8 #include <sys/select.h>
9 #include <sys/socket.h>
18 #include "capsicum-test.h"
20 /* Utilities for printing rights information */
21 /* Written in C style to allow for: */
22 /* TODO(drysdale): migrate these to somewhere in libcaprights/ */
23 #define RIGHTS_INFO(RR) { (RR), #RR}
28 static right_info known_rights[] = {
29 /* Rights that are common to all versions of Capsicum */
30 RIGHTS_INFO(CAP_READ),
31 RIGHTS_INFO(CAP_WRITE),
32 RIGHTS_INFO(CAP_SEEK_TELL),
33 RIGHTS_INFO(CAP_SEEK),
34 RIGHTS_INFO(CAP_PREAD),
35 RIGHTS_INFO(CAP_PWRITE),
36 RIGHTS_INFO(CAP_MMAP),
37 RIGHTS_INFO(CAP_MMAP_R),
38 RIGHTS_INFO(CAP_MMAP_W),
39 RIGHTS_INFO(CAP_MMAP_X),
40 RIGHTS_INFO(CAP_MMAP_RW),
41 RIGHTS_INFO(CAP_MMAP_RX),
42 RIGHTS_INFO(CAP_MMAP_WX),
43 RIGHTS_INFO(CAP_MMAP_RWX),
44 RIGHTS_INFO(CAP_CREATE),
45 RIGHTS_INFO(CAP_FEXECVE),
46 RIGHTS_INFO(CAP_FSYNC),
47 RIGHTS_INFO(CAP_FTRUNCATE),
48 RIGHTS_INFO(CAP_LOOKUP),
49 RIGHTS_INFO(CAP_FCHDIR),
50 RIGHTS_INFO(CAP_FCHFLAGS),
51 RIGHTS_INFO(CAP_CHFLAGSAT),
52 RIGHTS_INFO(CAP_FCHMOD),
53 RIGHTS_INFO(CAP_FCHMODAT),
54 RIGHTS_INFO(CAP_FCHOWN),
55 RIGHTS_INFO(CAP_FCHOWNAT),
56 RIGHTS_INFO(CAP_FCNTL),
57 RIGHTS_INFO(CAP_FLOCK),
58 RIGHTS_INFO(CAP_FPATHCONF),
59 RIGHTS_INFO(CAP_FSCK),
60 RIGHTS_INFO(CAP_FSTAT),
61 RIGHTS_INFO(CAP_FSTATAT),
62 RIGHTS_INFO(CAP_FSTATFS),
63 RIGHTS_INFO(CAP_FUTIMES),
64 RIGHTS_INFO(CAP_FUTIMESAT),
65 RIGHTS_INFO(CAP_MKDIRAT),
66 RIGHTS_INFO(CAP_MKFIFOAT),
67 RIGHTS_INFO(CAP_MKNODAT),
68 RIGHTS_INFO(CAP_RENAMEAT_SOURCE),
69 RIGHTS_INFO(CAP_SYMLINKAT),
70 RIGHTS_INFO(CAP_UNLINKAT),
71 RIGHTS_INFO(CAP_ACCEPT),
72 RIGHTS_INFO(CAP_BIND),
73 RIGHTS_INFO(CAP_CONNECT),
74 RIGHTS_INFO(CAP_GETPEERNAME),
75 RIGHTS_INFO(CAP_GETSOCKNAME),
76 RIGHTS_INFO(CAP_GETSOCKOPT),
77 RIGHTS_INFO(CAP_LISTEN),
78 RIGHTS_INFO(CAP_PEELOFF),
79 RIGHTS_INFO(CAP_RECV),
80 RIGHTS_INFO(CAP_SEND),
81 RIGHTS_INFO(CAP_SETSOCKOPT),
82 RIGHTS_INFO(CAP_SHUTDOWN),
83 RIGHTS_INFO(CAP_BINDAT),
84 RIGHTS_INFO(CAP_CONNECTAT),
85 RIGHTS_INFO(CAP_LINKAT_SOURCE),
86 RIGHTS_INFO(CAP_RENAMEAT_TARGET),
87 RIGHTS_INFO(CAP_SOCK_CLIENT),
88 RIGHTS_INFO(CAP_SOCK_SERVER),
89 RIGHTS_INFO(CAP_MAC_GET),
90 RIGHTS_INFO(CAP_MAC_SET),
91 RIGHTS_INFO(CAP_SEM_GETVALUE),
92 RIGHTS_INFO(CAP_SEM_POST),
93 RIGHTS_INFO(CAP_SEM_WAIT),
94 RIGHTS_INFO(CAP_EVENT),
95 RIGHTS_INFO(CAP_KQUEUE_EVENT),
96 RIGHTS_INFO(CAP_IOCTL),
97 RIGHTS_INFO(CAP_TTYHOOK),
98 RIGHTS_INFO(CAP_PDWAIT),
99 RIGHTS_INFO(CAP_PDGETPID),
100 RIGHTS_INFO(CAP_PDKILL),
101 RIGHTS_INFO(CAP_EXTATTR_DELETE),
102 RIGHTS_INFO(CAP_EXTATTR_GET),
103 RIGHTS_INFO(CAP_EXTATTR_LIST),
104 RIGHTS_INFO(CAP_EXTATTR_SET),
105 RIGHTS_INFO(CAP_ACL_CHECK),
106 RIGHTS_INFO(CAP_ACL_DELETE),
107 RIGHTS_INFO(CAP_ACL_GET),
108 RIGHTS_INFO(CAP_ACL_SET),
109 RIGHTS_INFO(CAP_KQUEUE_CHANGE),
110 RIGHTS_INFO(CAP_KQUEUE),
111 /* Rights that are only present in some version or some OS, and so are #ifdef'ed */
112 /* LINKAT got split */
114 RIGHTS_INFO(CAP_LINKAT),
116 #ifdef CAP_LINKAT_SOURCE
117 RIGHTS_INFO(CAP_LINKAT_SOURCE),
119 #ifdef CAP_LINKAT_TARGET
120 RIGHTS_INFO(CAP_LINKAT_TARGET),
122 /* Linux aliased some FD operations for pdgetpid/pdkill */
123 #ifdef CAP_PDGETPID_FREEBSD
124 RIGHTS_INFO(CAP_PDGETPID_FREEBSD),
126 #ifdef CAP_PDKILL_FREEBSD
127 RIGHTS_INFO(CAP_PDKILL_FREEBSD),
129 /* Linux-specific rights */
131 RIGHTS_INFO(CAP_FSIGNAL),
134 RIGHTS_INFO(CAP_EPOLL_CTL),
137 RIGHTS_INFO(CAP_NOTIFY),
140 RIGHTS_INFO(CAP_SETNS),
143 RIGHTS_INFO(CAP_PERFMON),
146 RIGHTS_INFO(CAP_BPF),
148 /* Rights in later versions of FreeBSD (>10.0) */
151 void ShowCapRights(FILE *out, int fd) {
155 CAP_SET_NONE(&rights);
156 if (cap_rights_get(fd, &rights) < 0) {
157 fprintf(out, "Failed to get rights for fd %d: errno %d\n", fd, errno);
161 /* First print out all known rights */
162 size_t num_known = (sizeof(known_rights)/sizeof(known_rights[0]));
163 for (ii = 0; ii < num_known; ii++) {
164 if (cap_rights_is_set(&rights, known_rights[ii].right)) {
165 if (!first) fprintf(out, ",");
167 fprintf(out, "%s", known_rights[ii].name);
170 /* Now repeat the loop, clearing rights we know of; this needs to be
171 * a separate loop because some named rights overlap.
