tools/testing/selftests/landlock/audit.h - linux - Git at Google

 /* SPDX-License-Identifier: GPL-2.0 */
 /*
  * Landlock audit helpers
  *
  * Copyright © 2024-2025 Microsoft Corporation
  */

 #define _GNU_SOURCE
 #include <errno.h>
 #include <linux/audit.h>
 #include <linux/limits.h>
 #include <linux/netlink.h>
 #include <regex.h>
 #include <stdbool.h>
 #include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sys/socket.h>
 #include <sys/time.h>
 #include <unistd.h>

 #include "kselftest.h"

 #ifndef ARRAY_SIZE
 #define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]))
 #endif

 #define REGEX_LANDLOCK_PREFIX "^audit([0-9.:]\\+): domain=\\([0-9a-f]\\+\\)"

 struct audit_filter {
 	__u32 record_type;
 	size_t exe_len;
 	char exe[PATH_MAX];
 };

 struct audit_message {
 	struct nlmsghdr header;
 	union {
 		struct audit_status status;
 		struct audit_features features;
 		struct audit_rule_data rule;
 		struct nlmsgerr err;
 		char data[PATH_MAX + 200];
 	};
 };

 static const struct timeval audit_tv_default = {
 	/*
 	 * Default socket timeout for audit_match_record() callers that expect a
 	 * record to arrive.  Asynchronous kauditd delivery can exceed 1 usec
 	 * under heavy debug configs (KASAN, lockdep), where kauditd_thread
 	 * scheduling between audit_log_end() and netlink_unicast() takes longer
 	 * than the previous 1 usec timeout. 1 second is a generous ceiling: on
 	 * the happy path, kauditd delivers within dozens of usec.
 	 */
 	.tv_sec = 1,
 };

 static const struct timeval audit_tv_fast = {
 	/*
 	 * Fast timeout for paths that expect no record (audit_init() drain,
 	 * audit_count_records(), probes).  Causes audit_recv() to return
 	 * -EAGAIN once the socket buffer is empty, naturally terminating the
 	 * read loop.
 	 */
 	.tv_usec = 1,
 };

 static int audit_send(const int fd, const struct audit_message *const msg)
 {
 	struct sockaddr_nl addr = {
 		.nl_family = AF_NETLINK,
 	};
 	int ret;

 	do {
 		ret = sendto(fd, msg, msg->header.nlmsg_len, 0,
 			     (struct sockaddr *)&addr, sizeof(addr));
 	} while (ret < 0 && errno == EINTR);

 	if (ret < 0)
 		return -errno;

 	if (ret != msg->header.nlmsg_len)
 		return -E2BIG;

 	return 0;
 }

 static int audit_recv(const int fd, struct audit_message *msg)
 {
 	struct sockaddr_nl addr;
 	socklen_t addrlen = sizeof(addr);
 	struct audit_message msg_tmp;
 	int err;

 	if (!msg)
 		msg = &msg_tmp;

 	do {
 		err = recvfrom(fd, msg, sizeof(*msg), 0,
 			       (struct sockaddr *)&addr, &addrlen);
 	} while (err < 0 && errno == EINTR);

 	if (err < 0)
 		return -errno;

 	if (addrlen != sizeof(addr) || addr.nl_pid != 0)
 		return -EINVAL;

 	/* Checks Netlink error or end of messages. */
 	if (msg->header.nlmsg_type == NLMSG_ERROR)
 		return msg->err.error;

 	return 0;
 }

 static int audit_request(const int fd,
 			 const struct audit_message *const request,
 			 struct audit_message *reply)
 {
 	struct audit_message msg_tmp;
 	bool first_reply = true;
 	int err;

 	err = audit_send(fd, request);
 	if (err)
 		return err;

 	if (!reply)
 		reply = &msg_tmp;

 	do {
 		if (first_reply)
 			first_reply = false;
 		else
 			reply = &msg_tmp;

 		err = audit_recv(fd, reply);
 		if (err)
 			return err;
 	} while (reply->header.nlmsg_type != NLMSG_ERROR &&
 		 reply->err.msg.nlmsg_type != request->header.nlmsg_type);

