/*
* Ensure that fcntl() works consistently for both regular file descriptors and
* capability-wrapped ones.
*/
int
test_fcntl(void)
{
int success = PASSED;
cap_rights_t rights = CAP_READ | CAP_FCNTL;
/*
* Open some files of different types, and wrap them in capabilities.
*/
struct fd files[] = {
{ "file", open("/etc/passwd", O_RDONLY) },
{ "socket", socket(PF_LOCAL, SOCK_STREAM, 0) },
{ "SHM", shm_open(SHM_ANON, O_RDWR, 0600) },
};
REQUIRE(files[0].f_fd);
REQUIRE(files[1].f_fd);
REQUIRE(files[2].f_fd);
struct fd caps[] = {
{ "file cap", cap_new(files[0].f_fd, rights) },
{ "socket cap", cap_new(files[1].f_fd, rights) },
{ "SHM cap", cap_new(files[2].f_fd, rights) },
};
REQUIRE(caps[0].f_fd);
REQUIRE(caps[1].f_fd);
REQUIRE(caps[2].f_fd);
struct fd all[] = {
files[0], caps[0],
files[1], caps[1],
files[2], caps[2],
};
const size_t len = sizeof(all) / sizeof(struct fd);
REQUIRE(cap_enter());
/*
* Ensure that we can fcntl() all the files that we opened above.
*/
for (size_t i = 0; i < len; i++)
{
struct fd f = all[i];
int cap;
CHECK_SYSCALL_SUCCEEDS(fcntl, f.f_fd, F_GETFL, 0);
REQUIRE(cap = cap_new(f.f_fd, CAP_READ));
if (fcntl(f.f_fd, F_GETFL, 0) == -1)
FAIL("Error calling fcntl('%s', F_GETFL)", f.f_name);
else
CHECK_NOTCAPABLE(fcntl, cap, F_GETFL, 0);
}
return (success);
}
static int lc_limitfd(int fd, cap_rights_t rights)
{
int fd_cap;
int error;
fd_cap = cap_new(fd, rights);
if (fd_cap < 0)
return -1;
if (dup2(fd_cap, fd) < 0) {
error = errno;
close(fd_cap);
errno = error;
return -1;
}
close(fd_cap);
return 0;
}
/*
* Given a file descriptor, create a capability with specific rights and
* make sure only those rights work.
*/
static int
try_file_ops(int filefd, int dirfd, cap_rights_t rights)
{
struct stat sb;
struct statfs sf;
cap_rights_t erights;
int fd_cap, fd_capcap, dfd_cap;
ssize_t ssize, ssize2;
off_t off;
void *p;
char ch;
int ret, is_nfs;
struct pollfd pollfd;
int success = -1;
REQUIRE(fstatfs(filefd, &sf));
is_nfs = (strcmp("nfs", sf.f_fstypename) == 0);
REQUIRE(fd_cap = cap_new(filefd, rights));
CHECK(cap_getrights(fd_cap, &erights) == 0);
CHECK(rights == erights);
REQUIRE(fd_capcap = cap_new(fd_cap, rights));
CHECK(cap_getrights(fd_capcap, &erights) == 0);
CHECK(rights == erights);
CHECK(fd_capcap != fd_cap);
REQUIRE(dfd_cap = cap_new(dirfd, rights));
CHECK(cap_getrights(dfd_cap, &erights) == 0);
CHECK(rights == erights);
ssize = read(fd_cap, &ch, sizeof(ch));
CHECK_RESULT(read, CAP_READ, ssize >= 0);
ssize = write(fd_cap, &ch, sizeof(ch));
CHECK_RESULT(write, CAP_WRITE, ssize >= 0);
off = lseek(fd_cap, 0, SEEK_SET);
CHECK_RESULT(lseek, CAP_SEEK, off >= 0);
ssize = pread(fd_cap, &ch, sizeof(ch), 0);
ssize2 = pread(fd_cap, &ch, sizeof(ch), 0);