173 for (ii = 0; ii < num_known; ii++) {
174 cap_rights_clear(&rights, known_rights[ii].right);
176 /* The following relies on the internal structure of cap_rights_t to
177 * try to show rights we don't know about. */
178 for (ii = 0; ii < (size_t)CAPARSIZE(&rights); ii++) {
179 uint64_t bits = (rights.cr_rights[0] & 0x01ffffffffffffffULL);
182 for (which = 1; which < 0x0200000000000000 ; which <<= 1) {
184 if (!first) fprintf(out, ",");
185 fprintf(out, "CAP_RIGHT(%d, 0x%016llxULL)", (int)ii, (long long unsigned)which);
193 void ShowAllCapRights(FILE *out) {
195 struct rlimit limits;
196 if (getrlimit(RLIMIT_NOFILE, &limits) != 0) {
197 fprintf(out, "Failed to getrlimit for max FDs: errno %d\n", errno);
200 for (fd = 0; fd < (int)limits.rlim_cur; fd++) {
201 if (fcntl(fd, F_GETFD, 0) != 0) {
204 fprintf(out, "fd %d: ", fd);
205 ShowCapRights(out, fd);
209 FORK_TEST(Capability, CapNew) {
211 cap_rights_init(&r_rws, CAP_READ, CAP_WRITE, CAP_SEEK);
215 int cap_fd = dup(STDOUT_FILENO);
217 CAP_SET_NONE(&rights);
218 EXPECT_OK(cap_rights_get(cap_fd, &rights));
219 EXPECT_RIGHTS_EQ(&r_all, &rights);
222 EXPECT_OK(cap_rights_limit(cap_fd, &r_rws));
223 if (cap_fd < 0) return;
224 int rc = write(cap_fd, "OK!\n", 4);
227 EXPECT_OK(cap_rights_get(cap_fd, &rights));
228 EXPECT_RIGHTS_EQ(&r_rws, &rights);
230 // dup/dup2 should preserve rights.
231 int cap_dup = dup(cap_fd);
233 EXPECT_OK(cap_rights_get(cap_dup, &rights));
234 EXPECT_RIGHTS_EQ(&r_rws, &rights);
236 EXPECT_OK(dup2(cap_fd, cap_dup));
237 EXPECT_OK(cap_rights_get(cap_dup, &rights));
238 EXPECT_RIGHTS_EQ(&r_rws, &rights);
241 EXPECT_OK(dup3(cap_fd, cap_dup, 0));
242 EXPECT_OK(cap_rights_get(cap_dup, &rights));
243 EXPECT_RIGHTS_EQ(&r_rws, &rights);
247 // Try to get a disjoint set of rights in a sub-capability.
249 cap_rights_init(&r_rs, CAP_READ, CAP_SEEK);
250 cap_rights_t r_rsmapchmod;
251 cap_rights_init(&r_rsmapchmod, CAP_READ, CAP_SEEK, CAP_MMAP, CAP_FCHMOD);
252 int cap_cap_fd = dup(cap_fd);
253 EXPECT_OK(cap_cap_fd);
254 EXPECT_NOTCAPABLE(cap_rights_limit(cap_cap_fd, &r_rsmapchmod));
256 // Dump rights info to stderr (mostly to ensure that Show[All]CapRights()
258 ShowAllCapRights(stderr);
260 EXPECT_OK(close(cap_fd));
263 FORK_TEST(Capability, CapEnter) {
264 EXPECT_EQ(0, cap_enter());
267 FORK_TEST(Capability, BasicInterception) {
269 cap_rights_init(&r_0, 0);
272 EXPECT_OK(cap_rights_limit(cap_fd, &r_0));
274 EXPECT_NOTCAPABLE(write(cap_fd, "", 0));
276 EXPECT_OK(cap_enter()); // Enter capability mode
278 EXPECT_NOTCAPABLE(write(cap_fd, "", 0));
280 // Create a new capability which does have write permission
282 cap_rights_init(&r_ws, CAP_WRITE, CAP_SEEK);
283 int cap_fd2 = dup(1);
285 EXPECT_OK(cap_rights_limit(cap_fd2, &r_ws));
286 EXPECT_OK(write(cap_fd2, "", 0));
289 if (cap_fd >= 0) close(cap_fd);
290 if (cap_fd2 >= 0) close(cap_fd2);
293 FORK_TEST_ON(Capability, OpenAtDirectoryTraversal, TmpFile("cap_openat_testfile")) {
294 int dir = open(tmpdir.c_str(), O_RDONLY);
299 int file = openat(dir, "cap_openat_testfile", O_RDONLY|O_CREAT, 0644);
302 // Test that we are confined to /tmp, and cannot
303 // escape using absolute paths or ../.
304 int new_file = openat(dir, "../dev/null", O_RDONLY);
305 EXPECT_EQ(-1, new_file);
307 new_file = openat(dir, "..", O_RDONLY);
308 EXPECT_EQ(-1, new_file);
310 new_file = openat(dir, "/dev/null", O_RDONLY);
311 EXPECT_EQ(-1, new_file);
313 new_file = openat(dir, "/", O_RDONLY);
314 EXPECT_EQ(-1, new_file);
321 FORK_TEST_ON(Capability, FileInSync, TmpFile("cap_file_sync")) {
322 int fd = open(TmpFile("cap_file_sync"), O_RDWR|O_CREAT, 0644);
324 const char* message = "Hello capability world";
325 EXPECT_OK(write(fd, message, strlen(message)));
327 cap_rights_t r_rsstat;
328 cap_rights_init(&r_rsstat, CAP_READ, CAP_SEEK, CAP_FSTAT);
330 int cap_fd = dup(fd);
332 EXPECT_OK(cap_rights_limit(cap_fd, &r_rsstat));
333 int cap_cap_fd = dup(cap_fd);
334 EXPECT_OK(cap_cap_fd);
335 EXPECT_OK(cap_rights_limit(cap_cap_fd, &r_rsstat));
337 EXPECT_OK(cap_enter()); // Enter capability mode.
339 // Changes to one file descriptor affect the others.
340 EXPECT_EQ(1, lseek(fd, 1, SEEK_SET));
341 EXPECT_EQ(1, lseek(fd, 0, SEEK_CUR));
342 EXPECT_EQ(1, lseek(cap_fd, 0, SEEK_CUR));
343 EXPECT_EQ(1, lseek(cap_cap_fd, 0, SEEK_CUR));
344 EXPECT_EQ(3, lseek(cap_fd, 3, SEEK_SET));
345 EXPECT_EQ(3, lseek(fd, 0, SEEK_CUR));
346 EXPECT_EQ(3, lseek(cap_fd, 0, SEEK_CUR));
347 EXPECT_EQ(3, lseek(cap_cap_fd, 0, SEEK_CUR));
348 EXPECT_EQ(5, lseek(cap_cap_fd, 5, SEEK_SET));
349 EXPECT_EQ(5, lseek(fd, 0, SEEK_CUR));
350 EXPECT_EQ(5, lseek(cap_fd, 0, SEEK_CUR));
351 EXPECT_EQ(5, lseek(cap_cap_fd, 0, SEEK_CUR));
358 // Create a capability on /tmp that does not allow CAP_WRITE,
359 // and check that this restriction is inherited through openat().
360 FORK_TEST_ON(Capability, Inheritance, TmpFile("cap_openat_write_testfile")) {
361 int dir = open(tmpdir.c_str(), O_RDONLY);
365 cap_rights_init(&r_rl, CAP_READ, CAP_LOOKUP);
367 int cap_dir = dup(dir);
369 EXPECT_OK(cap_rights_limit(cap_dir, &r_rl));
371 const char *filename = "cap_openat_write_testfile";
372 int file = openat(dir, filename, O_WRONLY|O_CREAT, 0644);
374 EXPECT_EQ(5, write(file, "TEST\n", 5));
375 if (file >= 0) close(file);
377 EXPECT_OK(cap_enter());
378 file = openat(cap_dir, filename, O_RDONLY);
382 cap_rights_init(&rights, 0);
383 EXPECT_OK(cap_rights_get(file, &rights));
384 EXPECT_RIGHTS_EQ(&r_rl, &rights);
385 if (file >= 0) close(file);
387 file = openat(cap_dir, filename, O_WRONLY|O_APPEND);
388 EXPECT_NOTCAPABLE(file);
389 if (file > 0) close(file);
391 if (dir > 0) close(dir);
392 if (cap_dir > 0) close(cap_dir);
396 // Ensure that, if the capability had enough rights for the system call to
397 // pass, then it did. Otherwise, ensure that the errno is ENOTCAPABLE;
398 // capability restrictions should kick in before any other error logic.
