src/test/test-capability.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2
   3 #include <netinet/in.h>
   4 #include <pwd.h>
   5 #include <sys/prctl.h>
   6 #include <sys/socket.h>
   7 #include <sys/wait.h>
   8 #include <unistd.h>
   9
  10 #define TEST_CAPABILITY_C
  11
  12 #include "alloc-util.h"
  13 #include "capability-util.h"
  14 #include "errno-util.h"
  15 #include "fd-util.h"
  16 #include "fileio.h"
  17 #include "macro.h"
  18 #include "missing_prctl.h"
  19 #include "parse-util.h"
  20 #include "process-util.h"
  21 #include "string-util.h"
  22 #include "tests.h"
  23
  24 static uid_t test_uid = -1;
  25 static gid_t test_gid = -1;
  26
  27 #if HAS_FEATURE_ADDRESS_SANITIZER
  28 /* Keep CAP_SYS_PTRACE when running under Address Sanitizer */
  29 static const uint64_t test_flags = UINT64_C(1) << CAP_SYS_PTRACE;
  30 #else
  31 /* We keep CAP_DAC_OVERRIDE to avoid errors with gcov when doing test coverage */
  32 static const uint64_t test_flags = UINT64_C(1) << CAP_DAC_OVERRIDE;
  33 #endif
  34
  35 /* verify cap_last_cap() against /proc/sys/kernel/cap_last_cap */
  36 static void test_last_cap_file(void) {
  37         _cleanup_free_ char *content = NULL;
  38         unsigned long val = 0;
  39         int r;
  40
  41         r = read_one_line_file("/proc/sys/kernel/cap_last_cap", &content);
  42         if (r == -ENOENT || ERRNO_IS_NEG_PRIVILEGE(r)) /* kernel pre 3.2 or no access */
  43                 return;
  44         assert_se(r >= 0);
  45
  46         r = safe_atolu(content, &val);
  47         assert_se(r >= 0);
  48         assert_se(val != 0);
  49         assert_se(val == cap_last_cap());
  50 }
  51
  52 /* verify cap_last_cap() against syscall probing */
  53 static void test_last_cap_probe(void) {
  54         unsigned long p = (unsigned long)CAP_LAST_CAP;
  55
  56         if (prctl(PR_CAPBSET_READ, p) < 0) {
  57                 for (p--; p > 0; p --)
  58                         if (prctl(PR_CAPBSET_READ, p) >= 0)
  59                                 break;
  60         } else {
  61                 for (;; p++)
  62                         if (prctl(PR_CAPBSET_READ, p+1) < 0)
  63                                 break;
  64         }
  65
  66         assert_se(p != 0);
  67         assert_se(p == cap_last_cap());
  68 }
  69
  70 static void fork_test(void (*test_func)(void)) {
  71         pid_t pid = 0;
  72
  73         pid = fork();
  74         assert_se(pid >= 0);
  75         if (pid == 0) {
  76                 test_func();
  77                 exit(EXIT_SUCCESS);
  78         } else if (pid > 0) {
  79                 int status;
  80
  81                 assert_se(waitpid(pid, &status, 0) > 0);
  82                 assert_se(WIFEXITED(status) && WEXITSTATUS(status) == 0);
  83         }
  84 }
  85
  86 static void show_capabilities(void) {
  87         cap_t caps;
  88         char *text;
  89
  90         caps = cap_get_proc();
  91         assert_se(caps);
  92
  93         text = cap_to_text(caps, NULL);
  94         assert_se(text);
  95
  96         log_info("Capabilities:%s", text);
  97         cap_free(caps);
  98         cap_free(text);
  99 }
 100
 101 static int setup_tests(bool *run_ambient) {
 102         struct passwd *nobody;
 103         int r;
 104
 105         nobody = getpwnam(NOBODY_USER_NAME);
 106         if (!nobody)
 107                 return log_warning_errno(SYNTHETIC_ERRNO(ENOENT), "Couldn't find 'nobody' user: %m");
 108
 109         test_uid = nobody->pw_uid;
 110         test_gid = nobody->pw_gid;
 111
 112         r = prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0, 0, 0);
 113         /* There's support for PR_CAP_AMBIENT if the prctl() call succeeded or error code was something else
 114          * than EINVAL. The EINVAL check should be good enough to rule out false positives. */
 115         *run_ambient = r >= 0 || errno != EINVAL;
 116
 117         return 0;
 118 }
 119
 120 static void test_drop_privileges_keep_net_raw(void) {
 121         int sock;
 122
 123         sock = socket(AF_INET, SOCK_RAW, IPPROTO_UDP);
