int main (void) { #if HAVE_GETPPRIV && HAVE_PRIV_H priv_set_t *set; ASSERT (set = priv_allocset ()); ASSERT (getppriv (PRIV_EFFECTIVE, set) == 0); ASSERT (priv_ismember (set, PRIV_PROC_EXEC) == 1); /* Do a series of removes and restores making sure that the results are consistent with our ismember function and solaris' priv_ismember. */ ASSERT (priv_set_ismember (PRIV_PROC_EXEC) == 1); ASSERT (getppriv (PRIV_EFFECTIVE, set) == 0); ASSERT (priv_ismember (set, PRIV_PROC_EXEC) == 1); ASSERT (priv_set_restore (PRIV_PROC_EXEC) == -1); ASSERT (errno == EINVAL); ASSERT (priv_set_ismember (PRIV_PROC_EXEC) == 1); ASSERT (getppriv (PRIV_EFFECTIVE, set) == 0); ASSERT (priv_ismember (set, PRIV_PROC_EXEC) == 1); ASSERT (priv_set_remove (PRIV_PROC_EXEC) == 0); ASSERT (priv_set_ismember (PRIV_PROC_EXEC) == 0); ASSERT (getppriv (PRIV_EFFECTIVE, set) == 0); ASSERT (priv_ismember (set, PRIV_PROC_EXEC) == 0); ASSERT (priv_set_remove (PRIV_PROC_EXEC) == -1); ASSERT (errno == EINVAL); ASSERT (priv_set_ismember (PRIV_PROC_EXEC) == 0); ASSERT (getppriv (PRIV_EFFECTIVE, set) == 0); ASSERT (priv_ismember (set, PRIV_PROC_EXEC) == 0); ASSERT (priv_set_restore (PRIV_PROC_EXEC) == 0); ASSERT (priv_set_ismember (PRIV_PROC_EXEC) == 1); ASSERT (getppriv (PRIV_EFFECTIVE, set) == 0); ASSERT (priv_ismember (set, PRIV_PROC_EXEC) == 1); ASSERT (priv_set_restore (PRIV_PROC_EXEC) == -1); ASSERT (errno == EINVAL); ASSERT (priv_set_ismember (PRIV_PROC_EXEC) == 1); ASSERT (getppriv (PRIV_EFFECTIVE, set) == 0); ASSERT (priv_ismember (set, PRIV_PROC_EXEC) == 1); /* Test the priv_set_linkdir wrappers. */ ASSERT (getppriv (PRIV_EFFECTIVE, set) == 0); if (priv_ismember (set, PRIV_SYS_LINKDIR)) { ASSERT (priv_set_restore_linkdir () == -1); ASSERT (errno == EINVAL); ASSERT (priv_set_remove_linkdir () == 0); ASSERT (priv_set_remove_linkdir () == -1); ASSERT (errno == EINVAL); ASSERT (priv_set_restore_linkdir () == 0); } #else ASSERT (priv_set_restore_linkdir () == -1); ASSERT (priv_set_remove_linkdir () == -1); #endif return 0; }
bool can_write_any_file (void) { static bool initialized; static bool can_write; if (! initialized) { bool can = false; #if defined PRIV_FILE_DAC_WRITE can = (priv_set_ismember (PRIV_FILE_DAC_WRITE) == 1); #else /* In traditional Unix, only root can unlink directories. */ can = (geteuid () == 0); #endif can_write = can; initialized = true; } return can_write; }
bool cannot_unlink_dir (void) { static bool initialized; static bool cannot; if (! initialized) { # if defined PRIV_SYS_LINKDIR /* We might be able to unlink directories if we cannot determine our privileges, or if we have the PRIV_SYS_LINKDIR privilege. */ cannot = (priv_set_ismember (PRIV_SYS_LINKDIR) == 0); # else /* In traditional Unix, only root can unlink directories. */ cannot = (geteuid () != ROOT_UID); # endif initialized = true; } return cannot; }