399 #define CHECK_RIGHT_RESULT(result, rights, ...) do { \
400 cap_rights_t rights_needed; \
401 cap_rights_init(&rights_needed, __VA_ARGS__); \
402 if (cap_rights_contains(&rights, &rights_needed)) { \
403 EXPECT_OK(result) << std::endl \
404 << " need: " << rights_needed \
406 << " got: " << rights; \
408 EXPECT_EQ(-1, result) << " need: " << rights_needed \
410 << " got: "<< rights; \
411 EXPECT_EQ(ENOTCAPABLE, errno); \
415 #define EXPECT_MMAP_NOTCAPABLE(result) do { \
417 EXPECT_EQ(MAP_FAILED, rv); \
418 EXPECT_EQ(ENOTCAPABLE, errno); \
419 if (rv != MAP_FAILED) munmap(rv, getpagesize()); \
422 #define EXPECT_MMAP_OK(result) do { \
424 EXPECT_NE(MAP_FAILED, rv) << " with errno " << errno; \
425 if (rv != MAP_FAILED) munmap(rv, getpagesize()); \
429 // As above, but for the special mmap() case: unmap after successful mmap().
430 #define CHECK_RIGHT_MMAP_RESULT(result, rights, ...) do { \
431 cap_rights_t rights_needed; \
432 cap_rights_init(&rights_needed, __VA_ARGS__); \
433 if (cap_rights_contains(&rights, &rights_needed)) { \
434 EXPECT_MMAP_OK(result); \
436 EXPECT_MMAP_NOTCAPABLE(result); \
440 FORK_TEST_ON(Capability, Mmap, TmpFile("cap_mmap_operations")) {
441 int fd = open(TmpFile("cap_mmap_operations"), O_RDWR | O_CREAT, 0644);
446 cap_rights_init(&r_0, 0);
448 cap_rights_init(&r_mmap, CAP_MMAP);
450 cap_rights_init(&r_r, CAP_PREAD);
451 cap_rights_t r_rmmap;
452 cap_rights_init(&r_rmmap, CAP_PREAD, CAP_MMAP);
454 // If we're missing a capability, it will fail.
455 int cap_none = dup(fd);
457 EXPECT_OK(cap_rights_limit(cap_none, &r_0));
458 int cap_mmap = dup(fd);
460 EXPECT_OK(cap_rights_limit(cap_mmap, &r_mmap));
461 int cap_read = dup(fd);
463 EXPECT_OK(cap_rights_limit(cap_read, &r_r));
464 int cap_both = dup(fd);
466 EXPECT_OK(cap_rights_limit(cap_both, &r_rmmap));
468 EXPECT_OK(cap_enter()); // Enter capability mode.
470 EXPECT_MMAP_NOTCAPABLE(mmap(NULL, getpagesize(), PROT_READ, MAP_PRIVATE, cap_none, 0));
471 EXPECT_MMAP_NOTCAPABLE(mmap(NULL, getpagesize(), PROT_READ, MAP_PRIVATE, cap_mmap, 0));
472 EXPECT_MMAP_NOTCAPABLE(mmap(NULL, getpagesize(), PROT_READ, MAP_PRIVATE, cap_read, 0));
474 EXPECT_MMAP_OK(mmap(NULL, getpagesize(), PROT_READ, MAP_PRIVATE, cap_both, 0));
476 // A call with MAP_ANONYMOUS should succeed without any capability requirements.
477 EXPECT_MMAP_OK(mmap(NULL, getpagesize(), PROT_READ, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0));
479 EXPECT_OK(close(cap_both));
480 EXPECT_OK(close(cap_read));
481 EXPECT_OK(close(cap_mmap));
482 EXPECT_OK(close(cap_none));
483 EXPECT_OK(close(fd));
486 // Given a file descriptor, create a capability with specific rights and
487 // make sure only those rights work.
488 #define TRY_FILE_OPS(fd, ...) do { \
489 cap_rights_t rights; \
490 cap_rights_init(&rights, __VA_ARGS__); \
491 TryFileOps((fd), rights); \
494 static void TryFileOps(int fd, cap_rights_t rights) {
495 int cap_fd = dup(fd);
497 EXPECT_OK(cap_rights_limit(cap_fd, &rights));
498 if (cap_fd < 0) return;
499 cap_rights_t erights;
500 EXPECT_OK(cap_rights_get(cap_fd, &erights));
501 EXPECT_RIGHTS_EQ(&rights, &erights);
503 // Check creation of a capability from a capability.
504 int cap_cap_fd = dup(cap_fd);
505 EXPECT_OK(cap_cap_fd);
506 EXPECT_OK(cap_rights_limit(cap_cap_fd, &rights));
507 EXPECT_NE(cap_fd, cap_cap_fd);
508 EXPECT_OK(cap_rights_get(cap_cap_fd, &erights));
509 EXPECT_RIGHTS_EQ(&rights, &erights);
513 CHECK_RIGHT_RESULT(read(cap_fd, &ch, sizeof(ch)), rights, CAP_READ, CAP_SEEK_ASWAS);
515 ssize_t len1 = pread(cap_fd, &ch, sizeof(ch), 0);
516 CHECK_RIGHT_RESULT(len1, rights, CAP_PREAD);
517 ssize_t len2 = pread(cap_fd, &ch, sizeof(ch), 0);
518 CHECK_RIGHT_RESULT(len2, rights, CAP_PREAD);
519 EXPECT_EQ(len1, len2);
521 CHECK_RIGHT_RESULT(write(cap_fd, &ch, sizeof(ch)), rights, CAP_WRITE, CAP_SEEK_ASWAS);
522 CHECK_RIGHT_RESULT(pwrite(cap_fd, &ch, sizeof(ch), 0), rights, CAP_PWRITE);
523 CHECK_RIGHT_RESULT(lseek(cap_fd, 0, SEEK_SET), rights, CAP_SEEK);
526 // Note: this is not expected to work over NFS.
