]>
Commit | Line | Data |
---|---|---|
6160e473 RC |
1 | /*** |
2 | This file is part of systemd | |
3 | ||
4 | Copyright 2014 Ronny Chevalier | |
5 | ||
6 | systemd is free software; you can redistribute it and/or modify it | |
7 | under the terms of the GNU Lesser General Public License as published by | |
8 | the Free Software Foundation; either version 2.1 of the License, or | |
9 | (at your option) any later version. | |
10 | ||
11 | systemd is distributed in the hope that it will be useful, but | |
12 | WITHOUT ANY WARRANTY; without even the implied warranty of | |
13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | |
14 | Lesser General Public License for more details. | |
15 | ||
16 | You should have received a copy of the GNU Lesser General Public License | |
17 | along with systemd; If not, see <http://www.gnu.org/licenses/>. | |
18 | ***/ | |
19 | ||
6160e473 RC |
20 | #include <netinet/in.h> |
21 | #include <pwd.h> | |
3ffd4af2 LP |
22 | #include <sys/capability.h> |
23 | #include <sys/socket.h> | |
24 | #include <sys/wait.h> | |
6160e473 RC |
25 | #include <unistd.h> |
26 | ||
27 | #include "capability.h" | |
3ffd4af2 | 28 | #include "fd-util.h" |
6160e473 | 29 | #include "macro.h" |
3ffd4af2 | 30 | #include "util.h" |
6160e473 RC |
31 | |
32 | static uid_t test_uid = -1; | |
33 | static gid_t test_gid = -1; | |
3ffd4af2 LP |
34 | |
35 | /* We keep CAP_DAC_OVERRIDE to avoid errors with gcov when doing test coverage */ | |
6160e473 RC |
36 | static uint64_t test_flags = 1ULL << CAP_DAC_OVERRIDE; |
37 | ||
38 | static void fork_test(void (*test_func)(void)) { | |
39 | pid_t pid = 0; | |
40 | ||
41 | pid = fork(); | |
42 | assert_se(pid >= 0); | |
43 | if (pid == 0) { | |
44 | test_func(); | |
45 | exit(0); | |
46 | } else if (pid > 0) { | |
47 | int status; | |
48 | ||
49 | assert_se(waitpid(pid, &status, 0) > 0); | |
50 | assert_se(WIFEXITED(status) && WEXITSTATUS(status) == 0); | |
51 | } | |
52 | } | |
53 | ||
54 | static void show_capabilities(void) { | |
55 | cap_t caps; | |
56 | char *text; | |
57 | ||
58 | caps = cap_get_proc(); | |
59 | assert_se(caps); | |
60 | ||
61 | text = cap_to_text(caps, NULL); | |
62 | assert_se(text); | |
63 | ||
64 | log_info("Capabilities:%s", text); | |
65 | cap_free(caps); | |
66 | cap_free(text); | |
67 | } | |
68 | ||
69 | static int setup_tests(void) { | |
70 | struct passwd *nobody; | |
71 | ||
72 | nobody = getpwnam("nobody"); | |
73 | if (!nobody) { | |
56f64d95 | 74 | log_error_errno(errno, "Could not find nobody user: %m"); |
6160e473 RC |
75 | return -EXIT_TEST_SKIP; |
76 | } | |
77 | test_uid = nobody->pw_uid; | |
78 | test_gid = nobody->pw_gid; | |
79 | ||
80 | return 0; | |
81 | } | |
82 | ||
83 | static void test_drop_privileges_keep_net_raw(void) { | |
84 | int sock; | |
85 | ||
86 | sock = socket(AF_INET, SOCK_RAW, IPPROTO_UDP); | |
87 | assert_se(sock >= 0); | |
88 | safe_close(sock); | |
89 | ||
90 | assert_se(drop_privileges(test_uid, test_gid, test_flags | (1ULL << CAP_NET_RAW)) >= 0); | |
91 | assert_se(getuid() == test_uid); | |
92 | assert_se(getgid() == test_gid); | |
93 | show_capabilities(); | |
94 | ||
95 | sock = socket(AF_INET, SOCK_RAW, IPPROTO_UDP); | |
96 | assert_se(sock >= 0); | |
97 | safe_close(sock); | |
98 | } | |
99 | ||
100 | static void test_drop_privileges_dontkeep_net_raw(void) { | |
101 | int sock; | |
102 | ||
103 | sock = socket(AF_INET, SOCK_RAW, IPPROTO_UDP); | |
104 | assert_se(sock >= 0); | |
105 | safe_close(sock); | |
106 | ||
107 | assert_se(drop_privileges(test_uid, test_gid, test_flags) >= 0); | |
108 | assert_se(getuid() == test_uid); | |
109 | assert_se(getgid() == test_gid); | |
110 | show_capabilities(); | |
111 | ||
112 | sock = socket(AF_INET, SOCK_RAW, IPPROTO_UDP); | |
113 | assert_se(sock < 0); | |
114 | } | |
115 | ||
116 | static void test_drop_privileges_fail(void) { | |
117 | assert_se(drop_privileges(test_uid, test_gid, test_flags) >= 0); | |
118 | assert_se(getuid() == test_uid); | |
119 | assert_se(getgid() == test_gid); | |
120 | ||
121 | assert_se(drop_privileges(test_uid, test_gid, test_flags) < 0); | |
122 | assert_se(drop_privileges(0, 0, test_flags) < 0); | |
123 | } | |
124 | ||
125 | static void test_drop_privileges(void) { | |
126 | fork_test(test_drop_privileges_keep_net_raw); | |
127 | fork_test(test_drop_privileges_dontkeep_net_raw); | |
128 | fork_test(test_drop_privileges_fail); | |
129 | } | |
130 | ||
131 | static void test_have_effective_cap(void) { | |
132 | assert_se(have_effective_cap(CAP_KILL)); | |
133 | assert_se(have_effective_cap(CAP_CHOWN)); | |
134 | ||
135 | assert_se(drop_privileges(test_uid, test_gid, test_flags | (1ULL << CAP_KILL)) >= 0); | |
136 | assert_se(getuid() == test_uid); | |
137 | assert_se(getgid() == test_gid); | |
138 | ||
139 | assert_se(have_effective_cap(CAP_KILL)); | |
140 | assert_se(!have_effective_cap(CAP_CHOWN)); | |
141 | } | |
142 | ||
143 | int main(int argc, char *argv[]) { | |
144 | int r; | |
145 | ||
146 | log_parse_environment(); | |
147 | log_open(); | |
148 | ||
149 | if (getuid() != 0) | |
150 | return EXIT_TEST_SKIP; | |
151 | ||
152 | r = setup_tests(); | |
153 | if (r < 0) | |
154 | return -r; | |
155 | ||
156 | show_capabilities(); | |
157 | ||
158 | test_drop_privileges(); | |
159 | fork_test(test_have_effective_cap); | |
160 | ||
161 | return 0; | |
162 | } |