1/*-
2 * Copyright (c) 2008-2009 Robert N. M. Watson
3 * Copyright (c) 2011 Jonathan Anderson
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright

--- 7 unchanged lines hidden (view full) ---

19 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25 * SUCH DAMAGE.
26 *
27 * $FreeBSD: head/tools/regression/security/cap_test/cap_test_capmode.c 224651 2011-08-04 14:20:13Z jonathan $
28 */
29
30/*
31 * Test routines to make sure a variety of system calls are or are not
32 * available in capability mode. The goal is not to see if they work, just
33 * whether or not they return the expected ECAPMODE.
34 */
35
36#include <sys/cdefs.h>
37__FBSDID("$FreeBSD: head/tools/regression/security/cap_test/cap_test_capmode.c 224651 2011-08-04 14:20:13Z jonathan $");
38
39#include <sys/param.h>
40#include <sys/capability.h>
41#include <sys/errno.h>
42#include <sys/mman.h>
43#include <sys/mount.h>
44#include <sys/socket.h>
45#include <sys/stat.h>
46#include <sys/wait.h>
47
48#include <machine/sysarch.h>
49
50#include <err.h>
51#include <fcntl.h>
52#include <stdlib.h>
53#include <string.h>
54#include <unistd.h>
55
56#include "cap_test.h"
57
58#define CHECK_SYSCALL_VOID_NOT_ECAPMODE(syscall, ...) do { \
59 errno = 0; \
60 (void)syscall(__VA_ARGS__); \
61 if (errno == ECAPMODE) \
62 FAIL("capmode: %s failed with ECAPMODE", #syscall); \
63} while (0)
64
65int
66test_capmode(void)
67{
68 struct statfs statfs;
69 struct stat sb;
70 long sysarch_arg = 0;
71 int fd_close, fd_dir, fd_file, fd_socket, fd2[2];
72 int success = PASSED;
73 pid_t pid, wpid;
74 char ch;
75
76 /* Open some files to play with. */
77 REQUIRE(fd_file = open("/tmp/cap_capmode", O_RDWR|O_CREAT, 0644));
78 REQUIRE(fd_close = open("/dev/null", O_RDWR));
79 REQUIRE(fd_dir = open("/tmp", O_RDONLY));
80 REQUIRE(fd_socket = socket(PF_INET, SOCK_DGRAM, 0));
81
82 /* Enter capability mode. */
83 REQUIRE(cap_enter());
84
85 /*
86 * System calls that are not permitted in capability mode.
87 */
88 CHECK_CAPMODE(access, "/tmp/cap_capmode_access", F_OK);
89 CHECK_CAPMODE(acct, "/tmp/cap_capmode_acct");
90 CHECK_CAPMODE(bind, PF_INET, NULL, 0);
91 CHECK_CAPMODE(chdir, "/tmp/cap_capmode_chdir");
92 CHECK_CAPMODE(chflags, "/tmp/cap_capmode_chflags", UF_NODUMP);
93 CHECK_CAPMODE(chmod, "/tmp/cap_capmode_chmod", 0644);
94 CHECK_CAPMODE(chown, "/tmp/cap_capmode_chown", -1, -1);
95 CHECK_CAPMODE(chroot, "/tmp/cap_capmode_chroot");
96 CHECK_CAPMODE(connect, PF_INET, NULL, 0);
97 CHECK_CAPMODE(creat, "/tmp/cap_capmode_creat", 0644);
98 CHECK_CAPMODE(fchdir, fd_dir);
99 CHECK_CAPMODE(getfsstat, &statfs, sizeof(statfs), MNT_NOWAIT);
100 CHECK_CAPMODE(link, "/tmp/foo", "/tmp/bar");
101 CHECK_CAPMODE(lstat, "/tmp/cap_capmode_lstat", &sb);
102 CHECK_CAPMODE(mknod, "/tmp/capmode_mknod", 06440, 0);
103 CHECK_CAPMODE(mount, "procfs", "/not_mounted", 0, NULL);
104 CHECK_CAPMODE(open, "/dev/null", O_RDWR);
105 CHECK_CAPMODE(readlink, "/tmp/cap_capmode_readlink", NULL, 0);
106 CHECK_CAPMODE(revoke, "/tmp/cap_capmode_revoke");
107 CHECK_CAPMODE(stat, "/tmp/cap_capmode_stat", &sb);
108 CHECK_CAPMODE(symlink,
109 "/tmp/cap_capmode_symlink_from",
110 "/tmp/cap_capmode_symlink_to");
111 CHECK_CAPMODE(unlink, "/tmp/cap_capmode_unlink");
112 CHECK_CAPMODE(unmount, "/not_mounted", 0);
113
114 /*
115 * System calls that are permitted in capability mode.