528 EXPECT_OK(fstatfs(fd, &sf));
529 bool is_nfs = (strncmp("nfs", sf.f_fstypename, sizeof(sf.f_fstypename)) == 0);
531 CHECK_RIGHT_RESULT(fchflags(cap_fd, UF_NODUMP), rights, CAP_FCHFLAGS);
535 CHECK_RIGHT_MMAP_RESULT(mmap(NULL, getpagesize(), PROT_NONE, MAP_SHARED, cap_fd, 0),
537 CHECK_RIGHT_MMAP_RESULT(mmap(NULL, getpagesize(), PROT_READ, MAP_SHARED, cap_fd, 0),
539 CHECK_RIGHT_MMAP_RESULT(mmap(NULL, getpagesize(), PROT_WRITE, MAP_SHARED, cap_fd, 0),
541 CHECK_RIGHT_MMAP_RESULT(mmap(NULL, getpagesize(), PROT_EXEC, MAP_SHARED, cap_fd, 0),
543 CHECK_RIGHT_MMAP_RESULT(mmap(NULL, getpagesize(), PROT_READ | PROT_WRITE, MAP_SHARED, cap_fd, 0),
544 rights, CAP_MMAP_RW);
545 CHECK_RIGHT_MMAP_RESULT(mmap(NULL, getpagesize(), PROT_READ | PROT_EXEC, MAP_SHARED, cap_fd, 0),
546 rights, CAP_MMAP_RX);
547 CHECK_RIGHT_MMAP_RESULT(mmap(NULL, getpagesize(), PROT_EXEC | PROT_WRITE, MAP_SHARED, cap_fd, 0),
548 rights, CAP_MMAP_WX);
549 CHECK_RIGHT_MMAP_RESULT(mmap(NULL, getpagesize(), PROT_READ | PROT_WRITE | PROT_EXEC, MAP_SHARED, cap_fd, 0),
550 rights, CAP_MMAP_RWX);
552 CHECK_RIGHT_RESULT(fsync(cap_fd), rights, CAP_FSYNC);
553 #ifdef HAVE_SYNC_FILE_RANGE
554 CHECK_RIGHT_RESULT(sync_file_range(cap_fd, 0, 1, 0), rights, CAP_FSYNC, CAP_SEEK);
557 int rc = fcntl(cap_fd, F_GETFL);
558 CHECK_RIGHT_RESULT(rc, rights, CAP_FCNTL);
559 rc = fcntl(cap_fd, F_SETFL, rc);
560 CHECK_RIGHT_RESULT(rc, rights, CAP_FCNTL);
562 CHECK_RIGHT_RESULT(fchown(cap_fd, -1, -1), rights, CAP_FCHOWN);
564 CHECK_RIGHT_RESULT(fchmod(cap_fd, 0644), rights, CAP_FCHMOD);
566 CHECK_RIGHT_RESULT(flock(cap_fd, LOCK_SH), rights, CAP_FLOCK);
567 CHECK_RIGHT_RESULT(flock(cap_fd, LOCK_UN), rights, CAP_FLOCK);
569 CHECK_RIGHT_RESULT(ftruncate(cap_fd, 0), rights, CAP_FTRUNCATE);
572 CHECK_RIGHT_RESULT(fstat(cap_fd, &sb), rights, CAP_FSTAT);
574 struct statfs cap_sf;
575 CHECK_RIGHT_RESULT(fstatfs(cap_fd, &cap_sf), rights, CAP_FSTATFS);
577 #ifdef HAVE_FPATHCONF
578 CHECK_RIGHT_RESULT(fpathconf(cap_fd, _PC_NAME_MAX), rights, CAP_FPATHCONF);
581 CHECK_RIGHT_RESULT(futimes(cap_fd, NULL), rights, CAP_FUTIMES);
583 struct pollfd pollfd;
585 pollfd.events = POLLIN | POLLERR | POLLHUP;
587 int ret = poll(&pollfd, 1, 0);
588 if (cap_rights_is_set(&rights, CAP_EVENT)) {
591 EXPECT_NE(0, (pollfd.revents & POLLNVAL));
599 FD_SET(cap_fd, &rset);
602 FD_SET(cap_fd, &wset);
603 ret = select(cap_fd+1, &rset, &wset, NULL, &tv);
604 if (cap_rights_is_set(&rights, CAP_EVENT)) {
607 EXPECT_NOTCAPABLE(ret);
610 // TODO(FreeBSD): kqueue
612 EXPECT_OK(close(cap_fd));
615 FORK_TEST_ON(Capability, Operations, TmpFile("cap_fd_operations")) {
616 int fd = open(TmpFile("cap_fd_operations"), O_RDWR | O_CREAT, 0644);
620 EXPECT_OK(cap_enter()); // Enter capability mode.
622 // Try a variety of different combinations of rights - a full
623 // enumeration is too large (2^N with N~30+) to perform.
624 TRY_FILE_OPS(fd, CAP_READ);
625 TRY_FILE_OPS(fd, CAP_PREAD);
626 TRY_FILE_OPS(fd, CAP_WRITE);
627 TRY_FILE_OPS(fd, CAP_PWRITE);
628 TRY_FILE_OPS(fd, CAP_READ, CAP_WRITE);
629 TRY_FILE_OPS(fd, CAP_PREAD, CAP_PWRITE);
630 TRY_FILE_OPS(fd, CAP_SEEK);
631 TRY_FILE_OPS(fd, CAP_FCHFLAGS);
632 TRY_FILE_OPS(fd, CAP_IOCTL);
633 TRY_FILE_OPS(fd, CAP_FSTAT);
634 TRY_FILE_OPS(fd, CAP_MMAP);
635 TRY_FILE_OPS(fd, CAP_MMAP_R);
636 TRY_FILE_OPS(fd, CAP_MMAP_W);
637 TRY_FILE_OPS(fd, CAP_MMAP_X);
638 TRY_FILE_OPS(fd, CAP_MMAP_RW);
639 TRY_FILE_OPS(fd, CAP_MMAP_RX);
640 TRY_FILE_OPS(fd, CAP_MMAP_WX);
641 TRY_FILE_OPS(fd, CAP_MMAP_RWX);
642 TRY_FILE_OPS(fd, CAP_FCNTL);
643 TRY_FILE_OPS(fd, CAP_EVENT);
644 TRY_FILE_OPS(fd, CAP_FSYNC);
645 TRY_FILE_OPS(fd, CAP_FCHOWN);
646 TRY_FILE_OPS(fd, CAP_FCHMOD);
647 TRY_FILE_OPS(fd, CAP_FTRUNCATE);
648 TRY_FILE_OPS(fd, CAP_FLOCK);
649 TRY_FILE_OPS(fd, CAP_FSTATFS);
650 TRY_FILE_OPS(fd, CAP_FPATHCONF);
651 TRY_FILE_OPS(fd, CAP_FUTIMES);
652 TRY_FILE_OPS(fd, CAP_ACL_GET);
653 TRY_FILE_OPS(fd, CAP_ACL_SET);
654 TRY_FILE_OPS(fd, CAP_ACL_DELETE);
655 TRY_FILE_OPS(fd, CAP_ACL_CHECK);
656 TRY_FILE_OPS(fd, CAP_EXTATTR_GET);
657 TRY_FILE_OPS(fd, CAP_EXTATTR_SET);
658 TRY_FILE_OPS(fd, CAP_EXTATTR_DELETE);
659 TRY_FILE_OPS(fd, CAP_EXTATTR_LIST);
660 TRY_FILE_OPS(fd, CAP_MAC_GET);
661 TRY_FILE_OPS(fd, CAP_MAC_SET);
664 TRY_FILE_OPS(fd, CAP_GETPEERNAME);
665 TRY_FILE_OPS(fd, CAP_GETSOCKNAME);
666 TRY_FILE_OPS(fd, CAP_ACCEPT);
671 #define TRY_DIR_OPS(dfd, ...) do { \
672 cap_rights_t rights; \
673 cap_rights_init(&rights, __VA_ARGS__); \
674 TryDirOps((dfd), rights); \
677 static void TryDirOps(int dirfd, cap_rights_t rights) {
678 cap_rights_t erights;
679 int dfd_cap = dup(dirfd);
681 EXPECT_OK(cap_rights_limit(dfd_cap, &rights));
682 EXPECT_OK(cap_rights_get(dfd_cap, &erights));
683 EXPECT_RIGHTS_EQ(&rights, &erights);
685 int rc = openat(dfd_cap, "cap_create", O_CREAT | O_RDONLY, 0600);
686 CHECK_RIGHT_RESULT(rc, rights, CAP_CREATE, CAP_READ, CAP_LOOKUP);
688 EXPECT_OK(close(rc));
689 EXPECT_OK(unlinkat(dirfd, "cap_create", 0));
691 rc = openat(dfd_cap, "cap_create", O_CREAT | O_WRONLY | O_APPEND, 0600);
