src/test/test-capability.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2 /***
   3   Copyright © 2014 Ronny Chevalier
   4 ***/
   5
   6 #include <netinet/in.h>
   7 #include <pwd.h>
   8 #include <sys/capability.h>
   9 #include <sys/prctl.h>
  10 #include <sys/socket.h>
  11 #include <sys/wait.h>
  12 #include <unistd.h>
  13
  14 #include "alloc-util.h"
  15 #include "capability-util.h"
  16 #include "fd-util.h"
  17 #include "fileio.h"
  18 #include "macro.h"
  19 #include "parse-util.h"
  20 #include "util.h"
  21
  22 static uid_t test_uid = -1;
  23 static gid_t test_gid = -1;
  24
  25 /* We keep CAP_DAC_OVERRIDE to avoid errors with gcov when doing test coverage */
  26 static uint64_t test_flags = 1ULL << CAP_DAC_OVERRIDE;
  27
  28 /* verify cap_last_cap() against /proc/sys/kernel/cap_last_cap */
  29 static void test_last_cap_file(void) {
  30         _cleanup_free_ char *content = NULL;
  31         unsigned long val = 0;
  32         int r;
  33
  34         r = read_one_line_file("/proc/sys/kernel/cap_last_cap", &content);
  35         assert_se(r >= 0);
  36
  37         r = safe_atolu(content, &val);
  38         assert_se(r >= 0);
  39         assert_se(val != 0);
  40         assert_se(val == cap_last_cap());
  41 }
  42
  43 /* verify cap_last_cap() against syscall probing */
  44 static void test_last_cap_probe(void) {
  45         unsigned long p = (unsigned long)CAP_LAST_CAP;
  46
  47         if (prctl(PR_CAPBSET_READ, p) < 0) {
  48                 for (p--; p > 0; p --)
  49                         if (prctl(PR_CAPBSET_READ, p) >= 0)
  50                                 break;
  51         } else {
  52                 for (;; p++)
  53                         if (prctl(PR_CAPBSET_READ, p+1) < 0)
  54                                 break;
  55         }
  56
  57         assert_se(p != 0);
  58         assert_se(p == cap_last_cap());
  59 }
  60
  61 static void fork_test(void (*test_func)(void)) {
  62         pid_t pid = 0;
  63
  64         pid = fork();
  65         assert_se(pid >= 0);
  66         if (pid == 0) {
  67                 test_func();
  68                 exit(EXIT_SUCCESS);
  69         } else if (pid > 0) {
  70                 int status;
  71
  72                 assert_se(waitpid(pid, &status, 0) > 0);
  73                 assert_se(WIFEXITED(status) && WEXITSTATUS(status) == 0);
  74         }
  75 }
  76
  77 static void show_capabilities(void) {
  78         cap_t caps;
  79         char *text;
  80
  81         caps = cap_get_proc();
  82         assert_se(caps);
  83
  84         text = cap_to_text(caps, NULL);
  85         assert_se(text);
  86
  87         log_info("Capabilities:%s", text);
  88         cap_free(caps);
  89         cap_free(text);
  90 }
  91
  92 static int setup_tests(bool *run_ambient) {
  93         struct passwd *nobody;
  94         int r;
  95
  96         nobody = getpwnam(NOBODY_USER_NAME);
  97         if (!nobody) {
  98                 log_error_errno(errno, "Could not find nobody user: %m");
  99                 return -EXIT_TEST_SKIP;
 100         }
 101         test_uid = nobody->pw_uid;
 102         test_gid = nobody->pw_gid;
 103
 104         *run_ambient = false;
 105
 106         r = prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0, 0, 0);
 107
 108         /* There's support for PR_CAP_AMBIENT if the prctl() call
 109          * succeeded or error code was something else than EINVAL. The
 110          * EINVAL check should be good enough to rule out false
 111          * positives. */
 112
 113         if (r >= 0 || errno != EINVAL)
 114                 *run_ambient = true;
 115
 116         return 0;
 117 }
 118
 119 static void test_drop_privileges_keep_net_raw(void) {
 120         int sock;
 121
 122         sock = socket(AF_INET, SOCK_RAW, IPPROTO_UDP);
 123         assert_se(sock >= 0);
 124         safe_close(sock);
 125
 126         assert_se(drop_privileges(test_uid, test_gid, test_flags | (1ULL << CAP_NET_RAW)) >= 0);
 127         assert_se(getuid() == test_uid);
 128         assert_se(getgid() == test_gid);
 129         show_capabilities();