 	return reply->err.error;
 }

 static int audit_filter_exe(const int audit_fd,
 			    const struct audit_filter *const filter,
 			    const __u16 type)
 {
 	struct audit_message msg = {
 		.header = {
 			.nlmsg_len = NLMSG_SPACE(sizeof(msg.rule)) +
 				     NLMSG_ALIGN(filter->exe_len),
 			.nlmsg_type = type,
 			.nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK,
 		},
 		.rule = {
 			.flags = AUDIT_FILTER_EXCLUDE,
 			.action = AUDIT_NEVER,
 			.field_count = 1,
 			.fields[0] = filter->record_type,
 			.fieldflags[0] = AUDIT_NOT_EQUAL,
 			.values[0] = filter->exe_len,
 			.buflen = filter->exe_len,
 		}
 	};

 	if (filter->record_type != AUDIT_EXE)
 		return -EINVAL;

 	memcpy(msg.rule.buf, filter->exe, filter->exe_len);
 	return audit_request(audit_fd, &msg, NULL);
 }

 static int audit_filter_drop(const int audit_fd, const __u16 type)
 {
 	struct audit_message msg = {
 		.header = {
 			.nlmsg_len = NLMSG_SPACE(sizeof(msg.rule)),
 			.nlmsg_type = type,
 			.nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK,
 		},
 		.rule = {
 			.flags = AUDIT_FILTER_EXCLUDE,
 			.action = AUDIT_NEVER,
 			.field_count = 1,
 			.fields[0] = AUDIT_MSGTYPE,
 			.fieldflags[0] = AUDIT_NOT_EQUAL,
 			.values[0] = AUDIT_LANDLOCK_DOMAIN,
 		}
 	};

 	return audit_request(audit_fd, &msg, NULL);
 }

 static int audit_set_status(int fd, __u32 key, __u32 val)
 {
 	const struct audit_message msg = {
 		.header = {
 			.nlmsg_len = NLMSG_SPACE(sizeof(msg.status)),
 			.nlmsg_type = AUDIT_SET,
 			.nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK,
 		},
 		.status = {
 			.mask = key,
 			.enabled = key == AUDIT_STATUS_ENABLED ? val : 0,
 			.pid = key == AUDIT_STATUS_PID ? val : 0,
 		}
 	};

 	return audit_request(fd, &msg, NULL);
 }

 /*
  * @domain_id: The domain ID extracted from the audit message (if the first part
  * of @pattern is REGEX_LANDLOCK_PREFIX).  It is set to 0 if the domain ID is
  * not found.
  */
 static int audit_match_record(int audit_fd, const __u16 type,
 			      const char *const pattern, __u64 *domain_id)
 {
 	struct audit_message msg, last_mismatch = {};
 	int ret, err = 0;
 	int num_type_match = 0;
 	regmatch_t matches[2];
 	regex_t regex;

 	ret = regcomp(&regex, pattern, 0);
 	if (ret)
 		return -EINVAL;

 	/*
 	 * Reads records until one matches both the expected type and the
 	 * pattern.  Type-matching records with non-matching content are
 	 * silently consumed, which handles stale domain deallocation records
 	 * from a previous test emitted asynchronously by kworker threads.
 	 */
 	while (true) {
 		memset(&msg, 0, sizeof(msg));
 		err = audit_recv(audit_fd, &msg);
 		if (err) {
 			if (num_type_match) {
 				printf("DATA: %s\n", last_mismatch.data);
 				printf("ERROR: %d record(s) matched type %u"
 				       " but not pattern: %s\n",
 				       num_type_match, type, pattern);
 			}
 			goto out;
 		}

 		if (type && msg.header.nlmsg_type != type)
 			continue;

 		ret = regexec(&regex, msg.data, ARRAY_SIZE(matches), matches,
 			      0);
 		if (!ret)
 			break;

 		num_type_match++;
 		last_mismatch = msg;
 	}

 	if (domain_id) {
 		*domain_id = 0;
 		if (matches[1].rm_so != -1) {
 			int match_len = matches[1].rm_eo - matches[1].rm_so;
 			/* The maximal characters of a 2^64 hexadecimal number is 17. */
 			char dom_id[18];

 			if (match_len > 0 && match_len < sizeof(dom_id)) {
 				memcpy(dom_id, msg.data + matches[1].rm_so,
 				       match_len);
 				dom_id[match_len] = '\0';
 				if (domain_id)
 					*domain_id = strtoull(dom_id, NULL, 16);
 			}
 		}
 	}