CHECK_RESULT(pread, CAP_PREAD, ssize >= 0);
CHECK(ssize == ssize2);
ssize = pwrite(fd_cap, &ch, sizeof(ch), 0);
CHECK_RESULT(pwrite, CAP_PWRITE, ssize >= 0);
p = mmap(NULL, getpagesize(), PROT_NONE, MAP_SHARED, fd_cap, 0);
CHECK_MMAP_RESULT(CAP_MMAP);
p = mmap(NULL, getpagesize(), PROT_READ, MAP_SHARED, fd_cap, 0);
CHECK_MMAP_RESULT(CAP_MMAP_R);
p = mmap(NULL, getpagesize(), PROT_WRITE, MAP_SHARED, fd_cap, 0);
CHECK_MMAP_RESULT(CAP_MMAP_W);
p = mmap(NULL, getpagesize(), PROT_EXEC, MAP_SHARED, fd_cap, 0);
CHECK_MMAP_RESULT(CAP_MMAP_X);
p = mmap(NULL, getpagesize(), PROT_READ | PROT_WRITE, MAP_SHARED,
fd_cap, 0);
CHECK_MMAP_RESULT(CAP_MMAP_RW);
p = mmap(NULL, getpagesize(), PROT_READ | PROT_EXEC, MAP_SHARED,
fd_cap, 0);
CHECK_MMAP_RESULT(CAP_MMAP_RX);
p = mmap(NULL, getpagesize(), PROT_EXEC | PROT_WRITE, MAP_SHARED,
fd_cap, 0);
CHECK_MMAP_RESULT(CAP_MMAP_WX);
p = mmap(NULL, getpagesize(), PROT_READ | PROT_WRITE | PROT_EXEC,
MAP_SHARED, fd_cap, 0);
CHECK_MMAP_RESULT(CAP_MMAP_RWX);
ret = openat(dfd_cap, "cap_create", O_CREAT | O_RDONLY, 0600);
CHECK_RESULT(openat(O_CREATE | O_RDONLY),
CAP_CREATE | CAP_READ | CAP_LOOKUP, ret >= 0);
CHECK(ret == -1 || close(ret) == 0);
CHECK(ret == -1 || unlinkat(dirfd, "cap_create", 0) == 0);
ret = openat(dfd_cap, "cap_create", O_CREAT | O_WRONLY | O_APPEND,
0600);
CHECK_RESULT(openat(O_CREATE | O_WRONLY | O_APPEND),
CAP_CREATE | CAP_WRITE | CAP_LOOKUP, ret >= 0);
CHECK(ret == -1 || close(ret) == 0);
CHECK(ret == -1 || unlinkat(dirfd, "cap_create", 0) == 0);
ret = openat(dfd_cap, "cap_create", O_CREAT | O_RDWR | O_APPEND, 0600);
CHECK_RESULT(openat(O_CREATE | O_RDWR | O_APPEND),
CAP_CREATE | CAP_READ | CAP_WRITE | CAP_LOOKUP, ret >= 0);
CHECK(ret == -1 || close(ret) == 0);
CHECK(ret == -1 || unlinkat(dirfd, "cap_create", 0) == 0);
ret = fsync(fd_cap);
CHECK_RESULT(fsync, CAP_FSYNC, ret == 0);
ret = openat(dirfd, "cap_fsync", O_CREAT, 0600);
CHECK(ret >= 0);
CHECK(close(ret) == 0);
ret = openat(dfd_cap, "cap_fsync", O_FSYNC | O_RDONLY);
CHECK_RESULT(openat(O_FSYNC | O_RDONLY),
CAP_FSYNC | CAP_READ | CAP_LOOKUP, ret >= 0);
CHECK(ret == -1 || close(ret) == 0);
ret = openat(dfd_cap, "cap_fsync", O_FSYNC | O_WRONLY | O_APPEND);
CHECK_RESULT(openat(O_FSYNC | O_WRONLY | O_APPEND),
CAP_FSYNC | CAP_WRITE | CAP_LOOKUP, ret >= 0);
CHECK(ret == -1 || close(ret) == 0);
ret = openat(dfd_cap, "cap_fsync", O_FSYNC | O_RDWR | O_APPEND);
CHECK_RESULT(openat(O_FSYNC | O_RDWR | O_APPEND),
CAP_FSYNC | CAP_READ | CAP_WRITE | CAP_LOOKUP, ret >= 0);
CHECK(ret == -1 || close(ret) == 0);
ret = openat(dfd_cap, "cap_fsync", O_SYNC | O_RDONLY);
CHECK_RESULT(openat(O_SYNC | O_RDONLY),
CAP_FSYNC | CAP_READ | CAP_LOOKUP, ret >= 0);
CHECK(ret == -1 || close(ret) == 0);