 124         assert_se(sock >= 0);
 125         safe_close(sock);
 126
 127         assert_se(drop_privileges(test_uid, test_gid, test_flags | (1ULL << CAP_NET_RAW)) >= 0);
 128         assert_se(getuid() == test_uid);
 129         assert_se(getgid() == test_gid);
 130         show_capabilities();
 131
 132         sock = socket(AF_INET, SOCK_RAW, IPPROTO_UDP);
 133         assert_se(sock >= 0);
 134         safe_close(sock);
 135 }
 136
 137 static void test_drop_privileges_dontkeep_net_raw(void) {
 138         int sock;
 139
 140         sock = socket(AF_INET, SOCK_RAW, IPPROTO_UDP);
 141         assert_se(sock >= 0);
 142         safe_close(sock);
 143
 144         assert_se(drop_privileges(test_uid, test_gid, test_flags) >= 0);
 145         assert_se(getuid() == test_uid);
 146         assert_se(getgid() == test_gid);
 147         show_capabilities();
 148
 149         sock = socket(AF_INET, SOCK_RAW, IPPROTO_UDP);
 150         assert_se(sock < 0);
 151 }
 152
 153 static void test_drop_privileges_fail(void) {
 154         assert_se(drop_privileges(test_uid, test_gid, test_flags) >= 0);
 155         assert_se(getuid() == test_uid);
 156         assert_se(getgid() == test_gid);
 157
 158         assert_se(drop_privileges(test_uid, test_gid, test_flags) < 0);
 159         assert_se(drop_privileges(0, 0, test_flags) < 0);
 160 }
 161
 162 static void test_drop_privileges(void) {
 163         fork_test(test_drop_privileges_fail);
 164
 165         if (have_effective_cap(CAP_NET_RAW) <= 0) /* The remaining two tests only work if we have CAP_NET_RAW
 166                                                    * in the first place. If we are run in some restricted
 167                                                    * container environment we might not. */
 168                 return;
 169
 170         fork_test(test_drop_privileges_keep_net_raw);
 171         fork_test(test_drop_privileges_dontkeep_net_raw);
 172 }
 173
 174 static void test_have_effective_cap(void) {
 175         assert_se(have_effective_cap(CAP_KILL) > 0);
 176         assert_se(have_effective_cap(CAP_CHOWN) > 0);
 177
 178         assert_se(drop_privileges(test_uid, test_gid, test_flags | (1ULL << CAP_KILL)) >= 0);
 179         assert_se(getuid() == test_uid);
 180         assert_se(getgid() == test_gid);
 181
 182         assert_se(have_effective_cap(CAP_KILL) > 0);
 183         assert_se(have_effective_cap(CAP_CHOWN) == 0);
 184 }
 185
 186 static void test_update_inherited_set(void) {
 187         cap_t caps;
 188         uint64_t set = 0;
 189         cap_flag_value_t fv;
 190
 191         caps = cap_get_proc();
 192         assert_se(caps);
 193
 194         set = (UINT64_C(1) << CAP_CHOWN);
 195
 196         assert_se(!capability_update_inherited_set(caps, set));
 197         assert_se(!cap_get_flag(caps, CAP_CHOWN, CAP_INHERITABLE, &fv));
 198         assert_se(fv == CAP_SET);
 199
 200         cap_free(caps);
 201 }
 202
 203 static void test_apply_ambient_caps(void) {
 204         cap_t caps;
 205         uint64_t set = 0;
 206         cap_flag_value_t fv;
 207
 208         assert_se(prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_IS_SET, CAP_CHOWN, 0, 0) == 0);
 209
 210         set = (UINT64_C(1) << CAP_CHOWN);
 211
 212         assert_se(!capability_ambient_set_apply(set, true));
 213
 214         caps = cap_get_proc();
 215         assert_se(caps);
 216         assert_se(!cap_get_flag(caps, CAP_CHOWN, CAP_INHERITABLE, &fv));
 217         assert_se(fv == CAP_SET);
 218         cap_free(caps);
 219
 220         assert_se(prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_IS_SET, CAP_CHOWN, 0, 0) == 1);
 221
 222         assert_se(!capability_ambient_set_apply(0, true));
 223         caps = cap_get_proc();
 224         assert_se(caps);
 225         assert_se(!cap_get_flag(caps, CAP_CHOWN, CAP_INHERITABLE, &fv));
 226         assert_se(fv == CAP_CLEAR);
 227         cap_free(caps);
 228
 229         assert_se(prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_IS_SET, CAP_CHOWN, 0, 0) == 0);
 230 }
 231