 out:
 	regfree(&regex);
 	return err;
 }

 static int __maybe_unused matches_log_domain_allocated(int audit_fd, pid_t pid,
 						       __u64 *domain_id)
 {
 	static const char log_template[] = REGEX_LANDLOCK_PREFIX
 		" status=allocated mode=enforcing pid=%d uid=[0-9]\\+"
 		" exe=\"[^\"]\\+\" comm=\".*_test\"$";
 	char log_match[sizeof(log_template) + 10];
 	int log_match_len;

 	log_match_len =
 		snprintf(log_match, sizeof(log_match), log_template, pid);
 	if (log_match_len >= sizeof(log_match))
 		return -E2BIG;

 	return audit_match_record(audit_fd, AUDIT_LANDLOCK_DOMAIN, log_match,
 				  domain_id);
 }

 /*
  * Matches a domain deallocation record.  When expected_domain_id is non-zero,
  * the pattern includes the specific domain ID so that stale deallocation
  * records from a previous test (with a different domain ID) are skipped by
  * audit_match_record(), waiting for the asynchronous kworker deallocation with
  * the default patient timeout.
  *
  * When expected_domain_id is zero, the caller is probing for any dealloc record
  * that may or may not arrive.  Temporarily lowers the socket timeout to
  * audit_tv_fast for this probe so it returns promptly when no record is
  * pending; restores audit_tv_default after.
  */
 static int __maybe_unused
 matches_log_domain_deallocated(int audit_fd, unsigned int num_denials,
 			       __u64 expected_domain_id, __u64 *domain_id)
 {
 	static const char log_template[] = REGEX_LANDLOCK_PREFIX
 		" status=deallocated denials=%u$";
 	static const char log_template_with_id[] =
 		"^audit([0-9.:]\\+): domain=\\(%llx\\)"
 		" status=deallocated denials=%u$";
 	char log_match[sizeof(log_template_with_id) + 32];
 	int log_match_len, err;

 	if (expected_domain_id)
 		log_match_len = snprintf(log_match, sizeof(log_match),
 					 log_template_with_id,
 					 (unsigned long long)expected_domain_id,
 					 num_denials);
 	else
 		log_match_len = snprintf(log_match, sizeof(log_match),
 					 log_template, num_denials);

 	if (log_match_len >= sizeof(log_match))
 		return -E2BIG;

 	if (!expected_domain_id) {
 		if (setsockopt(audit_fd, SOL_SOCKET, SO_RCVTIMEO,
 			       &audit_tv_fast, sizeof(audit_tv_fast)))
 			return -errno;
 	}

 	err = audit_match_record(audit_fd, AUDIT_LANDLOCK_DOMAIN, log_match,
 				 domain_id);

 	if (!expected_domain_id) {
 		if (setsockopt(audit_fd, SOL_SOCKET, SO_RCVTIMEO,
 			       &audit_tv_default, sizeof(audit_tv_default)) &&
 		    !err)
 			err = -errno;
 	}

 	return err;
 }

 struct audit_records {
 	size_t access;
 	size_t domain;
 };

 /*
  * Counts remaining audit records by type, skipping domain deallocation records.
  * Deallocation records are emitted asynchronously from kworker threads after a
  * previous test's child has exited, so they can arrive after the drain in
  * audit_init() and after the preceding audit_match_record() call.  Allocation
  * records are emitted synchronously during landlock_log_denial() in the current
  * test's syscall context, so only those are counted in records->domain.
  *
  * Temporarily lowers SO_RCVTIMEO to audit_tv_fast for the read loop: this is a
  * "no record expected" path that should terminate on the first -EAGAIN.  The
  * default patient timeout is restored on exit for subsequent
  * audit_match_record() callers.
  */
 static int audit_count_records(int audit_fd, struct audit_records *records)
 {
 	static const char dealloc_pattern[] = REGEX_LANDLOCK_PREFIX
 		" status=deallocated ";
 	struct audit_message msg;
 	regex_t dealloc_re;
 	int ret, err = 0;

 	ret = regcomp(&dealloc_re, dealloc_pattern, 0);
 	if (ret)
 		return -ENOMEM;

 	records->access = 0;
 	records->domain = 0;

 	if (setsockopt(audit_fd, SOL_SOCKET, SO_RCVTIMEO, &audit_tv_fast,
 		       sizeof(audit_tv_fast))) {
 		err = -errno;
 		goto out;
 	}