692 CHECK_RIGHT_RESULT(rc, rights, CAP_CREATE, CAP_WRITE, CAP_LOOKUP);
694 EXPECT_OK(close(rc));
695 EXPECT_OK(unlinkat(dirfd, "cap_create", 0));
697 rc = openat(dfd_cap, "cap_create", O_CREAT | O_RDWR | O_APPEND, 0600);
698 CHECK_RIGHT_RESULT(rc, rights, CAP_CREATE, CAP_READ, CAP_WRITE, CAP_LOOKUP);
700 EXPECT_OK(close(rc));
701 EXPECT_OK(unlinkat(dirfd, "cap_create", 0));
704 rc = openat(dirfd, "cap_faccess", O_CREAT, 0600);
706 EXPECT_OK(close(rc));
707 rc = faccessat(dfd_cap, "cap_faccess", F_OK, 0);
708 CHECK_RIGHT_RESULT(rc, rights, CAP_FSTAT, CAP_LOOKUP);
709 EXPECT_OK(unlinkat(dirfd, "cap_faccess", 0));
711 rc = openat(dirfd, "cap_fsync", O_CREAT, 0600);
713 EXPECT_OK(close(rc));
714 rc = openat(dfd_cap, "cap_fsync", O_FSYNC | O_RDONLY);
715 CHECK_RIGHT_RESULT(rc, rights, CAP_FSYNC, CAP_READ, CAP_LOOKUP);
717 EXPECT_OK(close(rc));
719 rc = openat(dfd_cap, "cap_fsync", O_FSYNC | O_WRONLY | O_APPEND);
720 CHECK_RIGHT_RESULT(rc, rights, CAP_FSYNC, CAP_WRITE, CAP_LOOKUP);
722 EXPECT_OK(close(rc));
724 rc = openat(dfd_cap, "cap_fsync", O_FSYNC | O_RDWR | O_APPEND);
725 CHECK_RIGHT_RESULT(rc, rights, CAP_FSYNC, CAP_READ, CAP_WRITE, CAP_LOOKUP);
727 EXPECT_OK(close(rc));
729 rc = openat(dfd_cap, "cap_fsync", O_SYNC | O_RDONLY);
730 CHECK_RIGHT_RESULT(rc, rights, CAP_FSYNC, CAP_READ, CAP_LOOKUP);
732 EXPECT_OK(close(rc));
734 rc = openat(dfd_cap, "cap_fsync", O_SYNC | O_WRONLY | O_APPEND);
735 CHECK_RIGHT_RESULT(rc, rights, CAP_FSYNC, CAP_WRITE, CAP_LOOKUP);
737 EXPECT_OK(close(rc));
739 rc = openat(dfd_cap, "cap_fsync", O_SYNC | O_RDWR | O_APPEND);
740 CHECK_RIGHT_RESULT(rc, rights, CAP_FSYNC, CAP_READ, CAP_WRITE, CAP_LOOKUP);
742 EXPECT_OK(close(rc));
744 EXPECT_OK(unlinkat(dirfd, "cap_fsync", 0));
746 rc = openat(dirfd, "cap_ftruncate", O_CREAT, 0600);
748 EXPECT_OK(close(rc));
749 rc = openat(dfd_cap, "cap_ftruncate", O_TRUNC | O_RDONLY);
750 CHECK_RIGHT_RESULT(rc, rights, CAP_FTRUNCATE, CAP_READ, CAP_LOOKUP);
752 EXPECT_OK(close(rc));
754 rc = openat(dfd_cap, "cap_ftruncate", O_TRUNC | O_WRONLY);
755 CHECK_RIGHT_RESULT(rc, rights, CAP_FTRUNCATE, CAP_WRITE, CAP_LOOKUP);
757 EXPECT_OK(close(rc));
759 rc = openat(dfd_cap, "cap_ftruncate", O_TRUNC | O_RDWR);
760 CHECK_RIGHT_RESULT(rc, rights, CAP_FTRUNCATE, CAP_READ, CAP_WRITE, CAP_LOOKUP);
762 EXPECT_OK(close(rc));
764 EXPECT_OK(unlinkat(dirfd, "cap_ftruncate", 0));
766 rc = openat(dfd_cap, "cap_create", O_CREAT | O_WRONLY, 0600);
767 CHECK_RIGHT_RESULT(rc, rights, CAP_CREATE, CAP_WRITE, CAP_SEEK, CAP_LOOKUP);
769 EXPECT_OK(close(rc));
770 EXPECT_OK(unlinkat(dirfd, "cap_create", 0));
772 rc = openat(dfd_cap, "cap_create", O_CREAT | O_RDWR, 0600);
773 CHECK_RIGHT_RESULT(rc, rights, CAP_CREATE, CAP_READ, CAP_WRITE, CAP_SEEK, CAP_LOOKUP);
775 EXPECT_OK(close(rc));
776 EXPECT_OK(unlinkat(dirfd, "cap_create", 0));
779 rc = openat(dirfd, "cap_fsync", O_CREAT, 0600);
781 EXPECT_OK(close(rc));
782 rc = openat(dfd_cap, "cap_fsync", O_FSYNC | O_WRONLY);
783 CHECK_RIGHT_RESULT(rc,
784 rights, CAP_FSYNC, CAP_WRITE, CAP_SEEK, CAP_LOOKUP);
786 EXPECT_OK(close(rc));
788 rc = openat(dfd_cap, "cap_fsync", O_FSYNC | O_RDWR);
789 CHECK_RIGHT_RESULT(rc,
790 rights, CAP_FSYNC, CAP_READ, CAP_WRITE, CAP_SEEK, CAP_LOOKUP);
792 EXPECT_OK(close(rc));
794 rc = openat(dfd_cap, "cap_fsync", O_SYNC | O_WRONLY);
795 CHECK_RIGHT_RESULT(rc,
796 rights, CAP_FSYNC, CAP_WRITE, CAP_SEEK, CAP_LOOKUP);
798 EXPECT_OK(close(rc));
800 rc = openat(dfd_cap, "cap_fsync", O_SYNC | O_RDWR);
801 CHECK_RIGHT_RESULT(rc,
802 rights, CAP_FSYNC, CAP_READ, CAP_WRITE, CAP_SEEK, CAP_LOOKUP);
804 EXPECT_OK(close(rc));
806 EXPECT_OK(unlinkat(dirfd, "cap_fsync", 0));
808 #ifdef HAVE_CHFLAGSAT
809 rc = openat(dirfd, "cap_chflagsat", O_CREAT, 0600);
811 EXPECT_OK(close(rc));
812 rc = chflagsat(dfd_cap, "cap_chflagsat", UF_NODUMP, 0);
813 CHECK_RIGHT_RESULT(rc, rights, CAP_CHFLAGSAT, CAP_LOOKUP);
814 EXPECT_OK(unlinkat(dirfd, "cap_chflagsat", 0));
817 rc = openat(dirfd, "cap_fchownat", O_CREAT, 0600);
819 EXPECT_OK(close(rc));
820 rc = fchownat(dfd_cap, "cap_fchownat", -1, -1, 0);
821 CHECK_RIGHT_RESULT(rc, rights, CAP_FCHOWN, CAP_LOOKUP);
822 EXPECT_OK(unlinkat(dirfd, "cap_fchownat", 0));
824 rc = openat(dirfd, "cap_fchmodat", O_CREAT, 0600);
826 EXPECT_OK(close(rc));
827 rc = fchmodat(dfd_cap, "cap_fchmodat", 0600, 0);
828 CHECK_RIGHT_RESULT(rc, rights, CAP_FCHMOD, CAP_LOOKUP);
829 EXPECT_OK(unlinkat(dirfd, "cap_fchmodat", 0));
831 rc = openat(dirfd, "cap_fstatat", O_CREAT, 0600);
833 EXPECT_OK(close(rc));
835 rc = fstatat(dfd_cap, "cap_fstatat", &sb, 0);
836 CHECK_RIGHT_RESULT(rc, rights, CAP_FSTAT, CAP_LOOKUP);
837 EXPECT_OK(unlinkat(dirfd, "cap_fstatat", 0));
839 rc = openat(dirfd, "cap_futimesat", O_CREAT, 0600);
841 EXPECT_OK(close(rc));
842 rc = futimesat(dfd_cap, "cap_futimesat", NULL);
843 CHECK_RIGHT_RESULT(rc, rights, CAP_FUTIMES, CAP_LOOKUP);
844 EXPECT_OK(unlinkat(dirfd, "cap_futimesat", 0));
846 // For linkat(2), need:
847 // - CAP_LINKAT_SOURCE on source
848 // - CAP_LINKAT_TARGET on destination.
