1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
3 #include <netinet/in.h>
6 #include <sys/socket.h>
10 #define TEST_CAPABILITY_C
12 #include "alloc-util.h"
13 #include "capability-util.h"
14 #include "errno-util.h"
18 #include "missing_prctl.h"
19 #include "parse-util.h"
20 #include "process-util.h"
21 #include "string-util.h"
24 static uid_t test_uid
= -1;
25 static gid_t test_gid
= -1;
27 #if HAS_FEATURE_ADDRESS_SANITIZER
28 /* Keep CAP_SYS_PTRACE when running under Address Sanitizer */
29 static const uint64_t test_flags
= UINT64_C(1) << CAP_SYS_PTRACE
;
31 /* We keep CAP_DAC_OVERRIDE to avoid errors with gcov when doing test coverage */
32 static const uint64_t test_flags
= UINT64_C(1) << CAP_DAC_OVERRIDE
;
35 /* verify cap_last_cap() against /proc/sys/kernel/cap_last_cap */
36 static void test_last_cap_file(void) {
37 _cleanup_free_
char *content
= NULL
;
38 unsigned long val
= 0;
41 r
= read_one_line_file("/proc/sys/kernel/cap_last_cap", &content
);
42 if (r
== -ENOENT
|| ERRNO_IS_NEG_PRIVILEGE(r
)) /* kernel pre 3.2 or no access */
46 r
= safe_atolu(content
, &val
);
49 assert_se(val
== cap_last_cap());
52 /* verify cap_last_cap() against syscall probing */
53 static void test_last_cap_probe(void) {
54 unsigned long p
= (unsigned long)CAP_LAST_CAP
;
56 if (prctl(PR_CAPBSET_READ
, p
) < 0) {
57 for (p
--; p
> 0; p
--)
58 if (prctl(PR_CAPBSET_READ
, p
) >= 0)
62 if (prctl(PR_CAPBSET_READ
, p
+1) < 0)
67 assert_se(p
== cap_last_cap());
70 static void fork_test(void (*test_func
)(void)) {
81 assert_se(waitpid(pid
, &status
, 0) > 0);
82 assert_se(WIFEXITED(status
) && WEXITSTATUS(status
) == 0);
86 static void show_capabilities(void) {
90 caps
= cap_get_proc();
93 text
= cap_to_text(caps
, NULL
);
96 log_info("Capabilities:%s", text
);
101 static int setup_tests(bool *run_ambient
) {
102 struct passwd
*nobody
;
105 nobody
= getpwnam(NOBODY_USER_NAME
);
107 return log_warning_errno(SYNTHETIC_ERRNO(ENOENT
), "Couldn't find 'nobody' user: %m");
109 test_uid
= nobody
->pw_uid
;
110 test_gid
= nobody
->pw_gid
;
112 r
= prctl(PR_CAP_AMBIENT
, PR_CAP_AMBIENT_CLEAR_ALL
, 0, 0, 0);
113 /* There's support for PR_CAP_AMBIENT if the prctl() call succeeded or error code was something else
114 * than EINVAL. The EINVAL check should be good enough to rule out false positives. */
115 *run_ambient
= r
>= 0 || errno
!= EINVAL
;
120 static void test_drop_privileges_keep_net_raw(void) {
123 sock
= socket(AF_INET
, SOCK_RAW
, IPPROTO_UDP
);
124 assert_se(sock
>= 0);
127 assert_se(drop_privileges(test_uid
, test_gid
, test_flags
| (1ULL << CAP_NET_RAW
)) >= 0);
128 assert_se(getuid() == test_uid
);
129 assert_se(getgid() == test_gid
);
132 sock
= socket(AF_INET
, SOCK_RAW
, IPPROTO_UDP
);
133 assert_se(sock
>= 0);
137 static void test_drop_privileges_dontkeep_net_raw(void) {
140 sock
= socket(AF_INET
, SOCK_RAW
, IPPROTO_UDP
);
141 assert_se(sock
>= 0);
144 assert_se(drop_privileges(test_uid
, test_gid
, test_flags
) >= 0);
145 assert_se(getuid() == test_uid
);
146 assert_se(getgid() == test_gid
);
149 sock
= socket(AF_INET
, SOCK_RAW
, IPPROTO_UDP
);
153 static void test_drop_privileges_fail(void) {
154 assert_se(drop_privileges(test_uid
, test_gid
, test_flags
) >= 0);
155 assert_se(getuid() == test_uid
);
156 assert_se(getgid() == test_gid
);
158 assert_se(drop_privileges(test_uid
, test_gid
, test_flags
) < 0);
159 assert_se(drop_privileges(0, 0, test_flags
) < 0);
162 static void test_drop_privileges(void) {
163 fork_test(test_drop_privileges_fail
);
165 if (have_effective_cap(CAP_NET_RAW
) <= 0) /* The remaining two tests only work if we have CAP_NET_RAW
166 * in the first place. If we are run in some restricted
167 * container environment we might not. */
170 fork_test(test_drop_privileges_keep_net_raw
);
171 fork_test(test_drop_privileges_dontkeep_net_raw
);
174 static void test_have_effective_cap(void) {
175 assert_se(have_effective_cap(CAP_KILL
) > 0);
176 assert_se(have_effective_cap(CAP_CHOWN