 	do {
 		memset(&msg, 0, sizeof(msg));
 		err = audit_recv(audit_fd, &msg);
 		if (err) {
 			if (err == -EAGAIN)
 				err = 0;
 			break;
 		}

 		switch (msg.header.nlmsg_type) {
 		case AUDIT_LANDLOCK_ACCESS:
 			records->access++;
 			break;
 		case AUDIT_LANDLOCK_DOMAIN:
 			ret = regexec(&dealloc_re, msg.data, 0, NULL, 0);
 			if (ret == REG_NOMATCH) {
 				records->domain++;
 			} else if (ret != 0) {
 				err = -EIO;
 				goto out;
 			}
 			break;
 		}
 	} while (true);

 out:
 	if (setsockopt(audit_fd, SOL_SOCKET, SO_RCVTIMEO, &audit_tv_default,
 		       sizeof(audit_tv_default)) &&
 	    !err)
 		err = -errno;
 	regfree(&dealloc_re);
 	return err;
 }

 static int audit_init(void)
 {
 	int fd, err;

 	fd = socket(PF_NETLINK, SOCK_RAW, NETLINK_AUDIT);
 	if (fd < 0)
 		return -errno;

 	err = audit_set_status(fd, AUDIT_STATUS_ENABLED, 1);
 	if (err)
 		goto err_close;

 	err = audit_set_status(fd, AUDIT_STATUS_PID, getpid());
 	if (err)
 		goto err_close;

 	/* Uses the fast timeout to drain stale records below. */
 	err = setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &audit_tv_fast,
 			 sizeof(audit_tv_fast));
 	if (err) {
 		err = -errno;
 		goto err_close;
 	}

 	/*
 	 * Drains stale audit records that accumulated in the kernel backlog
 	 * while no audit daemon socket was open.  This happens when non-audit
 	 * Landlock tests generate records while audit_enabled is non-zero (e.g.
 	 * from boot configuration), or when domain deallocation records arrive
 	 * asynchronously after a previous test's socket was closed.
 	 */
 	while (audit_recv(fd, NULL) == 0)
 		;

 	/*
 	 * Restores the default timeout for audit_match_record() callers that
 	 * expect a record to arrive.  Paths that expect no record restore the
 	 * fast timeout locally (audit_count_records(), the expected_domain_id
 	 * == 0 probe in matches_log_domain_deallocated()).
 	 */
 	err = setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &audit_tv_default,
 			 sizeof(audit_tv_default));
 	if (err) {
 		err = -errno;
 		goto err_close;
 	}

 	return fd;

 err_close:
 	close(fd);
 	return err;
 }

 static int audit_init_filter_exe(struct audit_filter *filter, const char *path)
 {
 	char *absolute_path = NULL;

 	/* It is assume that there is not already filtering rules. */
 	filter->record_type = AUDIT_EXE;
 	if (!path) {
 		int ret = readlink("/proc/self/exe", filter->exe,
 				   sizeof(filter->exe) - 1);
 		if (ret < 0)
 			return -errno;

 		filter->exe_len = ret;
 		return 0;
 	}

 	absolute_path = realpath(path, NULL);
 	if (!absolute_path)
 		return -errno;

 	/* No need for the terminating NULL byte. */
 	filter->exe_len = strlen(absolute_path);
 	if (filter->exe_len > sizeof(filter->exe))
 		return -E2BIG;

 	memcpy(filter->exe, absolute_path, filter->exe_len);
 	free(absolute_path);
 	return 0;
 }

 static int audit_cleanup(int audit_fd, struct audit_filter *filter)
 {
 	struct audit_filter new_filter;
 	int err = 0;

 	if (audit_fd < 0 || !filter) {
 		/*
 		 * Simulates audit_init_with_exe_filter() when called from
 		 * FIXTURE_TEARDOWN_PARENT().
 		 */
 		audit_fd = audit_init();
 		if (audit_fd < 0)
 			return audit_fd;

 		filter = &new_filter;
 		err = audit_init_filter_exe(filter, NULL);
 		if (err)
 			goto err_close;
 	}