116 */
117 CHECK_SYSCALL_SUCCEEDS(close, fd_close);
118 CHECK_SYSCALL_SUCCEEDS(dup, fd_file);
119 CHECK_SYSCALL_SUCCEEDS(fstat, fd_file, &sb);
120 CHECK_SYSCALL_SUCCEEDS(lseek, fd_file, SEEK_SET, 0);
121 CHECK_SYSCALL_SUCCEEDS(msync, &fd_file, 8192, MS_ASYNC);
122 CHECK_SYSCALL_SUCCEEDS(profil, NULL, 0, 0, 0);
123 CHECK_SYSCALL_SUCCEEDS(read, fd_file, &ch, sizeof(ch));
124 CHECK_SYSCALL_SUCCEEDS(recvfrom, fd_socket, NULL, 0, 0, NULL, NULL);
125 CHECK_SYSCALL_SUCCEEDS(setuid, getuid());
126 CHECK_SYSCALL_SUCCEEDS(write, fd_file, &ch, sizeof(ch));
127
128 /*
129 * These calls will fail for lack of e.g. a proper name to send to,
130 * but they are allowed in capability mode, so errno != ECAPMODE.
131 */
132 CHECK_NOT_CAPMODE(accept, fd_socket, NULL, NULL);
133 CHECK_NOT_CAPMODE(getpeername, fd_socket, NULL, NULL);
134 CHECK_NOT_CAPMODE(getsockname, fd_socket, NULL, NULL);
135 CHECK_NOT_CAPMODE(fchflags, fd_file, UF_NODUMP);
136 CHECK_NOT_CAPMODE(recvmsg, fd_socket, NULL, 0);
137 CHECK_NOT_CAPMODE(sendmsg, fd_socket, NULL, 0);
138 CHECK_NOT_CAPMODE(sendto, fd_socket, NULL, 0, 0, NULL, 0);
139
140 /*
141 * System calls which should be allowed in capability mode, but which
142 * don't return errors, and are thus difficult to check.
143 *
144 * We will try anyway, by checking errno.
145 */
146 CHECK_SYSCALL_VOID_NOT_ECAPMODE(getegid);
147 CHECK_SYSCALL_VOID_NOT_ECAPMODE(geteuid);
148 CHECK_SYSCALL_VOID_NOT_ECAPMODE(getgid);
149 CHECK_SYSCALL_VOID_NOT_ECAPMODE(getpid);
150 CHECK_SYSCALL_VOID_NOT_ECAPMODE(getppid);
151 CHECK_SYSCALL_VOID_NOT_ECAPMODE(getuid);
152
153 /*
154 * Finally, tests for system calls that don't fit the pattern very well.
155 */
156 pid = fork();
157 if (pid >= 0) {
158 if (pid == 0) {
159 exit(0);
160 } else if (pid > 0) {
161 wpid = waitpid(pid, NULL, 0);
162 if (wpid < 0) {
163 if (errno != ECAPMODE)
164 FAIL("capmode:waitpid");
165 } else
166 FAIL("capmode:waitpid succeeded");
167 }
168 } else
169 FAIL("capmode:fork");
170
171 if (getlogin() == NULL)
172 FAIL("test_sycalls:getlogin %d", errno);
173
174 if (getsockname(fd_socket, NULL, NULL) < 0) {
175 if (errno == ECAPMODE)
176 FAIL("capmode:getsockname");
177 }
178
179 /* XXXRW: ktrace */
180
181 if (pipe(fd2) == 0) {
182 close(fd2[0]);
183 close(fd2[1]);
184 } else if (errno == ECAPMODE)
185 FAIL("capmode:pipe");
186
187 /* XXXRW: ptrace. */
188
189 /* sysarch() is, by definition, architecture-dependent */
190#if defined (__amd64__) || defined (__i386__)
191 CHECK_CAPMODE(sysarch, I386_SET_IOPERM, &sysarch_arg);
192#else
193 /* XXXJA: write a test for arm */
194 FAIL("capmode:no sysarch() test for current architecture");
195#endif
196
197 /* XXXRW: No error return from sync(2) to test. */
198
199 return (success);
200}