diff --git a/tools/testing/selftests/tkernel/killblock.sh b/tools/testing/selftests/tkernel/killblock.sh
index a569b816e3d7daf6a5e099776c100661c517676b..7a6b5e214bc862a66fcb4e290a7df589f6a23235 100755
--- a/tools/testing/selftests/tkernel/killblock.sh
+++ b/tools/testing/selftests/tkernel/killblock.sh
@@ -5,7 +5,7 @@ SYSCTL=/proc/sys/kernel/sig_kill_block
 RULES=/proc/kill_block/whitelist
 STAT=/proc/kill_block/stat
 PARALLEL_SENDERS=8
-TESTS=12
+TESTS=19
 target_pid=
 module_loaded=0
 
@@ -192,6 +192,58 @@ ksft_result "$rc" "a matching whitelist rule allows SIGTERM"
 write_rule "del $sender_comm $target_comm *"
 ksft_result $? "the whitelist rule can be removed"
 
+if write_rule "del $sender_comm $target_comm *"; then
+	rc=1
+else
+	rc=0
+fi
+ksft_result "$rc" "removing a missing whitelist rule is rejected"
+
+write_rule "add $sender_comm $target_comm *"
+if write_rule "add $sender_comm $target_comm *"; then
+	rc=1
+else
+	rc=0
+fi
+ksft_result "$rc" "a duplicate whitelist rule is rejected"
+
+rule_cnt=$(awk 'END { print NR - 1 }' "$RULES")
+[ "$rule_cnt" -eq 1 ]
+ksft_result $? "a rejected duplicate leaves the rule list unchanged"
+
+long_cgrp=$(printf 'a%.0s' $(seq 70))
+write_rule "add $sender_comm $target_comm $long_cgrp"
+cut -f3 "$RULES" | tail -n +2 | grep -qx "$(printf '%s' "$long_cgrp" | cut -c 1-63)"
+rc=$?
+if [ "$rc" -eq 0 ]; then
+	write_rule "del $sender_comm $target_comm $(printf '%s' "$long_cgrp" | cut -c 1-63)" ||
+		rc=1
+fi
+ksft_result "$rc" "an oversized cgroup token is truncated to 63 chars"
+
+write_rule "flush"
+rc=$?
+rule_cnt=$(awk 'END { print NR - 1 }' "$RULES")
+[ "$rule_cnt" -eq 0 ] || rc=1
+ksft_result "$rc" "flush clears the whitelist"
+
+if write_rule "del $sender_comm $target_comm *"; then
+	rc=1
+else
+	rc=0
+fi
+ksft_result "$rc" "rules are gone after flush"
+
+start_target || ksft_skip_all "could not restart the signal target"
+write_rule "add $sender_comm $target_comm *"
+"$helper" send "$sender_comm" "$target_pid" 15 >/dev/null 2>&1
+rc=$?
+[ "$rc" -eq 0 ] && wait_for_exit && { target_pid=; rc=0; } || rc=1
+ksft_result "$rc" "a rule added after flush works again"
+
+start_target || ksft_skip_all "could not restart the signal target"
+write_sysctl 1 >/dev/null
+
 if write_sysctl 3; then
 	rc=1
 else
diff --git a/tools/testing/selftests/tkernel/killprotect.sh b/tools/testing/selftests/tkernel/killprotect.sh
index 1e2f7b6e6ab4ff1e803697e05413d82caeeb859f..dff9b61d9695b315874bd7a78b6500e340bb12c5 100755
--- a/tools/testing/selftests/tkernel/killprotect.sh
+++ b/tools/testing/selftests/tkernel/killprotect.sh
@@ -5,7 +5,7 @@ SYSCTL=/proc/sys/kernel/sig_kill_protect
 RULES=/proc/kill_protect/blacklist
 STAT=/proc/kill_protect/stat
 PARALLEL_SENDERS=8
-TESTS=12
+TESTS=15
 target_pid=
 module_loaded=0
 
@@ -190,6 +190,30 @@ ksft_result $? "concurrent protection events are all accounted"
 write_rule "del $target_comm"
 ksft_result $? "the blacklist rule can be removed"
 
+if write_rule "del $target_comm"; then
+	rc=1
+else
+	rc=0
+fi
+ksft_result "$rc" "removing a missing blacklist rule is rejected"
+
+long_comm=$(printf 'b%.0s' $(seq 20))
+write_rule "add $long_comm"
+tail -n +2 "$RULES" | grep -qx "$(printf '%s' "$long_comm" | cut -c 1-15)"
+rc=$?
+if [ "$rc" -eq 0 ]; then
+	write_rule "del $(printf '%s' "$long_comm" | cut -c 1-15)" || rc=1
+fi
+ksft_result "$rc" "an oversized comm token is truncated to 15 chars"
+
+write_rule "add $target_comm"
+write_rule "flush"
+rc=$?
+grep -qx "$target_comm" "$RULES" && rc=1
+rules_after=$(awk '/^rule count:/ { print $3 }' "$STAT")
+[ "$rc" -eq 0 ] && [ -n "$rules_after" ] && [ "$rules_after" = "0" ]
+ksft_result $? "flush clears the blacklist and resets the rule count"
+
 "$helper" send "$sender_comm" "$target_pid" 15 >/dev/null 2>&1
 rc=$?
 if [ "$rc" -eq 0 ] && wait_for_exit; then
@@ -198,7 +222,7 @@ if [ "$rc" -eq 0 ] && wait_for_exit; then
 else
 	rc=1
 fi
-ksft_result "$rc" "SIGTERM is delivered after removing the rule"
+ksft_result "$rc" "SIGTERM is delivered after flush removes the rules"
 
 reload_module
 rc=$?