 	/* Filters might not be in place. */
 	audit_filter_exe(audit_fd, filter, AUDIT_DEL_RULE);
 	audit_filter_drop(audit_fd, AUDIT_DEL_RULE);

 	err = audit_set_status(audit_fd, AUDIT_STATUS_ENABLED, 0);

 err_close:
 	close(audit_fd);
 	return err;
 }

 static int audit_init_with_exe_filter(struct audit_filter *filter)
 {
 	int fd, err;

 	fd = audit_init();
 	if (fd < 0)
 		return fd;

 	err = audit_init_filter_exe(filter, NULL);
 	if (err)
 		goto err_close;

 	err = audit_filter_exe(fd, filter, AUDIT_ADD_RULE);
 	if (err)
 		goto err_close;

 	return fd;

 err_close:
 	close(fd);
 	return err;
 }
	/* SPDX-License-Identifier: GPL-2.0 */
	/*
	* Landlock audit helpers
	*
	* Copyright © 2024-2025 Microsoft Corporation
	*/

	#define _GNU_SOURCE
	#include <errno.h>
	#include <linux/audit.h>
	#include <linux/limits.h>
	#include <linux/netlink.h>
	#include <regex.h>
	#include <stdbool.h>
	#include <stdint.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <sys/socket.h>
	#include <sys/time.h>
	#include <unistd.h>

	#include "kselftest.h"

	#ifndef ARRAY_SIZE
	#define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]))
	#endif

	#define REGEX_LANDLOCK_PREFIX "^audit([0-9.:]\\+): domain=\\([0-9a-f]\\+\\)"

	struct audit_filter {
	__u32 record_type;
	size_t exe_len;
	char exe[PATH_MAX];
	};

	struct audit_message {
	struct nlmsghdr header;
	union {
	struct audit_status status;
	struct audit_features features;
	struct audit_rule_data rule;
	struct nlmsgerr err;
	char data[PATH_MAX + 200];
	};
	};

	static const struct timeval audit_tv_default = {
	/*
	* Default socket timeout for audit_match_record() callers that expect a
	* record to arrive. Asynchronous kauditd delivery can exceed 1 usec
	* under heavy debug configs (KASAN, lockdep), where kauditd_thread
	* scheduling between audit_log_end() and netlink_unicast() takes longer
	* than the previous 1 usec timeout. 1 second is a generous ceiling: on
	* the happy path, kauditd delivers within dozens of usec.
	*/
	.tv_sec = 1,
	};

	static const struct timeval audit_tv_fast = {
	/*
	* Fast timeout for paths that expect no record (audit_init() drain,
	* audit_count_records(), probes). Causes audit_recv() to return
	* -EAGAIN once the socket buffer is empty, naturally terminating the
	* read loop.
	*/
	.tv_usec = 1,
	};

	static int audit_send(const int fd, const struct audit_message *const msg)
	{
	struct sockaddr_nl addr = {
	.nl_family = AF_NETLINK,
	};
	int ret;

	do {
	ret = sendto(fd, msg, msg->header.nlmsg_len, 0,
	(struct sockaddr *)&addr, sizeof(addr));
	} while (ret < 0 && errno == EINTR);

	if (ret < 0)
	return -errno;

	if (ret != msg->header.nlmsg_len)
	return -E2BIG;

	return 0;
	}

	static int audit_recv(const int fd, struct audit_message *msg)
	{
	struct sockaddr_nl addr;
	socklen_t addrlen = sizeof(addr);
	struct audit_message msg_tmp;
	int err;

	if (!msg)
	msg = &msg_tmp;

	do {
	err = recvfrom(fd, msg, sizeof(*msg), 0,
	(struct sockaddr *)&addr, &addrlen);
	} while (err < 0 && errno == EINTR);

	if (err < 0)
	return -errno;

	if (addrlen != sizeof(addr) \|\| addr.nl_pid != 0)
	return -EINVAL;

	/* Checks Netlink error or end of messages. */
	if (msg->header.nlmsg_type == NLMSG_ERROR)
	return msg->err.error;

	return 0;
	}

	static int audit_request(const int fd,
	const struct audit_message *const request,
	struct audit_message *reply)
	{
	struct audit_message msg_tmp;
	bool first_reply = true;
	int err;

	err = audit_send(fd, request);
	if (err)
	return err;

	if (!reply)
	reply = &msg_tmp;

	do {
	if (first_reply)
	first_reply = false;
	else
	reply = &msg_tmp;

	err = audit_recv(fd, reply);
	if (err)
	return err;
	} while (reply->header.nlmsg_type != NLMSG_ERROR &&
	reply->err.msg.nlmsg_type != request->header.nlmsg_type);

