1 /* SPDX-License-Identifier: LGPL-2.1+ */
3 #include <netinet/in.h>
5 #include <sys/capability.h>
7 #include <sys/socket.h>
11 #include "alloc-util.h"
12 #include "capability-util.h"
16 #include "missing_prctl.h"
17 #include "parse-util.h"
21 static uid_t test_uid = -1;
22 static gid_t test_gid = -1;
24 #if HAS_FEATURE_ADDRESS_SANITIZER
25 /* Keep CAP_SYS_PTRACE when running under Address Sanitizer */
26 static const uint64_t test_flags = UINT64_C(1) << CAP_SYS_PTRACE;
28 /* We keep CAP_DAC_OVERRIDE to avoid errors with gcov when doing test coverage */
29 static const uint64_t test_flags = UINT64_C(1) << CAP_DAC_OVERRIDE;
32 /* verify cap_last_cap() against /proc/sys/kernel/cap_last_cap */
33 static void test_last_cap_file(void) {
34 _cleanup_free_ char *content = NULL;
35 unsigned long val = 0;
38 r = read_one_line_file("/proc/sys/kernel/cap_last_cap", &content);
41 r = safe_atolu(content, &val);
44 assert_se(val == cap_last_cap());
47 /* verify cap_last_cap() against syscall probing */
48 static void test_last_cap_probe(void) {
49 unsigned long p = (unsigned long)CAP_LAST_CAP;
51 if (prctl(PR_CAPBSET_READ, p) < 0) {
52 for (p--; p > 0; p --)
53 if (prctl(PR_CAPBSET_READ, p) >= 0)
57 if (prctl(PR_CAPBSET_READ, p+1) < 0)
62 assert_se(p == cap_last_cap());
65 static void fork_test(void (*test_func)(void)) {
76 assert_se(waitpid(pid, &status, 0) > 0);
77 assert_se(WIFEXITED(status) && WEXITSTATUS(status) == 0);
81 static void show_capabilities(void) {
85 caps = cap_get_proc();
88 text = cap_to_text(caps, NULL);
91 log_info("Capabilities:%s", text);
96 static int setup_tests(bool *run_ambient) {
97 struct passwd *nobody;
100 nobody = getpwnam(NOBODY_USER_NAME);
102 return log_error_errno(errno, "Could not find nobody user: %m");
104 test_uid = nobody->pw_uid;
105 test_gid = nobody->pw_gid;
107 *run_ambient = false;
109 r = prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0, 0, 0);
111 /* There's support for PR_CAP_AMBIENT if the prctl() call
112 * succeeded or error code was something else than EINVAL. The
113 * EINVAL check should be good enough to rule out false
116 if (r >= 0 || errno != EINVAL)
122 static void test_drop_privileges_keep_net_raw(void) {
125 sock = socket(AF_INET, SOCK_RAW, IPPROTO_UDP);
126 assert_se(sock >= 0);
129 assert_se(drop_privileges(test_uid, test_gid, test_flags | (1ULL << CAP_NET_RAW)) >= 0);
130 assert_se(getuid() == test_uid);
131 assert_se(getgid() == test_gid);
134 sock = socket(AF_INET, SOCK_RAW, IPPROTO_UDP);
135 assert_se(sock >= 0);
139 static void test_drop_privileges_dontkeep_net_raw(void) {
142 sock = socket(AF_INET, SOCK_RAW, IPPROTO_UDP);
143 assert_se(sock >= 0);
146 assert_se(drop_privileges(test_uid, test_gid, test_flags) >= 0);
147 assert_se(getuid() == test_uid);
148 assert_se(getgid() == test_gid);
151 sock = socket(AF_INET, SOCK_RAW, IPPROTO_UDP);
155 static void test_drop_privileges_fail(void) {
156 assert_se(drop_privileges(test_uid, test_gid, test_flags) >= 0);
157 assert_se(getuid() == test_uid);
158 assert_se(getgid() == test_gid);
160 assert_se(drop_privileges(test_uid, test_gid, test_flags) < 0);
161 assert_se(drop_privileges(0, 0, test_flags) < 0);
164 static void test_drop_privileges(void) {
165 fork_test(test_drop_privileges_keep_net_raw);
166 fork_test(test_drop_privileges_dontkeep_net_raw);
167 fork_test(test_drop_privileges_fail);
170 static void test_have_effective_cap(void) {
171 assert_se(have_effective_cap(CAP_KILL));
172 assert_se(have_effective_cap(CAP_CHOWN));
174 assert_se(drop_privileges(test_uid, test_gid, test_flags | (1ULL << CAP_KILL)) >= 0);
175 assert_se(getuid() == test_uid);
176 assert_se(getgid() == test_gid);
178 assert_se(have_effective_cap(CAP_KILL));
179 assert_se(!have_effective_cap(CAP_CHOWN));
182 static void test_update_inherited_set(void) {
187 caps = cap_get_proc();
190 set = (UINT64_C(1) << CAP_CHOWN);
192 assert_se(!capability_update_inherited_set(caps, set));
193 assert_se(!cap_get_flag(caps, CAP_CHOWN, CAP_INHERITABLE, &fv));
194 assert(fv == CAP_SET);
199 static void test_set_ambient_caps(void) {
204 assert_se(prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_IS_SET, CAP_CHOWN, 0, 0) == 0);
206 set = (UINT64_C(1) << CAP_CHOWN);
208 assert_se(!capability_ambient_set_apply(set, true));
210 caps = cap_get_proc();
211 assert_se(!cap_get_flag(caps, CAP_CHOWN, CAP_INHERITABLE, &fv));
212 assert(fv == CAP_SET);
215 assert_se(prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_IS_SET, CAP_CHOWN, 0, 0) == 1);
218 int main(int argc, char *argv[]) {
221 test_setup_logging(LOG_INFO);
223 test_last_cap_file();
224 test_last_cap_probe();
226 log_info("have ambient caps: %s", yes_no(ambient_capabilities_supported()));
229 return log_tests_skipped("not running as root");
231 if (setup_tests(&run_ambient) < 0)
232 return log_tests_skipped("setup failed");
236 test_drop_privileges();
237 test_update_inherited_set();
239 fork_test(test_have_effective_cap);
242 fork_test(test_set_ambient_caps);