ret = openat(dfd_cap, "cap_fsync", O_SYNC | O_WRONLY | O_APPEND);
CHECK_RESULT(openat(O_SYNC | O_WRONLY | O_APPEND),
CAP_FSYNC | CAP_WRITE | CAP_LOOKUP, ret >= 0);
CHECK(ret == -1 || close(ret) == 0);
ret = openat(dfd_cap, "cap_fsync", O_SYNC | O_RDWR | O_APPEND);
CHECK_RESULT(openat(O_SYNC | O_RDWR | O_APPEND),
CAP_FSYNC | CAP_READ | CAP_WRITE | CAP_LOOKUP, ret >= 0);
CHECK(ret == -1 || close(ret) == 0);
CHECK(unlinkat(dirfd, "cap_fsync", 0) == 0);
ret = ftruncate(fd_cap, 0);
CHECK_RESULT(ftruncate, CAP_FTRUNCATE, ret == 0);
ret = openat(dirfd, "cap_ftruncate", O_CREAT, 0600);
CHECK(ret >= 0);
CHECK(close(ret) == 0);
ret = openat(dfd_cap, "cap_ftruncate", O_TRUNC | O_RDONLY);
CHECK_RESULT(openat(O_TRUNC | O_RDONLY),
CAP_FTRUNCATE | CAP_READ | CAP_LOOKUP, ret >= 0);
CHECK(ret == -1 || close(ret) == 0);
ret = openat(dfd_cap, "cap_ftruncate", O_TRUNC | O_WRONLY);
CHECK_RESULT(openat(O_TRUNC | O_WRONLY),
CAP_FTRUNCATE | CAP_WRITE | CAP_LOOKUP, ret >= 0);
CHECK(ret == -1 || close(ret) == 0);
ret = openat(dfd_cap, "cap_ftruncate", O_TRUNC | O_RDWR);
CHECK_RESULT(openat(O_TRUNC | O_RDWR),
CAP_FTRUNCATE | CAP_READ | CAP_WRITE | CAP_LOOKUP, ret >= 0);
CHECK(ret == -1 || close(ret) == 0);
CHECK(unlinkat(dirfd, "cap_ftruncate", 0) == 0);
ret = openat(dfd_cap, "cap_create", O_CREAT | O_WRONLY, 0600);
CHECK_RESULT(openat(O_CREATE | O_WRONLY),
CAP_CREATE | CAP_WRITE | CAP_SEEK | CAP_LOOKUP, ret >= 0);
CHECK(ret == -1 || close(ret) == 0);
CHECK(ret == -1 || unlinkat(dirfd, "cap_create", 0) == 0);
ret = openat(dfd_cap, "cap_create", O_CREAT | O_RDWR, 0600);
CHECK_RESULT(openat(O_CREATE | O_RDWR),
CAP_CREATE | CAP_READ | CAP_WRITE | CAP_SEEK | CAP_LOOKUP,
ret >= 0);
CHECK(ret == -1 || close(ret) == 0);
CHECK(ret == -1 || unlinkat(dirfd, "cap_create", 0) == 0);
ret = openat(dirfd, "cap_fsync", O_CREAT, 0600);
CHECK(ret >= 0);
CHECK(close(ret) == 0);
ret = openat(dfd_cap, "cap_fsync", O_FSYNC | O_WRONLY);
CHECK_RESULT(openat(O_FSYNC | O_WRONLY),
CAP_FSYNC | CAP_WRITE | CAP_SEEK | CAP_LOOKUP, ret >= 0);
CHECK(ret == -1 || close(ret) == 0);
ret = openat(dfd_cap, "cap_fsync", O_FSYNC | O_RDWR);
CHECK_RESULT(openat(O_FSYNC | O_RDWR),
CAP_FSYNC | CAP_READ | CAP_WRITE | CAP_SEEK | CAP_LOOKUP, ret >= 0);
CHECK(ret == -1 || close(ret) == 0);
ret = openat(dfd_cap, "cap_fsync", O_SYNC | O_WRONLY);
CHECK_RESULT(openat(O_SYNC | O_WRONLY),
CAP_FSYNC | CAP_WRITE | CAP_SEEK | CAP_LOOKUP, ret >= 0);
CHECK(ret == -1 || close(ret) == 0);
ret = openat(dfd_cap, "cap_fsync", O_SYNC | O_RDWR);
CHECK_RESULT(openat(O_SYNC | O_RDWR),
CAP_FSYNC | CAP_READ | CAP_WRITE | CAP_SEEK | CAP_LOOKUP, ret >= 0);
CHECK(ret == -1 || close(ret) == 0);
CHECK(unlinkat(dirfd, "cap_fsync", 0) == 0);
/*
* Note: this is not expected to work over NFS.
