From bcd0cf0f8c316721528c7dbad5b66a6ad97d5271 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E9=99=88=E9=82=A3=E5=87=A0?= <2078634206@qq.com>
Date: Fri, 21 Aug 2026 09:04:23 +0800
Subject: [PATCH] selftests: tkernel: cover kill rule flush and token edges
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

killblock.sh and killprotect.sh only exercise the add/del happy path
of the rule proc interface.  The flush command, the error returns for
removing a missing rule or adding a duplicate one, and the truncation
behaviour for oversized tokens are all untested.

Extend both scripts with contract checks for those paths: flush clears
the rule list (and resets the reported rule count in kill_protect),
removing a missing rule fails, a duplicate add is rejected and leaves
the list unchanged, an oversized cgroup token (killblock, 63 bytes)
and an oversized comm token (killprotect, 15 bytes) are stored
truncated and removable via their truncated form, and a rule added
after flush works again.

Upstream status: downstream-only

Signed-off-by: 陈那几 <2078634206@qq.com>
---
 tools/testing/selftests/tkernel/killblock.sh  | 54 ++++++++++++++++++-
 .../testing/selftests/tkernel/killprotect.sh  | 28 +++++++++-
 2 files changed, 79 insertions(+), 3 deletions(-)

diff --git a/tools/testing/selftests/tkernel/killblock.sh b/tools/testing/selftests/tkernel/killblock.sh
index a569b816e3d7..7a6b5e214bc8 100755
--- a/tools/testing/selftests/tkernel/killblock.sh
+++ b/tools/testing/selftests/tkernel/killblock.sh
@@ -5,7 +5,7 @@ SYSCTL=/proc/sys/kernel/sig_kill_block
 RULES=/proc/kill_block/whitelist
 STAT=/proc/kill_block/stat
 PARALLEL_SENDERS=8
-TESTS=12
+TESTS=19
 target_pid=
 module_loaded=0
 
@@ -192,6 +192,58 @@ ksft_result "$rc" "a matching whitelist rule allows SIGTERM"
 write_rule "del $sender_comm $target_comm *"
 ksft_result $? "the whitelist rule can be removed"
 
+if write_rule "del $sender_comm $target_comm *"; then
+	rc=1
+else
+	rc=0
+fi
+ksft_result "$rc" "removing a missing whitelist rule is rejected"
+
+write_rule "add $sender_comm $target_comm *"
+if write_rule "add $sender_comm $target_comm *"; then
+	rc=1
+else
+	rc=0
+fi
+ksft_result "$rc" "a duplicate whitelist rule is rejected"
+
+rule_cnt=$(awk 'END { print NR - 1 }' "$RULES")
+[ "$rule_cnt" -eq 1 ]
+ksft_result $? "a rejected duplicate leaves the rule list unchanged"
+
+long_cgrp=$(printf 'a%.0s' $(seq 70))
+write_rule "add $sender_comm $target_comm $long_cgrp"
+cut -f3 "$RULES" | tail -n +2 | grep -qx "$(printf '%s' "$long_cgrp" | cut -c 1-63)"
+rc=$?
+if [ "$rc" -eq 0 ]; then
+	write_rule "del $sender_comm $target_comm $(printf '%s' "$long_cgrp" | cut -c 1-63)" ||
+		rc=1
+fi
+ksft_result "$rc" "an oversized cgroup token is truncated to 63 chars"
+
+write_rule "flush"
+rc=$?
+rule_cnt=$(awk 'END { print NR - 1 }' "$RULES")
+[ "$rule_cnt" -eq 0 ] || rc=1
+ksft_result "$rc" "flush clears the whitelist"
+
+if write_rule "del $sender_comm $target_comm *"; then
+	rc=1
+else
+	rc=0
+fi
+ksft_result "$rc" "rules are gone after flush"
+
+start_target || ksft_skip_all "could not restart the signal target"
+write_rule "add $sender_comm $target_comm *"
+"$helper" send "$sender_comm" "$target_pid" 15 >/dev/null 2>&1
+rc=$?
+[ "$rc" -eq 0 ] && wait_for_exit && { target_pid=; rc=0; } || rc=1
+ksft_result "$rc" "a rule added after flush works again"
+
+start_target || ksft_skip_all "could not restart the signal target"
+write_sysctl 1 >/dev/null
+
 if write_sysctl 3; then
 	rc=1
 else
diff --git a/tools/testing/selftests/tkernel/killprotect.sh b/tools/testing/selftests/tkernel/killprotect.sh
index 1e2f7b6e6ab4..dff9b61d9695 100755
--- a/tools/testing/selftests/tkernel/killprotect.sh
+++ b/tools/testing/selftests/tkernel/killprotect.sh
@@ -5,7 +5,7 @@ SYSCTL=/proc/sys/kernel/sig_kill_protect
 RULES=/proc/kill_protect/blacklist
 STAT=/proc/kill_protect/stat
 PARALLEL_SENDERS=8
-TESTS=12
+TESTS=15
 target_pid=
 module_loaded=0
 
@@ -190,6 +190,30 @@ ksft_result $? "concurrent protection events are all accounted"
 write_rule "del $target_comm"
 ksft_result $? "the blacklist rule can be removed"
 
+if write_rule "del $target_comm"; then
+	rc=1
+else
+	rc=0
+fi
+ksft_result "$rc" "removing a missing blacklist rule is rejected"
+
+long_comm=$(printf 'b%.0s' $(seq 20))
+write_rule "add $long_comm"
+tail -n +2 "$RULES" | grep -qx "$(printf '%s' "$long_comm" | cut -c 1-15)"
+rc=$?
+if [ "$rc" -eq 0 ]; then
+	write_rule "del $(printf '%s' "$long_comm" | cut -c 1-15)" || rc=1
+fi
+ksft_result "$rc" "an oversized comm token is truncated to 15 chars"
+
+write_rule "add $target_comm"
+write_rule "flush"
+rc=$?
+grep -qx "$target_comm" "$RULES" && rc=1
+rules_after=$(awk '/^rule count:/ { print $3 }' "$STAT")
+[ "$rc" -eq 0 ] && [ -n "$rules_after" ] && [ "$rules_after" = "0" ]
+ksft_result $? "flush clears the blacklist and resets the rule count"
+
 "$helper" send "$sender_comm" "$target_pid" 15 >/dev/null 2>&1
 rc=$?
 if [ "$rc" -eq 0 ] && wait_for_exit; then
@@ -198,7 +222,7 @@ if [ "$rc" -eq 0 ] && wait_for_exit; then
 else
 	rc=1
 fi
-ksft_result "$rc" "SIGTERM is delivered after removing the rule"
+ksft_result "$rc" "SIGTERM is delivered after flush removes the rules"
 
 reload_module
 rc=$?
-- 
Gitee