849 rc = openat(dirfd, "cap_linkat_src", O_CREAT, 0600);
851 EXPECT_OK(close(rc));
853 rc = linkat(dirfd, "cap_linkat_src", dfd_cap, "cap_linkat_dst", 0);
854 CHECK_RIGHT_RESULT(rc, rights, CAP_LINKAT_TARGET);
856 EXPECT_OK(unlinkat(dirfd, "cap_linkat_dst", 0));
859 rc = linkat(dfd_cap, "cap_linkat_src", dirfd, "cap_linkat_dst", 0);
860 CHECK_RIGHT_RESULT(rc, rights, CAP_LINKAT_SOURCE);
862 EXPECT_OK(unlinkat(dirfd, "cap_linkat_dst", 0));
865 EXPECT_OK(unlinkat(dirfd, "cap_linkat_src", 0));
867 rc = mkdirat(dfd_cap, "cap_mkdirat", 0700);
868 CHECK_RIGHT_RESULT(rc, rights, CAP_MKDIRAT, CAP_LOOKUP);
870 EXPECT_OK(unlinkat(dirfd, "cap_mkdirat", AT_REMOVEDIR));
874 rc = mkfifoat(dfd_cap, "cap_mkfifoat", 0600);
875 CHECK_RIGHT_RESULT(rc, rights, CAP_MKFIFOAT, CAP_LOOKUP);
877 EXPECT_OK(unlinkat(dirfd, "cap_mkfifoat", 0));
882 rc = mknodat(dfd_cap, "cap_mknodat", S_IFCHR | 0600, 0);
883 CHECK_RIGHT_RESULT(rc, rights, CAP_MKNODAT, CAP_LOOKUP);
885 EXPECT_OK(unlinkat(dirfd, "cap_mknodat", 0));
889 // For renameat(2), need:
890 // - CAP_RENAMEAT_SOURCE on source
891 // - CAP_RENAMEAT_TARGET on destination.
892 rc = openat(dirfd, "cap_renameat_src", O_CREAT, 0600);
894 EXPECT_OK(close(rc));
896 rc = renameat(dirfd, "cap_renameat_src", dfd_cap, "cap_renameat_dst");
897 CHECK_RIGHT_RESULT(rc, rights, CAP_RENAMEAT_TARGET);
899 EXPECT_OK(unlinkat(dirfd, "cap_renameat_dst", 0));
901 EXPECT_OK(unlinkat(dirfd, "cap_renameat_src", 0));
904 rc = openat(dirfd, "cap_renameat_src", O_CREAT, 0600);
906 EXPECT_OK(close(rc));
908 rc = renameat(dfd_cap, "cap_renameat_src", dirfd, "cap_renameat_dst");
909 CHECK_RIGHT_RESULT(rc, rights, CAP_RENAMEAT_SOURCE);
912 EXPECT_OK(unlinkat(dirfd, "cap_renameat_dst", 0));
914 EXPECT_OK(unlinkat(dirfd, "cap_renameat_src", 0));
917 rc = symlinkat("test", dfd_cap, "cap_symlinkat");
918 CHECK_RIGHT_RESULT(rc, rights, CAP_SYMLINKAT, CAP_LOOKUP);
920 EXPECT_OK(unlinkat(dirfd, "cap_symlinkat", 0));
923 rc = openat(dirfd, "cap_unlinkat", O_CREAT, 0600);
925 EXPECT_OK(close(rc));
926 rc = unlinkat(dfd_cap, "cap_unlinkat", 0);
927 CHECK_RIGHT_RESULT(rc, rights, CAP_UNLINKAT, CAP_LOOKUP);
928 unlinkat(dirfd, "cap_unlinkat", 0);
929 EXPECT_OK(mkdirat(dirfd, "cap_unlinkat", 0700));
930 rc = unlinkat(dfd_cap, "cap_unlinkat", AT_REMOVEDIR);
931 CHECK_RIGHT_RESULT(rc, rights, CAP_UNLINKAT, CAP_LOOKUP);
932 unlinkat(dirfd, "cap_unlinkat", AT_REMOVEDIR);
934 EXPECT_OK(close(dfd_cap));
937 void DirOperationsTest(int extra) {
938 int rc = mkdir(TmpFile("cap_dirops"), 0755);
940 if (rc < 0 && errno != EEXIST) return;
941 int dfd = open(TmpFile("cap_dirops"), O_RDONLY | O_DIRECTORY | extra);
943 int tmpfd = open(tmpdir.c_str(), O_RDONLY | O_DIRECTORY);
946 EXPECT_OK(cap_enter()); // Enter capability mode.
948 TRY_DIR_OPS(dfd, CAP_LINKAT_SOURCE);
949 TRY_DIR_OPS(dfd, CAP_LINKAT_TARGET);
950 TRY_DIR_OPS(dfd, CAP_CREATE, CAP_READ, CAP_LOOKUP);
951 TRY_DIR_OPS(dfd, CAP_CREATE, CAP_WRITE, CAP_LOOKUP);
952 TRY_DIR_OPS(dfd, CAP_CREATE, CAP_READ, CAP_WRITE, CAP_LOOKUP);
953 TRY_DIR_OPS(dfd, CAP_FSYNC, CAP_READ, CAP_LOOKUP);
954 TRY_DIR_OPS(dfd, CAP_FSYNC, CAP_WRITE, CAP_LOOKUP);
955 TRY_DIR_OPS(dfd, CAP_FSYNC, CAP_READ, CAP_WRITE, CAP_LOOKUP);
956 TRY_DIR_OPS(dfd, CAP_FTRUNCATE, CAP_READ, CAP_LOOKUP);
957 TRY_DIR_OPS(dfd, CAP_FTRUNCATE, CAP_WRITE, CAP_LOOKUP);
958 TRY_DIR_OPS(dfd, CAP_FTRUNCATE, CAP_READ, CAP_WRITE, CAP_LOOKUP);
959 TRY_DIR_OPS(dfd, CAP_FCHOWN, CAP_LOOKUP);
960 TRY_DIR_OPS(dfd, CAP_FCHMOD, CAP_LOOKUP);
961 TRY_DIR_OPS(dfd, CAP_FSTAT, CAP_LOOKUP);
962 TRY_DIR_OPS(dfd, CAP_FUTIMES, CAP_LOOKUP);
963 TRY_DIR_OPS(dfd, CAP_MKDIRAT, CAP_LOOKUP);
964 TRY_DIR_OPS(dfd, CAP_MKFIFOAT, CAP_LOOKUP);
965 TRY_DIR_OPS(dfd, CAP_MKNODAT, CAP_LOOKUP);
966 TRY_DIR_OPS(dfd, CAP_SYMLINKAT, CAP_LOOKUP);
967 TRY_DIR_OPS(dfd, CAP_UNLINKAT, CAP_LOOKUP);
968 // Rename needs CAP_RENAMEAT_SOURCE on source directory and
969 // CAP_RENAMEAT_TARGET on destination directory.
970 TRY_DIR_OPS(dfd, CAP_RENAMEAT_SOURCE, CAP_UNLINKAT, CAP_LOOKUP);
971 TRY_DIR_OPS(dfd, CAP_RENAMEAT_TARGET, CAP_UNLINKAT, CAP_LOOKUP);
973 EXPECT_OK(unlinkat(tmpfd, "cap_dirops", AT_REMOVEDIR));
974 EXPECT_OK(close(tmpfd));
975 EXPECT_OK(close(dfd));
978 FORK_TEST(Capability, DirOperations) {
979 DirOperationsTest(0);
983 FORK_TEST(Capability, PathDirOperations) {
984 // Make the dfd in the test a path-only file descriptor.