*/
ret = fchflags(fd_cap, UF_NODUMP);
CHECK_RESULT(fchflags, CAP_FCHFLAGS,
ret == 0 || (is_nfs && errno == EOPNOTSUPP));
ret = openat(dirfd, "cap_chflagsat", O_CREAT, 0600);
CHECK(ret >= 0);
CHECK(close(ret) == 0);
ret = chflagsat(dfd_cap, "cap_chflagsat", UF_NODUMP, 0);
CHECK_RESULT(chflagsat, CAP_CHFLAGSAT | CAP_LOOKUP, ret == 0);
CHECK(unlinkat(dirfd, "cap_chflagsat", 0) == 0);
ret = fchown(fd_cap, -1, -1);
CHECK_RESULT(fchown, CAP_FCHOWN, ret == 0);
ret = openat(dirfd, "cap_fchownat", O_CREAT, 0600);
CHECK(ret >= 0);
CHECK(close(ret) == 0);
ret = fchownat(dfd_cap, "cap_fchownat", -1, -1, 0);
CHECK_RESULT(fchownat, CAP_FCHOWN | CAP_LOOKUP, ret == 0);
CHECK(unlinkat(dirfd, "cap_fchownat", 0) == 0);
ret = fchmod(fd_cap, 0644);
CHECK_RESULT(fchmod, CAP_FCHMOD, ret == 0);
ret = openat(dirfd, "cap_fchmodat", O_CREAT, 0600);
CHECK(ret >= 0);
CHECK(close(ret) == 0);
ret = fchmodat(dfd_cap, "cap_fchmodat", 0600, 0);
CHECK_RESULT(fchmodat, CAP_FCHMOD | CAP_LOOKUP, ret == 0);
CHECK(unlinkat(dirfd, "cap_fchmodat", 0) == 0);
ret = fcntl(fd_cap, F_GETFL);
CHECK_RESULT(fcntl(F_GETFL), CAP_FCNTL, ret >= 0);
ret = fcntl(fd_cap, F_SETFL, ret);
CHECK_RESULT(fcntl(F_SETFL), CAP_FCNTL, ret == 0);
/* XXX flock */
ret = fstat(fd_cap, &sb);
CHECK_RESULT(fstat, CAP_FSTAT, ret == 0);
ret = openat(dirfd, "cap_fstatat", O_CREAT, 0600);
CHECK(ret >= 0);
CHECK(close(ret) == 0);
ret = fstatat(dfd_cap, "cap_fstatat", &sb, 0);
CHECK_RESULT(fstatat, CAP_FSTAT | CAP_LOOKUP, ret == 0);
CHECK(unlinkat(dirfd, "cap_fstatat", 0) == 0);
ret = fstatfs(fd_cap, &sf);
CHECK_RESULT(fstatfs, CAP_FSTATFS, ret == 0);
ret = fpathconf(fd_cap, _PC_NAME_MAX);
CHECK_RESULT(fpathconf, CAP_FPATHCONF, ret >= 0);
ret = futimes(fd_cap, NULL);
CHECK_RESULT(futimes, CAP_FUTIMES, ret == 0);
ret = openat(dirfd, "cap_futimesat", O_CREAT, 0600);
CHECK(ret >= 0);
CHECK(close(ret) == 0);
ret = futimesat(dfd_cap, "cap_futimesat", NULL);
CHECK_RESULT(futimesat, CAP_FUTIMES | CAP_LOOKUP, ret == 0);
CHECK(unlinkat(dirfd, "cap_futimesat", 0) == 0);
ret = openat(dirfd, "cap_linkat_src", O_CREAT, 0600);