 232 static void test_ensure_cap_64_bit(void) {
 233         _cleanup_free_ char *content = NULL;
 234         unsigned long p = 0;
 235         int r;
 236
 237         r = read_one_line_file("/proc/sys/kernel/cap_last_cap", &content);
 238         if (r == -ENOENT || ERRNO_IS_NEG_PRIVILEGE(r)) /* kernel pre 3.2 or no access */
 239                 return;
 240         assert_se(r >= 0);
 241
 242         assert_se(safe_atolu(content, &p) >= 0);
 243
 244         /* If caps don't fit into 64-bit anymore, we have a problem, fail the test. */
 245         assert_se(p <= 63);
 246
 247         /* Also check for the header definition */
 248         assert_cc(CAP_LAST_CAP <= 63);
 249 }
 250
 251 static void test_capability_get_ambient(void) {
 252         uint64_t c;
 253         int r;
 254
 255         assert_se(capability_get_ambient(&c) >= 0);
 256
 257         r = safe_fork("(getambient)", FORK_RESET_SIGNALS|FORK_DEATHSIG_SIGTERM|FORK_WAIT|FORK_LOG, NULL);
 258         assert_se(r >= 0);
 259
 260         if (r == 0) {
 261                 int x, y;
 262                 /* child */
 263                 assert_se(capability_get_ambient(&c) >= 0);
 264
 265                 x = capability_ambient_set_apply(
 266                                 (UINT64_C(1) << CAP_MKNOD)|
 267                                 (UINT64_C(1) << CAP_LINUX_IMMUTABLE),
 268                                 /* also_inherit= */ true);
 269                 assert_se(x >= 0 || ERRNO_IS_PRIVILEGE(x));
 270
 271                 assert_se(capability_get_ambient(&c) >= 0);
 272                 assert_se(x < 0 || FLAGS_SET(c, UINT64_C(1) << CAP_MKNOD));
 273                 assert_se(x < 0 || FLAGS_SET(c, UINT64_C(1) << CAP_LINUX_IMMUTABLE));
 274                 assert_se(x < 0 || !FLAGS_SET(c, UINT64_C(1) << CAP_SETPCAP));
 275
 276                 y = capability_bounding_set_drop(
 277                                 ((UINT64_C(1) << CAP_LINUX_IMMUTABLE)|
 278                                  (UINT64_C(1) << CAP_SETPCAP)),
 279                                 /* right_now= */ true);
 280                 assert_se(y >= 0 || ERRNO_IS_PRIVILEGE(y));
 281
 282                 assert_se(capability_get_ambient(&c) >= 0);
 283                 assert_se(x < 0 || y < 0 || !FLAGS_SET(c, UINT64_C(1) << CAP_MKNOD));
 284                 assert_se(x < 0 || y < 0 || FLAGS_SET(c, UINT64_C(1) << CAP_LINUX_IMMUTABLE));
 285                 assert_se(x < 0 || y < 0 || !FLAGS_SET(c, UINT64_C(1) << CAP_SETPCAP));
 286
 287                 y = capability_bounding_set_drop(
 288                                 (UINT64_C(1) << CAP_SETPCAP),
 289                                 /* right_now= */ true);
 290                 assert_se(y >= 0 || ERRNO_IS_PRIVILEGE(y));
 291
 292                 assert_se(capability_get_ambient(&c) >= 0);
 293                 assert_se(x < 0 || y < 0 || !FLAGS_SET(c, UINT64_C(1) << CAP_MKNOD));
 294                 assert_se(x < 0 || y < 0 || !FLAGS_SET(c, UINT64_C(1) << CAP_LINUX_IMMUTABLE));
 295                 assert_se(x < 0 || y < 0 || !FLAGS_SET(c, UINT64_C(1) << CAP_SETPCAP));
 296
 297                 _exit(EXIT_SUCCESS);
 298         }
 299 }
 300
 301 int main(int argc, char *argv[]) {
 302         bool run_ambient;
 303
 304         test_setup_logging(LOG_DEBUG);
 305
 306         test_ensure_cap_64_bit();
 307
 308         test_last_cap_file();
 309         test_last_cap_probe();
 310
 311         log_info("have ambient caps: %s", yes_no(ambient_capabilities_supported()));
 312
 313         if (getuid() != 0)
 314                 return log_tests_skipped("not running as root");
 315
 316         if (setup_tests(&run_ambient) < 0)
 317                 return log_tests_skipped("setup failed");
 318
 319         show_capabilities();
 320
 321         test_drop_privileges();
 322         test_update_inherited_set();
 323
 324         fork_test(test_have_effective_cap);
 325
 326         if (run_ambient)
 327                 fork_test(test_apply_ambient_caps);
 328
 329         test_capability_get_ambient();
 330
 331         return 0;
 332 }