985 DirOperationsTest(O_PATH);
989 static void TryReadWrite(int cap_fd) {
991 EXPECT_OK(read(cap_fd, buffer, sizeof(buffer)));
992 int rc = write(cap_fd, "", 0);
994 EXPECT_EQ(ENOTCAPABLE, errno);
997 FORK_TEST_ON(Capability, SocketTransfer, TmpFile("cap_fd_transfer")) {
999 EXPECT_OK(socketpair(AF_UNIX, SOCK_STREAM, 0, sock_fds));
1002 mh.msg_name = NULL; // No address needed
1005 struct iovec iov[1];
1006 iov[0].iov_base = buffer1;
1007 iov[0].iov_len = sizeof(buffer1);
1011 mh.msg_control = buffer2;
1012 mh.msg_controllen = sizeof(buffer2);
1013 struct cmsghdr *cmptr;
1016 cap_rights_init(&r_rs, CAP_READ, CAP_SEEK);
1018 pid_t child = fork();
1020 // Child: enter cap mode
1021 EXPECT_OK(cap_enter());
1023 // Child: wait to receive FD over socket
1024 int rc = recvmsg(sock_fds[0], &mh, 0);
1026 EXPECT_LE(CMSG_LEN(sizeof(int)), mh.msg_controllen);
1027 cmptr = CMSG_FIRSTHDR(&mh);
1028 int cap_fd = *(int*)CMSG_DATA(cmptr);
1029 EXPECT_EQ(CMSG_LEN(sizeof(int)), cmptr->cmsg_len);
1030 cmptr = CMSG_NXTHDR(&mh, cmptr);
1031 EXPECT_TRUE(cmptr == NULL);
1033 // Child: confirm we can do the right operations on the capability
1034 cap_rights_t rights;
1035 EXPECT_OK(cap_rights_get(cap_fd, &rights));
1036 EXPECT_RIGHTS_EQ(&r_rs, &rights);
1037 TryReadWrite(cap_fd);
1039 // Child: wait for a normal read
1041 read(sock_fds[0], &val, sizeof(val));
1045 int fd = open(TmpFile("cap_fd_transfer"), O_RDWR | O_CREAT, 0644);
1048 int cap_fd = dup(fd);
1050 EXPECT_OK(cap_rights_limit(cap_fd, &r_rs));
1052 EXPECT_OK(cap_enter()); // Enter capability mode.
1054 // Confirm we can do the right operations on the capability
1055 TryReadWrite(cap_fd);
1057 // Send the file descriptor over the pipe to the sub-process
1058 mh.msg_controllen = CMSG_LEN(sizeof(int));
1059 cmptr = CMSG_FIRSTHDR(&mh);
1060 cmptr->cmsg_level = SOL_SOCKET;
1061 cmptr->cmsg_type = SCM_RIGHTS;
1062 cmptr->cmsg_len = CMSG_LEN(sizeof(int));
1063 *(int *)CMSG_DATA(cmptr) = cap_fd;
1067 int rc = sendmsg(sock_fds[1], &mh, 0);
1070 sleep(1); // Ensure subprocess runs
1072 write(sock_fds[1], &zero, sizeof(zero));
1075 TEST(Capability, SyscallAt) {
1076 int rc = mkdir(TmpFile("cap_at_topdir"), 0755);
1078 if (rc < 0 && errno != EEXIST) return;
1081 cap_rights_init(&r_all, CAP_READ, CAP_LOOKUP, CAP_MKNODAT, CAP_UNLINKAT, CAP_MKDIRAT, CAP_MKFIFOAT);
1082 cap_rights_t r_no_unlink;
1083 cap_rights_init(&r_no_unlink, CAP_READ, CAP_LOOKUP, CAP_MKDIRAT, CAP_MKFIFOAT);
1084 cap_rights_t r_no_mkdir;
1085 cap_rights_init(&r_no_mkdir, CAP_READ, CAP_LOOKUP, CAP_UNLINKAT, CAP_MKFIFOAT);
1086 cap_rights_t r_no_mkfifo;
1087 cap_rights_init(&r_no_mkfifo, CAP_READ, CAP_LOOKUP, CAP_UNLINKAT, CAP_MKDIRAT);
1088 cap_rights_t r_no_mknod;
1089 cap_rights_init(&r_no_mknod, CAP_READ, CAP_LOOKUP, CAP_UNLINKAT, CAP_MKDIRAT);
1090 cap_rights_t r_create;
1091 cap_rights_init(&r_create, CAP_READ, CAP_LOOKUP, CAP_CREATE);
1092 cap_rights_t r_bind;
1093 cap_rights_init(&r_bind, CAP_READ, CAP_LOOKUP, CAP_BIND);
1095 int dfd = open(TmpFile("cap_at_topdir"), O_RDONLY);
1097 int cap_dfd_all = dup(dfd);
1098 EXPECT_OK(cap_dfd_all);
1099 EXPECT_OK(cap_rights_limit(cap_dfd_all, &r_all));
1100 int cap_dfd_no_unlink = dup(dfd);
1101 EXPECT_OK(cap_dfd_no_unlink);
1102 EXPECT_OK(cap_rights_limit(cap_dfd_no_unlink, &r_no_unlink));
1103 int cap_dfd_no_mkdir = dup(dfd);
1104 EXPECT_OK(cap_dfd_no_mkdir);
1105 EXPECT_OK(cap_rights_limit(cap_dfd_no_mkdir, &r_no_mkdir));
1106 int cap_dfd_no_mkfifo = dup(dfd);
1107 EXPECT_OK(cap_dfd_no_mkfifo);
1108 EXPECT_OK(cap_rights_limit(cap_dfd_no_mkfifo, &r_no_mkfifo));
1109 int cap_dfd_no_mknod = dup(dfd);
1110 EXPECT_OK(cap_dfd_no_mknod);
1111 EXPECT_OK(cap_rights_limit(cap_dfd_no_mknod, &r_no_mknod));
1112 int cap_dfd_create = dup(dfd);
1113 EXPECT_OK(cap_dfd_create);
1114 EXPECT_OK(cap_rights_limit(cap_dfd_create, &r_create));
1115 int cap_dfd_bind = dup(dfd);
1116 EXPECT_OK(cap_dfd_bind);
1117 EXPECT_OK(cap_rights_limit(cap_dfd_bind, &r_bind));
1119 // Need CAP_MKDIRAT to mkdirat(2).
1120 EXPECT_NOTCAPABLE(mkdirat(cap_dfd_no_mkdir, "cap_subdir", 0755));
1121 rmdir(TmpFile("cap_at_topdir/cap_subdir"));
1122 EXPECT_OK(mkdirat(cap_dfd_all, "cap_subdir", 0755));
1124 // Need CAP_UNLINKAT to unlinkat(dfd, name, AT_REMOVEDIR).
1125 EXPECT_NOTCAPABLE(unlinkat(cap_dfd_no_unlink, "cap_subdir", AT_REMOVEDIR));
1126 EXPECT_OK(unlinkat(cap_dfd_all, "cap_subdir", AT_REMOVEDIR));
1127 rmdir(TmpFile("cap_at_topdir/cap_subdir"));
1129 // Need CAP_MKFIFOAT to mkfifoat(2).
1130 EXPECT_NOTCAPABLE(mkfifoat(cap_dfd_no_mkfifo, "cap_fifo", 0755));
1131 unlink(TmpFile("cap_at_topdir/cap_fifo"));
1132 EXPECT_OK(mkfifoat(cap_dfd_all, "cap_fifo", 0755));
1133 unlink(TmpFile("cap_at_topdir/cap_fifo"));
1135 #ifdef HAVE_MKNOD_REG
1136 // Need CAP_CREATE to create a regular file with mknodat(2).
1137 EXPECT_NOTCAPABLE(mknodat(cap_dfd_all, "cap_regular", S_IFREG|0755, 0));
1138 unlink(TmpFile("cap_at_topdir/cap_regular"));
1139 EXPECT_OK(mknodat(cap_dfd_create, "cap_regular", S_IFREG|0755, 0));
1140 unlink(TmpFile("cap_at_topdir/cap_regular"));
1143 #ifdef HAVE_MKNOD_SOCKET
1144 // Need CAP_BIND to create a UNIX domain socket with mknodat(2).
1145 EXPECT_NOTCAPABLE(mknodat(cap_dfd_all, "cap_socket", S_IFSOCK|0755, 0));
1146 unlink(TmpFile("cap_at_topdir/cap_socket"));
1147 EXPECT_OK(mknodat(cap_dfd_bind, "cap_socket", S_IFSOCK|0755, 0));
1148 unlink(TmpFile("cap_at_topdir/cap_socket"));
1151 if (getuid() == 0) {
1152 // Need CAP_MKNODAT to mknodat(2) a device
1153 EXPECT_NOTCAPABLE(mknodat(cap_dfd_no_mknod, "cap_device", S_IFCHR|0755, makedev(99, 123)));
1154 unlink(TmpFile("cap_at_topdir/cap_device"));
1155 EXPECT_OK(mknodat(cap_dfd_all, "cap_device", S_IFCHR|0755, makedev(99, 123)));
1156 unlink(TmpFile("cap_at_topdir/cap_device"));
1158 // Need CAP_MKFIFOAT to mknodat(2) for a FIFO.