	return reply->err.error;
	}

	static int audit_filter_exe(const int audit_fd,
	const struct audit_filter *const filter,
	const __u16 type)
	{
	struct audit_message msg = {
	.header = {
	.nlmsg_len = NLMSG_SPACE(sizeof(msg.rule)) +
	NLMSG_ALIGN(filter->exe_len),
	.nlmsg_type = type,
	.nlmsg_flags = NLM_F_REQUEST \| NLM_F_ACK,
	},
	.rule = {
	.flags = AUDIT_FILTER_EXCLUDE,
	.action = AUDIT_NEVER,
	.field_count = 1,
	.fields[0] = filter->record_type,
	.fieldflags[0] = AUDIT_NOT_EQUAL,
	.values[0] = filter->exe_len,
	.buflen = filter->exe_len,
	}
	};

	if (filter->record_type != AUDIT_EXE)
	return -EINVAL;

	memcpy(msg.rule.buf, filter->exe, filter->exe_len);
	return audit_request(audit_fd, &msg, NULL);
	}

	static int audit_filter_drop(const int audit_fd, const __u16 type)
	{
	struct audit_message msg = {
	.header = {
	.nlmsg_len = NLMSG_SPACE(sizeof(msg.rule)),
	.nlmsg_type = type,
	.nlmsg_flags = NLM_F_REQUEST \| NLM_F_ACK,
	},
	.rule = {
	.flags = AUDIT_FILTER_EXCLUDE,
	.action = AUDIT_NEVER,
	.field_count = 1,
	.fields[0] = AUDIT_MSGTYPE,
	.fieldflags[0] = AUDIT_NOT_EQUAL,
	.values[0] = AUDIT_LANDLOCK_DOMAIN,
	}
	};

	return audit_request(audit_fd, &msg, NULL);
	}

	static int audit_set_status(int fd, __u32 key, __u32 val)
	{
	const struct audit_message msg = {
	.header = {
	.nlmsg_len = NLMSG_SPACE(sizeof(msg.status)),
	.nlmsg_type = AUDIT_SET,
	.nlmsg_flags = NLM_F_REQUEST \| NLM_F_ACK,
	},
	.status = {
	.mask = key,
	.enabled = key == AUDIT_STATUS_ENABLED ? val : 0,
	.pid = key == AUDIT_STATUS_PID ? val : 0,
	}
	};

	return audit_request(fd, &msg, NULL);
	}

	/*
	* @domain_id: The domain ID extracted from the audit message (if the first part
	* of @pattern is REGEX_LANDLOCK_PREFIX). It is set to 0 if the domain ID is
	* not found.
	*/
	static int audit_match_record(int audit_fd, const __u16 type,
	const char const pattern, __u64 domain_id)
	{
	struct audit_message msg, last_mismatch = {};
	int ret, err = 0;
	int num_type_match = 0;
	regmatch_t matches[2];
	regex_t regex;

	ret = regcomp(&regex, pattern, 0);
	if (ret)
	return -EINVAL;

	/*
	* Reads records until one matches both the expected type and the
	* pattern. Type-matching records with non-matching content are
	* silently consumed, which handles stale domain deallocation records
	* from a previous test emitted asynchronously by kworker threads.
	*/
	while (true) {
	memset(&msg, 0, sizeof(msg));
	err = audit_recv(audit_fd, &msg);
	if (err) {
	if (num_type_match) {
	printf("DATA: %s\n", last_mismatch.data);
	printf("ERROR: %d record(s) matched type %u"
	" but not pattern: %s\n",
	num_type_match, type, pattern);
	}
	goto out;
	}

	if (type && msg.header.nlmsg_type != type)
	continue;

	ret = regexec(&regex, msg.data, ARRAY_SIZE(matches), matches,
	0);
	if (!ret)
	break;

	num_type_match++;
	last_mismatch = msg;
	}

	if (domain_id) {
	*domain_id = 0;
	if (matches[1].rm_so != -1) {
	int match_len = matches[1].rm_eo - matches[1].rm_so;
	/* The maximal characters of a 2^64 hexadecimal number is 17. */
	char dom_id[18];

	if (match_len > 0 && match_len < sizeof(dom_id)) {
	memcpy(dom_id, msg.data + matches[1].rm_so,
	match_len);
	dom_id[match_len] = '\0';
	if (domain_id)
	*domain_id = strtoull(dom_id, NULL, 16);
	}
	}
	}

