/*
* Ensure that fcntl() works consistently for both regular file descriptors and
* capability-wrapped ones.
*/
int
test_fcntl(void)
{
int success = PASSED;
cap_rights_t rights = CAP_READ | CAP_FCNTL;
/*
* Open some files of different types, and wrap them in capabilities.
*/
struct fd files[] = {
{ "file", open("/etc/passwd", O_RDONLY) },
{ "socket", socket(PF_LOCAL, SOCK_STREAM, 0) },
{ "SHM", shm_open(SHM_ANON, O_RDWR, 0600) },
};
REQUIRE(files[0].f_fd);
REQUIRE(files[1].f_fd);
REQUIRE(files[2].f_fd);
struct fd caps[] = {
{ "file cap", cap_new(files[0].f_fd, rights) },
{ "socket cap", cap_new(files[1].f_fd, rights) },
{ "SHM cap", cap_new(files[2].f_fd, rights) },
};
REQUIRE(caps[0].f_fd);
REQUIRE(caps[1].f_fd);
REQUIRE(caps[2].f_fd);
struct fd all[] = {
files[0], caps[0],
files[1], caps[1],
files[2], caps[2],
};
const size_t len = sizeof(all) / sizeof(struct fd);
REQUIRE(cap_enter());
/*
* Ensure that we can fcntl() all the files that we opened above.
*/
for (size_t i = 0; i < len; i++)
{
struct fd f = all[i];
int cap;
CHECK_SYSCALL_SUCCEEDS(fcntl, f.f_fd, F_GETFL, 0);
REQUIRE(cap = cap_new(f.f_fd, CAP_READ));
if (fcntl(f.f_fd, F_GETFL, 0) == -1)
FAIL("Error calling fcntl('%s', F_GETFL)", f.f_name);
else
CHECK_NOTCAPABLE(fcntl, cap, F_GETFL, 0);
}
return (success);
}
int
test_capmode(void)
{
struct statfs statfs;
struct stat sb;
long sysarch_arg = 0;
int fd_close, fd_dir, fd_file, fd_socket, fd2[2];
int success = PASSED;
pid_t pid, wpid;
char ch;
/* Open some files to play with. */
REQUIRE(fd_file = open("/tmp/cap_capmode", O_RDWR|O_CREAT, 0644));
REQUIRE(fd_close = open("/dev/null", O_RDWR));
REQUIRE(fd_dir = open("/tmp", O_RDONLY));
REQUIRE(fd_socket = socket(PF_INET, SOCK_DGRAM, 0));
/* Enter capability mode. */
REQUIRE(cap_enter());
/*
* System calls that are not permitted in capability mode.
*/
CHECK_CAPMODE(access, "/tmp/cap_capmode_access", F_OK);
CHECK_CAPMODE(acct, "/tmp/cap_capmode_acct");
CHECK_CAPMODE(bind, PF_INET, NULL, 0);
CHECK_CAPMODE(chdir, "/tmp/cap_capmode_chdir");
CHECK_CAPMODE(chflags, "/tmp/cap_capmode_chflags", UF_NODUMP);
CHECK_CAPMODE(chmod, "/tmp/cap_capmode_chmod", 0644);
CHECK_CAPMODE(chown, "/tmp/cap_capmode_chown", -1, -1);
CHECK_CAPMODE(chroot, "/tmp/cap_capmode_chroot");
CHECK_CAPMODE(connect, PF_INET, NULL, 0);
CHECK_CAPMODE(creat, "/tmp/cap_capmode_creat", 0644);
CHECK_CAPMODE(fchdir, fd_dir);
CHECK_CAPMODE(getfsstat, &statfs, sizeof(statfs), MNT_NOWAIT);
CHECK_CAPMODE(link, "/tmp/foo", "/tmp/bar");
CHECK_CAPMODE(lstat, "/tmp/cap_capmode_lstat", &sb);
CHECK_CAPMODE(mknod, "/tmp/capmode_mknod", 06440, 0);
CHECK_CAPMODE(mount, "procfs", "/not_mounted", 0, NULL);
CHECK_CAPMODE(open, "/dev/null", O_RDWR);
CHECK_CAPMODE(readlink, "/tmp/cap_capmode_readlink", NULL, 0);
CHECK_CAPMODE(revoke, "/tmp/cap_capmode_revoke");
CHECK_CAPMODE(stat, "/tmp/cap_capmode_stat", &sb);
CHECK_CAPMODE(symlink,
"/tmp/cap_capmode_symlink_from",
"/tmp/cap_capmode_symlink_to");
CHECK_CAPMODE(unlink, "/tmp/cap_capmode_unlink");
CHECK_CAPMODE(unmount, "/not_mounted", 0);
/*
* System calls that are permitted in capability mode.