CHECK(ret >= 0);
CHECK(close(ret) == 0);
ret = linkat(dirfd, "cap_linkat_src", dfd_cap, "cap_linkat_dst", 0);
CHECK_RESULT(linkat, CAP_LINKAT | CAP_LOOKUP, ret == 0);
CHECK(unlinkat(dirfd, "cap_linkat_src", 0) == 0);
CHECK(ret == -1 || unlinkat(dirfd, "cap_linkat_dst", 0) == 0);
ret = mkdirat(dfd_cap, "cap_mkdirat", 0700);
CHECK_RESULT(mkdirat, CAP_MKDIRAT | CAP_LOOKUP, ret == 0);
CHECK(ret == -1 || unlinkat(dirfd, "cap_mkdirat", AT_REMOVEDIR) == 0);
ret = mkfifoat(dfd_cap, "cap_mkfifoat", 0600);
CHECK_RESULT(mkfifoat, CAP_MKFIFOAT | CAP_LOOKUP, ret == 0);
CHECK(ret == -1 || unlinkat(dirfd, "cap_mkfifoat", 0) == 0);
ret = mknodat(dfd_cap, "cap_mknodat", S_IFCHR | 0600, 0);
CHECK_RESULT(mknodat, CAP_MKNODAT | CAP_LOOKUP, ret == 0);
CHECK(ret == -1 || unlinkat(dirfd, "cap_mknodat", 0) == 0);
/* TODO: renameat(2) */
ret = symlinkat("test", dfd_cap, "cap_symlinkat");
CHECK_RESULT(symlinkat, CAP_SYMLINKAT | CAP_LOOKUP, ret == 0);
CHECK(ret == -1 || unlinkat(dirfd, "cap_symlinkat", 0) == 0);
ret = openat(dirfd, "cap_unlinkat", O_CREAT, 0600);
CHECK(ret >= 0);
CHECK(close(ret) == 0);
ret = unlinkat(dfd_cap, "cap_unlinkat", 0);
CHECK_RESULT(unlinkat, CAP_UNLINKAT | CAP_LOOKUP, ret == 0);
CHECK(ret == 0 || unlinkat(dirfd, "cap_unlinkat", 0) == 0);
ret = mkdirat(dirfd, "cap_unlinkat", 0700);
CHECK(ret == 0);
ret = unlinkat(dfd_cap, "cap_unlinkat", AT_REMOVEDIR);
CHECK_RESULT(unlinkat, CAP_UNLINKAT | CAP_LOOKUP, ret == 0);
CHECK(ret == 0 || unlinkat(dirfd, "cap_unlinkat", AT_REMOVEDIR) == 0);
pollfd.fd = fd_cap;
pollfd.events = POLLIN | POLLERR | POLLHUP;
pollfd.revents = 0;
ret = poll(&pollfd, 1, 0);
if (rights & CAP_EVENT)
CHECK((pollfd.revents & POLLNVAL) == 0);
else
CHECK((pollfd.revents & POLLNVAL) != 0);
/* XXX: select, kqueue */
close(fd_cap);
close(fd_capcap);
if (success == -1) {
fprintf(stderr, "No tests for rights 0x%jx.\n",
(uintmax_t)rights);
success = FAILED;
}
return (success);
}
/*
* Given a file descriptor, create a capability with specific rights and
* make sure only those rights work.