	out:
	regfree(&regex);
	return err;
	}

	static int __maybe_unused matches_log_domain_allocated(int audit_fd, pid_t pid,
	__u64 *domain_id)
	{
	static const char log_template[] = REGEX_LANDLOCK_PREFIX
	" status=allocated mode=enforcing pid=%d uid=[0-9]\\+"
	" exe=\"[^\"]\\+\" comm=\".*_test\"$";
	char log_match[sizeof(log_template) + 10];
	int log_match_len;

	log_match_len =
	snprintf(log_match, sizeof(log_match), log_template, pid);
	if (log_match_len >= sizeof(log_match))
	return -E2BIG;

	return audit_match_record(audit_fd, AUDIT_LANDLOCK_DOMAIN, log_match,
	domain_id);
	}

	/*
	* Matches a domain deallocation record. When expected_domain_id is non-zero,
	* the pattern includes the specific domain ID so that stale deallocation
	* records from a previous test (with a different domain ID) are skipped by
	* audit_match_record(), waiting for the asynchronous kworker deallocation with
	* the default patient timeout.
	*
	* When expected_domain_id is zero, the caller is probing for any dealloc record
	* that may or may not arrive. Temporarily lowers the socket timeout to
	* audit_tv_fast for this probe so it returns promptly when no record is
	* pending; restores audit_tv_default after.
	*/
	static int __maybe_unused
	matches_log_domain_deallocated(int audit_fd, unsigned int num_denials,
	__u64 expected_domain_id, __u64 *domain_id)
	{
	static const char log_template[] = REGEX_LANDLOCK_PREFIX
	" status=deallocated denials=%u$";
	static const char log_template_with_id[] =
	"^audit([0-9.:]\\+): domain=\\(%llx\\)"
	" status=deallocated denials=%u$";
	char log_match[sizeof(log_template_with_id) + 32];
	int log_match_len, err;

	if (expected_domain_id)
	log_match_len = snprintf(log_match, sizeof(log_match),
	log_template_with_id,
	(unsigned long long)expected_domain_id,
	num_denials);
	else
	log_match_len = snprintf(log_match, sizeof(log_match),
	log_template, num_denials);

	if (log_match_len >= sizeof(log_match))
	return -E2BIG;

	if (!expected_domain_id) {
	if (setsockopt(audit_fd, SOL_SOCKET, SO_RCVTIMEO,
	&audit_tv_fast, sizeof(audit_tv_fast)))
	return -errno;
	}

	err = audit_match_record(audit_fd, AUDIT_LANDLOCK_DOMAIN, log_match,
	domain_id);

	if (!expected_domain_id) {
	if (setsockopt(audit_fd, SOL_SOCKET, SO_RCVTIMEO,
	&audit_tv_default, sizeof(audit_tv_default)) &&
	!err)
	err = -errno;
	}

	return err;
	}

	struct audit_records {
	size_t access;
	size_t domain;
	};

	/*
	* Counts remaining audit records by type, skipping domain deallocation records.
	* Deallocation records are emitted asynchronously from kworker threads after a
	* previous test's child has exited, so they can arrive after the drain in
	* audit_init() and after the preceding audit_match_record() call. Allocation
	* records are emitted synchronously during landlock_log_denial() in the current
	* test's syscall context, so only those are counted in records->domain.
	*
	* Temporarily lowers SO_RCVTIMEO to audit_tv_fast for the read loop: this is a
	* "no record expected" path that should terminate on the first -EAGAIN. The
	* default patient timeout is restored on exit for subsequent
	* audit_match_record() callers.
	*/
	static int audit_count_records(int audit_fd, struct audit_records *records)
	{
	static const char dealloc_pattern[] = REGEX_LANDLOCK_PREFIX
	" status=deallocated ";
	struct audit_message msg;
	regex_t dealloc_re;
	int ret, err = 0;

	ret = regcomp(&dealloc_re, dealloc_pattern, 0);
	if (ret)
	return -ENOMEM;

	records->access = 0;
	records->domain = 0;

	if (setsockopt(audit_fd, SOL_SOCKET, SO_RCVTIMEO, &audit_tv_fast,
	sizeof(audit_tv_fast))) {
	err = -errno;
	goto out;
	}

	do {
	memset(&msg, 0, sizeof(msg));
	err = audit_recv(audit_fd, &msg);
	if (err) {
	if (err == -EAGAIN)
	err = 0;
	break;
	}