*/
CHECK_SYSCALL_SUCCEEDS(close, fd_close);
CHECK_SYSCALL_SUCCEEDS(dup, fd_file);
CHECK_SYSCALL_SUCCEEDS(fstat, fd_file, &sb);
CHECK_SYSCALL_SUCCEEDS(lseek, fd_file, 0, SEEK_SET);
CHECK_SYSCALL_SUCCEEDS(msync, &fd_file, 8192, MS_ASYNC);
CHECK_SYSCALL_SUCCEEDS(profil, NULL, 0, 0, 0);
CHECK_SYSCALL_SUCCEEDS(read, fd_file, &ch, sizeof(ch));
CHECK_SYSCALL_SUCCEEDS(recvfrom, fd_socket, NULL, 0, 0, NULL, NULL);
CHECK_SYSCALL_SUCCEEDS(setuid, getuid());
CHECK_SYSCALL_SUCCEEDS(write, fd_file, &ch, sizeof(ch));
/*
* These calls will fail for lack of e.g. a proper name to send to,
* but they are allowed in capability mode, so errno != ECAPMODE.
*/
CHECK_NOT_CAPMODE(accept, fd_socket, NULL, NULL);
CHECK_NOT_CAPMODE(getpeername, fd_socket, NULL, NULL);
CHECK_NOT_CAPMODE(getsockname, fd_socket, NULL, NULL);
CHECK_NOT_CAPMODE(fchflags, fd_file, UF_NODUMP);
CHECK_NOT_CAPMODE(recvmsg, fd_socket, NULL, 0);
CHECK_NOT_CAPMODE(sendmsg, fd_socket, NULL, 0);
CHECK_NOT_CAPMODE(sendto, fd_socket, NULL, 0, 0, NULL, 0);
/*
* System calls which should be allowed in capability mode, but which
* don't return errors, and are thus difficult to check.
*
* We will try anyway, by checking errno.
*/
CHECK_SYSCALL_VOID_NOT_ECAPMODE(getegid);
CHECK_SYSCALL_VOID_NOT_ECAPMODE(geteuid);
CHECK_SYSCALL_VOID_NOT_ECAPMODE(getgid);
CHECK_SYSCALL_VOID_NOT_ECAPMODE(getpid);
CHECK_SYSCALL_VOID_NOT_ECAPMODE(getppid);
CHECK_SYSCALL_VOID_NOT_ECAPMODE(getuid);
/*
* Finally, tests for system calls that don't fit the pattern very well.
*/
pid = fork();
if (pid >= 0) {
if (pid == 0) {
exit(0);
} else if (pid > 0) {
wpid = waitpid(pid, NULL, 0);
if (wpid < 0) {
if (errno != ECAPMODE)
FAIL("capmode:waitpid");
} else
FAIL("capmode:waitpid succeeded");
}
} else
FAIL("capmode:fork");
if (getlogin() == NULL)
FAIL("test_sycalls:getlogin %d", errno);
if (getsockname(fd_socket, NULL, NULL) < 0) {
if (errno == ECAPMODE)
FAIL("capmode:getsockname");
}
/* XXXRW: ktrace */
if (pipe(fd2) == 0) {
close(fd2[0]);
close(fd2[1]);
} else if (errno == ECAPMODE)
FAIL("capmode:pipe");
/* XXXRW: ptrace. */
/* sysarch() is, by definition, architecture-dependent */
#if defined (__amd64__) || defined (__i386__)
CHECK_CAPMODE(sysarch, I386_SET_IOPERM, &sysarch_arg);
#else
/* XXXJA: write a test for arm */
FAIL("capmode:no sysarch() test for current architecture");
#endif
/* XXXRW: No error return from sync(2) to test. */
return (success);
}