*/
static int
try_file_ops(int fd, cap_rights_t rights)
{
struct stat sb;
struct statfs sf;
int fd_cap, fd_capcap;
ssize_t ssize, ssize2;
off_t off;
void *p;
char ch;
int ret, is_nfs;
struct pollfd pollfd;
int success = PASSED;
REQUIRE(fstatfs(fd, &sf));
is_nfs = (strncmp("nfs", sf.f_fstypename, sizeof(sf.f_fstypename))
== 0);
REQUIRE(fd_cap = cap_new(fd, rights));
REQUIRE(fd_capcap = cap_new(fd_cap, rights));
CHECK(fd_capcap != fd_cap);
pollfd.fd = fd_cap;
pollfd.events = POLLIN | POLLERR | POLLHUP;
pollfd.revents = 0;
ssize = read(fd_cap, &ch, sizeof(ch));
CHECK_RESULT(read, CAP_READ | CAP_SEEK, ssize >= 0);
ssize = pread(fd_cap, &ch, sizeof(ch), 0);
ssize2 = pread(fd_cap, &ch, sizeof(ch), 0);
CHECK_RESULT(pread, CAP_READ, ssize >= 0);
CHECK(ssize == ssize2);
ssize = write(fd_cap, &ch, sizeof(ch));
CHECK_RESULT(write, CAP_WRITE | CAP_SEEK, ssize >= 0);
ssize = pwrite(fd_cap, &ch, sizeof(ch), 0);
CHECK_RESULT(pwrite, CAP_WRITE, ssize >= 0);
off = lseek(fd_cap, 0, SEEK_SET);
CHECK_RESULT(lseek, CAP_SEEK, off >= 0);
/*
* Note: this is not expected to work over NFS.
*/
ret = fchflags(fd_cap, UF_NODUMP);
CHECK_RESULT(fchflags, CAP_FCHFLAGS,
(ret == 0) || (is_nfs && (errno == EOPNOTSUPP)));
ret = fstat(fd_cap, &sb);
CHECK_RESULT(fstat, CAP_FSTAT, ret == 0);
p = mmap(NULL, getpagesize(), PROT_READ, MAP_SHARED, fd_cap, 0);
CHECK_MMAP_RESULT(CAP_MMAP | CAP_READ);
p = mmap(NULL, getpagesize(), PROT_WRITE, MAP_SHARED, fd_cap, 0);
CHECK_MMAP_RESULT(CAP_MMAP | CAP_WRITE);
p = mmap(NULL, getpagesize(), PROT_EXEC, MAP_SHARED, fd_cap, 0);
CHECK_MMAP_RESULT(CAP_MMAP | CAP_MAPEXEC);
p = mmap(NULL, getpagesize(), PROT_READ | PROT_WRITE, MAP_SHARED,
fd_cap, 0);
CHECK_MMAP_RESULT(CAP_MMAP | CAP_READ | CAP_WRITE);
p = mmap(NULL, getpagesize(), PROT_READ | PROT_EXEC, MAP_SHARED,
fd_cap, 0);
CHECK_MMAP_RESULT(CAP_MMAP | CAP_READ | CAP_MAPEXEC);
p = mmap(NULL, getpagesize(), PROT_EXEC | PROT_WRITE, MAP_SHARED,
fd_cap, 0);
CHECK_MMAP_RESULT(CAP_MMAP | CAP_MAPEXEC | CAP_WRITE);
p = mmap(NULL, getpagesize(), PROT_READ | PROT_WRITE | PROT_EXEC,
MAP_SHARED, fd_cap, 0);
CHECK_MMAP_RESULT(CAP_MMAP | CAP_READ | CAP_WRITE | CAP_MAPEXEC);
ret = fsync(fd_cap);
CHECK_RESULT(fsync, CAP_FSYNC, ret == 0);
ret = fchown(fd_cap, -1, -1);
CHECK_RESULT(fchown, CAP_FCHOWN, ret == 0);
ret = fchmod(fd_cap, 0644);
CHECK_RESULT(fchmod, CAP_FCHMOD, ret == 0);
/* XXX flock */
ret = ftruncate(fd_cap, 0);
CHECK_RESULT(ftruncate, CAP_FTRUNCATE, ret == 0);
ret = fstatfs(fd_cap, &sf);
CHECK_RESULT(fstatfs, CAP_FSTATFS, ret == 0);
ret = fpathconf(fd_cap, _PC_NAME_MAX);
CHECK_RESULT(fpathconf, CAP_FPATHCONF, ret >= 0);
ret = futimes(fd_cap, NULL);
CHECK_RESULT(futimes, CAP_FUTIMES, ret == 0);
ret = poll(&pollfd, 1, 0);
if (rights & CAP_POLL_EVENT)
CHECK((pollfd.revents & POLLNVAL) == 0);
else
CHECK((pollfd.revents & POLLNVAL) != 0);
/* XXX: select, kqueue */
close (fd_cap);
return (success);
}