1159 EXPECT_NOTCAPABLE(mknodat(cap_dfd_no_mkfifo, "cap_fifo", S_IFIFO|0755, 0));
1160 unlink(TmpFile("cap_at_topdir/cap_fifo"));
1161 EXPECT_OK(mknodat(cap_dfd_all, "cap_fifo", S_IFIFO|0755, 0));
1162 unlink(TmpFile("cap_at_topdir/cap_fifo"));
1164 TEST_SKIPPED("requires root (partial)");
1168 close(cap_dfd_no_mknod);
1169 close(cap_dfd_no_mkfifo);
1170 close(cap_dfd_no_mkdir);
1171 close(cap_dfd_no_unlink);
1172 close(cap_dfd_create);
1173 close(cap_dfd_bind);
1177 rmdir(TmpFile("cap_at_topdir"));
1180 FORK_TEST_ON(Capability, ExtendedAttributes, TmpFile("cap_extattr")) {
1181 int fd = open(TmpFile("cap_extattr"), O_RDONLY|O_CREAT, 0644);
1185 int rc = fgetxattr_(fd, "user.capsicumtest", buffer, sizeof(buffer));
1186 if (rc < 0 && errno == ENOTSUP) {
1187 // Need user_xattr mount option for non-root users on Linux
1188 TEST_SKIPPED("/tmp doesn't support extended attributes");
1194 cap_rights_init(&r_rws, CAP_READ, CAP_WRITE, CAP_SEEK);
1195 cap_rights_t r_xlist;
1196 cap_rights_init(&r_xlist, CAP_EXTATTR_LIST);
1197 cap_rights_t r_xget;
1198 cap_rights_init(&r_xget, CAP_EXTATTR_GET);
1199 cap_rights_t r_xset;
1200 cap_rights_init(&r_xset, CAP_EXTATTR_SET);
1201 cap_rights_t r_xdel;
1202 cap_rights_init(&r_xdel, CAP_EXTATTR_DELETE);
1206 EXPECT_OK(cap_rights_limit(cap, &r_rws));
1207 int cap_xlist = dup(fd);
1208 EXPECT_OK(cap_xlist);
1209 EXPECT_OK(cap_rights_limit(cap_xlist, &r_xlist));
1210 int cap_xget = dup(fd);
1211 EXPECT_OK(cap_xget);
1212 EXPECT_OK(cap_rights_limit(cap_xget, &r_xget));
1213 int cap_xset = dup(fd);
1214 EXPECT_OK(cap_xset);
1215 EXPECT_OK(cap_rights_limit(cap_xset, &r_xset));
1216 int cap_xdel = dup(fd);
1217 EXPECT_OK(cap_xdel);
1218 EXPECT_OK(cap_rights_limit(cap_xdel, &r_xdel));
1220 const char* value = "capsicum";
1221 int len = strlen(value) + 1;
1222 EXPECT_NOTCAPABLE(fsetxattr_(cap, "user.capsicumtest", value, len, 0));
1223 EXPECT_NOTCAPABLE(fsetxattr_(cap_xlist, "user.capsicumtest", value, len, 0));
1224 EXPECT_NOTCAPABLE(fsetxattr_(cap_xget, "user.capsicumtest", value, len, 0));
1225 EXPECT_NOTCAPABLE(fsetxattr_(cap_xdel, "user.capsicumtest", value, len, 0));
1226 EXPECT_OK(fsetxattr_(cap_xset, "user.capsicumtest", value, len, 0));
1228 EXPECT_NOTCAPABLE(flistxattr_(cap, buffer, sizeof(buffer)));
1229 EXPECT_NOTCAPABLE(flistxattr_(cap_xget, buffer, sizeof(buffer)));
1230 EXPECT_NOTCAPABLE(flistxattr_(cap_xset, buffer, sizeof(buffer)));
1231 EXPECT_NOTCAPABLE(flistxattr_(cap_xdel, buffer, sizeof(buffer)));
1232 EXPECT_OK(flistxattr_(cap_xlist, buffer, sizeof(buffer)));
1234 EXPECT_NOTCAPABLE(fgetxattr_(cap, "user.capsicumtest", buffer, sizeof(buffer)));
1235 EXPECT_NOTCAPABLE(fgetxattr_(cap_xlist, "user.capsicumtest", buffer, sizeof(buffer)));
1236 EXPECT_NOTCAPABLE(fgetxattr_(cap_xset, "user.capsicumtest", buffer, sizeof(buffer)));
1237 EXPECT_NOTCAPABLE(fgetxattr_(cap_xdel, "user.capsicumtest", buffer, sizeof(buffer)));
1238 EXPECT_OK(fgetxattr_(cap_xget, "user.capsicumtest", buffer, sizeof(buffer)));
1240 EXPECT_NOTCAPABLE(fremovexattr_(cap, "user.capsicumtest"));
1241 EXPECT_NOTCAPABLE(fremovexattr_(cap_xlist, "user.capsicumtest"));
1242 EXPECT_NOTCAPABLE(fremovexattr_(cap_xget, "user.capsicumtest"));
1243 EXPECT_NOTCAPABLE(fremovexattr_(cap_xset, "user.capsicumtest"));
1244 EXPECT_OK(fremovexattr_(cap_xdel, "user.capsicumtest"));
1254 TEST(Capability, PipeUnseekable) {
1256 EXPECT_OK(pipe(fds));
1258 // Some programs detect pipes by calling seek() and getting ESPIPE.
1259 EXPECT_EQ(-1, lseek(fds[0], 0, SEEK_SET));
1260 EXPECT_EQ(ESPIPE, errno);
1262 cap_rights_t rights;
1263 cap_rights_init(&rights, CAP_READ, CAP_WRITE, CAP_SEEK);
1264 EXPECT_OK(cap_rights_limit(fds[0], &rights));
1266 EXPECT_EQ(-1, lseek(fds[0], 0, SEEK_SET));
1267 EXPECT_EQ(ESPIPE, errno);
1269 // Remove CAP_SEEK and see if ENOTCAPABLE trumps ESPIPE.
1270 cap_rights_init(&rights, CAP_READ, CAP_WRITE);
1271 EXPECT_OK(cap_rights_limit(fds[0], &rights));
1272 EXPECT_EQ(-1, lseek(fds[0], 0, SEEK_SET));
1273 EXPECT_EQ(ENOTCAPABLE, errno);
1274 // TODO(drysdale): in practical terms it might be nice if ESPIPE trumped ENOTCAPABLE.
1275 // EXPECT_EQ(ESPIPE, errno);
1281 TEST(Capability, NoBypassDAC) {
1283 int fd = open(TmpFile("cap_root_owned"), O_RDONLY|O_CREAT, 0644);
1285 cap_rights_t rights;
1286 cap_rights_init(&rights, CAP_READ, CAP_WRITE, CAP_FCHMOD, CAP_FSTAT);
1287 EXPECT_OK(cap_rights_limit(fd, &rights));
1289 pid_t child = fork();
1291 // Child: change uid to a lesser being
1293 // Attempt to fchmod the file, and fail.
1294 // Having CAP_FCHMOD doesn't bypass the need to comply with DAC policy.
1295 int rc = fchmod(fd, 0666);
1297 EXPECT_EQ(EPERM, errno);
1301 EXPECT_EQ(child, waitpid(child, &status, 0));
1302 EXPECT_TRUE(WIFEXITED(status)) << "0x" << std::hex << status;
1303 EXPECT_EQ(0, WEXITSTATUS(status));
1305 EXPECT_OK(fstat(fd, &info));
1306 EXPECT_EQ((mode_t)(S_IFREG|0644), info.st_mode);
1308 unlink(TmpFile("cap_root_owned"));