	switch (msg.header.nlmsg_type) {
	case AUDIT_LANDLOCK_ACCESS:
	records->access++;
	break;
	case AUDIT_LANDLOCK_DOMAIN:
	ret = regexec(&dealloc_re, msg.data, 0, NULL, 0);
	if (ret == REG_NOMATCH) {
	records->domain++;
	} else if (ret != 0) {
	err = -EIO;
	goto out;
	}
	break;
	}
	} while (true);

	out:
	if (setsockopt(audit_fd, SOL_SOCKET, SO_RCVTIMEO, &audit_tv_default,
	sizeof(audit_tv_default)) &&
	!err)
	err = -errno;
	regfree(&dealloc_re);
	return err;
	}

	static int audit_init(void)
	{
	int fd, err;

	fd = socket(PF_NETLINK, SOCK_RAW, NETLINK_AUDIT);
	if (fd < 0)
	return -errno;

	err = audit_set_status(fd, AUDIT_STATUS_ENABLED, 1);
	if (err)
	goto err_close;

	err = audit_set_status(fd, AUDIT_STATUS_PID, getpid());
	if (err)
	goto err_close;

	/* Uses the fast timeout to drain stale records below. */
	err = setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &audit_tv_fast,
	sizeof(audit_tv_fast));
	if (err) {
	err = -errno;
	goto err_close;
	}

	/*
	* Drains stale audit records that accumulated in the kernel backlog
	* while no audit daemon socket was open. This happens when non-audit
	* Landlock tests generate records while audit_enabled is non-zero (e.g.
	* from boot configuration), or when domain deallocation records arrive
	* asynchronously after a previous test's socket was closed.
	*/
	while (audit_recv(fd, NULL) == 0)
	;

	/*
	* Restores the default timeout for audit_match_record() callers that
	* expect a record to arrive. Paths that expect no record restore the
	* fast timeout locally (audit_count_records(), the expected_domain_id
	* == 0 probe in matches_log_domain_deallocated()).
	*/
	err = setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &audit_tv_default,
	sizeof(audit_tv_default));
	if (err) {
	err = -errno;
	goto err_close;
	}

	return fd;

	err_close:
	close(fd);
	return err;
	}

	static int audit_init_filter_exe(struct audit_filter filter, const char path)
	{
	char *absolute_path = NULL;

	/* It is assume that there is not already filtering rules. */
	filter->record_type = AUDIT_EXE;
	if (!path) {
	int ret = readlink("/proc/self/exe", filter->exe,
	sizeof(filter->exe) - 1);
	if (ret < 0)
	return -errno;

	filter->exe_len = ret;
	return 0;
	}

	absolute_path = realpath(path, NULL);
	if (!absolute_path)
	return -errno;

	/* No need for the terminating NULL byte. */
	filter->exe_len = strlen(absolute_path);
	if (filter->exe_len > sizeof(filter->exe))
	return -E2BIG;

	memcpy(filter->exe, absolute_path, filter->exe_len);
	free(absolute_path);
	return 0;
	}

	static int audit_cleanup(int audit_fd, struct audit_filter *filter)
	{
	struct audit_filter new_filter;
	int err = 0;

	if (audit_fd < 0 \|\| !filter) {
	/*
	* Simulates audit_init_with_exe_filter() when called from
	* FIXTURE_TEARDOWN_PARENT().
	*/
	audit_fd = audit_init();
	if (audit_fd < 0)
	return audit_fd;

	filter = &new_filter;
	err = audit_init_filter_exe(filter, NULL);
	if (err)
	goto err_close;
	}

	/* Filters might not be in place. */
	audit_filter_exe(audit_fd, filter, AUDIT_DEL_RULE);
	audit_filter_drop(audit_fd, AUDIT_DEL_RULE);

	err = audit_set_status(audit_fd, AUDIT_STATUS_ENABLED, 0);

	err_close:
	close(audit_fd);
	return err;
	}

	static int audit_init_with_exe_filter(struct audit_filter *filter)
	{
	int fd, err;

	fd = audit_init();
	if (fd < 0)
	return fd;

	err = audit_init_filter_exe(filter, NULL);
	if (err)
	goto err_close;

	err = audit_filter_exe(fd, filter, AUDIT_ADD_RULE);
	if (err)
	goto err_close;

	return fd;

	err_close:
	close(fd);
	return err;
	}