) > 0);
178 assert_se(drop_privileges(test_uid
, test_gid
, test_flags
| (1ULL << CAP_KILL
)) >= 0);
179 assert_se(getuid() == test_uid
);
180 assert_se(getgid() == test_gid
);
182 assert_se(have_effective_cap(CAP_KILL
) > 0);
183 assert_se(have_effective_cap(CAP_CHOWN
) == 0);
186 static void test_update_inherited_set(void) {
191 caps
= cap_get_proc();
194 set
= (UINT64_C(1) << CAP_CHOWN
);
196 assert_se(!capability_update_inherited_set(caps
, set
));
197 assert_se(!cap_get_flag(caps
, CAP_CHOWN
, CAP_INHERITABLE
, &fv
));
198 assert_se(fv
== CAP_SET
);
203 static void test_apply_ambient_caps(void) {
208 assert_se(prctl(PR_CAP_AMBIENT
, PR_CAP_AMBIENT_IS_SET
, CAP_CHOWN
, 0, 0) == 0);
210 set
= (UINT64_C(1) << CAP_CHOWN
);
212 assert_se(!capability_ambient_set_apply(set
, true));
214 caps
= cap_get_proc();
216 assert_se(!cap_get_flag(caps
, CAP_CHOWN
, CAP_INHERITABLE
, &fv
));
217 assert_se(fv
== CAP_SET
);
220 assert_se(prctl(PR_CAP_AMBIENT
, PR_CAP_AMBIENT_IS_SET
, CAP_CHOWN
, 0, 0) == 1);
222 assert_se(!capability_ambient_set_apply(0, true));
223 caps
= cap_get_proc();
225 assert_se(!cap_get_flag(caps
, CAP_CHOWN
, CAP_INHERITABLE
, &fv
));
226 assert_se(fv
== CAP_CLEAR
);
229 assert_se(prctl(PR_CAP_AMBIENT
, PR_CAP_AMBIENT_IS_SET
, CAP_CHOWN
, 0, 0) == 0);
232 static void test_ensure_cap_64_bit(void) {
233 _cleanup_free_
char *content
= NULL
;
237 r
= read_one_line_file("/proc/sys/kernel/cap_last_cap", &content
);
238 if (r
== -ENOENT
|| ERRNO_IS_NEG_PRIVILEGE(r
)) /* kernel pre 3.2 or no access */
242 assert_se(safe_atolu(content
, &p
) >= 0);
244 /* If caps don't fit into 64-bit anymore, we have a problem, fail the test. */
247 /* Also check for the header definition */
248 assert_cc(CAP_LAST_CAP
<= 63);
251 static void test_capability_get_ambient(void) {
255 assert_se(capability_get_ambient(&c
) >= 0);
257 r
= safe_fork("(getambient)", FORK_RESET_SIGNALS
|FORK_DEATHSIG
|FORK_WAIT
|FORK_LOG
, NULL
);
263 assert_se(capability_get_ambient(&c
) >= 0);
265 x
= capability_ambient_set_apply(
266 (UINT64_C(1) << CAP_MKNOD
)|
267 (UINT64_C(1) << CAP_LINUX_IMMUTABLE
),
268 /* also_inherit= */ true);
269 assert_se(x
>= 0 || ERRNO_IS_PRIVILEGE(x
));
271 assert_se(capability_get_ambient(&c
) >= 0);
272 assert_se(x
< 0 || FLAGS_SET(c
, UINT64_C(1) << CAP_MKNOD
));
273 assert_se(x
< 0 || FLAGS_SET(c
, UINT64_C(1) << CAP_LINUX_IMMUTABLE
));
274 assert_se(x
< 0 || !FLAGS_SET(c
, UINT64_C(1) << CAP_SETPCAP
));
276 y
= capability_bounding_set_drop(
277 ((UINT64_C(1) << CAP_LINUX_IMMUTABLE
)|
278 (UINT64_C(1) << CAP_SETPCAP
)),
279 /* right_now= */ true);
280 assert_se(y
>= 0 || ERRNO_IS_PRIVILEGE(y
));
282 assert_se(capability_get_ambient(&c
) >= 0);
283 assert_se(x
< 0 || y
< 0 || !FLAGS_SET(c
, UINT64_C(1) << CAP_MKNOD
));
284 assert_se(x
< 0 || y
< 0 || FLAGS_SET(c
, UINT64_C(1) << CAP_LINUX_IMMUTABLE
));
285 assert_se(x
< 0 || y
< 0 || !FLAGS_SET(c
, UINT64_C(1) << CAP_SETPCAP
));
287 y
= capability_bounding_set_drop(
288 (UINT64_C(1) << CAP_SETPCAP
),
289 /* right_now= */ true);
290 assert_se(y
>= 0 || ERRNO_IS_PRIVILEGE(y
));
292 assert_se(capability_get_ambient(&c
) >= 0);
293 assert_se(x
< 0 || y
< 0 || !FLAGS_SET(c
, UINT64_C(1) << CAP_MKNOD
));
294 assert_se(x
< 0 || y
< 0 || !FLAGS_SET(c
, UINT64_C(1) << CAP_LINUX_IMMUTABLE
));
295 assert_se(x
< 0 || y
< 0 || !FLAGS_SET(c
, UINT64_C(1) << CAP_SETPCAP
));
301 int main(int argc
, char *argv
[]) {
304 test_setup_logging(LOG_DEBUG
);
306 test_ensure_cap_64_bit();
308 test_last_cap_file();
309 test_last_cap_probe();
311 log_info("have ambient caps: %s", yes_no(ambient_capabilities_supported()));
314 return log_tests_skipped("not running as root");
316 if (setup_tests(&run_ambient
) < 0)
317 return log_tests_skipped("setup failed");
321 test_drop_privileges();
322 test_update_inherited_set();
324 fork_test(test_have_effective_cap
);
327 fork_test(test_apply_ambient_caps
);
329 test_capability_get_ambient();