots[i]);
> 
> Why do you assert less-or-equal? You want a valid fd so you should
> expect >= 0?
> 

This says 0 <= slots[i], or equivalently slots[i] >= 0.

> > +
> > +TEST_F(scm_rights_denial_bpf, denied_without_notrunc)
> > +{
> > +	int slots[NR_FILES], nr_slots, flags;
> > +
> > +	/*
> > +	 * Baseline behaviour without SO_RIGHTS_NOTRUNC: the fd array is
> > +	 * truncated at the first denied fd and MSG_CTRUNC is set.
> > +	 */
> > +	ASSERT_EQ(0, deny_inode(self->map_fd, self->inos[1]));
> > +
> > +	ASSERT_NE(-1, send_fds(self->sk[SK_SENDER], self->files, NR_FILES));
> > +	nr_slots = recv_fd_slots(self->sk[SK_RECEIVER], slots, &flags);
> > +
> > +	ASSERT_EQ(1, nr_slots);
> > +	EXPECT_NE(0, flags & MSG_CTRUNC);
> > +
> > +	ASSERT_LE(0, slots[0]);
> 
> Why do you expect less-equal than zero? Don't you need ASSERT_GE()
> because you want slots[0] to be a valid file desscriptor?
> 

Idem.

But I do think ASSERT_GE() read a bit better here, so I have changed it.

> And even the other way around... Zero is a valid file descriptor so on
> failure you must expect ASSERT_LT()?
> 

> -- 
> Christian Brauner <brauner@xxxxxxxxxx>

Thanks,
Jori.