 130
 131         sock = socket(AF_INET, SOCK_RAW, IPPROTO_UDP);
 132         assert_se(sock >= 0);
 133         safe_close(sock);
 134 }
 135
 136 static void test_drop_privileges_dontkeep_net_raw(void) {
 137         int sock;
 138
 139         sock = socket(AF_INET, SOCK_RAW, IPPROTO_UDP);
 140         assert_se(sock >= 0);
 141         safe_close(sock);
 142
 143         assert_se(drop_privileges(test_uid, test_gid, test_flags) >= 0);
 144         assert_se(getuid() == test_uid);
 145         assert_se(getgid() == test_gid);
 146         show_capabilities();
 147
 148         sock = socket(AF_INET, SOCK_RAW, IPPROTO_UDP);
 149         assert_se(sock < 0);
 150 }
 151
 152 static void test_drop_privileges_fail(void) {
 153         assert_se(drop_privileges(test_uid, test_gid, test_flags) >= 0);
 154         assert_se(getuid() == test_uid);
 155         assert_se(getgid() == test_gid);
 156
 157         assert_se(drop_privileges(test_uid, test_gid, test_flags) < 0);
 158         assert_se(drop_privileges(0, 0, test_flags) < 0);
 159 }
 160
 161 static void test_drop_privileges(void) {
 162         fork_test(test_drop_privileges_keep_net_raw);
 163         fork_test(test_drop_privileges_dontkeep_net_raw);
 164         fork_test(test_drop_privileges_fail);
 165 }
 166
 167 static void test_have_effective_cap(void) {
 168         assert_se(have_effective_cap(CAP_KILL));
 169         assert_se(have_effective_cap(CAP_CHOWN));
 170
 171         assert_se(drop_privileges(test_uid, test_gid, test_flags | (1ULL << CAP_KILL)) >= 0);
 172         assert_se(getuid() == test_uid);
 173         assert_se(getgid() == test_gid);
 174
 175         assert_se(have_effective_cap(CAP_KILL));
 176         assert_se(!have_effective_cap(CAP_CHOWN));
 177 }
 178
 179 static void test_update_inherited_set(void) {
 180         cap_t caps;
 181         uint64_t set = 0;
 182         cap_flag_value_t fv;
 183
 184         caps = cap_get_proc();
 185         assert_se(caps);
 186         assert_se(!cap_get_flag(caps, CAP_CHOWN, CAP_INHERITABLE, &fv));
 187         assert(fv == CAP_CLEAR);
 188
 189         set = (UINT64_C(1) << CAP_CHOWN);
 190
 191         assert_se(!capability_update_inherited_set(caps, set));
 192         assert_se(!cap_get_flag(caps, CAP_CHOWN, CAP_INHERITABLE, &fv));
 193         assert(fv == CAP_SET);
 194
 195         cap_free(caps);
 196 }
 197
 198 static void test_set_ambient_caps(void) {
 199         cap_t caps;
 200         uint64_t set = 0;
 201         cap_flag_value_t fv;
 202
 203         caps = cap_get_proc();
 204         assert_se(caps);
 205         assert_se(!cap_get_flag(caps, CAP_CHOWN, CAP_INHERITABLE, &fv));
 206         assert(fv == CAP_CLEAR);
 207         cap_free(caps);
 208
 209         assert_se(prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_IS_SET, CAP_CHOWN, 0, 0) == 0);
 210
 211         set = (UINT64_C(1) << CAP_CHOWN);
 212
 213         assert_se(!capability_ambient_set_apply(set, true));
 214
 215         caps = cap_get_proc();
 216         assert_se(!cap_get_flag(caps, CAP_CHOWN, CAP_INHERITABLE, &fv));
 217         assert(fv == CAP_SET);
 218         cap_free(caps);
 219
 220         assert_se(prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_IS_SET, CAP_CHOWN, 0, 0) == 1);
 221 }
 222
 223 int main(int argc, char *argv[]) {
 224         int r;
 225         bool run_ambient;
 226
 227         test_last_cap_file();
 228         test_last_cap_probe();
 229
 230         log_parse_environment();
 231         log_open();
 232
 233         log_info("have ambient caps: %s", yes_no(ambient_capabilities_supported()));
 234
 235         if (getuid() != 0)
 236                 return EXIT_TEST_SKIP;
 237
 238         r = setup_tests(&run_ambient);
 239         if (r < 0)
 240                 return -r;
 241
 242         show_capabilities();
 243
 244         test_drop_privileges();
 245         test_update_inherited_set();
 246
 247         fork_test(test_have_effective_cap);
 248
 249         if (run_ambient)
 250                 fork_test(test_set_ambient_caps);
 251
 252         return 0;
 253 }